From 281462fab8330a3cecef4f7c78a7cf5f9a0c02b3 Mon Sep 17 00:00:00 2001
From: Marijn Doeve <marijn@doeve.me>
Date: Sun, 24 May 2026 19:43:30 +0200
Subject: [PATCH] Added Gedmo stuff, fix translations (#117)

* Added Gedmo stuff, fix translations

* Add CSRF token validation across backoffice forms

- Added CSRF validations to candidate correction, penalty, answer saving, and elimination forms.
- Updated corresponding Twig templates to include CSRF token inputs.
- Adjusted column count in `tab_result` template to maintain layout consistency.

* Add unique index constraint for `quiz_candidate` with soft delete support

- Updated migration to include a unique index on `quiz_candidate` table that excludes soft-deleted records.
- Adjusted `QuizCandidate` entity to reflect the new unique constraint with `deleted_at` condition.

* Add CSRF token validation for quiz-related actions

- Added CSRF validation to `enableQuiz`, `clearQuiz`, `deleteQuiz`, `toggleCandidate`, and `prepareElimination` actions.
- Updated Twig templates to replace links with POST forms to include CSRF tokens.
- Set HTTP method restrictions for related endpoints to `POST`.

* Fix unique index condition for `quiz_candidate` with soft deletes

- Updated condition in unique index definition of `quiz_candidate` to add parentheses for clarity.
- Adjusted related migration to reflect the revised condition.

* Remove if for post an use methods in Route instead

* Refactor CSRF token validation in backoffice controllers

- Applied `#[IsCsrfTokenValid]` attribute for CSRF checks to simplify and standardize validation.
- Removed manual `isCsrfTokenValid` calls and associated exception throwing.
- Updated method signatures across affected endpoints to remove unnecessary `Request` dependency.
- Ensured consistency in route HTTP method restrictions where applicable.

* Add rector and phpstan

* Add validation for answering incorrect quiz question

- Added logic to prevent candidates from answering questions out of sequence in `QuizController`.
- Updated Dutch translations to include the new error message.

* Things
---
 .github/workflows/ci.yml                      |  20 ++-
 .idea/TijdVoorDeTest.iml                      |   1 +
 .idea/inspectionProfiles/Project_Default.xml  |   1 +
 .idea/php.xml                                 |   1 +
 compose.override.yaml                         |   2 +-
 config/packages/doctrine.yaml                 |   4 +
 config/packages/stof_doctrine_extensions.yaml |   1 +
 config/packages/verify_email.yaml             |   2 +
 config/reference.php                          |   6 +
 migrations/Version20260523095205.php          |  34 ++++
 migrations/Version20260523095302.php          |  32 ++++
 migrations/Version20260524135246.php          |  30 ++++
 .../PrepareEliminationController.php          |   9 +-
 src/Controller/Backoffice/QuizController.php  |  24 +--
 src/Controller/EliminationController.php      |   4 +-
 src/Controller/LoginController.php            |   1 +
 src/Controller/QuizController.php             |  11 +-
 src/DataFixtures/KrtekFixtures.php            |   6 +
 src/Entity/Elimination.php                    |  11 +-
 src/Entity/GivenAnswer.php                    |   4 +
 src/Entity/Quiz.php                           |   2 +-
 src/Entity/QuizCandidate.php                  |   6 +-
 src/Entity/User.php                           |   7 -
 .../prepare_elimination/index.html.twig       |   1 +
 .../quiz/tab_candidates_list.html.twig        |  18 ++-
 .../backoffice/quiz/tab_overview.html.twig    |  35 ++--
 .../backoffice/quiz/tab_result.html.twig      | 151 +++++++++---------
 templates/backoffice/quiz_add.html.twig       |   2 +-
 templates/flashes.html.twig                   |   2 +-
 translations/messages+intl-icu.nl.xliff       |  26 +--
 30 files changed, 319 insertions(+), 135 deletions(-)
 create mode 100644 config/packages/verify_email.yaml
 create mode 100644 migrations/Version20260523095205.php
 create mode 100644 migrations/Version20260523095302.php
 create mode 100644 migrations/Version20260524135246.php

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 25bd701..d4cd6e9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,12 +15,15 @@ concurrency:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   tests:
     name: Tests
     runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      pull-requests: write
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -48,6 +51,10 @@ jobs:
         run: docker compose exec -T php vendor/bin/php-cs-fixer check --diff --show-progress=none
       - name: Twig Coding Style
         run: docker compose exec -T php vendor/bin/twig-cs-fixer check
+      - name: Static Analysis (PHPStan)
+        run: docker compose exec -T php vendor/bin/phpstan analyse --no-progress --no-ansi --error-format=github
+      - name: Rector
+        run: docker compose exec -T php vendor/bin/rector process --dry-run --no-progress-bar --output-format=github
       - name: Check HTTP reachability
         run: curl -v --fail-with-body http://localhost
       - name: Check Mercure reachability
@@ -60,12 +67,21 @@ jobs:
       - name: Load fixtures
         run: docker compose exec -T php bin/console -e test doctrine:fixtures:load --no-interaction --group=test
       - name: Run PHPUnit
-        run: docker compose exec -T php vendor/bin/phpunit
+        run: docker compose exec -T php vendor/bin/phpunit --log-junit var/phpunit/junit.xml
+      - name: Publish PHPUnit test results
+        if: always()
+        uses: mikepenz/action-junit-report@v5
+        with:
+          report_paths: var/phpunit/junit.xml
+          check_name: PHPUnit
       - name: Doctrine Schema Validator
         run: docker compose exec -T php bin/console -e test doctrine:schema:validate
   
   build-deploy:
     name: Build and deploy to ${{ startsWith(github.ref, 'refs/tags/') && 'production' || (github.ref == 'refs/heads/main' && 'acceptance' || '') }}
+    permissions:
+      contents: read
+      packages: write
     environment:
       name: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || (github.ref == 'refs/heads/main' && 'acceptance' || '') }}
       url: ${{ vars.URL }}
diff --git a/.idea/TijdVoorDeTest.iml b/.idea/TijdVoorDeTest.iml
index f867990..0567d5f 100644
--- a/.idea/TijdVoorDeTest.iml
+++ b/.idea/TijdVoorDeTest.iml
@@ -166,6 +166,7 @@
       <excludeFolder url="file://$MODULE_DIR$/vendor/gedmo/doctrine-extensions" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/stof/doctrine-extensions-bundle" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/git-state" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/ergebnis/agent-detector" />
     </content>
     <orderEntry type="inheritedJdk" />
     <orderEntry type="sourceFolder" forTests="false" />
diff --git a/.idea/inspectionProfiles/Project_Default.xml b/.idea/inspectionProfiles/Project_Default.xml
index 5b777b1..84dda62 100644
--- a/.idea/inspectionProfiles/Project_Default.xml
+++ b/.idea/inspectionProfiles/Project_Default.xml
@@ -73,6 +73,7 @@
     <inspection_tool class="PhpFullyQualifiedNameUsageInspection" enabled="true" level="WEAK WARNING" enabled_by_default="true">
       <option name="IGNORE_GLOBAL_NAMESPACE" value="true" />
     </inspection_tool>
+    <inspection_tool class="PhpPublicPropertyModifierCanBeOmittedInspection" enabled="false" level="WEAK WARNING" enabled_by_default="false" />
     <inspection_tool class="PhpStanGlobal" enabled="true" level="WEAK WARNING" enabled_by_default="true" />
     <inspection_tool class="SecurityAdvisoriesInspection" enabled="true" level="WARNING" enabled_by_default="true">
       <option name="optionConfiguration">
diff --git a/.idea/php.xml b/.idea/php.xml
index 720e488..cadf993 100644
--- a/.idea/php.xml
+++ b/.idea/php.xml
@@ -203,6 +203,7 @@
       <path value="$PROJECT_DIR$/vendor/symfony/polyfill-php84" />
       <path value="$PROJECT_DIR$/vendor/symfony/polyfill-php85" />
       <path value="$PROJECT_DIR$/vendor/sebastian/git-state" />
+      <path value="$PROJECT_DIR$/vendor/ergebnis/agent-detector" />
     </include_path>
   </component>
   <component name="PhpInterpreters">
diff --git a/compose.override.yaml b/compose.override.yaml
index df3e622..1927cbc 100644
--- a/compose.override.yaml
+++ b/compose.override.yaml
@@ -61,7 +61,7 @@ services:
     image: axllent/mailpit
     ports:
       - "1025"
-      - "8025"
+      - "8025:8025"
     environment:
       MP_SMTP_AUTH_ACCEPT_ANY: 1
       MP_SMTP_AUTH_ALLOW_INSECURE: 1
diff --git a/config/packages/doctrine.yaml b/config/packages/doctrine.yaml
index 8425377..8d04f8f 100644
--- a/config/packages/doctrine.yaml
+++ b/config/packages/doctrine.yaml
@@ -22,6 +22,10 @@ doctrine:
         identity_generation_preferences:
             Doctrine\DBAL\Platforms\PostgreSQLPlatform: identity
         auto_mapping: true
+        filters:
+            softdeleteable:
+                class: Gedmo\SoftDeleteable\Filter\SoftDeleteableFilter
+                enabled: true
         mappings:
             Tvdt:
                 type: attribute
diff --git a/config/packages/stof_doctrine_extensions.yaml b/config/packages/stof_doctrine_extensions.yaml
index 9718713..a973161 100644
--- a/config/packages/stof_doctrine_extensions.yaml
+++ b/config/packages/stof_doctrine_extensions.yaml
@@ -5,3 +5,4 @@ stof_doctrine_extensions:
     orm:
         default:
             timestampable: true
+            softdeleteable: true
diff --git a/config/packages/verify_email.yaml b/config/packages/verify_email.yaml
new file mode 100644
index 0000000..f96c10b
--- /dev/null
+++ b/config/packages/verify_email.yaml
@@ -0,0 +1,2 @@
+symfonycasts_verify_email:
+    lifetime: 604800 # 1 week in seconds
diff --git a/config/reference.php b/config/reference.php
index 9d9f800..e9621b0 100644
--- a/config/reference.php
+++ b/config/reference.php
@@ -1309,6 +1309,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         traces_sampler?: scalar|Param|null,
  *         profiles_sample_rate?: float|Param, // The sampling factor to apply to profiles. A value of 0 will deny sending any profiles, and a value of 1 will send all profiles. Profiles are sampled in relation to traces_sample_rate
  *         enable_logs?: bool|Param,
+ *         log_flush_threshold?: mixed, // Default: null
  *         enable_metrics?: bool|Param, // Default: true
  *         attach_stacktrace?: bool|Param,
  *         attach_metric_code_locations?: bool|Param,
@@ -1318,6 +1319,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         spotlight?: bool|Param,
  *         spotlight_url?: scalar|Param|null,
  *         release?: scalar|Param|null, // Default: "%env(default::SENTRY_RELEASE)%"
+ *         org_id?: int|Param,
  *         server_name?: scalar|Param|null,
  *         ignore_exceptions?: list<scalar|Param|null>,
  *         ignore_transactions?: list<scalar|Param|null>,
@@ -1328,6 +1330,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         before_send_log?: scalar|Param|null,
  *         before_send_metric?: scalar|Param|null,
  *         trace_propagation_targets?: mixed,
+ *         strict_trace_continuation?: bool|Param,
  *         tags?: array<string, scalar|Param|null>,
  *         error_types?: scalar|Param|null,
  *         max_breadcrumbs?: int|Param,
@@ -1352,11 +1355,13 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         enabled?: bool|Param, // Default: false
  *         capture_soft_fails?: bool|Param, // Default: true
  *         isolate_breadcrumbs_by_message?: bool|Param, // Default: false
+ *         isolate_context_by_message?: bool|Param, // Default: false
  *     },
  *     tracing?: bool|array{
  *         enabled?: bool|Param, // Default: true
  *         dbal?: bool|array{
  *             enabled?: bool|Param, // Default: true
+ *             ignore_prepare_spans?: bool|Param, // Default: false
  *             connections?: list<scalar|Param|null>,
  *         },
  *         twig?: bool|array{
@@ -1376,6 +1381,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  * @psalm-type SymfonycastsSassConfig = array{
  *     root_sass?: list<scalar|Param|null>,
  *     binary?: scalar|Param|null, // The Sass binary to use // Default: null
+ *     search_for_binary?: scalar|Param|null, // Whether to search for the Sass binary in the system PATH // Default: true
  *     sass_options?: array{
  *         style?: "compressed"|"expanded"|Param, // The style of the generated CSS: compressed or expanded. // Default: "expanded"
  *         charset?: bool|Param, // Whether to include the charset declaration in the generated Sass.
diff --git a/migrations/Version20260523095205.php b/migrations/Version20260523095205.php
new file mode 100644
index 0000000..1ff49c4
--- /dev/null
+++ b/migrations/Version20260523095205.php
@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260523095205 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add soft-delete support (deleted_at columns) and rename elimination.created to created_at';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE elimination ADD deleted_at TIMESTAMP(0) WITHOUT TIME ZONE DEFAULT NULL');
+        $this->addSql('ALTER TABLE elimination RENAME COLUMN created TO created_at');
+        $this->addSql('ALTER TABLE given_answer ADD deleted_at TIMESTAMP(0) WITHOUT TIME ZONE DEFAULT NULL');
+        $this->addSql('ALTER TABLE quiz_candidate ADD deleted_at TIMESTAMP(0) WITHOUT TIME ZONE DEFAULT NULL');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE elimination DROP deleted_at');
+        $this->addSql('ALTER TABLE elimination RENAME COLUMN created_at TO created');
+        $this->addSql('ALTER TABLE given_answer DROP deleted_at');
+        $this->addSql('ALTER TABLE quiz_candidate DROP deleted_at');
+    }
+}
diff --git a/migrations/Version20260523095302.php b/migrations/Version20260523095302.php
new file mode 100644
index 0000000..f280fa0
--- /dev/null
+++ b/migrations/Version20260523095302.php
@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260523095302 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add updated_at column to elimination table and set it to created_at';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE elimination ADD updated_at TIMESTAMP(0) WITHOUT TIME ZONE');
+        $this->addSql('ALTER TABLE elimination ALTER created_at TYPE TIMESTAMP(0) WITHOUT TIME ZONE');
+        $this->addSql('UPDATE elimination SET updated_at = created_at');
+        $this->addSql('ALTER TABLE elimination ALTER updated_at SET NOT NULL');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE elimination DROP updated_at');
+        $this->addSql('ALTER TABLE elimination ALTER created_at TYPE TIMESTAMP(0) WITH TIME ZONE');
+    }
+}
diff --git a/migrations/Version20260524135246.php b/migrations/Version20260524135246.php
new file mode 100644
index 0000000..76b8190
--- /dev/null
+++ b/migrations/Version20260524135246.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260524135246 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add unique constraint for quiz_candidate with deleted_at filter';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('DROP INDEX uniq_ced2ffa291bd8781853cd175');
+        $this->addSql('CREATE UNIQUE INDEX UNIQ_CED2FFA291BD8781853CD175 ON quiz_candidate (candidate_id, quiz_id) WHERE (deleted_at IS NULL)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('DROP INDEX UNIQ_CED2FFA291BD8781853CD175');
+        $this->addSql('CREATE UNIQUE INDEX uniq_ced2ffa291bd8781853cd175 ON quiz_candidate (candidate_id, quiz_id)');
+    }
+}
diff --git a/src/Controller/Backoffice/PrepareEliminationController.php b/src/Controller/Backoffice/PrepareEliminationController.php
index 7b5284a..4627372 100644
--- a/src/Controller/Backoffice/PrepareEliminationController.php
+++ b/src/Controller/Backoffice/PrepareEliminationController.php
@@ -10,6 +10,7 @@ use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Routing\Requirement\Requirement;
+use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
 use Tvdt\Controller\AbstractController;
 use Tvdt\Entity\Elimination;
 use Tvdt\Entity\Quiz;
@@ -20,10 +21,12 @@ final class PrepareEliminationController extends AbstractController
 {
     public function __construct(private readonly EliminationFactory $eliminationFactory, private readonly EntityManagerInterface $em) {}
 
+    #[IsCsrfTokenValid('prepare_elimination')]
     #[Route(
         '/backoffice/season/{seasonCode:season}/quiz/{quiz}/elimination/prepare',
         name: 'tvdt_prepare_elimination',
         requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'quiz' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function index(Season $season, Quiz $quiz): RedirectResponse
     {
@@ -32,14 +35,16 @@ final class PrepareEliminationController extends AbstractController
         return $this->redirectToRoute('tvdt_prepare_elimination_view', ['elimination' => $elimination->id]);
     }
 
+    #[IsCsrfTokenValid('prepare_elimination', methods: ['POST'])]
     #[Route(
         '/backoffice/elimination/{elimination}',
         name: 'tvdt_prepare_elimination_view',
         requirements: ['elimination' => Requirement::UUID],
+        methods: ['GET', 'POST'],
     )]
     public function viewElimination(Elimination $elimination, Request $request): Response
     {
-        if ('POST' === $request->getMethod()) {
+        if ($request->isMethod('POST')) {
             $elimination->updateFromInputBag($request->request);
             $this->em->flush();
 
@@ -48,6 +53,8 @@ final class PrepareEliminationController extends AbstractController
             }
 
             $this->addFlash('success', 'Elimination updated');
+
+            return $this->redirectToRoute('tvdt_prepare_elimination_view', ['elimination' => $elimination->id]);
         }
 
         return $this->render('backoffice/prepare_elimination/index.html.twig', [
diff --git a/src/Controller/Backoffice/QuizController.php b/src/Controller/Backoffice/QuizController.php
index 2094411..c12ffae 100644
--- a/src/Controller/Backoffice/QuizController.php
+++ b/src/Controller/Backoffice/QuizController.php
@@ -10,9 +10,9 @@ use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Attribute\AsController;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
-use Symfony\Component\HttpKernel\Exception\MethodNotAllowedHttpException;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Routing\Requirement\Requirement;
+use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Contracts\Translation\TranslatorInterface;
 use Tvdt\Controller\AbstractController;
@@ -184,6 +184,7 @@ class QuizController extends AbstractController
         ]);
     }
 
+    #[IsCsrfTokenValid('candidate_answer')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
     #[Route(
         '/backoffice/season/{seasonCode:season}/quiz/{quiz}/candidates/{question}',
@@ -241,11 +242,13 @@ class QuizController extends AbstractController
         ]);
     }
 
+    #[IsCsrfTokenValid('enable_quiz')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
     #[Route(
         '/backoffice/season/{seasonCode:season}/quiz/{quiz}/enable',
         name: 'tvdt_backoffice_enable',
         requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'quiz' => Requirement::UUID.'|null'],
+        methods: ['POST'],
     )]
     public function enableQuiz(Season $season, ?Quiz $quiz): RedirectResponse
     {
@@ -259,11 +262,13 @@ class QuizController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_season', ['seasonCode' => $season->seasonCode]);
     }
 
+    #[IsCsrfTokenValid('clear_quiz')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/clear',
         name: 'tvdt_backoffice_quiz_clear',
         requirements: ['quiz' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function clearQuiz(Quiz $quiz): RedirectResponse
     {
@@ -277,11 +282,13 @@ class QuizController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_quiz', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
     }
 
+    #[IsCsrfTokenValid('delete_quiz')]
     #[IsGranted(SeasonVoter::DELETE, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/delete',
         name: 'tvdt_backoffice_quiz_delete',
         requirements: ['quiz' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function deleteQuiz(Quiz $quiz): RedirectResponse
     {
@@ -292,18 +299,16 @@ class QuizController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_season', ['seasonCode' => $quiz->season->seasonCode]);
     }
 
+    #[IsCsrfTokenValid('candidate_correction')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/candidate/{candidate}/modify_correction',
         name: 'tvdt_backoffice_modify_correction',
         requirements: ['quiz' => Requirement::UUID, 'candidate' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function modifyCorrection(Quiz $quiz, Candidate $candidate, Request $request): RedirectResponse
     {
-        if (!$request->isMethod('POST')) {
-            throw new MethodNotAllowedHttpException(['POST']);
-        }
-
         $corrections = (float) $request->request->get('corrections');
 
         $this->quizCandidateRepository->setCorrectionsForCandidate($quiz, $candidate, $corrections);
@@ -311,18 +316,16 @@ class QuizController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_quiz', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
     }
 
+    #[IsCsrfTokenValid('candidate_penalty')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/candidate/{candidate}/modify_penalty',
         name: 'tvdt_backoffice_modify_penalty',
         requirements: ['quiz' => Requirement::UUID, 'candidate' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function modifyPenalty(Quiz $quiz, Candidate $candidate, Request $request): RedirectResponse
     {
-        if (!$request->isMethod('POST')) {
-            throw new MethodNotAllowedHttpException(['POST']);
-        }
-
         $penalty = (int) $request->request->get('penalty');
 
         $this->quizCandidateRepository->setPenaltyForCandidate($quiz, $candidate, $penalty);
@@ -330,12 +333,13 @@ class QuizController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_quiz', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
     }
 
+    #[IsCsrfTokenValid('toggle_candidate')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/candidate/{candidate}/toggle',
         name: 'tvdt_backoffice_toggle_candidate',
         requirements: ['quiz' => Requirement::UUID, 'candidate' => Requirement::UUID],
-        methods: ['GET'],
+        methods: ['POST'],
     )]
     public function toggleCandidate(Quiz $quiz, Candidate $candidate): RedirectResponse
     {
diff --git a/src/Controller/EliminationController.php b/src/Controller/EliminationController.php
index 6e9aab8..bb3f467 100644
--- a/src/Controller/EliminationController.php
+++ b/src/Controller/EliminationController.php
@@ -55,7 +55,7 @@ final class EliminationController extends AbstractController
         $candidate = $this->candidateRepository->getCandidateByHash($elimination->quiz->season, $candidateHash);
         if (!$candidate instanceof Candidate) {
             $this->addFlash(FlashType::Warning,
-                t('Cound not find candidate with name %name%', ['%name%' => Base64::base64UrlDecode($candidateHash)])->trans($this->translator),
+                t('Could not find candidate with name {name}', ['name' => Base64::base64UrlDecode($candidateHash)])->trans($this->translator),
             );
 
             return $this->redirectToRoute('tvdt_elimination', ['elimination' => $elimination->id]);
@@ -64,7 +64,7 @@ final class EliminationController extends AbstractController
         $screenColour = $elimination->getScreenColour($candidate->name);
 
         if (null === $screenColour) {
-            $this->addFlash(FlashType::Warning, $this->translator->trans('Cound not find candidate with name %name% in elimination.', ['%name%' => $candidate->name]));
+            $this->addFlash(FlashType::Warning, $this->translator->trans('Could not find candidate with name {name} in elimination.', ['name' => $candidate->name]));
 
             return $this->redirectToRoute('tvdt_elimination', ['elimination' => $elimination->id]);
         }
diff --git a/src/Controller/LoginController.php b/src/Controller/LoginController.php
index eda6fb2..477b4ee 100644
--- a/src/Controller/LoginController.php
+++ b/src/Controller/LoginController.php
@@ -8,6 +8,7 @@ use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Attribute\AsController;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Core\User\UserInterface;
 use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
 use Symfony\Contracts\Translation\TranslatorInterface;
 use Tvdt\Enum\FlashType;
diff --git a/src/Controller/QuizController.php b/src/Controller/QuizController.php
index 9951e9d..c36909f 100644
--- a/src/Controller/QuizController.php
+++ b/src/Controller/QuizController.php
@@ -9,6 +9,7 @@ use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Attribute\AsController;
 use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
 use Symfony\Contracts\Translation\TranslatorInterface;
 use Tvdt\Entity\Answer;
 use Tvdt\Entity\Candidate;
@@ -70,10 +71,12 @@ final class QuizController extends AbstractController
         return $this->render('quiz/enter_name.twig', ['season' => $season, 'form' => $form]);
     }
 
+    #[IsCsrfTokenValid('question', tokenKey: 'token', methods: ['POST'])]
     #[Route(
         path: '/{seasonCode:season}/{nameHash}',
         name: 'tvdt_quiz_quiz_page',
         requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'nameHash' => self::CANDIDATE_HASH_REGEX],
+        methods: ['GET', 'POST'],
     )]
     public function quizPage(
         Season $season,
@@ -96,7 +99,7 @@ final class QuizController extends AbstractController
             return $this->redirectToRoute('tvdt_quiz_enter_name', ['seasonCode' => $season->seasonCode]);
         }
 
-        if ('POST' === $request->getMethod()) {
+        if ($request->isMethod('POST')) {
             // TODO: Extract saving answer logic to a service
             // Check if candidate is inactive for this quiz
             $quizCandidate = $this->quizCandidateRepository->findOneBy(['quiz' => $quiz, 'candidate' => $candidate]);
@@ -114,6 +117,12 @@ final class QuizController extends AbstractController
                 return $this->redirectToRoute('tvdt_quiz_quiz_page', ['seasonCode' => $season->seasonCode, 'nameHash' => $nameHash]);
             }
 
+            if ($answer->question !== $this->questionRepository->findNextQuestionForCandidate($candidate)) {
+                $this->addFlash(FlashType::Danger, $this->translator->trans('You cannot answer this question'));
+
+                return $this->redirectToRoute('tvdt_quiz_quiz_page', ['seasonCode' => $season->seasonCode, 'nameHash' => $nameHash]);
+            }
+
             $givenAnswer = new GivenAnswer($candidate, $answer->question->quiz, $answer);
             $this->entityManager->persist($givenAnswer);
             $this->entityManager->flush();
diff --git a/src/DataFixtures/KrtekFixtures.php b/src/DataFixtures/KrtekFixtures.php
index 29cfb9c..2fe95b5 100644
--- a/src/DataFixtures/KrtekFixtures.php
+++ b/src/DataFixtures/KrtekFixtures.php
@@ -12,6 +12,7 @@ use Tvdt\Entity\Candidate;
 use Tvdt\Entity\Question;
 use Tvdt\Entity\Quiz;
 use Tvdt\Entity\Season;
+use Tvdt\Entity\SeasonSettings;
 
 final class KrtekFixtures extends Fixture implements FixtureGroupInterface
 {
@@ -48,6 +49,11 @@ final class KrtekFixtures extends Fixture implements FixtureGroupInterface
         $season->activeQuiz = $quiz1;
         $season->addQuiz($this->createQuiz2($season));
 
+        \assert($season->settings instanceof SeasonSettings);
+
+        $season->settings->confirmAnswers = true;
+        $season->settings->showNumbers = true;
+
         $manager->flush();
 
         $this->addReference(self::KRTEK_SEASON, $season);
diff --git a/src/Entity/Elimination.php b/src/Entity/Elimination.php
index 416ae0b..6a234c6 100644
--- a/src/Entity/Elimination.php
+++ b/src/Entity/Elimination.php
@@ -7,15 +7,20 @@ namespace Tvdt\Entity;
 use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping as ORM;
 use Gedmo\Mapping\Annotation as Gedmo;
+use Gedmo\SoftDeleteable\Traits\SoftDeleteableEntity;
+use Gedmo\Timestampable\Traits\TimestampableEntity;
 use Symfony\Bridge\Doctrine\Types\UuidType;
 use Symfony\Component\HttpFoundation\InputBag;
 use Symfony\Component\Uid\Uuid;
 use Tvdt\Repository\EliminationRepository;
 
+#[Gedmo\SoftDeleteable]
 #[ORM\Entity(repositoryClass: EliminationRepository::class)]
-#[ORM\HasLifecycleCallbacks]
 class Elimination
 {
+    use SoftDeleteableEntity;
+    use TimestampableEntity;
+
     public const string SCREEN_GREEN = 'green';
 
     public const string SCREEN_RED = 'red';
@@ -30,10 +35,6 @@ class Elimination
     #[ORM\Column(type: Types::JSONB)]
     public array $data = [];
 
-    #[Gedmo\Timestampable(on: 'create')]
-    #[ORM\Column(type: Types::DATETIMETZ_IMMUTABLE, nullable: false)]
-    public private(set) \DateTimeImmutable $created;
-
     public function __construct(
         #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
         #[ORM\ManyToOne(inversedBy: 'eliminations')]
diff --git a/src/Entity/GivenAnswer.php b/src/Entity/GivenAnswer.php
index fb5edea..64387da 100644
--- a/src/Entity/GivenAnswer.php
+++ b/src/Entity/GivenAnswer.php
@@ -7,13 +7,17 @@ namespace Tvdt\Entity;
 use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping as ORM;
 use Gedmo\Mapping\Annotation as Gedmo;
+use Gedmo\SoftDeleteable\Traits\SoftDeleteableEntity;
 use Symfony\Bridge\Doctrine\Types\UuidType;
 use Symfony\Component\Uid\Uuid;
 use Tvdt\Repository\GivenAnswerRepository;
 
+#[Gedmo\SoftDeleteable]
 #[ORM\Entity(repositoryClass: GivenAnswerRepository::class)]
 class GivenAnswer
 {
+    use SoftDeleteableEntity;
+
     #[ORM\Column(type: UuidType::NAME, unique: true)]
     #[ORM\CustomIdGenerator(class: 'doctrine.uuid_generator')]
     #[ORM\GeneratedValue(strategy: 'CUSTOM')]
diff --git a/src/Entity/Quiz.php b/src/Entity/Quiz.php
index b9614e6..056b7d3 100644
--- a/src/Entity/Quiz.php
+++ b/src/Entity/Quiz.php
@@ -42,7 +42,7 @@ class Quiz
 
     /** @var Collection<int, Elimination> */
     #[ORM\OneToMany(targetEntity: Elimination::class, mappedBy: 'quiz', cascade: ['persist'], orphanRemoval: true)]
-    #[ORM\OrderBy(['created' => 'DESC'])]
+    #[ORM\OrderBy(['createdAt' => 'DESC'])]
     public private(set) Collection $eliminations;
 
     public function __construct()
diff --git a/src/Entity/QuizCandidate.php b/src/Entity/QuizCandidate.php
index 20f2c5d..2a8f16a 100644
--- a/src/Entity/QuizCandidate.php
+++ b/src/Entity/QuizCandidate.php
@@ -7,14 +7,18 @@ namespace Tvdt\Entity;
 use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping as ORM;
 use Gedmo\Mapping\Annotation as Gedmo;
+use Gedmo\SoftDeleteable\Traits\SoftDeleteableEntity;
 use Symfony\Bridge\Doctrine\Types\UuidType;
 use Symfony\Component\Uid\Uuid;
 use Tvdt\Repository\QuizCandidateRepository;
 
+#[Gedmo\SoftDeleteable]
 #[ORM\Entity(repositoryClass: QuizCandidateRepository::class)]
-#[ORM\UniqueConstraint(columns: ['candidate_id', 'quiz_id'])]
+#[ORM\UniqueConstraint(columns: ['candidate_id', 'quiz_id'], options: ['where' => '(deleted_at IS NULL)'])]
 class QuizCandidate
 {
+    use SoftDeleteableEntity;
+
     #[ORM\Column(type: UuidType::NAME, unique: true)]
     #[ORM\CustomIdGenerator(class: 'doctrine.uuid_generator')]
     #[ORM\GeneratedValue(strategy: 'CUSTOM')]
diff --git a/src/Entity/User.php b/src/Entity/User.php
index 7495f41..660ad03 100644
--- a/src/Entity/User.php
+++ b/src/Entity/User.php
@@ -89,13 +89,6 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
         return $this->password;
     }
 
-    /** @see UserInterface */
-    public function eraseCredentials(): void
-    {
-        // If you store any temporary, sensitive data on the user, clear it here
-        // $this->plainPassword = null;
-    }
-
     public function addSeason(Season $season): static
     {
         if (!$this->seasons->contains($season)) {
diff --git a/templates/backoffice/prepare_elimination/index.html.twig b/templates/backoffice/prepare_elimination/index.html.twig
index 1c50933..bf16ede 100644
--- a/templates/backoffice/prepare_elimination/index.html.twig
+++ b/templates/backoffice/prepare_elimination/index.html.twig
@@ -15,6 +15,7 @@
     <div class="row">
         <div class="col-12 col-md-6">
             <form method="post">
+                <input type="hidden" name="_token" value="{{ csrf_token('prepare_elimination') }}">
                 {%~ for candidate, colour in elimination.data %}
                     <div class="row mb-3">
                         <label for="colour-{{ candidate|lower }}" class="col-4 col-form-label">{{ candidate }}</label>
diff --git a/templates/backoffice/quiz/tab_candidates_list.html.twig b/templates/backoffice/quiz/tab_candidates_list.html.twig
index 6c3ba98..19883ce 100644
--- a/templates/backoffice/quiz/tab_candidates_list.html.twig
+++ b/templates/backoffice/quiz/tab_candidates_list.html.twig
@@ -35,14 +35,16 @@
                     {% endif %}
                 </td>
                 <td>
-                    <a href="{{ path('tvdt_backoffice_toggle_candidate', {quiz: quiz.id, candidate: candidate.id}) }}"
-                       class="btn btn-sm btn-outline-secondary">
-                        {% if quizCandidate == null or quizCandidate.active %}
-                            {{ 'Deactivate'|trans }}
-                        {% else %}
-                            {{ 'Activate'|trans }}
-                        {% endif %}
-                    </a>
+                    <form action="{{ path('tvdt_backoffice_toggle_candidate', {quiz: quiz.id, candidate: candidate.id}) }}" method="POST">
+                        <input type="hidden" name="_token" value="{{ csrf_token('toggle_candidate') }}">
+                        <button type="submit" class="btn btn-sm btn-outline-secondary">
+                            {% if quizCandidate == null or quizCandidate.active %}
+                                {{ 'Deactivate'|trans }}
+                            {% else %}
+                                {{ 'Activate'|trans }}
+                            {% endif %}
+                        </button>
+                    </form>
                 </td>
             </tr>
         {% endfor %}
diff --git a/templates/backoffice/quiz/tab_overview.html.twig b/templates/backoffice/quiz/tab_overview.html.twig
index 6d159e6..3ab04c2 100644
--- a/templates/backoffice/quiz/tab_overview.html.twig
+++ b/templates/backoffice/quiz/tab_overview.html.twig
@@ -1,18 +1,26 @@
 <div data-controller="bo--quiz">
-    <h4 class="mb-3">Quick actions</h4>
+    <h4 class="mb-3">{{ 'Quick actions'|trans }}</h4>
     <div class="mb-3 btn-group">
 
         {% if quiz is same as (season.activeQuiz) %}
-            <a class="btn btn-secondary"
-               href="{{ path('tvdt_backoffice_enable', {seasonCode: season.seasonCode, quiz: 'null'}) }}">{{ 'Deactivate Quiz'|trans }}</a>
+            <form action="{{ path('tvdt_backoffice_enable', {seasonCode: season.seasonCode, quiz: 'null'}) }}" method="POST">
+                <input type="hidden" name="_token" value="{{ csrf_token('enable_quiz') }}">
+                <button type="submit" class="btn btn-secondary rounded-0 rounded-start">
+                    {{ 'Deactivate Quiz'|trans }}
+                </button>
+            </form>
         {% else %}
-            <a class="btn btn-primary"
-               href="{{ path('tvdt_backoffice_enable', {seasonCode: season.seasonCode, quiz: quiz.id}) }}">{{ 'Make active'|trans }}</a>
+            <form action="{{ path('tvdt_backoffice_enable', {seasonCode: season.seasonCode, quiz: quiz.id}) }}" method="POST">
+                <input type="hidden" name="_token" value="{{ csrf_token('enable_quiz') }}">
+                <button type="submit" class="btn btn-primary rounded-0 rounded-start">
+                    {{ 'Make active'|trans }}
+                </button>
+            </form>
         {% endif %}
         <button class="btn btn-danger" data-action="click->bo--quiz#clearQuiz">
             {{ 'Clear Quiz...'|trans }}
         </button>
-        <button class="btn btn-danger" data-action="click->bo--quiz#deleteQuiz">
+        <button class="btn btn-danger rounded-0 rounded-end" data-action="click->bo--quiz#deleteQuiz">
             {{ 'Delete Quiz...'|trans }}
         </button>
     </div>
@@ -28,7 +36,8 @@
                             data-bs-target="#question-{{ loop.index0 }}"
                             aria-controls="question-{{ loop.index0 }}">
                         {% set questionError = questionErrors[question.id.toString] ?? null %}
-                        <span class="badge rounded-pill me-2{% if questionError %} text-bg-danger{% else %} invisible{% endif %}"{% if questionError %} data-bs-toggle="tooltip" title="{{ questionError }}"{% endif %}>!</span>
+                        <span
+                            class="badge rounded-pill me-2{% if questionError %} text-bg-danger{% else %} invisible{% endif %}"{% if questionError %} data-bs-toggle="tooltip" title="{{ questionError }}"{% endif %}>!</span>
                         {{~ loop.index -}}. {{ question.question -}}
                     </button>
                 </h2>
@@ -73,8 +82,10 @@
                 </div>
                 <div class="modal-footer">
                     <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'No'|trans }}</button>
-                    <a href="{{ path('tvdt_backoffice_quiz_clear', {quiz: quiz.id}) }}"
-                       class="btn btn-danger">{{ 'Yes'|trans }}</a>
+                    <form action="{{ path('tvdt_backoffice_quiz_clear', {quiz: quiz.id}) }}" method="POST">
+                        <input type="hidden" name="_token" value="{{ csrf_token('clear_quiz') }}">
+                        <button type="submit" class="btn btn-danger">{{ 'Yes'|trans }}</button>
+                    </form>
                 </div>
             </div>
         </div>
@@ -96,8 +107,10 @@
                 </div>
                 <div class="modal-footer">
                     <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'No'|trans }}</button>
-                    <a href="{{ path('tvdt_backoffice_quiz_delete', {quiz: quiz.id}) }}"
-                       class="btn btn-danger">{{ 'Yes'|trans }}</a>
+                    <form action="{{ path('tvdt_backoffice_quiz_delete', {quiz: quiz.id}) }}" method="POST">
+                        <input type="hidden" name="_token" value="{{ csrf_token('delete_quiz') }}">
+                        <button type="submit" class="btn btn-danger">{{ 'Yes'|trans }}</button>
+                    </form>
                 </div>
             </div>
         </div>
diff --git a/templates/backoffice/quiz/tab_result.html.twig b/templates/backoffice/quiz/tab_result.html.twig
index db42574..d1c9101 100644
--- a/templates/backoffice/quiz/tab_result.html.twig
+++ b/templates/backoffice/quiz/tab_result.html.twig
@@ -1,77 +1,80 @@
 <h4 class="mb-3">{{ 'Score'|trans }}</h4>
-    <div class="btn-toolbar mb-3" role="toolbar">
-        <div class="btn-group me-2">
-            {# <a class="btn btn-primary">{{ 'Start Elimination'|trans }}</a> #}
-            <a href="{{ path('tvdt_prepare_elimination', {seasonCode: season.seasonCode, quiz: quiz.id}) }}"
-               class="btn btn-secondary">{{ 'Prepare Custom Elimination'|trans }}</a>
-            {%~ if not quiz.eliminations.empty %}
-                <button class="btn btn-secondary dropdown-toggle"
-                        data-bs-toggle="dropdown">{{ 'Load Prepared Elimination'|trans }}</button>
-                <ul class="dropdown-menu">
-                    {%~ for elimination in quiz.eliminations %}
-                        <li><a class="dropdown-item"
-                               href="{{ path('tvdt_prepare_elimination_view', {elimination: elimination.id}) }}">{{ elimination.created|format_datetime() }}</a>
-                        </li>
-                    {%~ endfor %}
-                </ul>
-            {% endif %}
-        </div>
+<div class="btn-toolbar mb-3" role="toolbar">
+    <div class="btn-group me-2">
+        {# <a class="btn btn-primary">{{ 'Start Elimination'|trans }}</a> #}
+        <form action="{{ path('tvdt_prepare_elimination', {seasonCode: season.seasonCode, quiz: quiz.id}) }}" method="POST">
+            <input type="hidden" name="_token" value="{{ csrf_token('prepare_elimination') }}">
+            <button type="submit" class="btn btn-secondary rounded-0 rounded-start">{{ 'Prepare Custom Elimination'|trans }}</button>
+        </form>
+        {%~ if not quiz.eliminations.empty %}
+            <button class="btn btn-secondary dropdown-toggle"
+                    data-bs-toggle="dropdown">{{ 'Load Prepared Elimination'|trans }}</button>
+            <ul class="dropdown-menu">
+                {%~ for elimination in quiz.eliminations %}
+                    <li><a class="dropdown-item"
+                           href="{{ path('tvdt_prepare_elimination_view', {elimination: elimination.id}) }}">{{ elimination.createdAt|format_datetime() }}</a>
+                    </li>
+                {%~ endfor %}
+            </ul>
+        {% endif %}
     </div>
-    <p class="mb-3">{{ 'Number of dropouts:'|trans }}  {{ quiz.dropouts }} </p>
-    <table class="table table-hover mb-3">
-        <thead>
-        <tr>
-            <th scope="col">{{ 'Candidate'|trans }}</th>
-            <th style="width: 15%" scope="col">{{ 'Correct Answers'|trans }}</th>
-            <th style="width: 20%" scope="col">{{ 'Corrections'|trans }}</th>
-            <th style="width: 20%" scope="col">{{ 'Penalty'|trans }}</th>
-            <th style="width: 10%" scope="col">{{ 'Score'|trans }}</th>
-            <th style="width: 20%" scope="col">{{ 'Time'|trans }}</th>
+</div>
+<p class="mb-3">{{ 'Number of dropouts:'|trans }}  {{ quiz.dropouts }} </p>
+<table class="table table-hover mb-3">
+    <thead>
+    <tr>
+        <th scope="col">{{ 'Candidate'|trans }}</th>
+        <th style="width: 15%" scope="col">{{ 'Correct Answers'|trans }}</th>
+        <th style="width: 20%" scope="col">{{ 'Corrections'|trans }}</th>
+        <th style="width: 20%" scope="col">{{ 'Penalty'|trans }}</th>
+        <th style="width: 10%" scope="col">{{ 'Score'|trans }}</th>
+        <th style="width: 20%" scope="col">{{ 'Time'|trans }}</th>
+    </tr>
+    </thead>
+    <tbody>
+    {%~ for candidate in result ~%}
+        <tr class="table-{% if loop.revindex > quiz.dropouts %}success{% else %}danger{% endif %}">
+            <td>{{ candidate.name }}</td>
+            <td>{{ candidate.correct|default('0') }}</td>
+            <td>
+                <form method="post"
+                      action="{{ path('tvdt_backoffice_modify_correction', {quiz: quiz.id, candidate: candidate.id}) }}">
+                    <input type="hidden" name="_token" value="{{ csrf_token('candidate_correction') }}">
+                    <div class="row">
+                        <div class="col-8">
+                            <input class="form-control form-control-sm" type="number"
+                                   value="{{ candidate.corrections }}" step="0.5"
+                                   name="corrections">
+                        </div>
+                        <div class="col-2">
+                            <button class="btn btn-sm btn-primary" type="submit">{{ 'Save'|trans }}</button>
+                        </div>
+                    </div>
+                </form>
+            </td>
+            <td>
+                <form method="post"
+                      action="{{ path('tvdt_backoffice_modify_penalty', {quiz: quiz.id, candidate: candidate.id}) }}">
+                    <input type="hidden" name="_token" value="{{ csrf_token('candidate_penalty') }}">
+                    <div class="row">
+                        <div class="col-8">
+                            <input class="form-control form-control-sm" type="number"
+                                   value="{{ candidate.penaltySeconds }}" step="1"
+                                   name="penalty">
+                        </div>
+                        <div class="col-2">
+                            <button class="btn btn-sm btn-primary" type="submit">{{ 'Save'|trans }}</button>
+                        </div>
+                    </div>
+                </form>
+            </td>
+            <td>{{ candidate.score|default('x') }}</td>
+            <td>{{ candidate.time.format('%i:%S') }}</td>
         </tr>
-        </thead>
-        <tbody>
-        {%~ for candidate in result ~%}
-            <tr class="table-{% if loop.revindex > quiz.dropouts %}success{% else %}danger{% endif %}">
-                <td>{{ candidate.name }}</td>
-                <td>{{ candidate.correct|default('0') }}</td>
-                <td>
-                    <form method="post"
-                          action="{{ path('tvdt_backoffice_modify_correction', {quiz: quiz.id, candidate: candidate.id}) }}">
-                        <div class="row">
-                            <div class="col-8">
-                                <input class="form-control form-control-sm" type="number"
-                                       value="{{ candidate.corrections }}" step="0.5"
-                                       name="corrections">
-                            </div>
-                            <div class="col-2">
-                                <button class="btn btn-sm btn-primary" type="submit">{{ 'Save'|trans }}</button>
-                            </div>
-                        </div>
-                    </form>
-                </td>
-                <td>
-                    <form method="post"
-                          action="{{ path('tvdt_backoffice_modify_penalty', {quiz: quiz.id, candidate: candidate.id}) }}">
-                        <input type="hidden" name="_token" value="{{ csrf_token('candidate_answer') }}">
-                        <div class="row">
-                            <div class="col-8">
-                                <input class="form-control form-control-sm" type="number"
-                                       value="{{ candidate.penaltySeconds }}" step="1"
-                                       name="penalty">
-                            </div>
-                            <div class="col-2">
-                                <button class="btn btn-sm btn-primary" type="submit">{{ 'Save'|trans }}</button>
-                            </div>
-                        </div>
-                    </form>
-                </td>
-                <td>{{ candidate.score|default('x') }}</td>
-                <td>{{ candidate.time.format('%i:%S') }}</td>
-            </tr>
-        {% else %}
-            <tr>
-                <td colspan="5">{{ 'No results'|trans }}</td>
-            </tr>
-        {% endfor %}
-        </tbody>
-    </table>
+    {% else %}
+        <tr>
+            <td colspan="6">{{ 'No results'|trans }}</td>
+        </tr>
+    {% endfor %}
+    </tbody>
+</table>
diff --git a/templates/backoffice/quiz_add.html.twig b/templates/backoffice/quiz_add.html.twig
index a43c0e1..e9553e0 100644
--- a/templates/backoffice/quiz_add.html.twig
+++ b/templates/backoffice/quiz_add.html.twig
@@ -13,7 +13,7 @@
 {% block body %}
     <div class="row">
         <div class="col-md-6 col-12">
-            <h2 class="mb-3">{{ t('Add a quiz to %name%', {'%name%': season.name})|trans }} </h2>
+            <h2 class="mb-3">{{ t('Add a quiz to {name}', {name: season.name})|trans }} </h2>
             {{ form_start(form) }}
             {{ form_row(form.name) }}
             {{ form_row(form.sheet) }}
diff --git a/templates/flashes.html.twig b/templates/flashes.html.twig
index b033dd2..c528195 100644
--- a/templates/flashes.html.twig
+++ b/templates/flashes.html.twig
@@ -4,7 +4,7 @@
         {% for label, messages in flashes %}
             {% for message in messages %}
                 <div class="alert alert-{{ label }} alert-dismissible " role="alert">
-                    {{ message }}
+                    {{ message|trans }}
                     <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
                 </div>
             {% endfor %}
diff --git a/translations/messages+intl-icu.nl.xliff b/translations/messages+intl-icu.nl.xliff
index 18c1de6..8e637e9 100644
--- a/translations/messages+intl-icu.nl.xliff
+++ b/translations/messages+intl-icu.nl.xliff
@@ -37,9 +37,9 @@
         <source>Add Quiz</source>
         <target>Test toevoegen</target>
       </trans-unit>
-      <trans-unit id="ehB6pAw" resname="Add a quiz to %name%">
-        <source>Add a quiz to %name%</source>
-        <target>Voeg een test toe aan %name%</target>
+      <trans-unit id="apgpM9w" resname="Add a quiz to {name}">
+        <source>Add a quiz to {name}</source>
+        <target>Voeg een test toe aan {name}</target>
       </trans-unit>
       <trans-unit id="qiXD5ve" resname="All Seasons">
         <source>All Seasons</source>
@@ -109,13 +109,13 @@
         <source>Corrections</source>
         <target>Jokers</target>
       </trans-unit>
-      <trans-unit id="Lu7u8U2" resname="Cound not find candidate with name %name%">
-        <source>Cound not find candidate with name %name%</source>
-        <target>Kon kandidaat met naam %name% niet vinden</target>
+      <trans-unit id="9JHLsoe" resname="Could not find candidate with name {name}">
+        <source>Could not find candidate with name {name}</source>
+        <target>Kon kandidaat met naam {name} niet vinden</target>
       </trans-unit>
-      <trans-unit id="YQUiB4T" resname="Cound not find candidate with name %name% in elimination.">
-        <source>Cound not find candidate with name %name% in elimination.</source>
-        <target>Kon geen kandidaat vinden met de naam %name% in de eliminatie</target>
+      <trans-unit id="h589jDz" resname="Could not find candidate with name {name} in elimination.">
+        <source>Could not find candidate with name {name} in elimination.</source>
+        <target>Kon geen kandidaat vinden met de naam {name} in de eliminatie</target>
       </trans-unit>
       <trans-unit id="0DvmToq" resname="Create a season">
         <source>Create a season</source>
@@ -301,6 +301,10 @@
         <source>Questions</source>
         <target>Vragen</target>
       </trans-unit>
+      <trans-unit id="1jiUI_8" resname="Quick actions">
+        <source>Quick actions</source>
+        <target>Snelle acties</target>
+      </trans-unit>
       <trans-unit id="0tv0gq." resname="Quiz">
         <source>Quiz</source>
         <target>Test</target>
@@ -429,6 +433,10 @@
         <source>You are not allowed to answer this quiz</source>
         <target>Je mag deze test niet beantwoorden</target>
       </trans-unit>
+      <trans-unit id="78moQnF" resname="You cannot answer this question">
+        <source>You cannot answer this question</source>
+        <target>Je kan deze vraag niet beantwoorden</target>
+      </trans-unit>
       <trans-unit id="0afY1NF" resname="You have no seasons yet.">
         <source>You have no seasons yet.</source>
         <target>Je hebt nog geen seizoenen.</target>