Language: PHP
Label: vulnerable
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
    public function onSuccess()
    {
        if ($this->callOnSuccess === false) {
            $this->getSubmitButton()->setValue($this->getElement('delete')->getButtonLabel());
            return;
        }

        $templateConfig = Config::fromIni($this->config->getConfigFile());
        $value = $this->getValue('template');

        if ($this->templateName !== null && $value !== $this->templateName) {
            $template = $templateConfig->getSection($this->templateName);
            $templateConfig->removeSection($this->templateName);
            $templateConfig->setSection($value, $template);
        } else {
            $template = $templateConfig->getSection($value);
            $templateConfig->setSection($this->getValue('template'), $template);
        }

        $templateConfig->saveIni($templateConfig->getConfigFile());
    }