wip: group inquiries and booking

src/Controller/Admin/AdditionalService/DeleteController.php

@@ -27,6 +27,10 @@ class DeleteController extends AbstractController
         $accommodation = $additionalService->getAccommodation();
 
         if (true === $request->isMethod(Request::METHOD_POST)) {
+            if (!$this->isCsrfTokenValid('delete_additional_service_'.$additionalService->getId(), $request->request->getString('_token'))) {
+                throw $this->createAccessDeniedException('Invalid CSRF token.');
+            }
+
             $this->entityManager->remove($additionalService);
             $this->entityManager->flush();
 
@@ -48,6 +52,7 @@ class DeleteController extends AbstractController
         return $this->render('admin/additional_service/modal_delete.html.twig', [
             'additionalService' => $additionalService,
             'accommodation' => $accommodation,
+            'csrf_token_id' => 'delete_additional_service_'.$additionalService->getId(),
         ]);
     }
 }