From d38486fbd615d40017fae17eeedc3818b173c7e6 Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Tue, 10 May 2016 16:47:22 -0400
Subject: [PATCH] Possible fix for incorrect token

It appears that sometimes the first time you open the page,
the token is not synced correctly or something, causing
the CSRF check to fail. Starting the session before any
HTML is outputted seems to be a recommended first step to
troubleshooting PHP session errors. I have tried to test
this fix, but right now I don't know exactly what triggers
the error.
---
 list.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/list.php b/list.php
index 1e4c350a..74a4926e 100644
--- a/list.php
+++ b/list.php
@@ -1,4 +1,5 @@
 <?php
+session_start();
 require "header.html";
 
 $list = $_GET['l'];
@@ -12,7 +13,6 @@ function getFullName() {
 }
 
 // Generate CSRF token
-session_start();
 if(empty($_SESSION['token'])) {
     $_SESSION['token'] = base64_encode(openssl_random_pseudo_bytes(32));
 }