From e669122fccf83bea8967c2c2bf16aeee8947e0dd Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 4 Aug 2023 11:28:53 +0200
Subject: [PATCH] Bug 34478: Add missing CSRF token to POST forms

This is the result of
  % perl csrf_add_missing_csrf.pl
---
 .../prog/en/includes/acquisitions-search.inc     |  2 ++
 .../prog/en/includes/acquisitions-toolbar.inc    |  1 +
 .../prog/en/includes/budgets-admin-search.inc    |  1 +
 .../prog/en/includes/checkin-search-box.inc      |  1 +
 .../prog/en/includes/checkouts-table.inc         |  1 +
 .../intranet-tmpl/prog/en/includes/circ-menu.inc |  2 ++
 .../prog/en/includes/cities-admin-search.inc     |  1 +
 .../prog/en/includes/contracts-admin-search.inc  |  1 +
 .../prog/en/includes/currencies-admin-search.inc |  1 +
 .../prog/en/includes/desks-admin-search.inc      |  1 +
 .../prog/en/includes/letters-search.inc          |  1 +
 .../prog/en/includes/mana/mana-share-report.inc  |  1 +
 .../prog/en/includes/member-search-box.inc       |  1 +
 .../prog/en/includes/members-toolbar.inc         |  1 +
 .../en/includes/modals/cataloguing_create_av.inc |  1 +
 .../includes/modals/serials_multi_receiving.inc  |  1 +
 .../prog/en/includes/patron-detail-tabs.inc      |  3 +++
 .../prog/en/includes/patron-restrictions-tab.inc |  1 +
 .../prog/en/includes/patron-search-box.inc       |  1 +
 .../prog/en/includes/patron_messages.inc         |  1 +
 .../prog/en/includes/patrons-admin-search.inc    |  1 +
 .../prog/en/includes/renew-search-box.inc        |  1 +
 .../prog/en/includes/waiting_holds.inc           |  1 +
 .../prog/en/includes/z3950-admin-search.inc      |  1 +
 .../prog/en/modules/acqui/acqui-home.tt          |  1 +
 .../prog/en/modules/acqui/addorder.tt            |  1 +
 .../prog/en/modules/acqui/addorderiso2709.tt     |  1 +
 .../prog/en/modules/acqui/basket.tt              |  6 ++++++
 .../prog/en/modules/acqui/basketgroup.tt         |  1 +
 .../prog/en/modules/acqui/basketheader.tt        |  1 +
 .../prog/en/modules/acqui/cancelorder.tt         |  1 +
 .../prog/en/modules/acqui/duplicate_orders.tt    |  3 +++
 .../prog/en/modules/acqui/histsearch.tt          |  1 +
 .../prog/en/modules/acqui/invoice-files.tt       |  1 +
 .../prog/en/modules/acqui/invoice.tt             |  2 ++
 .../prog/en/modules/acqui/invoices.tt            |  1 +
 .../prog/en/modules/acqui/lateorders.tt          |  3 +++
 .../prog/en/modules/acqui/moddeliverydate.tt     |  1 +
 .../prog/en/modules/acqui/modordernotes.tt       |  1 +
 .../prog/en/modules/acqui/neworderempty.tt       |  2 ++
 .../prog/en/modules/acqui/supplier.tt            |  1 +
 .../prog/en/modules/acqui/uncertainprice.tt      |  2 ++
 .../prog/en/modules/acqui/vendor_issues.tt       |  2 ++
 .../prog/en/modules/acqui/z3950_search.tt        |  2 ++
 .../prog/en/modules/admin/additional-fields.tt   |  1 +
 .../prog/en/modules/admin/admin-home.tt          |  1 +
 .../prog/en/modules/admin/adveditorshortcuts.tt  |  1 +
 .../prog/en/modules/admin/aqbudgetperiods.tt     |  5 +++++
 .../prog/en/modules/admin/aqbudgets.tt           |  2 ++
 .../prog/en/modules/admin/aqcontract.tt          |  4 ++++
 .../prog/en/modules/admin/aqplan.tt              |  3 +++
 .../prog/en/modules/admin/audio_alerts.tt        |  2 ++
 .../en/modules/admin/auth_subfields_structure.tt |  2 ++
 .../prog/en/modules/admin/auth_tag_structure.tt  |  5 +++++
 .../prog/en/modules/admin/authorised_values.tt   |  2 ++
 .../prog/en/modules/admin/authtypes.tt           |  3 +++
 .../prog/en/modules/admin/biblio_framework.tt    |  4 ++++
 .../en/modules/admin/branch_transfer_limits.tt   |  1 +
 .../prog/en/modules/admin/branches.tt            |  2 ++
 .../prog/en/modules/admin/cash_registers.tt      |  1 +
 .../prog/en/modules/admin/categories.tt          |  2 ++
 .../prog/en/modules/admin/cities.tt              |  2 ++
 .../prog/en/modules/admin/classsources.tt        |  3 +++
 .../prog/en/modules/admin/clone-rules.tt         |  1 +
 .../prog/en/modules/admin/columns_settings.tt    |  1 +
 .../prog/en/modules/admin/credit_types.tt        |  1 +
 .../prog/en/modules/admin/curbside_pickup.tt     |  1 +
 .../prog/en/modules/admin/currency.tt            |  4 ++++
 .../prog/en/modules/admin/debit_types.tt         |  1 +
 .../intranet-tmpl/prog/en/modules/admin/desks.tt |  2 ++
 .../prog/en/modules/admin/didyoumean.tt          |  1 +
 .../prog/en/modules/admin/edi_accounts.tt        |  2 ++
 .../prog/en/modules/admin/edi_ean_accounts.tt    |  2 ++
 .../modules/admin/identity_provider_domains.tt   |  2 ++
 .../prog/en/modules/admin/identity_providers.tt  |  2 ++
 .../prog/en/modules/admin/items_search_field.tt  |  1 +
 .../prog/en/modules/admin/items_search_fields.tt |  1 +
 .../prog/en/modules/admin/itemtypes.tt           |  3 +++
 .../prog/en/modules/admin/koha2marclinks.tt      |  1 +
 .../prog/en/modules/admin/localization.tt        |  1 +
 .../prog/en/modules/admin/marc-overlay-rules.tt  |  2 ++
 .../en/modules/admin/marc_subfields_structure.tt |  3 +++
 .../prog/en/modules/admin/marctagstructure.tt    |  5 +++++
 .../prog/en/modules/admin/matching-rules.tt      |  2 ++
 .../prog/en/modules/admin/oai_set_mappings.tt    |  1 +
 .../prog/en/modules/admin/oai_sets.tt            |  1 +
 .../prog/en/modules/admin/overdrive.tt           |  1 +
 .../prog/en/modules/admin/patron-attr-types.tt   |  2 ++
 .../prog/en/modules/admin/preferences.tt         |  1 +
 .../prog/en/modules/admin/restrictions.tt        |  2 ++
 .../admin/searchengine/elasticsearch/mappings.tt |  3 +++
 .../prog/en/modules/admin/share_content.tt       |  3 +++
 .../prog/en/modules/admin/smart-rules.tt         |  9 +++++++++
 .../prog/en/modules/admin/sms_providers.tt       |  1 +
 .../prog/en/modules/admin/smtp_servers.tt        |  2 ++
 .../prog/en/modules/admin/sru_modmapping.tt      |  1 +
 .../prog/en/modules/admin/sru_modmapping_auth.tt |  1 +
 .../prog/en/modules/admin/systempreferences.tt   |  6 ++++++
 .../en/modules/admin/transport-cost-matrix.tt    |  1 +
 .../prog/en/modules/admin/usage_statistics.tt    |  1 +
 .../prog/en/modules/admin/z3950servers.tt        |  1 +
 koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt  |  2 ++
 .../prog/en/modules/authorities/authorities.tt   |  1 +
 .../prog/en/modules/authorities/merge.tt         |  2 ++
 .../prog/en/modules/basket/downloadcart.tt       |  1 +
 .../prog/en/modules/basket/sendbasketform.tt     |  1 +
 .../prog/en/modules/catalogue/moredetail.tt      |  6 ++++++
 .../prog/en/modules/catalogue/results.tt         |  1 +
 .../prog/en/modules/catalogue/search-history.tt  |  4 ++++
 .../prog/en/modules/catalogue/stockrotation.tt   |  1 +
 .../prog/en/modules/cataloguing/addbiblio.tt     |  1 +
 .../prog/en/modules/cataloguing/additem.tt       |  1 +
 .../prog/en/modules/cataloguing/linkitem.tt      |  3 +++
 .../prog/en/modules/cataloguing/merge.tt         |  2 ++
 .../prog/en/modules/cataloguing/moveitem.tt      |  2 ++
 .../value_builder/marc21_linking_section.tt      |  1 +
 .../value_builder/unimarc_field_210c.tt          |  1 +
 .../value_builder/unimarc_field_4XX.tt           |  1 +
 .../en/modules/cataloguing/z3950_auth_search.tt  |  2 ++
 .../prog/en/modules/cataloguing/z3950_search.tt  |  2 ++
 .../prog/en/modules/circ/article-requests.tt     |  1 +
 .../prog/en/modules/circ/branchoverdues.tt       |  1 +
 .../prog/en/modules/circ/branchtransfers.tt      |  4 ++++
 .../prog/en/modules/circ/checkout-notes.tt       |  1 +
 .../prog/en/modules/circ/circulation.tt          |  4 ++++
 .../modules/circ/circulation_batch_checkouts.tt  |  2 ++
 .../prog/en/modules/circ/curbside_pickups.tt     | 10 ++++++++++
 .../prog/en/modules/circ/overdue.tt              |  1 +
 .../prog/en/modules/circ/pendingreserves.tt      |  3 +++
 .../intranet-tmpl/prog/en/modules/circ/renew.tt  |  9 +++++++++
 .../prog/en/modules/circ/request-article.tt      |  1 +
 .../prog/en/modules/circ/reserveratios.tt        |  1 +
 .../prog/en/modules/circ/returns.tt              | 10 ++++++++++
 .../prog/en/modules/circ/set-library.tt          |  2 ++
 .../prog/en/modules/circ/waitingreserves.tt      |  3 +++
 .../prog/en/modules/clubs/clubs-add-modify.tt    |  1 +
 .../en/modules/clubs/templates-add-modify.tt     |  1 +
 .../modules/course_reserves/add_items-step1.tt   |  1 +
 .../modules/course_reserves/add_items-step2.tt   |  1 +
 .../modules/course_reserves/batch_add_items.tt   |  1 +
 .../en/modules/course_reserves/batch_rm_items.tt |  1 +
 .../prog/en/modules/course_reserves/course.tt    |  1 +
 .../prog/en/modules/ill/ill-requests.tt          |  6 ++++++
 .../prog/en/modules/installer/auth.tt            |  1 +
 .../prog/en/modules/installer/step1.tt           |  1 +
 .../prog/en/modules/installer/step2.tt           |  2 ++
 .../prog/en/modules/installer/step3.tt           |  6 ++++++
 .../prog/en/modules/labels/barcode-print.tt      |  1 +
 .../prog/en/modules/labels/label-bib-search.tt   |  1 +
 .../prog/en/modules/labels/label-edit-batch.tt   |  1 +
 .../prog/en/modules/labels/label-edit-range.tt   |  1 +
 .../prog/en/modules/labels/label-print.tt        |  1 +
 .../prog/en/modules/labels/search.tt             |  1 +
 .../prog/en/modules/labels/spinelabel-home.tt    |  1 +
 .../prog/en/modules/members/apikeys.tt           |  3 +++
 .../prog/en/modules/members/boraccount.tt        |  1 +
 .../prog/en/modules/members/discharge.tt         |  1 +
 .../prog/en/modules/members/files.tt             |  1 +
 .../prog/en/modules/members/housebound.tt        |  2 ++
 .../prog/en/modules/members/mancredit.tt         |  1 +
 .../prog/en/modules/members/maninvoice.tt        |  1 +
 .../prog/en/modules/members/member-flags.tt      |  1 +
 .../prog/en/modules/members/member-password.tt   |  1 +
 .../prog/en/modules/members/member.tt            |  1 +
 .../prog/en/modules/members/memberentrygen.tt    |  1 +
 .../prog/en/modules/members/members-update.tt    |  1 +
 .../prog/en/modules/members/notices.tt           |  1 +
 .../intranet-tmpl/prog/en/modules/members/pay.tt |  1 +
 .../prog/en/modules/members/paycollect.tt        |  3 +++
 .../prog/en/modules/members/two_factor_auth.tt   |  1 +
 .../prog/en/modules/members/update-child.tt      |  1 +
 .../prog/en/modules/offline_circ/process_koc.tt  |  3 +++
 .../en/modules/onboarding/onboardingstep1.tt     |  1 +
 .../en/modules/onboarding/onboardingstep2.tt     |  1 +
 .../en/modules/onboarding/onboardingstep3.tt     |  1 +
 .../en/modules/onboarding/onboardingstep4.tt     |  1 +
 .../en/modules/onboarding/onboardingstep5.tt     |  1 +
 .../prog/en/modules/patron_lists/add-modify.tt   |  1 +
 .../prog/en/modules/patron_lists/list.tt         |  2 ++
 .../prog/en/modules/patroncards/edit-batch.tt    |  1 +
 .../prog/en/modules/patroncards/edit-layout.tt   |  1 +
 .../prog/en/modules/patroncards/edit-profile.tt  |  1 +
 .../prog/en/modules/patroncards/edit-template.tt |  1 +
 .../prog/en/modules/patroncards/image-manage.tt  |  2 ++
 .../prog/en/modules/patroncards/print.tt         |  1 +
 .../prog/en/modules/plugins/plugins-upload.tt    |  1 +
 .../intranet-tmpl/prog/en/modules/pos/pay.tt     |  2 ++
 .../prog/en/modules/pos/register.tt              |  2 ++
 .../prog/en/modules/pos/registers.tt             |  1 +
 .../prog/en/modules/recalls/recalls_overdue.tt   |  1 +
 .../prog/en/modules/recalls/recalls_queue.tt     |  1 +
 .../prog/en/modules/recalls/recalls_to_pull.tt   |  1 +
 .../prog/en/modules/recalls/recalls_waiting.tt   |  2 ++
 .../prog/en/modules/recalls/request.tt           |  1 +
 .../en/modules/reports/acquisitions_stats.tt     |  1 +
 .../prog/en/modules/reports/bor_issues_top.tt    |  1 +
 .../prog/en/modules/reports/borrowers_out.tt     |  1 +
 .../prog/en/modules/reports/borrowers_stats.tt   |  1 +
 .../en/modules/reports/cash_register_stats.tt    |  1 +
 .../prog/en/modules/reports/cat_issues_top.tt    |  1 +
 .../prog/en/modules/reports/catalogue_out.tt     |  1 +
 .../prog/en/modules/reports/catalogue_stats.tt   |  1 +
 .../prog/en/modules/reports/dictionary.tt        |  6 ++++++
 .../en/modules/reports/guided_reports_start.tt   | 16 ++++++++++++++++
 .../prog/en/modules/reports/issues_avg_stats.tt  |  1 +
 .../prog/en/modules/reports/issues_stats.tt      |  1 +
 .../prog/en/modules/reports/itemslost.tt         |  1 +
 .../prog/en/modules/reports/itemtypes.tt         |  1 +
 .../prog/en/modules/reports/orders_by_budget.tt  |  1 +
 .../prog/en/modules/reports/reserves_stats.tt    |  1 +
 .../prog/en/modules/reports/serials_stats.tt     |  1 +
 .../prog/en/modules/reserve/request.tt           |  5 +++++
 .../en/modules/rotating_collections/addItems.tt  |  1 +
 .../rotating_collections/editCollections.tt      |  1 +
 .../rotating_collections/transferCollection.tt   |  1 +
 .../prog/en/modules/serials/acqui-search.tt      |  1 +
 .../prog/en/modules/serials/claims.tt            |  2 ++
 .../prog/en/modules/serials/routing-preview.tt   |  1 +
 .../prog/en/modules/serials/routing.tt           |  1 +
 .../en/modules/serials/serials-collection.tt     |  1 +
 .../prog/en/modules/serials/serials-edit.tt      |  1 +
 .../prog/en/modules/serials/serials-search.tt    |  1 +
 .../prog/en/modules/serials/subscription-add.tt  |  1 +
 .../en/modules/serials/subscription-batchedit.tt |  1 +
 .../en/modules/serials/subscription-detail.tt    |  1 +
 .../modules/serials/subscription-frequencies.tt  |  1 +
 .../en/modules/serials/subscription-history.tt   |  1 +
 .../serials/subscription-numberpatterns.tt       |  1 +
 .../en/modules/serials/subscription-renew.tt     |  1 +
 .../prog/en/modules/suggestion/suggestion.tt     |  2 ++
 .../intranet-tmpl/prog/en/modules/tags/review.tt |  3 +++
 .../prog/en/modules/tools/additional-contents.tt |  3 +++
 .../tools/automatic_item_modification_by_age.tt  |  1 +
 .../prog/en/modules/tools/batchMod-del.tt        |  1 +
 .../prog/en/modules/tools/batchMod-edit.tt       |  1 +
 .../prog/en/modules/tools/batchMod.tt            |  1 +
 .../en/modules/tools/batch_delete_records.tt     |  2 ++
 .../en/modules/tools/batch_extend_due_dates.tt   |  2 ++
 .../modules/tools/batch_record_modification.tt   |  2 ++
 .../prog/en/modules/tools/cleanborrowers.tt      |  2 ++
 .../prog/en/modules/tools/csv-profiles.tt        |  2 ++
 .../prog/en/modules/tools/export.tt              |  4 ++++
 .../prog/en/modules/tools/holidays.tt            |  3 +++
 .../prog/en/modules/tools/import_borrowers.tt    |  1 +
 .../prog/en/modules/tools/inventory.tt           |  2 ++
 .../prog/en/modules/tools/letter.tt              |  5 +++++
 .../prog/en/modules/tools/manage-marc-import.tt  |  5 +++++
 .../modules/tools/marc_modification_templates.tt |  2 ++
 .../prog/en/modules/tools/modborrowers.tt        |  2 ++
 .../prog/en/modules/tools/overduerules.tt        |  2 ++
 .../prog/en/modules/tools/picture-upload.tt      |  1 +
 .../prog/en/modules/tools/problem-reports.tt     |  1 +
 .../prog/en/modules/tools/quotes.tt              |  2 ++
 .../prog/en/modules/tools/scheduler.tt           |  2 ++
 .../prog/en/modules/tools/stage-marc-import.tt   |  2 ++
 .../prog/en/modules/tools/stockrotation.tt       |  5 +++++
 .../prog/en/modules/tools/upload-images.tt       |  2 ++
 .../prog/en/modules/tools/upload.tt              |  4 ++++
 .../prog/en/modules/tools/viewlog.tt             |  1 +
 .../modules/virtualshelves/addbybiblionumber.tt  |  1 +
 .../en/modules/virtualshelves/downloadshelf.tt   |  1 +
 .../en/modules/virtualshelves/sendshelfform.tt   |  1 +
 .../prog/en/modules/virtualshelves/shelves.tt    |  4 ++++
 .../bootstrap/en/includes/account-table.inc      |  1 +
 .../bootstrap/en/includes/holds-table.inc        |  7 +++++++
 .../opac-tmpl/bootstrap/en/includes/masthead.inc |  1 +
 .../en/includes/opac-detail-sidebar.inc          |  1 +
 .../bootstrap/en/includes/opac-note.inc          |  1 +
 .../bootstrap/en/includes/overdrive-checkout.inc |  1 +
 .../bootstrap/en/includes/overdrive-login.inc    |  1 +
 .../en/modules/opac-addbybiblionumber.tt         |  3 +++
 .../bootstrap/en/modules/opac-alert-subscribe.tt |  2 ++
 .../opac-tmpl/bootstrap/en/modules/opac-auth.tt  |  1 +
 .../en/modules/opac-authorities-home.tt          |  1 +
 .../bootstrap/en/modules/opac-basket.tt          |  1 +
 .../en/modules/opac-curbside-pickups.tt          |  3 +++
 .../bootstrap/en/modules/opac-detail.tt          |  2 ++
 .../bootstrap/en/modules/opac-downloadcart.tt    |  1 +
 .../bootstrap/en/modules/opac-downloadshelf.tt   |  1 +
 .../bootstrap/en/modules/opac-illrequests.tt     |  3 +++
 .../bootstrap/en/modules/opac-issue-note.tt      |  1 +
 .../opac-tmpl/bootstrap/en/modules/opac-main.tt  |  1 +
 .../bootstrap/en/modules/opac-memberentry.tt     |  1 +
 .../bootstrap/en/modules/opac-messaging.tt       |  1 +
 .../bootstrap/en/modules/opac-passwd.tt          |  2 ++
 .../en/modules/opac-password-recovery.tt         |  2 ++
 .../bootstrap/en/modules/opac-patron-consent.tt  |  1 +
 .../bootstrap/en/modules/opac-privacy.tt         |  4 ++++
 .../bootstrap/en/modules/opac-recall.tt          |  1 +
 .../bootstrap/en/modules/opac-recalls.tt         |  1 +
 .../en/modules/opac-registration-confirmation.tt |  1 +
 .../bootstrap/en/modules/opac-reportproblem.tt   |  1 +
 .../bootstrap/en/modules/opac-request-article.tt |  1 +
 .../bootstrap/en/modules/opac-reserve.tt         |  1 +
 .../bootstrap/en/modules/opac-reset-password.tt  |  1 +
 .../bootstrap/en/modules/opac-review.tt          |  1 +
 .../bootstrap/en/modules/opac-search-history.tt  |  4 ++++
 .../bootstrap/en/modules/opac-sendbasketform.tt  |  1 +
 .../bootstrap/en/modules/opac-sendshelfform.tt   |  1 +
 .../bootstrap/en/modules/opac-serial-issues.tt   |  1 +
 .../bootstrap/en/modules/opac-shelves.tt         | 12 ++++++++++++
 .../bootstrap/en/modules/opac-suggestions.tt     |  2 ++
 .../opac-tmpl/bootstrap/en/modules/opac-tags.tt  |  1 +
 .../bootstrap/en/modules/opac-tags_subject.tt    |  1 +
 .../opac-tmpl/bootstrap/en/modules/opac-user.tt  |  5 +++++
 .../bootstrap/en/modules/sci/sci-main.tt         |  2 ++
 .../bootstrap/en/modules/sco/sco-main.tt         |  9 +++++++++
 307 files changed, 580 insertions(+)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc
index bb7cfddd61a..508aa762d64 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc
@@ -3,6 +3,7 @@
     <div class="tab-content">
         <div id="supplier_search" role="tabpanel" class="tab-pane active">
             <form name="findsupplier" action="/cgi-bin/koha/acqui/booksellers.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label">Vendor search</label>
                 </div>
@@ -16,6 +17,7 @@
 
         <div id="orders_search" role="tabpanel" class="tab-pane">
             <form action="/cgi-bin/koha/acqui/histsearch.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label">Orders search</label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
index 1dfd5955ab3..7060b7ca0e3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
@@ -25,6 +25,7 @@
                 [% UNLESS ( basketcount OR subscriptioncount ) %]
                     <div class="btn-group">
                         <form action="/cgi-bin/koha/acqui/supplier.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete" />
                             <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                             <button class="btn btn-default" id="deletesupplier" type="submit"><i class="fa fa-trash-can"></i> Delete vendor</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc
index 2fd0daaf194..ebce3ac0ced 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc
@@ -6,6 +6,7 @@
     <div class="tab-content">
         <div id="budgets_search" role="tabpanel" class="tab-pane active">
             <form action="/cgi-bin/koha/admin/aqbudgets.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
 
                 <div class="form-title">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search-box.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search-box.inc
index ea1ba961bb5..3d7c727c633 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search-box.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search-box.inc
@@ -6,6 +6,7 @@
         <div id="checkin_search" role="tabpanel" class="tab-pane">
     [% END %]
         <form method="post" action="/cgi-bin/koha/circ/returns.pl" autocomplete="off">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="form-title">
                 <label class="control-label">Check in</label>
             </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc
index 05c888f0559..313fe2b49c9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc
@@ -16,6 +16,7 @@
         </p>
     </div>
     <form name="issues" action="/cgi-bin/koha/tools/export.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <table id="issues-table" style="width: 100% !Important;">
             <thead>
                 <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
index c57dec0bf14..10df4d368c4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
@@ -200,6 +200,7 @@
                 <div id="upload-patron-image" class="patroninfo-section">
                     <h5>Upload patron photo</h5>
                     <form method="post" id="picture-upload" action="/cgi-bin/koha/tools/picture-upload.pl"
+                        [% INCLUDE 'csrf-token.inc' %]
                         enctype="multipart/form-data">
                         [% IF ( patron.image ) %]
                             <div class="hint">
@@ -232,6 +233,7 @@
                 <div id="capture-patron-image" class="patroninfo-section">
                     <h5>Take patron photo</h5>
                     <form method="post" id="camera-upload" action="/cgi-bin/koha/tools/picture-upload.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="btn-toolbar">
                             <div class="btn-group">
                                 <button class="btn btn-default" id="takebutton"><i class="fa fa-camera"></i> Take photo</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc
index a689cc4b803..579394a0d49 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="city_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label">Search cities</label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc
index 2415d09f1bf..0e62288092c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="contract_description_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label">Search contracts</label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc
index c6c70728319..1b1c36189c6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="currency_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label">Search currencies</label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/desks-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/desks-admin-search.inc
index 6c988586d58..513f296949f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/desks-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/desks-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="desk_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name|html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label">Search desks</label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc
index 8112f727309..4956988a35d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="notices_search" role="tabpanel" class="tab-pane active">
             <form action="/cgi-bin/koha/tools/letter.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label">Search notices</label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-share-report.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-share-report.inc
index a181062892d..3ddf2c6fa7e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-share-report.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-share-report.inc
@@ -2,6 +2,7 @@
     <div class="modal-dialog modal-wide" role="document">
         <div class="modal-content">
             <form method="post" id="mana_share_form" action="/cgi-bin/koha/reports/guided_reports.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
                     <h3 id="mana_share_modal_label">Share with Mana</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/member-search-box.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/member-search-box.inc
index 42543b2a1ec..3240574912b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/member-search-box.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/member-search-box.inc
@@ -11,6 +11,7 @@
         <div id="patron_search" role="tabpanel" class="tab-pane">
     [% END %]
         <form method="post" action="/cgi-bin/koha/members/member.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="quicksearch" value="1" />
 
             <div class="form-title">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
index 8e277919a6b..ac3dfc60e54 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
@@ -112,6 +112,7 @@
     <div class="modal-dialog">
         <div class="modal-content">
             <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-header">
                     <h3>Leave a message</h3>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cataloguing_create_av.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cataloguing_create_av.inc
index 06184747407..abdc4b3f978 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cataloguing_create_av.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cataloguing_create_av.inc
@@ -6,6 +6,7 @@
                 <h3 id="avCreateLabel">Create a new authorized value</h3>
             </div>
             <form id="add_new_av" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                     <fieldset class="rows">
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc
index 74e9be3e350..17035f431c5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc
@@ -2,6 +2,7 @@
     <div class="modal-dialog">
         <div class="modal-content">
             <form action="/cgi-bin/koha/serials/serials-collection.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                     <fieldset class="rows">
                         <legend>Multi receiving</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-detail-tabs.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-detail-tabs.inc
index 0d5c4c740ac..0ca2febd824 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-detail-tabs.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-detail-tabs.inc
@@ -138,6 +138,7 @@
             [% WRAPPER tab_panel tabname="holds" %]
                 [% IF ( holds_count ) %]
                     <form action="/cgi-bin/koha/reserve/modrequest.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="from" value="circ" />
                         <table id="holds-table" style="width: 100% !Important;">
                             <thead>
@@ -175,6 +176,7 @@
 
                     [% IF Koha.Preference('SuspendHoldsIntranet') %]
                         <form action="/cgi-bin/koha/reserve/modrequest_suspendall.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="action">
                                 <input type="hidden" name="from" value="[% patronpage | html %]" />
                                 <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
@@ -189,6 +191,7 @@
                         </form>
 
                         <form action="/cgi-bin/koha/reserve/modrequest_suspendall.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="action">
                                 <input type="hidden" name="from" value="borrower" />
                                 <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
index 20a9eaf19cd..bc83ea093ae 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
@@ -47,6 +47,7 @@
 [% IF CAN_user_borrowers_edit_borrowers && CAN_user_circulate_manage_restrictions %]
     <p><a href="#" id="add_manual_restriction"><i class="fa fa-plus"></i> Add manual restriction</a></p>
     <form method="post" action="/cgi-bin/koha/members/mod_debarment.pl" class="clearfix">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
         <input type="hidden" name="action" value="add" />
         <fieldset class="rows" id="manual_restriction_form">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc
index 8211872696c..b99e93a05d8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc
@@ -6,6 +6,7 @@
         <div id="circ_search" role="tabpanel" class="tab-pane">
     [% END %]
         <form action="/cgi-bin/koha/circ/circulation.pl" id="patronsearch" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="form-title">
                 <label class="control-label" for="findborrower">Check out</label>
             </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
index e343f175c3e..605453f0f85 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
@@ -332,6 +332,7 @@
             <div class="modal-dialog">
                 <div class="modal-content">
                     <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="message_id" value="[% pm.message_id | html %]"/>
                         <div class="modal-header">
                             <h3>Edit message</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc
index 0bb3e3c9fbd..c08eba990a2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="patron_category_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label">Search patron categories</label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/renew-search-box.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/renew-search-box.inc
index dd8d9b8c61b..2da27d375f1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/renew-search-box.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/renew-search-box.inc
@@ -6,6 +6,7 @@
         <div id="renew_search" role="tabpanel" class="tab-pane">
     [% END %]
         <form method="post" action="/cgi-bin/koha/circ/renew.pl" autocomplete="off">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="form-title">
                 <label class="control-label">Renew</label>
             </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/waiting_holds.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/waiting_holds.inc
index 484f1d609be..03644ba2b3b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/waiting_holds.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/waiting_holds.inc
@@ -67,6 +67,7 @@
                 <td>[% reserveloo.item.enumchron | html %]</td>
                 <td>
                     <form name="cancelReserve" action="waitingreserves.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="borrowernumber" value="[% reserveloo.borrower.borrowernumber | html %]" />
                         <input type="hidden" name="itemnumber" value="[% reserveloo.item.itemnumber | html %]" />
                         <input type="hidden" name="fbr" value="[% reserveloo.item.holdingbranch | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc
index 952fdab79f4..f5b2a21a717 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="z3950_search" role="tabpanel" class="tab-pane active">
             <form action="/cgi-bin/koha/admin/z3950servers.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label">Search Z39.50/SRU servers</label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt
index 6fa7008a908..a684016f552 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt
@@ -49,6 +49,7 @@
     <fieldset>
         <legend>Manage orders</legend>
         <form name="findsupplier" action="/cgi-bin/koha/acqui/booksellers.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <p><label for="supplierpage">Vendor: </label><input type="text" size="25" name="supplier" id="supplierpage" class="focus" />
             <input type="submit" class="btn btn-primary" value="Search" />
             </p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt
index 90d07cf0ba2..115c891a10a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt
@@ -9,6 +9,7 @@
     <div class="container-fluid">
       [% IF (not_enough_budget) %]
         <form action="/cgi-bin/koha/acqui/addorder.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
           [% FOREACH var IN vars_loop %]
             [% FOREACH val IN var.values %]
               <input type="hidden" name="[% var.name | html %]" value="[% val | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt
index 4440130df66..f850ac7d041 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt
@@ -88,6 +88,7 @@
                         ([% file_name | html %] staged on [% upload_timestamp | $KohaDates  with_hours => 1 %])
                     </h1>
                     <form action="/cgi-bin/koha/acqui/addorderiso2709.pl" method="post" id="Aform" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% WRAPPER tabs id= "tabs" %]
                             [% WRAPPER tabs_nav %]
                                 [% WRAPPER tab_item tabname= "records_to_import" bt_active= 1 %] <span>Select to import</span> [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
index 604d1a2f36f..e5ee22514bc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
@@ -102,6 +102,7 @@
                                         [% IF ( active && books_loop ) %]
                                             <div class="btn-group">
                                                 <form action="/cgi-bin/koha/acqui/basket.pl" method="post">
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="op" value="email" />
                                                     <input type="hidden" name="basketno" value="[% basketno | html %]" />
                                                     <button type="submit" class="btn btn-default" id="emailvendorbutton"><i class="fa-solid fa-envelope"></i> E-mail order</button>
@@ -305,6 +306,7 @@
                                                     <ol>
                                                         <li id="managedby">
                                                             <form action="/cgi-bin/koha/acqui/basket.pl" method="post">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <span class="label">Managed by:</span>
                                                                 <div style="display:inline-block">
                                                                     <ul id="users_names" style="padding-left:0">
@@ -343,6 +345,7 @@
                                                                 <span class="label">&nbsp;</span>
                                                                 <div>
                                                                     <form action="/cgi-bin/koha/acqui/basket.pl" method="post">
+                                                                        [% INCLUDE 'csrf-token.inc' %]
                                                                         <select id="select_managing_library" name="branch">
                                                                             <option value="">(no library)</option>
                                                                             [% FOREACH branch IN branches_loop %]
@@ -402,6 +405,7 @@
                                                                     <span class="label">&nbsp;</span>
                                                                     <div style="float:left">
                                                                         <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="post">
+                                                                            [% INCLUDE 'csrf-token.inc' %]
                                                                             <select id="basketgroupid" name="basketgroupid">
                                                                                 <option value="">No group</option>
                                                                                 [% FOREACH bg IN basketgroups %]
@@ -880,6 +884,7 @@
     <div class="modal" id="noteEditor" tabindex="-1" role="dialog" aria-labelledby="noteEditorLabel">
         <div class="modal-dialog" role="document">
             <form id="modify_order_notes" action="/cgi-bin/koha/acqui/modordernotes.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-content">
                     <div class="modal-header">
                         <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
@@ -904,6 +909,7 @@
     <div class="modal" id="dateEditor" tabindex="-1" role="dialog" aria-labelledby="dateEditorLabel">
         <div class="modal-dialog" role="document">
             <form id="modify_estimated_delivery_date" action="/cgi-bin/koha/acqui/moddeliverydate.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-content">
                     <div class="modal-header">
                         <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt
index 83d998fe581..63947c47478 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt
@@ -202,6 +202,7 @@
                             <div class="col-xs-6 col-xs-pull-6">
                         [% END %]
                             <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="post" id="groupingform" onsubmit="return submitForm(this)">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset id="various" class="brief">
                                     <ol>
                                         [% UNLESS (closedbg) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
index 88dd4cb3545..351dc35e3c8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
@@ -51,6 +51,7 @@
         [% ELSE %]<h1>Add a basket to [% booksellername | html %]</h1>
         [% END %]
     <form name="Aform" action="[% script_name | html %]" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
         <fieldset class="rows">
             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt
index 28171a1bdba..f5c24dd607b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt
@@ -30,6 +30,7 @@
 
       [% UNLESS ( confirmcancel ) %]
       <form method="post" action="">
+          [% INCLUDE 'csrf-token.inc' %]
         <div class="dialog alert">
           <h1>Are you sure you want to cancel this order ([% ordernumber | html %])</h1>
           <p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt
index 4e6faad480d..68f7b887415 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt
@@ -51,6 +51,7 @@ Acquisitions &rsaquo; Koha
 
 [% IF op == 'search' || op == 'select' %]
 <form action="/cgi-bin/koha/acqui/duplicate_orders.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
         <legend>
             [% IF op == 'search' %]
@@ -133,6 +134,7 @@ Acquisitions &rsaquo; Koha
 
 [% IF op == 'select' && ( result_order_loop || selected_order_loop ) %]
 <form method="post" action="/cgi-bin/koha/acqui/duplicate_orders.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     <div id="orders_to_copy" class="page-section">
         <table id="table_orders">
             <caption>
@@ -180,6 +182,7 @@ Acquisitions &rsaquo; Koha
 [% ELSIF op == "batch_edit" %]
 
 <form method="post" action="/cgi-bin/koha/acqui/duplicate_orders.pl" id="batch_edit_form">
+    [% INCLUDE 'csrf-token.inc' %]
     <div id="accounting_details">
       <p>Duplicate all the orders with the following accounting details:</p>
       <fieldset class="rows" style="float:none;">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt
index 83947d7345b..e7ac7819c72 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt
@@ -192,6 +192,7 @@
 
 [% BLOCK filter_form %]
     <form action="/cgi-bin/koha/acqui/histsearch.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         [% IF ( context == "sidebar" ) %]
             <fieldset class="brief">
                 <h4>Search orders</h4>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
index c86109b3264..c2a7520fe59 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
@@ -81,6 +81,7 @@
       [% IF invoiceid %]
           <br />
           <form method="post" action="/cgi-bin/koha/acqui/invoice-files.pl" enctype="multipart/form-data">
+              [% INCLUDE 'csrf-token.inc' %]
               <fieldset class="rows">
                   <legend>Upload new file</legend>
                   <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
index 20130ae0a7b..b7892ff8614 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
@@ -58,6 +58,7 @@
                 <p>Vendor: <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | uri %]">[% suppliername | html %]</a></p>
 
                 <form action="/cgi-bin/koha/acqui/invoice.pl" method="post" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <ol>
                             <li>
@@ -143,6 +144,7 @@
                 </form>
 
                 <form action="/cgi-bin/koha/acqui/invoice.pl" method="post" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <input type="hidden" name="invoiceid" value="[% invoiceid | html %]" />
                         <h3>Adjustments</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
index 74b9f8d0461..82c5f9552c7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
@@ -163,6 +163,7 @@
 
                         <div id="merge_invoices">
                             <form id="merge_invoice_form" class="validated" action="/cgi-bin/koha/acqui/invoice.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="rows">
                                     <ol>
                                         <li><h2>Merge invoices</h2></li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
index 2de9b35463f..82749957b4a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
@@ -48,6 +48,7 @@
 [% END %]
 [% IF lateorders.size %]
 <form action="lateorders.pl" name="claim" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="send_alert" />
   <input type="hidden" name="delay" value="[% delay | html %]" />
   <input type="hidden" name="booksellerid" value="[% bookseller_filter.id | html %]" />
@@ -272,6 +273,7 @@
 <div class="modal" id="noteEditor" tabindex="-1" role="dialog" aria-labelledby="noteEditorLabel">
     <div class="modal-dialog" role="document">
         <form id="modify_order_notes" action="/cgi-bin/koha/acqui/modordernotes.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="modal-content">
                 <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
@@ -296,6 +298,7 @@
 <div class="modal" id="dateEditor" tabindex="-1" role="dialog" aria-labelledby="dateEditorLabel">
     <div class="modal-dialog" role="document">
         <form id="modify_estimated_delivery_date" action="/cgi-bin/koha/acqui/moddeliverydate.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="modal-content">
                 <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/moddeliverydate.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/moddeliverydate.tt
index 812e28b1bb9..09f26423a68 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/moddeliverydate.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/moddeliverydate.tt
@@ -32,6 +32,7 @@
 
       <h1>Change estimated delivery date</h1>
       <form action="/cgi-bin/koha/acqui/moddeliverydate.pl" method="post">
+          [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="brief">
           <label for="estimated_delivery_date">Estimated delivery date:</label>
           <input type="text" id="estimated_delivery_date" size="10" name="estimated_delivery_date" class="flatpickr" value="[% estimated_delivery_date | html %]"/>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt
index 6feb14b9a65..0693f625b5e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt
@@ -43,6 +43,7 @@
           <h1>Change order internal note (order no. [% ordernumber | html %])</h1>
       [% END %]
       <form action="/cgi-bin/koha/acqui/modordernotes.pl" method="post">
+          [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="brief">
           <label for="ordernotes">Note:</label>
           <textarea id="ordernotes" name="ordernotes" rows="3" cols="30" class="focus">[% ordernotes | html %]</textarea>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
index effff82f58b..a529187ed35 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
@@ -281,6 +281,7 @@
         [% IF ( creationdate ) %]<li><span class="label">Open on:</span>  [% creationdate | $KohaDates %]</li>[% END %]
         [% IF ( closedate ) %]
         <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
         <li><span class="label">Closed on:</span>  [% closedate | $KohaDates %]</li>
         [% IF ( basketgroups ) %]
             <li>Basketgroup: <select id="basketgroupid" name="basketgroupid">
@@ -306,6 +307,7 @@
 [% END %]
 
 <form action="/cgi-bin/koha/acqui/addorder.pl" method="post" class="validated noEnterSubmit" id="Aform" onsubmit="return Check(this);" >
+    [% INCLUDE 'csrf-token.inc' %]
 
     <fieldset class="rows">
         <legend>Patrons</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
index 9141921d55f..cd61d2a4175 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
@@ -145,6 +145,7 @@ div.rows { padding: 1rem; }
 [% UNLESS ( enter ) %][% INCLUDE 'acquisitions-toolbar.inc' %][% END %]
 [% IF ( enter ) %]
     <form action="updatesupplier.pl" name="updatesupplier" style="display:block" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <div id="toolbar" class="btn-toolbar">
             <button class="btn btn-primary" type="submit"><i class="fa fa-save"></i> Save</button>
             [% IF ( booksellerid ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt
index c3e29e714ad..42142919105 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt
@@ -80,6 +80,7 @@
         <div class="page-section">
             <h2>Order lines with uncertain prices</h2>
             <form action="[% scriptname | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                 <label for="owner">Orders from:</label>
                 <select id="owner" name="owner">
@@ -95,6 +96,7 @@
             </form>
         </div> <!-- /.page-section -->
         <form action="[% scriptname | html %]" method="post" id="uncertainprices">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                 <input type="hidden" name="op" value="validate" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt
index 0a9de738a76..09333b4492b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt
@@ -92,6 +92,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/acqui/vendor_issues.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="booksellerid" value="[% vendor.id | html %]" />
         <input type="hidden" name="issue_id" value="[% issue.issue_id| html %]" />
@@ -133,6 +134,7 @@
     <div class="dialog alert">
         <h1>Delete issue #[% issue.issue_id | html %]?<h1>
         <form action="/cgi-bin/koha/acqui/vendor_issues.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="issue_id" value="[% issue.issue_id | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt
index 2c2aafc83d6..eb8a317a88c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt
@@ -73,6 +73,7 @@ tr.selected td {
 <div class="main container-fluid">
       [% IF ( opsearch ) %]
     <form method="post" action="z3950_search.pl" name="f" class="checkboxed">
+        [% INCLUDE 'csrf-token.inc' %]
     <div class="row">
     <div class="col-sm-6">
     <h1>Order from external source</h1>
@@ -237,6 +238,7 @@ tr.selected td {
     </div>
 
     <form method="post" action="z3950_search.pl" id="page_form" name="page_form" class="checkboxed">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" id="op" value="do_search" />
         <input type="hidden" name="current_page" id="current_page" value="[% current_page | html %]" />
         <input type="hidden" id="searchtitle"  name="title" value="[% title | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
index 9182a16b8b9..defbea04b27 100755
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
@@ -179,6 +179,7 @@
             <h1>Add field</h1>
         [% END %]
         <form action="" name="add_form" id="add_field" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <ol>
                     <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
index 47b2142fea0..9cc1b317279 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
@@ -53,6 +53,7 @@
             <div class="col-md-6 sysprefs">
             [% IF ( CAN_user_parameters_manage_sysprefs ) %]
                 <form action="/cgi-bin/koha/admin/preferences.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                 <fieldset>
                     <h4><a href="/cgi-bin/koha/admin/preferences.pl">System preferences</a></h4>
                     <p>Manage system preferences like MARC flavor, date format, administrator email, and templates.</p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/adveditorshortcuts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/adveditorshortcuts.tt
index 85784a2e848..c5475ed7575 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/adveditorshortcuts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/adveditorshortcuts.tt
@@ -39,6 +39,7 @@
                     </ul>
 
                     <form id="adveditor_shortcuts" method="post" action="/cgi-bin/koha/admin/adveditorshortcuts.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset>
                         <input type=hidden name="op" value="save" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt
index bfc45230b90..66e71622307 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt
@@ -148,6 +148,7 @@
 [% IF ( duplicate_form ) %]
 <h1>Duplicate budget</h1>
 <form action="/cgi-bin/koha/admin/aqbudgetperiods.pl" id="add_modify_budget" name="f" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <input type="hidden" name="op" value="duplicate_budget" />
     <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
@@ -217,6 +218,7 @@
         <h1>Add budget</h1>
 	[% END %]
 <form action="/cgi-bin/koha/admin/aqbudgetperiods.pl" id="add_modify_budget" name="f" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <!-- ################################################################################# -->
     <!-- display information about the budget period that must be added or modified -->
@@ -309,11 +311,13 @@
     <!-- ############################################################# -->
 
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="delete_confirmed" />
         <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
         <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
     </form>
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not delete</button>
     </form>
     [% END %]
@@ -355,6 +359,7 @@
           </tbody>
         </table>
         <form action="/cgi-bin/koha/admin/aqbudgetperiods.pl" name="f" method="post" id="move_form">
+            [% INCLUDE 'csrf-token.inc' %]
           <fieldset class="rows">
             <ol>
               <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt
index 23e84e043e9..391417b8122 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt
@@ -234,6 +234,7 @@
 <!-- create add/mod entry form -->
 [% IF op == 'add_form' && !error_not_authorised_to_modify %]
 <form action="/cgi-bin/koha/admin/aqbudgets.pl" id="edit_fund" name="Aform" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
         <legend><h1>[% IF ( budget_id ) %]<span>Modify fund</span>[% ELSE %]<span>Add fund</span>[% END %]
     [% IF ( budget_period_description ) %]
@@ -414,6 +415,7 @@
         </table>
 
         <form action="/cgi-bin/koha/admin/aqbudgets.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="budget_id" value="[% budget_id | html %]" />
             <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt
index 8a2979a421c..42376e4d5f3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt
@@ -87,6 +87,7 @@
             [% IF ( add_form ) %]
                 <div class="page-section">
                     <form name="Aform" action="/cgi-bin/koha/admin/aqcontract.pl" id="add_modify_contract" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_validate" />
                         <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                         <input type="hidden" name="checked" value="0" />
@@ -131,6 +132,7 @@
             [% IF ( add_validate ) %]
                 <h1>Data recorded</h1>
                 <form action="[% script_name | html %]" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="submit" class="btn btn-primary" value="OK" />
                 </form>
             [% END %]
@@ -146,6 +148,7 @@
                             <tr><th scope="row">Vendor:</th><td>[% booksellername | html %]</td></tr>
                         </table>
                         <form action="[% script_name | html %]" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_confirmed" />
                             <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                             <input type="hidden" name="contractnumber" value="[% contractnumber | html %]" />
@@ -161,6 +164,7 @@
             [% IF ( delete_confirmed ) %]
                 <h1>Contract deleted</h1>
                 <form action="[% script_name | html %]" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                     <input type="submit" class="btn btn-primary" value="OK" />
                 </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt
index 22a1eca1006..e1841d2df2d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt
@@ -39,6 +39,7 @@
 [% INCLUDE 'budgets-admin-toolbar.inc' %]
 
 <form method="post" id="Aform" name="Aform"  action="/cgi-bin/koha/admin/aqplan.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <h1>Planning for [% budget_period_description | html %] [% PROCESS planning plan=authcat %]</h1>
 <input type="hidden" name="authcat" value="[% authcat | html %]" />
 <!-- Budget Lines -->
@@ -195,6 +196,7 @@
             <aside>
 
 <form method="post" action="/cgi-bin/koha/admin/aqplan.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
 <fieldset class="brief">
 <h4>Filter</h4>
@@ -255,6 +257,7 @@
 </form>
 [% IF ( budget_lines ) %]
 <form method="post" action="/cgi-bin/koha/admin/aqplan.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="brief">
 <h4>Export</h4>
     <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt
index 3638e29e627..1d4fdb4c225 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt
@@ -33,6 +33,7 @@
                 </div>
 
                 <form id="new-alert-form" action="audio_alerts.pl" method="post" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <legend><h1><span class="create-alert">Add new alert</span><span class="edit-alert">Edit alert</span></h1></legend>
 
@@ -82,6 +83,7 @@
                 </form>
 
                 <form id="delete-alert-form" action="audio_alerts.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <h1>Audio alerts</h1>
                     [%IF !( Koha.Preference('AudioAlerts') ) %]
                         <div class="dialog alert">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt
index ec758d69d69..96893c5512e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt
@@ -77,6 +77,7 @@
     [% ELSE %][% action | html %][% END %]</h1>
     <div class="hint">You can drag and drop the subfield tabs to change the order.</div>
     <form action="[% script_name | html %]" name="Aform" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
         <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
@@ -279,6 +280,7 @@
     <div class="dialog alert">
         <h1>Delete subfield <span class="ex">'[% ass.tagsubfield | html %]'?</span></h1>
         <form action="[% delete_link | html %]" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <table>
                 <tr><th scope="row">Subfield:</th> <td>[% ass.tagsubfield | html %]</td></tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
index 78e4cdc20de..8a991403a5c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
@@ -129,6 +129,7 @@ Authority MARC framework &rsaquo; Administration &rsaquo; Koha
         [% END %]
     </h2>
     <form action="[% script_name | html %]" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         [% IF ( heading_modify_tag_p ) %]<input type="hidden" name="modif" value="1" />[% END %]
         <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
@@ -184,6 +185,7 @@ Authority MARC framework &rsaquo; Administration &rsaquo; Koha
     <div class="dialog alert">
         <h3>Confirm deletion</h3>
         <form action="[% script_name | html %]" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <table>
                 <tr><th scope="row">Tag: </th><td>[% searchfield | html %] [% liblibrarian | html %]</td></tr>
             </table>
@@ -202,6 +204,7 @@ Authority MARC framework &rsaquo; Administration &rsaquo; Koha
 
   <div class="dialog message">  <h3>Data deleted</h3>
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
     <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
     <input type="submit" value="OK" class="btn btn-primary" />
@@ -210,6 +213,7 @@ Authority MARC framework &rsaquo; Administration &rsaquo; Koha
 [% IF ( authtype_create ) %]
 
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="authtype_create_confirm" />
         <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
         Create authority framework for [% authtypecode | html %] using
@@ -235,6 +239,7 @@ Authority MARC framework &rsaquo; Administration &rsaquo; Koha
 
 <h2>Select an authority framework</h2>
 <form action="[% script_name | html %]" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <select name="authtypecode">
     [% FOREACH authority_type IN authority_types%]
         [% IF authority_type.authtypecode == authtypecode%]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
index b7e58a28d6c..8abb4bf3f56 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
@@ -110,6 +110,7 @@
                     [% END %]
 
                     <form action="/cgi-bin/koha/admin/authorised_values.pl" name="Aform" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             [% IF action_add_category %]
                                 <ol>
@@ -298,6 +299,7 @@
                                 </form>
                                 [% UNLESS category.is_system %]
                                     <form id="delete_category" action="/cgi-bin/koha/admin/authorised_values.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="op" value="delete_category" />
                                         <input type="hidden" name="category_name" value="[% category.category_name | html %]" />
                                         <button type="submit"><i class="fa fa-plus"></i> Delete category '[% category.category_name | html %]' </button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt
index 0b7e8ae57fa..2ae342aeb7f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt
@@ -84,6 +84,7 @@ Authority types &rsaquo; Administration &rsaquo; Koha
 
 [% IF op == 'add_form' %]
     <form action="/cgi-bin/koha/admin/authtypes.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <legend>
                 <h1>
@@ -144,6 +145,7 @@ Authority types &rsaquo; Administration &rsaquo; Koha
         [% ELSE %]
             <h1>Confirm deletion of authority structure definition for <span class="ex">'[% authority_type.authtypetext | html %]' ([% authority_type.authtypecode | html %])</span></h1>
             <form action="/cgi-bin/koha/admin/authtypes.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <input type="hidden" name="authtypecode" value="[% authority_type.authtypecode | html %]" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
@@ -230,6 +232,7 @@ Authority types &rsaquo; Administration &rsaquo; Koha
                                     <h3 id="importLabelexportModal_[% authority_type.authtypecode | html %][% loop.count | html %]">Import [% authority_type.authtypecode | html %] authority type (fields and subfields) from a spreadsheet file (.csv, .ods)</h3>
                                 </div>
                                 <form action="/cgi-bin/koha/admin/import_export_authtype.pl" name="form_i_[% authority_type.authtypecode | html %]" id="form_i_[% authority_type.authtypecode | html %]" method="post" enctype="multipart/form-data" class="form_import">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <div class="modal-body">
                                         <input type="hidden" name="authtypecode" value="[% authority_type.authtypecode | html %]" />
                                         <input type="hidden" name="action" value="import" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
index 5ba2841c411..cd81881d102 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
@@ -95,6 +95,7 @@ MARC frameworks &rsaquo; Administration &rsaquo; Koha
 [% IF op == 'add_form' %]
     <h1>[% IF framework %]Modify framework text[% ELSE %]Add framework[% END %]</h1>
     <form action="/cgi-bin/koha/admin/biblio_framework.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <fieldset class="rows">
             <ol>
@@ -136,6 +137,7 @@ MARC frameworks &rsaquo; Administration &rsaquo; Koha
         [% ELSE %]
             <h1>Delete framework for [% framework.frameworktext | html %] ([% framework.frameworkcode | html %])?</h1>
             <form class="inline" action="/cgi-bin/koha/admin/biblio_framework.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this framework</button>
@@ -209,6 +211,7 @@ MARC frameworks &rsaquo; Administration &rsaquo; Koha
                         <h1 id="importLabelexportModal_[% framework.frameworkcode | html %][% frameworks.count | html %]">Import default framework structure (fields and subfields) from a spreadsheet file (.csv or .ods)</h1>
                     </div> <!-- /.modal-header -->
                     <form action="/cgi-bin/koha/admin/import_export_framework.pl" name="form_i_default" id="form_i_default" method="post" enctype="multipart/form-data" class="form_import">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="modal-body">
                             <input type="hidden" name="frameworkcode" value="default" />
                             <input type="hidden" name="action" value="import" />
@@ -279,6 +282,7 @@ MARC frameworks &rsaquo; Administration &rsaquo; Koha
                             <h1 id="importLabelexportModal_[% loo.frameworkcode | html %][% loop.count | html %]">Import [% loo.frameworkcode | html %] framework structure (fields and subfields) from a spreadsheet file (.csv or .ods)</h1>
                         </div> <!-- /.modal-header -->
                         <form action="/cgi-bin/koha/admin/import_export_framework.pl" name="form_i_[% loo.frameworkcode | html %]" id="form_i_[% loo.frameworkcode | html %]" method="post" enctype="multipart/form-data" class="form_import">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <div class="modal-body">
                                 <input type="hidden" name="frameworkcode" value="[% loo.frameworkcode | html %]" />
                                 <input type="hidden" name="action" value="import" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt
index 2ac8d5467e2..e47bd4497eb 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt
@@ -57,6 +57,7 @@
     [% END %]
 
     <form method="post" action="branch_transfer_limits.pl">
+        [% INCLUDE 'csrf-token.inc' %]
         [% WRAPPER tab_panels %]
             [% FOREACH codes_loo IN codes_loop %]
                 [% WRAPPER tab_panel tabname=codes_loo.code %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
index a413c4c0654..b4fb0d35af3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
@@ -113,6 +113,7 @@ Libraries &rsaquo; Administration &rsaquo; Koha
 [% IF op == 'add_form' %]
     <h1>[% IF library %]Modify library[% ELSE %]New library[% END %]</h1>
     <form action="/cgi-bin/koha/admin/branches.pl" id="Aform" name="Aform" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <input type="hidden" name="op" value="add_validate" />
             [% IF library %]
@@ -287,6 +288,7 @@ Libraries &rsaquo; Administration &rsaquo; Koha
 [% IF op == 'delete_confirm' and not ( items_count or patrons_count )%]
     <div class="dialog alert">
         <form action="/cgi-bin/koha/admin/branches.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <h1>Are you sure you want to delete [% library.branchname | html %] ([% library.branchcode | html %])?</h1>
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="branchcode" value="[% library.branchcode | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt
index 41bdd3b63ee..ae6ad9a00e3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt
@@ -91,6 +91,7 @@ Cash registers &rsaquo; Administration &rsaquo; Koha
                 [% IF op == 'add_form' %]
                 <h1>[% IF cash_register %]Modify cash register[% ELSE %]Add new cash register[% END %]</h1>
                 <form action="/cgi-bin/koha/admin/cash_registers.pl" id="Aform" name="Aform" class="validated" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
 
                     <fieldset class="rows">
                         <input type="hidden" name="op" value="add_validate" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
index a1d49cadc77..aa4f1700b97 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
@@ -113,6 +113,7 @@
 
 [% IF op == 'add_form' %]
     <form id="category_form" action="/cgi-bin/koha/admin/categories.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="checked" value="0" />
         [% IF category %]
@@ -436,6 +437,7 @@
 
 [% IF op == 'delete_confirm' %]
     <form action="/cgi-bin/koha/admin/categories.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset>
             <legend>
                 <h1>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
index d3759067448..f4ab7705f20 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
@@ -97,6 +97,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/admin/cities.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="cityid" value="[% city.cityid | html %]" />
 
@@ -152,6 +153,7 @@
             </tr>
         </table>
         <form action="/cgi-bin/koha/admin/cities.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="cityid" value="[% city.cityid | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt
index 814d52c3d3c..fa4ed65e368 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt
@@ -142,6 +142,7 @@ Classification sources &rsaquo; Administration &rsaquo; Koha
 <h1>Add classification source</h1>
   [% END %]
 <form action="[% script_name | html %]" name="Aform" class="validated" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="add_source_validate" />
   <fieldset class="rows">
     <ol>
@@ -206,6 +207,7 @@ Classification sources &rsaquo; Administration &rsaquo; Koha
 <h1>Add filing rule</h1>
   [% END %]
 <form action="[% script_name | html %]" name="Aform" class="validated" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="add_sort_rule_validate" />
   <fieldset class="rows">
     <ol>
@@ -252,6 +254,7 @@ Classification sources &rsaquo; Administration &rsaquo; Koha
 <h1>Add splitting rule</h1>
   [% END %]
 <form action="[% script_name | html %]" name="Aform" class="validated" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="add_split_rule_validate" />
   <fieldset class="rows">
     <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/clone-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/clone-rules.tt
index 909ff774e37..fc9245ff0ec 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/clone-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/clone-rules.tt
@@ -46,6 +46,7 @@
 
     <p class="help">Use carefully! If the destination library already has circulation and fine rules, they will be deleted without warning!</p>
     <form action="/cgi-bin/koha/admin/clone-rules.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         [% UNLESS ( frombranch ) %]
             <fieldset>
                 <legend>Please choose a library to clone rules from:</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt
index 149f46b6994..5fd0a65c357 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt
@@ -12,6 +12,7 @@
     [% END %]
     <div class="pagelist">
         <form method="post" action="/cgi-bin/koha/admin/columns_settings.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="action" value="save" />
             <input type="hidden" name="module" value="[% modulename | html %]" />
             [% IF module.keys and module.keys.size > 0 %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt
index df2de27ae3c..07f0974dd95 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt
@@ -80,6 +80,7 @@
                     [% END %]
 
                     <form action="/cgi-bin/koha/admin/credit_types.pl" name="Aform" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_validate" />
                         <fieldset class="rows">
                             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt
index 4992ab64917..8fc35e28504 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt
@@ -61,6 +61,7 @@
         <div class="dialog message">The [% pref_CurbsidePickup_link | $raw | $KohaSpan %] preference is not enabled, do not forget to enable it to turn the feature on.</div>
     [% END %]
     <form method="post" class="form">
+        [% INCLUDE 'csrf-token.inc' %]
         <div id="curbside_pickup_tabs" class="toptabs">
             <ul class="nav nav-tabs" role="tablist">
                 [% FOREACH l IN libraries %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt
index 188fd333f51..1f76ae6c63c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt
@@ -86,6 +86,7 @@
 [% IF op == 'add_form' %]
 
 <form action="/cgi-bin/koha/admin/currency.pl" name="Aform" method="post" class="validated">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="op" value="add_validate" />
     <fieldset class="rows">
         <legend>
@@ -164,6 +165,7 @@
             <span>Deletion not possible</span>
         </p>
         <form action="/cgi-bin/koha/admin/currency.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
         </form>
     </div>
@@ -179,11 +181,13 @@
             </tr>
         </table>
         <form action="/cgi-bin/koha/admin/currency.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="currency_code" value="[% currency.currency | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this currency</button>
         </form>
         <form action="/cgi-bin/koha/admin/currency.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not delete</button>
         </form>
     </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt
index 1ce38e82dbf..baa9663ace7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt
@@ -78,6 +78,7 @@
                     [% END %]
 
                     <form action="/cgi-bin/koha/admin/debit_types.pl" name="Aform" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_validate" />
                         <fieldset class="rows">
                             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt
index 9b1e7d4bc09..4fb605f2b58 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt
@@ -93,6 +93,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/admin/desks.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="desk_id" value="[% desk.desk_id | html %]" />
 
@@ -149,6 +150,7 @@
             </tr>
         </table>
         <form action="/cgi-bin/koha/admin/desks.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="desk_id" value="[% desk.desk_id | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt
index ae0b86856e6..fc0b4de9286 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt
@@ -62,6 +62,7 @@
             plugins that you want to use.
         </div>
         <form action="/cgi-bin/koha/admin/didyoumean.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset id="didyoumeanopac">
                 <legend>OPAC</legend>
                 [% PROCESS pluginlist plugins=OPACpluginlist type='opac' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt
index f7eec4f203d..e1e476664c3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt
@@ -80,6 +80,7 @@ EDI accounts &rsaquo; Administration &rsaquo; Koha
 
 [% IF acct_form %]
 <form action="/cgi-bin/koha/admin/edi_accounts.pl" name="Actform" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="save" />
   [% IF account %]
   <input type="hidden" name="id" value="[% account.id | html %]" />
@@ -277,6 +278,7 @@ EDI accounts &rsaquo; Administration &rsaquo; Koha
     </tr>
 </table>
 <form action="/cgi-bin/koha/admin/edi_accounts.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <table>
     </table>
     <input type="hidden" name="op" value="delete_confirmed" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt
index f7be9830ace..04da598c91a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt
@@ -70,6 +70,7 @@ Library EANs &rsaquo; Administration &rsaquo; Koha
 
 [% IF ean_form %]
 <form action="/cgi-bin/koha/admin/edi_ean_accounts.pl" name="Eanform" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="save" />
   [% IF ean %]
       <input type="hidden" name="oldbranchcode" value="[% ean.branch.branchcode | html %]" />
@@ -139,6 +140,7 @@ Library EANs &rsaquo; Administration &rsaquo; Koha
 <div class="dialog alert">
 <h1>Delete EAN [% ean.ean | html %] for [% ean.branch.branchname | html %]?</h1>
 <form action="/cgi-bin/koha/admin/edi_ean_accounts.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="op" value="delete_confirmed" />
     <input type="hidden" name="id" value="[% ean.id | html %]" />
     <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt
index 40a28f90284..d491db98c1d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt
@@ -81,6 +81,7 @@
     <h1>New email domain</h1>
     <div class="page-section">
         <form action="/cgi-bin/koha/admin/identity_providers.pl" id="add" name="add" class="validated" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="add" />
             <input type="hidden" name="domain_ops" value="1" />
             <input type="hidden" name="identity_provider_id" value="[%- identity_provider_id | html -%]" />
@@ -162,6 +163,7 @@
     <h1>Edit identity provider domain</h1>
     <div class="page-section">
         <form action="/cgi-bin/koha/admin/identity_providers.pl" id="edit_save" name="edit_save" class="validated" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="edit_save" />
             <input type="hidden" name="domain_ops" value="1" />
             <input type="hidden" name="identity_provider_id" value="[%- identity_provider_id | html -%]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt
index 86d32fce320..0d4a50c619f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt
@@ -78,6 +78,7 @@
     <h1>New identity provider</h1>
     <div class="page-section">
         <form action="/cgi-bin/koha/admin/identity_providers.pl" id="add" name="add" class="validated" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="add" />
             <fieldset class="rows">
                 <legend id="identity_provider_basic">Basic configuration</legend>
@@ -232,6 +233,7 @@
     <h1>Edit identity provider</h1>
     <div class="page-section">
         <form action="/cgi-bin/koha/admin/identity_providers.pl" id="edit_save" name="edit_save" class="validated" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="edit_save" />
             <input type="hidden" name="identity_provider_id" value="[%- identity_provider.identity_provider_id | html -%]" />
             <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt
index 1f9d8f19fdb..79ef78f9cba 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt
@@ -42,6 +42,7 @@
                     <h1>Item search field: [% field.label | html %]</h1>
 
                     <form action="/cgi-bin/koha/admin/items_search_field.pl" method="POST" id="edit_search_fields">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                         <legend>Edit field</legend>
                         [% INCLUDE 'admin-items-search-field-form.inc' field=field %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt
index 467d78389d9..45bd4989ccc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt
@@ -104,6 +104,7 @@
                     [% END %]
 
                     <form id="add_field_form" action="/cgi-bin/koha/admin/items_search_fields.pl" method="POST">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <legend><h1>Add a new field</h1></legend>
                             [% INCLUDE 'admin-items-search-field-form.inc' field=undef %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
index 98cfc84e221..af5992bcfdc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
@@ -143,6 +143,7 @@ Item types &rsaquo; Administration &rsaquo; Koha
         <h1>Add item type</h1>
     [% END %]
     <form action="/cgi-bin/koha/admin/itemtypes.pl" name="Aform" method="post" id="itemtypeentry">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <fieldset class="rows">
             <ol>
@@ -367,10 +368,12 @@ Item types &rsaquo; Administration &rsaquo; Koha
             <tr><th scope="row">Rental charge</th><td>[% itemtype.rentalcharge | $Price %]</td></tr>
         </table>
         <form action="/cgi-bin/koha/admin/itemtypes.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" /><input type="hidden" name="itemtype" value="[% itemtype.itemtype | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this item type</button>
         </form>
         <form action="/cgi-bin/koha/admin/itemtypes.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not delete</button>
         </form>
     </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt
index 2dc64b08646..c9539a8c1ca 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt
@@ -31,6 +31,7 @@
 <br/>
 <div class="dialog message">If you make any change to the mappings, you must ask your administrator to run misc/batchRebuildBiblioTables.pl.</div>
 <form action="/cgi-bin/koha/admin/koha2marclinks.pl" method="post" id="koha2marc">
+    [% INCLUDE 'csrf-token.inc' %]
 
 [% IF error_add %]
     <div class="dialog alert">Failed to add mapping for [% error_info | html %]</div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
index 88ffd25b4ed..24e506ed4c4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
@@ -13,6 +13,7 @@
             <div class="col-sm-12">
                 <h1>Localization</h1>
 <form id="add_translation" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="entity" value="[% entity | html %]" />
     <input type="hidden" name="code" value="[% code | html %]" />
     <input type="hidden" name="interface" value="[% interface_side | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt
index 8b7a1bc813e..2cb71b224e6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt
@@ -73,6 +73,7 @@
 
                 <div class="page-section">
                 <form action="/cgi-bin/koha/admin/marc-overlay-rules.pl" method="POST" id="marc-overlay-rules-form">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <table id="marc-overlay-rules">
                         <thead><tr>
                             <th>Rule</th>
@@ -254,6 +255,7 @@
                 </div> <!-- /.page-section -->
 
                 <form action="/cgi-bin/koha/admin/marc-overlay-rules.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="redo-matching" />
                 </form>
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
index f501abef6c8..b68797a984d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
@@ -111,6 +111,7 @@
                         <div class="hint">You can drag and drop the subfield tabs to change the order.</div>
 
                         <form action="[% script_name | html %]" name="Aform" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="add_validate" />
                             <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
                             <input type="hidden" name="frameworkcode" value="[% frameworkcode | html %]" />
@@ -345,6 +346,7 @@
                             <p>Description: [% mss.liblibrarian | html_entity %]</p>
 
                             <form action="[% delete_link | html %]" method="post"><input type="hidden" name="op" value="delete_confirmed" />
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="tagfield" value="[% mss.tagfield | html %]" />
                                 <input type="hidden" name="tagsubfield" value="[% mss.tagsubfield | html %]" />
                                 <input type="hidden" name="frameworkcode" value="[% mss.frameworkcode | html %]" />
@@ -353,6 +355,7 @@
 
 
                             <form action="[% script_name | html %]" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="tagfield" value="[% mss.tagfield | html %]" />
                                 <input type="hidden" name="tagsubfield" value="[% mss.tagsubfield | html %]" />
                                 <input type="hidden" name="frameworkcode" value="[% mss.frameworkcode | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt
index 89b5775e077..0c7e61ec464 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt
@@ -112,6 +112,7 @@ MARC frameworks &rsaquo; Administration &rsaquo; Koha
 [% IF ( add_form ) %]
 
     <form action="[% script_name | html %]" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
 
       <fieldset class="rows">
             <legend>
@@ -185,6 +186,7 @@ MARC frameworks &rsaquo; Administration &rsaquo; Koha
         <p>Tag: [% searchfield | html %]</p>
         <p>Description: [% liblibrarian | html %]</p>
         <form action="[% script_name | html %]" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
             <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
@@ -200,12 +202,14 @@ MARC frameworks &rsaquo; Administration &rsaquo; Koha
 
     <div class="dialog message"><h3>Tag deleted</h3>
     <form action="[% script_name | html %]" method="post"><input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
+        [% INCLUDE 'csrf-token.inc' %]
         <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
     </form></div>
 [% END %]
 [% IF ( framework_create ) %]
 
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="framework_create_confirm" />
         <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
         Create framework for [% framework.frameworkcode | html %] ([% framework.frameworktext | html %]) using
@@ -222,6 +226,7 @@ MARC frameworks &rsaquo; Administration &rsaquo; Koha
 
 [% IF ( else ) %]
 <form name="f" action="[% script_name | html %]" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset style="padding:.5em;">
         <label for="tag_search"><strong>Search for tag:</strong> </label>
         <input type="text" name="searchfield" id="tag_search" size="4" value="[% searchfield | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt
index 1e57883c1f0..31ef1677b1b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt
@@ -109,6 +109,7 @@
                         <h1>Add record matching rule</h1>
                     [% END %]
                     <form action="[% script_name | html %]" name="Aform" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="[% confirm_op | html %]" />
                         <fieldset class="rows">
                             <ol>
@@ -419,6 +420,7 @@
                     <div class="dialog alert">
                         <h1>Confirm deletion of record matching rule <span class="ex">'[% code | html %]' ([% description | html %])</span>?</h1>
                         <form action="[% script_name | html %]" name="Aform" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="[% confirm_op | html %]" />
                             <input type="hidden" name="matcher_id" value="[% matcher_id | html %]" />
                             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete record matching rule</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
index 140e834befe..f6b6c850f8c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
@@ -43,6 +43,7 @@
 
         <div class="page-section">
             <form action="/cgi-bin/koha/admin/oai_set_mappings.pl" method="post" id="mappingform">
+                [% INCLUDE 'csrf-token.inc' %]
                 <table id="mappings">
                     <thead>
                         <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
index 82724949bfe..937aa899919 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
@@ -52,6 +52,7 @@
 
         [% IF ( op_new || op_mod ) %]
             <form method="post" action="/cgi-bin/koha/admin/oai_sets.pl" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
             [% IF ( op_new ) %]
                 <h1>Add a new OAI set</h1>
                 <input type="hidden" name="op" value="savenew" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt
index 73f7c7e214c..1c1a8861c00 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt
@@ -33,6 +33,7 @@
                 <h1>OverDrive library authnames</h1>
 
                 <form action="/cgi-bin/koha/admin/overdrive.pl" name="overdrive_form" method="post" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="update" />
                     <fieldset>
                         <table id="od_info">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
index c7d2afb18cd..1d1dcf2d3ae 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
@@ -81,6 +81,7 @@ Patron attribute types &rsaquo; Administration &rsaquo; Koha
 </div>
 [% END %]
 <form action="[% script_name | html %]" class="validated" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="[% confirm_op | html %]" />
   <fieldset class="rows">
     <ol>
@@ -245,6 +246,7 @@ Patron attribute types &rsaquo; Administration &rsaquo; Koha
     <div class="dialog alert">
         <h1>Confirm deletion of patron attribute type <span class="ex">'[% code | html %]' ([% description | html %])</span>?</h1>
         <form action="[% script_name | html %]" name="Aform" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="[% confirm_op | html %]" />
             <input type="hidden" name="code" value="[% code | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete patron attribute type</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt
index 1bc14581413..cde2c20c489 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt
@@ -53,6 +53,7 @@
     <div class="prefs-tab">
     <h2>[% TAB.tab_title | html %] preferences</h2>
     <form action="/cgi-bin/koha/admin/preferences.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         [% UNLESS ( searchfield ) %]<div id="toolbar"><button class="save-all btn btn-primary" type="submit">Save all [% TAB.tab_title | html %] preferences</button></div>[% END %]
         <input type="hidden" name="op" value="save" />
         <input type="hidden" name="tab" value="[% TAB.tab_id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt
index c26c8350341..dddf6cadcc5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt
@@ -81,6 +81,7 @@
 
 [% IF op == 'add_form' %]
     <form id="restriction_form" action="/cgi-bin/koha/admin/restrictions.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="checked" value="0" />
         [% IF restriction %]
@@ -125,6 +126,7 @@
 
 [% IF op == 'delete_confirm' %]
     <form action="/cgi-bin/koha/admin/restrictions.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset>
             <legend>
                 Confirm restriction type deletion
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
index 5a1cf263fc1..53f7397cc77 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
@@ -88,11 +88,13 @@ a.add, a.delete {
         <div class="dialog alert">
             <h3>The current mappings you see on the screen will be erased and replaced by the mappings in the mappings.yaml file.</h3>
             <form method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="reset_confirmed" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, reset mappings</button>
             </form>
 
             <form method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not reset mappings</button>
             </form>
         </div>
@@ -111,6 +113,7 @@ a.add, a.delete {
     </div>
 
     <form id="es_mappings" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
 
         [% WRAPPER tabs id= "tabs" %]
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt
index cea35c77e2e..d37bb883552 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt
@@ -62,6 +62,7 @@
                     [% END %]
 
                     <form id="mana_preference" method="post" class="clearfix">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <ol>
                                 <li>
@@ -111,6 +112,7 @@
 
                     [% IF Koha.Preference('ManaToken') %]
                         <form id="mana_token" method="post" class="clearfix">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                             <legend>Mana KB token</legend>
                                 <ol>
@@ -128,6 +130,7 @@
                         </form>
                     [% ELSE %]
                         <form id="mana_request" method="post" class="clearfix">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows" id="mana_subscription">
                                 <ol>
                                     <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
index 3ffde1caa37..1d38a6578da 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
@@ -86,6 +86,7 @@
                         </form>
                         [% IF ( definedbranch ) %]
                             <form action="/cgi-bin/koha/admin/clone-rules.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <label for="tobranch"><strong>Clone these rules to:</strong></label>
                                 <input type="hidden" name="frombranch" value="[% current_branch | html %]" />
                                 <select name="tobranch" id="tobranch">
@@ -99,6 +100,7 @@
 
                 <div class="page-section">
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table id="default-circulation-rules">
@@ -602,6 +604,7 @@
                     <h2>Default checkout, hold and return policy[% IF humanbranch %] for [% Branches.GetName( humanbranch ) | html %][% END %]</h2>
                     <p>You can set a default maximum number of checkouts, hold policy and return policy that will be used if none is defined below for a particular item type or category.</p>
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="set-branch-defaults" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -789,6 +792,7 @@
                        no limit applies, except possibly for a limit you define for a specific item type.
                     </p>
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add-branch-cat" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -868,6 +872,7 @@
                 [% END %]
                     <p>Specify if waiting holds can be cancelled for a given patron category.</p>
                     <form id="set-waiting-hold-cancellation" method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="set-waiting-hold-cancellation" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -952,6 +957,7 @@
                 [% END %]
                     <p>Specify the maximum number simultaneous current article requests a patron of a given category can have.</p>
                     <form id="set-article-requests-daily-limit" method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add-open-article-requests-limit" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -1006,6 +1012,7 @@
                 [% END %]
                     <p>Specify the article request fee for a given patron category.</p>
                     <form id="set-article-request-fee" method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="set-article-request-fee" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -1066,6 +1073,7 @@
                 [% END %]
                     <p>Specify the default policy for lost item fees on return.</p>
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="mod-refund-lost-item-fee-rule" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]" />
                         <table>
@@ -1267,6 +1275,7 @@
                     </ul>
 
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add-branch-item" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt
index 1c4be533c89..8937af9feed 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt
@@ -74,6 +74,7 @@
 
                 <div id="sms_add_form">
                     <form id="sms_form" action="sms_providers.pl" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <legend>Add an SMS cellular provider</legend>
                             <input type="hidden" id="id" name="id" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
index de9c86cb325..da8c5714ff5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
@@ -75,6 +75,7 @@
 [% IF op == 'add_form' %]
     <h1>New SMTP server</h1>
     <form action="/cgi-bin/koha/admin/smtp_servers.pl" id="add" name="add" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add" />
         <fieldset class="rows">
             <ol>
@@ -143,6 +144,7 @@
 [% IF op == 'edit_form' %]
     <h1>Edit SMTP server</h1>
     <form action="/cgi-bin/koha/admin/smtp_servers.pl" id="edit_save" name="edit_save" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="edit_save" />
         <input type="hidden" name="smtp_server_id" value="[%- smtp_server.id | html -%]" />
         <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt
index 90e89c4b877..7b5cebd3d8a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt
@@ -14,6 +14,7 @@
         <h1>Modify SRU search fields mapping for bibliographic records</h1>
 
         <form id="form01" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <div class="row">
                     <div class="col-xs-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt
index f778d64e6d5..164eb6280c3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt
@@ -11,6 +11,7 @@
     <main>
         <h1>Modify SRU search fields mapping for authorities</h1>
         <form id="form01" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <div class="row">
                     <div class="col-xs-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt
index 1941f22b5d9..df984c9d9bf 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt
@@ -91,6 +91,7 @@
             <form action="[% script_name | html %]" name="Aform" method="post" enctype="multipart/form-data">
         [% ELSE %]
             <form action="[% script_name | html %]" name="Aform" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
         [% END %]
         <fieldset class="rows"><legend>
         <h1>
@@ -272,6 +273,7 @@
         <h1>Data recorded</h1>
         
         <form action="[% script_name | html %]" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
         <input type="submit" class="btn btn-primary" value="OK" />
         </form>
     [% END %]
@@ -287,16 +289,19 @@
         [% Tvalue | html %]
         </td></tr></table>
         <form class="inline" action="[% script_name | html %]" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="delete_confirmed" />
         <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
         <input type="hidden" name="Tvalue" value="[% Tvalue | html %]" />
         <input type="submit"  value="Yes, delete" /></form>
         <form class="inline" action="[% script_name | html %]" method="post"><input type="submit" value="No, do not delete" /></form>
+            [% INCLUDE 'csrf-token.inc' %]
     [% END %]
     
     [% IF ( delete_confirmed ) %]
         <h1>Data deleted</h1>
         <form action="[% script_name | html %]" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="submit" class="btn btn-primary" value="Back to system preferences" />
         </form>
     [% END %]
@@ -334,6 +339,7 @@
             <form action="/cgi-bin/koha/admin/systempreferences.pl" method="post" enctype="multipart/form-data">
         [% ELSE %]
             <form action="/cgi-bin/koha/admin/systempreferences.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
         [% END %]
                 [% IF ( loo.type_free ) %]
                 <input type="text" name="value" size="[% loo.fieldlength | html %]" value="[% loo.value | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt
index 60b361e8ed4..194f3a8b1f5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt
@@ -50,6 +50,7 @@
     </div>[% END %]
 
         <form method="post" action="/cgi-bin/koha/admin/transport-cost-matrix.pl" id="cost_matrix_form">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="set-cost-matrix" />
             <fieldset id="transport-cost-matrix">
                 <div class="help">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt
index 18762120e54..4ac5753693f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt
@@ -59,6 +59,7 @@
 [% END %]
 
     <form id="category_form" action="/cgi-bin/koha/admin/usage_statistics.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <h1>Modify the statistics you share with the Koha community</h1>
         <div class="row">
             <div class="col-xs-12 col-sm-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt
index 4b9c1425eaa..62d530a4510 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt
@@ -75,6 +75,7 @@
 
 [% IF ( add_form ) %]
     <form action="[% script_name | html %]" name="Aform" method="post" id="serverentry">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validated" />
         <input type="hidden" name="servertype" value="[% server.servertype||type||'zed' | html %]"/>
         [% IF op == 'edit' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
index e87cb438c4c..059396416dd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
@@ -103,6 +103,7 @@
     [% END # /IF  identity_providers.size %]
 
     <form action="[% script_name | html %]" method="post" name="loginform" id="loginform">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="koha_login_context" value="intranet" />
     [% FOREACH INPUT IN INPUTS %]
         <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
@@ -176,6 +177,7 @@
     [% END %]
 [% ELSIF TwoFA_prompt %]
     <form action="[% script_name | html %]" method="post" name="loginform" id="loginform" autocomplete="off">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="koha_login_context" value="intranet" />
         [% FOREACH INPUT IN INPUTS %]
             <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
index 6c8f454b01b..cd29f1f454e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
@@ -401,6 +401,7 @@
                 [% END # /IF duplicateauthid %]
 
                 <form method="post" id="f" name="f" action="/cgi-bin/koha/authorities/authorities.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="add" />
                     <input type="hidden" name="addfield_field" value="" />
                     <input type="hidden" name="repeat_field" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt
index d2fb80baff3..de114bfb32c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt
@@ -63,6 +63,7 @@ div#result { margin-top: 1em; }
 
 <p>Please choose which record will be the reference for the merge. The record chosen as reference will be kept, and the other will be deleted.</p>
 <form id="mergeform" action="/cgi-bin/koha/authorities/merge.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <legend>Merge reference</legend>
     <ol>
@@ -96,6 +97,7 @@ div#result { margin-top: 1em; }
 [% ELSE %]
 
 <form id="mergeform" action="/cgi-bin/koha/authorities/merge.pl" method="post" onsubmit="return mergeformsubmit()">
+    [% INCLUDE 'csrf-token.inc' %]
 
     <div class="row">
         <div class="col-sm-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt
index f61355622c5..55db8c1b1f2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt
@@ -7,6 +7,7 @@
     <p>Your download should begin automatically.</p>
 [% ELSE %]
 <form method="post" action="/cgi-bin/koha/basket/downloadcart.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows">
 	<legend>Download cart</legend>
 	<ol><li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
index 0e3e9f74ecf..b85efe1df6d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
@@ -18,6 +18,7 @@
 
 [% INCLUDE 'blocking_errors.inc' %]
 <form action="/cgi-bin/koha/basket/sendbasket.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 
 <fieldset class="rows"> 
 <legend>Sending your cart</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
index 4ff7adc54e4..9ea20204f18 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
@@ -193,6 +193,7 @@
                                                 [% IF ( CAN_user_circulate ) %]
                                                     [% SET ClaimReturnedLostValue = Koha.Preference('ClaimReturnedLostValue') %]
                                                     <form action="updateitem.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                         <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                         <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -242,6 +243,7 @@
                                                 <span class="label">Damaged status:</span>
                                                 [% IF ( CAN_user_circulate ) %]
                                                     <form action="updateitem.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                         <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                         <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -276,6 +278,7 @@
                                                 <span class="label">Withdrawn status:</span>
                                                 [% IF ( CAN_user_circulate ) %]
                                                     <form action="updateitem.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                         <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                         <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -315,6 +318,7 @@
                                         <li>
                                             <span class="label">Exclude from local holds priority:</span>
                                             <form action="updateitem.pl" method="post">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                 <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                 <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -428,6 +432,7 @@
                                             <span class="label">Public note:</span>
                                             [% IF ( CAN_user_editcatalogue_edit_items ) %]
                                                 <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
                                                     <input type="hidden" name="op" value="set_public_note" />
                                                     <textarea name="itemnotes" rows="2" cols="30">[% ITEM_DAT.itemnotes | html %]</textarea><input type="submit" name="submit" class="btn btn-primary btn-xs" value="Update" />
@@ -441,6 +446,7 @@
                                             <span class="label">Non-public note:</span>
                                             [% IF ( CAN_user_editcatalogue_edit_items ) %]
                                                 <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
                                                     <input type="hidden" name="op" value="set_non_public_note" />
                                                     <textarea name="itemnotes_nonpublic" rows="2" cols="30">[% ITEM_DAT.itemnotes_nonpublic | html %]</textarea><input type="submit" name="submit" class="btn btn-primary btn-xs" value="Update" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
index 78cec6a3376..88e0fc3e035 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
@@ -341,6 +341,7 @@
 
                 [% ELSE # /IF total %]
                     <form method="post" name="fz3950" class="fz3950bigrpad">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div id="toolbar" class="btn-toolbar" style="background-color:transparent"><div>
                             <button class="btn btn-default" type="button" id="z3950submit"><i class="fa fa-search"></i> Z39.50/SRU search</button>
                         </div></div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt
index 1aee560715e..ca8e473e07c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt
@@ -42,6 +42,7 @@
                         [% IF ( current_biblio_searches ) %]
                             <h2>Current session</h2>
                             <form id="current_cat" action="/cgi-bin/koha/catalogue/search-history.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p class="selections-toolbar">
                                     <a class="CheckAll" data-form="current_cat" href="#"><i class="fa fa-check"></i> Select all visible rows</a>
                                     <span class="sep">|</span>
@@ -83,6 +84,7 @@
                         [% IF ( previous_biblio_searches ) %]
                             <h2>Previous sessions</h2>
                             <form id="previous_cat" action="/cgi-bin/koha/catalogue/search-history.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p class="selections-toolbar">
                                     <a class="CheckAll" data-form="previous_cat" href="#"><i class="fa fa-check"></i> Select all visible rows</a>
                                     <span class="sep">|</span>
@@ -126,6 +128,7 @@
                         [% IF ( current_authority_searches ) %]
                             <h2>Current session</h2>
                             <form id="current_auth" action="/cgi-bin/koha/catalogue/search-history.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p class="selections-toolbar">
                                     <a class="CheckAll" data-form="current_auth" href="#"><i class="fa fa-check"></i> Select all visible rows</a>
                                     <span class="sep">|</span>
@@ -167,6 +170,7 @@
                         [% IF ( previous_authority_searches ) %]
                             <h2>Previous sessions</h2>
                             <form id="previous_auth" action="/cgi-bin/koha/catalogue/search-history.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p class="selections-toolbar">
                                     <a class="CheckAll" data-form="previous_auth" href="#"><i class="fa fa-check"></i> Select all visible rows</a>
                                     <span class="sep">|</span>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt
index 8fbf62a7835..28e0d3db413 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt
@@ -134,6 +134,7 @@
                                         </a>
                                     [% ELSE %]
                                         <form class="rota_select_form" method="post" enctype="multipart/form-data">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <select class="item_select_rota" name="rota_id">
                                                 [% FOREACH rota IN rotas %]
                                                     <option value="[% rota.rota_id | uri %]">[% rota.title | html %]</option>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
index 7047d2d381a..f80480b7985 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
@@ -866,6 +866,7 @@ function PopupMARCFieldDoc(field) {
                     </script>
                 [% ELSE %]
                     <form method="post" name="f" id="f" action="/cgi-bin/koha/cataloguing/addbiblio.pl" onsubmit="return Check();">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" value="[% IF ( biblionumber ) %]view[% ELSE %]items[% END %]" id="redirect" name="redirect" />
                         <input type="hidden" value="" id="current_tab" name="current_tab" />
                         <input type="hidden" value="0" id="confirm_not_duplicate" name="confirm_not_duplicate" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt
index 950c68572bc..f55535b63f3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt
@@ -166,6 +166,7 @@
 
 <div id="cataloguing_additem_newitem" class="item_edit_form page-section">
     <form id="f" method="post" action="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblio.biblionumber | html %]" name="f">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="op" value="[% op | html %]" />
     [% IF (popup) %]
         <input type="hidden" name="popup" value="1" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt
index 78927bc3f17..ab274254730 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt
@@ -32,6 +32,7 @@
 	[% IF ( errornohostitemnumber ) %]ERROR: Unable to get the item number from this barcode.[% END %]
     </div>
     <form action="/cgi-bin/koha/catalogue/MARCdetail.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="submit" class="btn btn-primary" value="OK" />
 	<input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
     </form>
@@ -39,12 +40,14 @@
     [% IF ( success ) %]
     <div class="dialog message">The item has successfully been linked to <em>[% bibliotitle | html %]</em>.</div>
 	<form action="/cgi-bin/koha/catalogue/MARCdetail.pl" method="post">
+	    [% INCLUDE 'csrf-token.inc' %]
         <input type="submit" class="btn btn-primary" value="OK" />
 	    <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
 	</form>
     [% ELSE %]
 	[% IF ( missingparameter ) %]
 	<form method="post" action="/cgi-bin/koha/cataloguing/linkitem.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	    [% IF ( missingbiblionumber ) %]
 	    <fieldset id="biblionumber_fieldset">
 		<label for="biblionumber_fieldset">Select the biblionumber to link the item to</label>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt
index 1dce7fe1450..1a3e580e5f1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt
@@ -101,6 +101,7 @@ div#result { margin-top: 1em; }
 [% IF ( choosereference ) %]
 <p>Please choose which record will be the reference for the merge. The record chosen as reference will be kept, and the other will be deleted.</p>
 <form id="mergeform" action="/cgi-bin/koha/cataloguing/merge.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <legend>Merge reference</legend>
     <ol>
@@ -164,6 +165,7 @@ div#result { margin-top: 1em; }
     </div>
 [% ELSE %]
 <form id="mergeform" action="/cgi-bin/koha/cataloguing/merge.pl" method="post" onsubmit="return mergeformsubmit()">
+    [% INCLUDE 'csrf-token.inc' %]
 
 <div class="col-sm-6">
 [% PROCESS mergesource sourcerecords=records %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt
index eccfb20d7b8..c2fb9ded1ec 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt
@@ -37,6 +37,7 @@
                              <form action="/cgi-bin/koha/catalogue/ISBDdetail.pl" method="post">
                         [% ELSE %]
                              <form action="/cgi-bin/koha/catalogue/detail.pl" method="post">
+                                 [% INCLUDE 'csrf-token.inc' %]
                         [% END %]
 [% END %]
 
@@ -98,6 +99,7 @@
     [% ELSE %]
 	[% IF ( missingparameter ) %]
 	<form method="post" action="/cgi-bin/koha/cataloguing/moveitem.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	    [% IF ( missingbiblionumber ) %]
 	    <fieldset id="biblionumber_fieldset">
 		<label for="biblionumber">Select the biblionumber to attach the item to</label>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt
index 468c2863d7f..28f34e80213 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt
@@ -16,6 +16,7 @@
         <div id="MARC21_Linking_section_search" class="page-section">
             <h2>Search for</h2>
             <form name="f" method="post" action="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl">
+                [% INCLUDE 'csrf-token.inc' %]
 
                 <p>
                     <input type="hidden" name="plugin_name" value="marc21_linking_section.pl" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt
index 12106e9ac8a..9f041315d02 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt
@@ -10,6 +10,7 @@
 <h1>UNIMARC field 210c builder</h1>
     <h4>Search for authority type: EDITORS</h4>
         <form name="f" method="post" action="plugin_launcher.pl">
+            [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <input type="hidden" name="plugin_name" value="unimarc_field_210c.pl" />
             <input type="hidden" name="op" value="do_search" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
index 6534bbb16c1..9e045df2d10 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
@@ -14,6 +14,7 @@
             <div id="UNIMARC_Field_4XX_search" class="page-section">
                 <h2> Search on  </h2>
                 <form name="f" method="post" action="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
 
                     <p>
                         <input type="hidden" name="plugin_name" value="unimarc_field_4XX.pl" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt
index 487e09553a0..efc00d04fb7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt
@@ -18,6 +18,7 @@
     [% IF ( opsearch ) %]
         <h1>Z39.50 authority search points</h1>
         <form method="post" action="z3950_auth_search.pl" name="f" class="checkboxed">
+            [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" id="op" value="do_search" />
         <input type="hidden" name="authid" value="[% authid | html %]" />
         <input type="hidden" name="index" value="[% index | html %]" />
@@ -118,6 +119,7 @@
     </div>
 
     <form method="post" action="z3950_auth_search.pl" id="page_form" name="page_form" class="checkboxed">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" id="op" value="do_search" />
         <input type="hidden" name="current_page" id="current_page" value="[% current_page | html %]" />
         <input type="hidden" id="nameany"  name="nameany" value="[% nameany | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt
index dc1c4ecb08f..ef116250174 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt
@@ -38,6 +38,7 @@
         [% IF ( opsearch ) %]
             <h1>Z39.50/SRU search</h1>
             <form method="post" action="z3950_search.pl" name="f" class="checkboxed">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="row">
                     <div class="col-xs-6">
                         <input type="hidden" name="op" id="op" value="do_search" />
@@ -221,6 +222,7 @@
                             </div>
 
                             <form method="post" action="z3950_search.pl" id="page_form" name="page_form" class="checkboxed">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="op" id="op" value="do_search" />
                                 <input type="hidden" name="current_page" id="current_page" value="[% current_page | html %]" />
                                 <input type="hidden" id="title"  name="title" value="[% title | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt
index 6393e2c95dc..2d79a299a28 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt
@@ -157,6 +157,7 @@
                 [% PROCESS urls_modal %]
 
                 <form id="ar-branchcode-form" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <select name="branchcode" id="branchcode">
                         <option value="">All libraries</option>
                         [% FOREACH b IN Branches.all( only_from_group => 1 ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt
index 75ccc305fa4..6f6379c07cc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt
@@ -36,6 +36,7 @@
 <h1>Circulation: Overdues at [% Branches.GetLoggedInBranchname | html %]</h1>
 
 <form name="selectlocation" action="branchoverdues.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <label for="location">Shelving location selected: </label><select id="location" name="location">
         <option value="">All shelving locations</option>
         [% FOREACH locationsloo IN locationsloop %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
index d3e7369ffc9..3fb3fecd1a7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
@@ -59,6 +59,7 @@
                 </th>
                 <td>
                     <form method="post" name="mainform" id="mainform" action="branchtransfers.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% FOREACH trsfitemloo IN trsfitemloop %]
                             <input type="hidden" name="bc-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.item.barcode | html %]" />
                             <input type="hidden" name="fb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.frombrcd | html %]" />
@@ -85,6 +86,7 @@
                         <th>Cancel hold and then attempt transfer:</th>
                         <td>
                             <form method="post" name="mainform" id="mainform" action="branchtransfers.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 [% FOREACH trsfitemloo IN trsfitemloop %]
                                     <input type="hidden" name="bc-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.item.barcode | html %]" />
                                     <input type="hidden" name="fb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.frombrcd | html %]" />
@@ -104,6 +106,7 @@
                         <th>Ignore and return to transfers: </th>
                             <td>
                                 <form method="post" name="mainform" id="mainform" action="branchtransfers.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="tobranchcd" value="[% tobranchcd | html %]" />
                                     <input type="hidden" name="barcode" />
                                     [% FOREACH trsfitemloo IN trsfitemloop %]
@@ -169,6 +172,7 @@
 
 <div id="branchtransfers">
     <form method="post" name="mainform" id="mainform" action="/cgi-bin/koha/circ/branchtransfers.pl">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="brief">
             <legend>Transfer</legend>
             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt
index 80cd6e600b9..60b0f32a302 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt
@@ -56,6 +56,7 @@
 
             [% IF ( notes.count ) %]
                 <form id="mark_selected" method="post" action="/cgi-bin/koha/circ/checkout-notes.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <div id="toolbar" class="btn-toolbar">
                         <button type="submit" class="btn btn-default markseen" name="mark_selected-seen" value="seen" disabled="disabled"><i class="fa-solid fa-eye"></i> Mark seen</button>
                         <button type="submit" class="btn btn-default markseen" name="mark_selected-notseen" value="notseen" disabled="disabled"><i class="fa-solid fa-eye-slash"></i> Mark not seen</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
index 4150426c371..34abc59b085 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
@@ -242,6 +242,7 @@
 
                             [% IF CAN_user_circulate_force_checkout or HIGHHOLDS %]
                                 <form method="post" action="/cgi-bin/koha/circ/circulation.pl" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="restoreduedatespec" />
 
                                     [% IF (forceallow) %]<input type="hidden" name="forceallow" value="1">[% END %]
@@ -334,6 +335,7 @@
 
                             [% IF ADDITIONAL_MATERIALS && !CAN_user_circulate_force_checkout %]
                                 <form method="post" action="/cgi-bin/koha/circ/circulation.pl" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="restoreduedatespec" />
 
                                     [% IF (forceallow) %]<input type="hidden" name="forceallow" value="1">[% END %]
@@ -572,6 +574,7 @@
                                                             [% END %]
                                                             <td>
                                                                 <form method="post" action="/cgi-bin/koha/circ/circulation.pl" autocomplete="off">
+                                                                    [% INCLUDE 'csrf-token.inc' %]
                                                                     [% IF (forceallow) %]
                                                                         <input type="hidden" name="forceallow" value="1">
                                                                     [% END %]
@@ -631,6 +634,7 @@
                             [% IF ( !noissues ) || ( Koha.Preference('OnSiteCheckouts') && Koha.Preference('OnSiteCheckoutsForce') )%]
                                 <div class="col-sm-6">
                                     <form method="post" action="/cgi-bin/koha/circ/circulation.pl" id="mainform" name="mainform" autocomplete="off">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="restoreduedatespec" />
                                         [% IF ( issue ) %]
                                             <fieldset id="circ_circulation_issue" class="lastchecked">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
index f5396da1bae..349d0b485f0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
@@ -82,6 +82,7 @@
   </div>
 [% ELSIF patron and not checkout_infos %]
   <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/circ/circulation.pl">
+      [% INCLUDE 'csrf-token.inc' %]
     <fieldset id="circ_circulation_issue">
       <label for="barcode">Checking out to [% INCLUDE 'patron-title.inc' %]</label>
       <fieldset class="rows">
@@ -120,6 +121,7 @@
   [% IF confirmation_needed && CAN_user_circulate_force_checkout %]
     <h3>Batch checkout confirmation [% IF patron %] for [% INCLUDE 'patron-title.inc' invert_name = 1 %] [% END %]</h3>
     <form method="post" action="/cgi-bin/koha/circ/circulation.pl" id="mainform" name="mainform" autocomplete="off">
+        [% INCLUDE 'csrf-token.inc' %]
   [% ELSE %]
     <h3>Batch checkout information [% IF patron.borrowernumber %] for [% INCLUDE 'patron-title.inc' invert_name = 1 %] |[% batch | html %]|[% END %]</h3>
   [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt
index e1eec439a8c..1e7e010dc62 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt
@@ -121,6 +121,7 @@
                 [% END %]
 
                 <form method="post" class="refresh-form">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <p>
                         <input type="hidden" name="tab" id="current-tab" value="[% tab | html %]" />
                         <button type="submit" class="btn btn-default"><i class="fa-solid fa-rotate" aria-hidden="true"></i> Refresh</button>
@@ -210,6 +211,7 @@
                                                     </td>
                                                     <td>
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-staged"/>
                                                             <input type="hidden" name="tab" value="to-be-staged"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -219,6 +221,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="cancel"/>
                                                             <input type="hidden" name="tab" value="to-be-staged"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -269,6 +272,7 @@
                                                     </td>
                                                     <td>
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-patron-has-arrived"/>
                                                             <input type="hidden" name="tab" value="staged-and-ready"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -278,6 +282,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-delivered"/>
                                                             <input type="hidden" name="tab" value="staged-and-ready"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -287,6 +292,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-unstaged"/>
                                                             <input type="hidden" name="tab" value="staged-and-ready"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -337,6 +343,7 @@
                                                     </td>
                                                     <td>
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-delivered"/>
                                                             <input type="hidden" name="tab" value="patron-is-outside"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -346,6 +353,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-staged"/>
                                                             <input type="hidden" name="tab" value="patron-is-outside"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -355,6 +363,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-unstaged"/>
                                                             <input type="hidden" name="tab" value="patron-is-outside"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -434,6 +443,7 @@
                             [% SET waiting_holds = patron.holds.search( found => 'W', branchcode => Branches.GetLoggedInBranchcode ) %]
                             [% IF !policy.enable_waiting_holds_only || waiting_holds.count > 0 %]
                                 <form id="create-pickup" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="rows" style="float: none;">
                                         <input type="hidden" name="borrowernumber" value="[% patron.id | html %]"/>
                                         <input type="hidden" name="op" value="create-pickup"/>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt
index 8db42fff200..92856b865b8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt
@@ -157,6 +157,7 @@
             <aside>
 
 <form method="post" action="/cgi-bin/koha/circ/overdue.pl">
+    [% INCLUDE 'csrf-token.inc' %]
   <fieldset class="brief">
 <h4>Filter on:</h4>
     <fieldset><legend>Date due:</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
index 4f265aaa7d7..b14e77343d9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
@@ -200,6 +200,7 @@
         </td>
         <td>
             <form name="cancelReserve" action="/cgi-bin/koha/circ/pendingreserves.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="cancel_reserve" />
                 <input type="hidden" name="reserve_id" value="[% hold.reserve_id | html %]" />
 
@@ -226,6 +227,7 @@
         [% IF Koha.Preference('CanMarkHoldsToPullAsLost') != 'do_not_allow' %]
             [% IF hold.itemnumber %]
                 <form name="cancelReserve" action="/cgi-bin/koha/circ/pendingreserves.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="reserve_id" value="[% hold.reserve_id | html %]" />
                     [% IF Koha.Preference('CanMarkHoldsToPullAsLost') == 'allow' %]
                         <input type="hidden" name="op" value="mark_as_lost" />
@@ -280,6 +282,7 @@
 <div id="filters">
 
 <form action="/cgi-bin/koha/circ/pendingreserves.pl" method="post" >
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="brief">
 <h4>Refine results</h4>
 <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt
index 9b0664a6d11..a6df1efdde8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt
@@ -56,6 +56,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override limit and renew</button>
@@ -68,6 +69,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override limit and renew</button>
@@ -80,6 +82,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override and renew</button>
@@ -92,6 +95,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override and renew</button>
@@ -104,6 +108,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <input type="submit" class="approve" value="Override and renew" />
@@ -116,6 +121,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <input type="submit" class="approve" value="Override and renew" />
@@ -128,6 +134,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override limit and renew</button>
@@ -139,6 +146,7 @@
                                 <p>[% INCLUDE 'biblio-title.inc' biblio=item.biblio link = 1 %] ( [% item.barcode | html %] ): This item is on hold for another patron.</p>
 
                                 <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                     <input type="hidden" name="override_limit" value="1" />
                                     <input type="hidden" name="override_holds" value="1" />
@@ -191,6 +199,7 @@
 
             [% UNLESS error %]
                 <form method="post" action="/cgi-bin/koha/circ/renew.pl" autocomplete="off" >
+                    [% INCLUDE 'csrf-token.inc' %]
 
                     <fieldset>
                         <h1>Renew</h1>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt
index 7b27c73a356..76c4d9850dd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt
@@ -112,6 +112,7 @@
                                 </div>
                             [% END %]
                             <form id="place-article-request" method="post" action="/cgi-bin/koha/circ/request-article.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="action" value="create" />
                                 <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblio.biblionumber | html %]" />
                                 <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt
index 15c6c758781..91517496594 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt
@@ -132,6 +132,7 @@
             <aside>
 
 <form action="/cgi-bin/koha/circ/reserveratios.pl" method="post" >
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="brief">
 <h4>Refine results:</h4>
 <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
index 0028507470b..80df8fb38d8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
@@ -412,6 +412,7 @@
                                         </div>
                                         <div class="modal-footer">
                                             <form method="post" action="/cgi-bin/koha/circ/returns.pl" autocomplete="off">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="barcode" value="[% item.barcode | html %]" />
                                                 <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" />
                                                 <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" />
@@ -436,6 +437,7 @@
                             <div class="modal-dialog modal-wide">
                                 <div class="modal-content">
                                     <form method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <div class="modal-header">
                                             <h3>Please confirm bundle contents for [% item.barcode | html %]</h3>
                                         </div>
@@ -522,6 +524,7 @@
                                 <div class="modal-dialog">
                                     <div class="modal-content">
                                         <form method="post" action="returns.pl" name="mainform" id="mainform">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <div class="modal-header">
                                                 <h3>
                                                     Cannot check in
@@ -566,6 +569,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="returns.pl" name="wrongtransferform" id="wrongtransferform">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" />
                                                 <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" />
                                                 <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />
@@ -611,6 +615,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="returns.pl" class="confirm">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <div class="modal-header">
                                                     <h3>
                                                         Hold found (item is already waiting):
@@ -712,6 +717,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="returns.pl" name="mainform" id="mainform">
+                                                [% INCLUDE 'csrf-token.inc' %]
 
                                                 <input type="hidden" name="print_slip" value="0" />
 
@@ -770,6 +776,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="returns.pl" class="confirm">
+                                                [% INCLUDE 'csrf-token.inc' %]
 
                                                 <input type="hidden" name="print_slip" value="0" />
 
@@ -886,6 +893,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="/cgi-bin/koha/circ/returns.pl" class="confirm">
+                                                [% INCLUDE 'csrf-token.inc' %]
 
                                                 <div class="modal-header">
                                                     <h3>
@@ -987,6 +995,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="/cgi-bin/koha/circ/returns.pl" class="confirm">
+                                                [% INCLUDE 'csrf-token.inc' %]
 
                                                 <div class="modal-header">
                                                     <h3>
@@ -1079,6 +1088,7 @@
                         </div>
 
                         <form id="checkin-form" method="post" action="/cgi-bin/koha/circ/returns.pl" autocomplete="off" >
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset id="circ_returns_checkin">
                                 <div class="show_checkin_dialog" style="float:right;display:none"><button type="button" class="btn btn-default btn-sm" data-toggle="tooltip" title="Show the last checkin message"><i class="fa fa-info"></i></button></div>
                                 <h1>Check in</h1>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt
index 071f9649ae3..e0e86b18cbd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt
@@ -68,6 +68,7 @@ Updated:<ul>
     [% END %]
     </ul>
 <form method="post" action="[% referer or "/cgi-bin/koha/circ/circulation.pl" %]">
+    [% INCLUDE 'csrf-token.inc' %]
     <div class="noshow">
         [% FOREACH recycle_loo IN recycle_loop %]
         <input type="text" name="[% recycle_loo.param | html %]" value="[% recycle_loo.value | html %]" />
@@ -79,6 +80,7 @@ Updated:<ul>
 [% ELSE %]
 
 <form method="post" action="set-library.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 [% IF ( CAN_user_superlibrarian || CAN_user_loggedinlibrary ) %]
 <fieldset class="rows">
     <legend>Set library</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt
index 61a5686f18b..491c67c92e3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt
@@ -65,6 +65,7 @@
                                         Please retain this item and check it in to process the hold.
                                         </p>
                                         <form name="cancelReservewithtransfert" action="waitingreserves.pl#[% tab | html %]" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
                                         </form>
                                     </div>
@@ -76,6 +77,7 @@
                                         Please retain this item and check it in to process the hold.
                                         </p>
                                         <form name="cancelReservewithwaiting" action="waitingreserves.pl#[% tab | html %]" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
                                         </form>
                                     </div>
@@ -122,6 +124,7 @@
                                             <span id="holdsover-cancel-all">
                                                 <button class="cancel_selected_holds" data-bulk="true"></button>
                                                 <form name="cancelAllReserve" action="waitingreserves.pl" method="post">
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="cancelall" value="1" />
                                                     <input type="hidden" name="allbranches" value="[% allbranches | html %]" />
                                                     <input type="hidden" name="tab" value="holdsover">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt
index ebbb27897ad..e0b16516535 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt
@@ -43,6 +43,7 @@
         <div class="col-md-8 col-md-offset-2">
 
             <form method="post" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="id" value="[% club.id | html %]" />
                 <input type="hidden" name="club_template_id" value="[% club_template.id | html %]" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt
index bb4d3e57382..f9c5081a8c3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt
@@ -48,6 +48,7 @@
         <div class="col-md-8 col-md-offset-2">
 
             <form method="post" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="id" value="[% club_template.id | html %]" />
 
                 <h1>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt
index 751c89ac1c4..48b1c03e023 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt
@@ -40,6 +40,7 @@
         [% END %]
 
         <form method="post" action="/cgi-bin/koha/course_reserves/add_items.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="course_id" value="[% course.course_id | html %]" />
             <input type="hidden" name="action" value="lookup" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt
index ba14d8f2d93..d2fe66db255 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt
@@ -50,6 +50,7 @@
         [% END %]
 
         <form method="post" action="/cgi-bin/koha/course_reserves/add_items.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="course_id" value="[% course.course_id | html %]" />
             <input type="hidden" name="return" value="[% return | html %]" />
             <input type="hidden" name="action" value="add" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt
index eb4e674a247..3451c979207 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt
@@ -39,6 +39,7 @@
 
         [% IF action == 'display_form' %]
             <form method="post" action="/cgi-bin/koha/course_reserves/batch_add_items.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="course_id" value="[% course.course_id | html %]" />
                 <input type="hidden" name="action" value="add" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt
index 7f3f657a2af..83ec3175131 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt
@@ -28,6 +28,7 @@
             <h1>Batch remove reserves</h1>
         [% IF action == 'display_form' %]
             <form method="post" action="/cgi-bin/koha/course_reserves/batch_rm_items.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="action" value="batch_rm" />
                 <fieldset class="rows">
                     <legend>Remove items: scan barcodes</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
index 2a7cc6e9465..e3b5c9b4a29 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
@@ -50,6 +50,7 @@
                 </h1>
 
             <form method="post" action="/cgi-bin/koha/course_reserves/mod_course.pl" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
                 [% IF course_id %]<input type="hidden" name="course_id" value="[% course_id | html %]" />[% END %]
                 <fieldset class="rows">
                     <legend>[% IF course_id %]Edit course[% ELSE %]Create course[% END %]</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
index 719a1f59ed2..22cc07c214e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
@@ -168,6 +168,7 @@
                         [% END %]
                         [% IF request.biblio_id && request.biblio_id.length > 0  && !whole.value.check_out_errors.error.STATS %]
                             <form method="POST" action="/cgi-bin/koha/ill/ill-requests.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="rows">
                                     <legend>Check out details</legend>
                                     [% items = whole.value.biblio.items.unblessed %]
@@ -308,6 +309,7 @@
                     [% IF whole.value.partners %]
                        [% ill_url = "/cgi-bin/koha/ill/ill-requests.pl?method=illview&illrequest_id=" _ request.illrequest_id %]
                         <form method="POST" action="/cgi-bin/koha/ill/ill-requests.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 <legend>Interlibrary loan request details</legend>
                                 <ol>
@@ -386,6 +388,7 @@
 
                 [% ELSIF query_type == 'edit_action' %]
                     <form method="POST" action="/cgi-bin/koha/ill/ill-requests.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <legend>Request details</legend>
                             <ol>
@@ -471,6 +474,7 @@
                     <div class="dialog alert">
                         <h3>Are you sure you wish to delete this request?</h3>
                         <form action="/cgi-bin/koha/ill/ill-requests.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="method" value="delete" />
                             <input type="hidden" name="confirmed" value="1" />
                             <input type="hidden" name="illrequest_id" value="[% request.id | html %]" />
@@ -747,6 +751,7 @@
                                 <h3><a id="toggle_addcomment" href="#">Add comment</a></h3>
                                 <div id="addcomment" class="content_hidden">
                                     <form class="validated" method="post" action="/cgi-bin/koha/ill/ill-requests.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" value="save_comment" name="method">
                                         [% INCLUDE csrf-token.inc %]
                                         <input type="hidden" value="[% request.illrequest_id | html %]" name="illrequest_id">
@@ -780,6 +785,7 @@
                     <div id="results" class="page-section">
                         <h3>Displaying availability results</h3>
                         <form method="POST" action="/cgi-bin/koha/ill/ill-requests.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             [% FOREACH key IN whole.keys %]
                                 [% value = whole.$key %]
                                 [% IF key != 'method' && key != 'custom_key' && key != 'custom_value' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt
index 62f848b86fa..cdf4fda9114 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt
@@ -39,6 +39,7 @@
                     <p>Before we begin, please verify you have the correct credentials to continue. Please log in with the username and password given to you by your systems administrator and located in your <code>koha-conf.xml</code> configuration file.</p>
 
                     <form action="[% url | html %]" method="post" id="mainform">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% FOREACH INPUT IN INPUTS %]
                             <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
                         [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt
index 952855ee535..f85ca288a55 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt
@@ -41,6 +41,7 @@
                     <p>Please pick your language from the following list. If your language is not listed, please inform your system administrator.</p>
 
                     <form name="language" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="form-group">
                             <label for="language">Select a language: </label>
                             <select id="language" name="language">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt
index d9e528cb1c0..cb1322cd37d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt
@@ -34,6 +34,7 @@
 
                 [% IF ( dbconnection ) %]
                     <form name="checkdbparameters" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF ( checkdatabaseaccess ) %]
                             <div class="alert alert-success" role="alert"><p>Connection established.</p></div>
                             [% IF ( checkdatabasecreated ) %]
@@ -80,6 +81,7 @@
                     </form>
                 [% ELSE %]
                     <form name="checkinformation" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="step" value="2" />
                         <input type="hidden" name="checkdb" value="1" />
                         <p><input value="Continue to the next step" class="btn btn-primary" type="submit" /> </p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt
index 4d5053e791d..722c3522c81 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt
@@ -78,6 +78,7 @@
                     </div>
 
                     <form name="frameworkselection" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="selectframeworks" />
 
@@ -117,6 +118,7 @@
                     </div>
 
                     <form name="frameworkselection" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="addframeworks" />
                         [% IF ( frameworksloop ) %]
@@ -246,6 +248,7 @@
                     <p>In the next steps you will be guided through some basic requirements like defining Koha user with all administrative privileges (superlibrarian).</p>
 
                     <form action="/cgi-bin/koha/installer/install.pl" method="post" name="finish">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <h4>
                             You can help the Koha community by sharing your statistics with us.
                         </h4>
@@ -283,6 +286,7 @@
                         </div>
 
                         <form action="install.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="step" value="3" />
                             <p><input value="Continue to the next step" class="btn btn-primary" type="submit" /></p>
                         </form>
@@ -305,6 +309,7 @@
 
                     <p>Now we're ready to create the database tables and fill them with some default data.</p>
                     <form action="install.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="importdatastructure" />
                         <p><input value="Continue to the next step" class="btn btn-primary" type="submit" /></p>
@@ -332,6 +337,7 @@
 
                         <p>We are ready to do some basic configuration.</p>
                         <form action="install.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="step" value="3" />
                             <input type="hidden" name="op" value="choosemarc" />
                             <p><input value="Continue to the next step" class="btn btn-primary" type="submit" /></p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt
index e2e7d0ebb43..03f02c8dc5d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt
@@ -62,6 +62,7 @@
                 <h2>Barcode image generator</h2>
 
                 <form action="/cgi-bin/koha/svc/barcode" method="post" id="barcodegen">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="brief">
                         <div class="row">
                             <div class="col-sm-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt
index f054c2e058a..dc23dfaec4b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt
@@ -6,6 +6,7 @@
 <h1>Search</h1>
 
 <form name="f" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 	<input type="hidden" name="op" value="do_search" />
 	<input type="hidden" name="type" value="intranet" />
 	<div class="details">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
index cae46b81a4e..0511b57eabc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
@@ -78,6 +78,7 @@
 
                         <div id="manage-label-batches">
                             <form name="add_by_number" action="/cgi-bin/koha/labels/label-edit-batch.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <div>
                                     <fieldset class="rows" style="border-bottom: 0px; border: 0px;">
                                     <ol><li id="description">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt
index e15fe31d4fa..d1a5e3b249a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt
@@ -31,6 +31,7 @@
                     [% INCLUDE 'labels-toolbar.inc' %]
                     <h1>Print barcode range</h1>
                     <form name="add_by_number" action="/cgi-bin/koha/labels/label-edit-batch.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add" />
                         <fieldset class="rows">
                             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
index 04d910c739a..2b1c62a41f2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
@@ -66,6 +66,7 @@
                 [% END %]
             </h3>
             <form name="exporting" method="post" action="/cgi-bin/koha/labels/label-print.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="export" />
                 <input type="hidden" name="referer" value="[% referer | html %]" />
                 [% FOREACH batch_id IN batch_ids %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt
index edf948b8024..a5b9f77c626 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt
@@ -14,6 +14,7 @@ to add to Batch [% batch_id | html %]
 </h1>
 
 <form name="f" method="post" action="/cgi-bin/koha/labels/label-item-search.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 	<input type="hidden" name="op" value="do_search" />
 	<input type="hidden" name="batch_id" value="[% batch_id | html %]" />
 	<input type="hidden" name="type" value="[% type | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt
index 3b400b0e0c2..7a43a46565b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt
@@ -28,6 +28,7 @@
 
 <h1>Quick spine label creator</h1>
                 <form action="/cgi-bin/koha/labels/spinelabel-print.pl" method="post" id="spinelabelprint">
+                    [% INCLUDE 'csrf-token.inc' %]
 				<fieldset class="brief">
 				<ol>
 					<li><label for="barcode">Barcode: </label>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
index 1249ed31973..cac5c7eb6b6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
@@ -56,6 +56,7 @@
             [% END %]
 
                 <form id="add-api-key" action="/cgi-bin/koha/members/apikeys.pl" method="post" style="display:none">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
                     [% INCLUDE csrf-token.inc %]
                     <input type="hidden" name="op" value="generate" />
@@ -94,6 +95,7 @@
                                         <td>[% IF key.active %]Yes[% ELSE %]No[% END %]</td>
                                         <td>
                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
                                                 <input type="hidden" name="key" value="[% key.id | html %]" />
                                                 [% INCLUDE csrf-token.inc %]
@@ -101,6 +103,7 @@
                                                 <button class="btn btn-default btn-xs delete" type="submit"><i class="fa fa-trash-can"></i> Delete</button>
                                             </form>
                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
                                                 <input type="hidden" name="key" value="[% key.id | html %]" />
                                                 [% INCLUDE csrf-token.inc %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
index e964f5c3b46..d647e57f408 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
@@ -154,6 +154,7 @@
         [% END %]
         [% IF account.is_debit && account.amount == account.amountoutstanding && account.status != 'CANCELLED' && !(account.debit_type_code == 'PAYOUT') %]
           <form method="post" action="/cgi-bin/koha/members/cancel-charge.pl">
+              [% INCLUDE 'csrf-token.inc' %]
             [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]">
             <input type="hidden" name="accountlines_id" value="[% account.accountlines_id | html %]">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
index b8d1e625354..68cd922dafe 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
@@ -51,6 +51,7 @@
     [% END %]
     <div class="btn-toolbar">
         <form method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="submit" name="discharge" class="btn btn-primary" value="Generate discharge" />
             <input type="hidden" value="[% patron.borrowernumber | html %]" name="borrowernumber" />
         </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
index bda394864b2..37038382aa4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
@@ -77,6 +77,7 @@
                 [% END %]
 
                 <form method="post" action="/cgi-bin/koha/members/files.pl" enctype="multipart/form-data">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <legend>Upload new file</legend>
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
index e8c061b2af7..499bb4664fb 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
@@ -107,6 +107,7 @@
             <!-- Create or edit housebound_profile -->
             [% IF ( method == 'update_or_create' ) %]
               <form id="editform" method="post" name="editform"
+                  [% INCLUDE 'csrf-token.inc' %]
                     action="/cgi-bin/koha/members/housebound.pl">
                 <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                 [% IF ( housebound_profile ) %]
@@ -244,6 +245,7 @@
             [% ELSIF ( method == 'visit_update_or_create' ) %]
               <h4>Manage housebound deliveries</h4>
               <form name="form" id="instance_form" method="post"
+                  [% INCLUDE 'csrf-token.inc' %]
                     action="/cgi-bin/koha/members/housebound.pl">
                 [% IF ( visit ) %]
                   <input type="hidden" name="method" value="editvisitconfirm" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
index 101d98d7ba1..dd8be075922 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
@@ -62,6 +62,7 @@
                 <div class="tab-content">
                     <div role="tabpanel" class="tab-pane active">
                         <form action="/cgi-bin/koha/members/mancredit.pl" method="post" id="mancredit">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
                             [% INCLUDE csrf-token.inc %]
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
index 496cc902d0f..b12a905338d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
@@ -71,6 +71,7 @@
                     </div>
                 [% END %]
                 <form action="/cgi-bin/koha/members/maninvoice.pl" method="post" id="maninvoice">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
                     [% INCLUDE csrf-token.inc %]
                     <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt
index 33e312d3e18..70501a55a77 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt
@@ -37,6 +37,7 @@
 [% INCLUDE 'members-toolbar.inc' %]
 
 <form id="flag_form" method="post" action="/cgi-bin/koha/members/member-flags.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     [% INCLUDE csrf-token.inc %]
     <input type="hidden" name="member" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="newflags" value="1" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
index 17c55a75f27..e40b5ea4ac0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
@@ -46,6 +46,7 @@
 [% ELSE %]
 
 <form method="post" id="changepasswordf" action="/cgi-bin/koha/members/member-password.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="destination" value="[% destination | html %]" />
 <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
 	[% IF ( errormsg ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
index 6d664186cba..633fc29a068 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
@@ -105,6 +105,7 @@
           </div>
         [% IF CAN_user_tools_edit_patrons %]
             <form id="patron_batchmod_form" method="post" action="/cgi-bin/koha/tools/modborrowers.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="show" />
                 <textarea style="display:none" id="borrowernumberlist" name="borrowernumberlist"></textarea>
             </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
index 8a620d153f7..0bc215e60e9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
@@ -227,6 +227,7 @@ legend:hover {
                         [% END %]
 
                         <form name="form" id="entryform" action="/cgi-bin/koha/members/memberentry.pl" method="post" autocomplete="off" class="toggler">
+                            [% INCLUDE 'csrf-token.inc' %]
                             [% UNLESS ( check_member ) %]
                                 <input type="hidden" name="nodouble"  value="[% nodouble | html %]" />
                             [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt
index 99b2b62c525..2d18d57372a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt
@@ -109,6 +109,7 @@
             <h1>Update patron records</h1>
             [% IF PendingModifications %]
                 <form method="post" action="members-update-do.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <div id="pending_updates" class="panel-group" role="tablist" aria-multiselectable="true">
                         [% FOREACH pm IN PendingModifications %]
                             [% SET borrowernumber = pm.borrowernumber %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt
index c4ff2311efd..254f1f2ad12 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt
@@ -78,6 +78,7 @@
                                                 [% IF ( QUEUED_MESSAGE.status != 'pending' ) %]
                                                     <div class="notice">
                                                         <form id="resend_notice[% QUEUED_MESSAGE.message_id | html %]" action="/cgi-bin/koha/members/notices.pl?borrowernumber=[% borrowernumber | html %]" method="POST">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="resend_notice" />
                                                             <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
                                                             <input type="hidden" name="message_id" value="[% QUEUED_MESSAGE.message_id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
index f71f849fea1..45384e4852f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
@@ -69,6 +69,7 @@
 [% INCLUDE 'renew_results.inc' renew_results=renew_results %]
 [% IF ( accounts ) %]
     <form action="/cgi-bin/koha/members/pay.pl" method="post" id="pay-fines-form">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     [% INCLUDE 'csrf-token.inc' %]
 <p><span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> | <span class="clearall"><a id="CheckNone" href="#"><i class="fa fa-times"></i> Clear all</a></span></p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
index 42a982247a5..6c24c1f64b4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
@@ -132,6 +132,7 @@
     </ul>
 
     <form name="payindivfine" id="payindivfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     [% INCLUDE csrf-token.inc %]
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual | html %]" />
@@ -228,6 +229,7 @@
     </ul>
 
     <form name="woindivfine" id="woindivfine" action="/cgi-bin/koha/members/pay.pl" method="post" >
+        [% INCLUDE 'csrf-token.inc' %]
     [% INCLUDE csrf-token.inc %]
     <fieldset class="rows">
     <legend>Write off an individual charge</legend>
@@ -295,6 +297,7 @@
     [% END %]
 
     <form name="payfine" id="payfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     [% INCLUDE csrf-token.inc %]
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="selected_accts" id="selected_accts" value="[% selected_accts | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
index d3522d6566f..ad9fd78002e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
@@ -53,6 +53,7 @@
                             <div class="two-factor-status">Status: Enabled</div>
 
                             <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 [% INCLUDE csrf-token.inc %]
                                 <input type="hidden" name="op" value="disable-2FA" />
                                 <input type="submit" value="Disable two-factor authentication" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt
index 460ee2d1902..cf015ad33d4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt
@@ -15,6 +15,7 @@
 
     [% IF patron_categories %]
         <form method="post" action="update-child.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset>
                 <table id="catst">
                     <thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt
index fcd05bb280c..f3e93f37026 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt
@@ -65,6 +65,7 @@
 
    <div id="fileuploadform">
      <form method="post" action="/cgi-bin/koha/offline_circ/process_koc.pl" enctype="multipart/form-data" class="validated">
+         [% INCLUDE 'csrf-token.inc' %]
 		<fieldset class="brief">
        <ol><li><label for="fileToUpload">Choose .koc file: </label>
             <input class="required" required="required" type="file" id="fileToUpload" size="50" name="fileToUpload" />
@@ -80,12 +81,14 @@
    </div>
 
    <form action="enqueue_koc.pl" id="processfile" method="post" enctype="multipart/form-data">
+       [% INCLUDE 'csrf-token.inc' %]
      <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
      <input type="hidden" name="action" value="add_to_queue" />
      <input type="submit" value="Add to offline circulation queue" id="queueformsubmit" />
    </form>
 
    <form action="process_koc.pl" id="enqueuefile" method="post" enctype="multipart/form-data">
+       [% INCLUDE 'csrf-token.inc' %]
      <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
      <!-- <input type="submit" value="Apply directly" id="mainformsubmit" /> -->
    </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep1.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep1.tt
index b1f36ca9a3f..7cb4be0a242 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep1.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep1.tt
@@ -29,6 +29,7 @@
                 </div>
 
                 <form name="LibraryCreation" method="post" action="onboarding.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows" >
                         <input type="hidden" name="step" value="1"/>
                         <input type="hidden" name="op" value="add_validate_library"/>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt
index 8105efb0aa3..00fcd14a210 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt
@@ -41,6 +41,7 @@
                 <p> The patron category you create will be used by the <span class="bg-info">administrator account</span>.</p>
 
                 <form id="category_form" method="post" action="onboarding.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <input type="hidden" name="step" value="2" />
                         <input type="hidden" name="op" value="add_validate_category" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt
index 4c96d28df9d..9720f2fe71c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt
@@ -34,6 +34,7 @@
                 Now we will create a patron with superlibrarian permissions. Log in with this to access Koha as a staff member with all permissions.
                 </p>
                 <form name="createpatron" id="createpatron" method="post" action="onboarding.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="add_validate_patron" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt
index 94ebc55255e..67bf084aecc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt
@@ -34,6 +34,7 @@
                     <p> Important: Item types are what you apply circulation rules to. Circulation rules govern how your institution will lend its items: Checkout length, renewal policy, hold policy, etc. For example a circulation rule applied to the DVD item type may enforce a payment of $1.00 for checking out any DVD.</p>
 
                     <form id="createitemform" method="post" action="onboarding.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <input type="hidden" name="step" value="4" />
                         <input type="hidden" name="op" value="add_validate_itemtype" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt
index 9daf2d73c91..e71a587d019 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt
@@ -52,6 +52,7 @@
                     </div>
 
                     <form name="createcirculationrule" method="post" action="onboarding.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <input type="hidden" name="step" value="5"/>
                             <input type="hidden" name="op" value="add_validate_circ_rule" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt
index 85fabb0c84c..3074c770e7a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt
@@ -47,6 +47,7 @@
         </h1>
 
         <form method="post" action="/cgi-bin/koha/patron_lists/add-modify.pl" class="validated">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
 
                 <legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
index 00a33b8c2a4..51640300a58 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
@@ -98,6 +98,7 @@
         [% END %]
 
         <form action="list.pl" id="add_patrons" method="post" class="clearfix">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <legend>Add patrons</legend>
                 <ol>
@@ -149,6 +150,7 @@
         </form>
 
         <form action="list.pl" id="remove_patrons" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
 
             <div class="searchheader" id="searchheader">
                 <span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> |
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
index 49810c17ee1..cf859f774cd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
@@ -55,6 +55,7 @@
                     [% INCLUDE 'patroncards-errors.inc' %]
                     <div id="manage-patroncard-batches">
                             <form name="add_by_bor_num" action="/cgi-bin/koha/patroncards/edit-batch.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <div>
                                     <fieldset class="rows" style="border-bottom: 0px; border: 0px;">
                                     <ol><li id="description">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt
index cbb46554976..b98c3aeb8b1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt
@@ -44,6 +44,7 @@
 
                 <!-- NOTE: The order of the elements on this form is crictical to correct processing. You've been warned...  -->
                 <form name="input" action="/cgi-bin/koha/patroncards/edit-layout.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                 <div class="row">
                 <div class="col-sm-6">
                         <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt
index ade2605ee6c..b1fda7baa3a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt
@@ -47,6 +47,7 @@
                                 [% IF (profile_id) %] ([% profile_id | html %])[% END %]
                             </h1>
                                     <form name="input" action="/cgi-bin/koha/patroncards/edit-profile.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="rows"><legend>Profile settings</legend>
                                         <ol>
                                             <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt
index 46a1ee8da6d..505f7a1dafc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt
@@ -47,6 +47,7 @@
                         [% IF (template_id) %] ([% template_id | html %])[% END %]
                     </h1>
                     <form name="input" action="/cgi-bin/koha/patroncards/edit-template.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="row">
                         <div class="col-sm-6">
                             <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt
index 7c9c49d79b5..658b95a801d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt
@@ -38,6 +38,7 @@
                         <h2>Upload additional images for patron cards</h2>
                         <p>Manage additional images to use as logo, decoration or background on a patron card layout.</p>
                         <form name="upload_images" method="post" action="/cgi-bin/koha/patroncards/image-manage.pl" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="brief">
                                 <div class="hint">Only PNG, GIF, JPEG, XPM formats are supported. Maximum image size is 2MB.</div>
                                 <ol>
@@ -76,6 +77,7 @@
                     <h2>Delete images</h2>
                         [% IF ( TABLE ) %]
                         <form name="delete_images" method="post" action="/cgi-bin/koha/patroncards/image-manage.pl" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="brief">
                                 <div class="hint">
                                     Select one or more images to delete.
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
index 41a2ebc31a0..d8c14ca4367 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
@@ -55,6 +55,7 @@
                     [% END %]
             </h3>
             <form id="exportingf" name="exporting" method="post" action="/cgi-bin/koha/patroncards/print.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="export" />
                 <input type="hidden" name="referer" value="[% referer | html %]" />
                 [% FOREACH batch_id IN batch_ids %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt
index 96e74dc7f61..2feea2d73d1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt
@@ -39,6 +39,7 @@
                 </div>
                 [% END %]
                 <form method="post" action="/cgi-bin/koha/plugins/plugins-upload.pl" enctype="multipart/form-data">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="brief">
                          <div class="hint"><strong>NOTE:</strong> Only KPZ file format is supported.</div>
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt
index fb389fdab9d..e6b16c9d7de 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt
@@ -38,6 +38,7 @@
                 </p>
                 [% IF ( CAN_user_parameters_manage_cash_registers ) %]
                     <form action="/cgi-bin/koha/admin/cash_registers.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_form" />
                         <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button>
                     </form>
@@ -52,6 +53,7 @@
         [% END %]
 
         <form name="payForm" id="payForm" method="post" action="/cgi-bin/koha/pos/pay.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="row">
 
                 <div class="col-md-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt
index e8a41ff3017..07f174352c8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt
@@ -39,6 +39,7 @@
                     </p>
                     [% IF ( CAN_user_parameters_manage_cash_registers ) %]
                         <form action="/cgi-bin/koha/admin/cash_registers.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="add_form" />
                             <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button>
                         </form>
@@ -307,6 +308,7 @@
     <!-- Issue refund modal -->
     <div class="modal" id="issueRefundModal" tabindex="-1" role="dialog" aria-labelledby="issueRefundLabel">
         <form id="refund_form" method="post" enctype="multipart/form-data" class="validated">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="accountline" value="" id="refundline">
             <div class="modal-dialog" role="document">
                 <div class="modal-content">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt
index f463aab4497..9b7dae1a590 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt
@@ -36,6 +36,7 @@
                             </p>
                             [% IF ( CAN_user_parameters_manage_cash_registers ) %]
                                 <form action="/cgi-bin/koha/admin/cash_registers.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="add_form" />
                                     <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button>
                                 </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_overdue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_overdue.tt
index 4c5e49bed46..176da9f98a0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_overdue.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_overdue.tt
@@ -37,6 +37,7 @@
             [% IF recalls.count %]
                 <div class="page-section">
                     <form method="post" action="/cgi-bin/koha/recalls/recalls_overdue.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="cancel_multiple_recalls">
                         <input type="checkbox" id="select_all"> <span id="select_all_text">Select all</span>
                         [% INCLUDE 'recalls.inc' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_queue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_queue.tt
index 728ceff73f0..2f51590f169 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_queue.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_queue.tt
@@ -37,6 +37,7 @@
             [% IF recalls.count %]
                 <div class="page-section">
                     <form method="post" action="/cgi-bin/koha/recalls/recalls_queue.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="cancel_multiple_recalls">
                         <input type="checkbox" id="select_all"> <span id="select_all_text">Select all</span>
                         [% INCLUDE 'recalls.inc' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt
index 8ea8f2b0c70..843d6e5c89b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt
@@ -119,6 +119,7 @@
                                 </td>
                                 <td class="recall-action">
                                     <form action="/cgi-bin/koha/recalls/recalls_to_pull.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="recall_id" value="[% recall.first_recall.id | html %]">
                                         <input type="hidden" name="op" value="cancel">
                                         [% IF recall.first_recall.in_transit %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt
index 105ea93e0e3..fd396db49a2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt
@@ -73,6 +73,7 @@
                                                 <td class="recall-library">[% recall.library.branchname | html %]</td>
                                                 <td class="recall-action actions">
                                                     <form action="/cgi-bin/koha/recalls/recalls_waiting.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="recall_id" value="[% recall.id | html %]">
                                                         <input type="hidden" name="op" value="modify">
                                                         <fieldset class="action">
@@ -117,6 +118,7 @@
                                                     <td class="recall-library">[% recall.library.branchname | html %]</td>
                                                     <td class="recall-action actions">
                                                         <form action="/cgi-bin/koha/recalls/recalls_waiting.pl" method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="recall_id" value="[% recall.id | html %]">
                                                             <input type="hidden" name="op" value="modify">
                                                             <fieldset class="action">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/request.tt
index e335ba0256a..71fdcf866b1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/request.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/request.tt
@@ -37,6 +37,7 @@
         [% IF recalls.count %]
             <div class="page-section">
                 <form method="post" action="/cgi-bin/koha/recalls/request.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="cancel_multiple_recalls">
                     <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]">
                     <input type="checkbox" id="select_all"> <span id="select_all_text">Select all</span>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt
index 557507594a7..ef5507ac5d3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt
@@ -98,6 +98,7 @@
 	[% END %]
 [% ELSE %]
 	<form method="post" action="/cgi-bin/koha/reports/acquisitions_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
 	<legend>Acquisitions statistics</legend>
 	<table>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt
index 9c0fcdfac1a..c695502e939 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt
@@ -111,6 +111,7 @@
 [% ELSE %]
     <h1>Patrons with the most checkouts</h1>
 	<form method="post" action="/cgi-bin/koha/reports/bor_issues_top.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
         <ol>
             <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt
index 484eedfad06..405de55781e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt
@@ -66,6 +66,7 @@
 [% ELSE %]
     <h1>Patrons with no checkouts</h1>
     <form method="post" action="/cgi-bin/koha/reports/borrowers_out.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
 		<ol>
             <li><label for="patroncategory">Patron category: </label> <select name="Filter" id="patroncategory"><option value="" > Any category code</option>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt
index 4c025c25e93..212dfef55c4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt
@@ -86,6 +86,7 @@
 [% ELSE %]
 
 	<form method="post" action="/cgi-bin/koha/reports/borrowers_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows"><legend>Patrons statistics</legend>
 	<table>
 		<thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt
index b785a1ab82d..5a39783ac77 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt
@@ -55,6 +55,7 @@
 
     <h1>Cash register statistics</h1>
     <form method="post" action="/cgi-bin/koha/reports/cash_register_stats.pl" id="frmCashRegister">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <legend>Cash register statistics [% beginDate | $KohaDates %] to [% endDate | $KohaDates %]</legend>
             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
index 1c25a8a18d5..db30f88d581 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
@@ -82,6 +82,7 @@
 [% ELSE %]
     <h1>Most-circulated items</h1>
 	<form method="post" action="/cgi-bin/koha/reports/cat_issues_top.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
 	<ol>
         <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt
index 99897e7638a..cc7c438345c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt
@@ -158,6 +158,7 @@
                     <h1>Items with no checkouts</h1>
 
                     <form method="post" action="/cgi-bin/koha/reports/catalogue_out.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <ol>
                                 <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt
index 894171b1a7c..7ce2535b6e8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt
@@ -90,6 +90,7 @@
 [% ELSE %]
 
 	<form method="post" action="/cgi-bin/koha/reports/catalogue_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
 	<legend>Catalog statistics</legend>
 	<table>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
index b0ff99568cb..1292292739a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
@@ -81,6 +81,7 @@
             <div class="page-section">
                 <h2>Current terms</h2>
                 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="phase" value="View Dictionary" />
                     [% IF ( areas ) %]
                         Filter by area
@@ -129,6 +130,7 @@
 [% IF ( new_dictionary ) %]
 <h3>Add new definition</h3>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows"><legend>Step 1 of 5: Name the new definition</legend><ol>
 <li>
 <label for="definition_name">Definition name:</label>
@@ -148,6 +150,7 @@
 [%- IF ( step_2 ) -%]
 <h3>Add new definition</h3>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <fieldset class="rows">
     <legend>Step 2 of 5: Choose the area</legend>
     <ol>
@@ -170,6 +173,7 @@
 [% IF ( step_3 ) %]
 <h3>Add new definition</h3>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">      
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows">
 <legend>Step 3 of 5: Choose a column</legend>
 <input type="hidden" name="area" value="[% area | html %]" />
@@ -206,6 +210,7 @@
 [% IF ( step_4 ) %]
 <h3>Add new definition</h3>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows">
 <legend>Step 4 of 5: Specify a value</legend>
 <input type="hidden" name="area" value="[% area | html %]" />
@@ -255,6 +260,7 @@
 
 [% IF ( step_5 ) %]
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="area" value="[% area | html %]" />
 <input type="hidden" name="definition_name" value="[% definition_name | html %]" />
 <input type="hidden" name="definition_description" value="[% definition_description | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
index 9a037da8cd6..12b1a6aa2a2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
@@ -250,6 +250,7 @@
                                     [% END %]
 
                                     <form action="/cgi-bin/koha/reports/guided_reports.pl" id="reports_form" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="phase" value="Delete Multiple" />
                                         <table id="table_reports">
                                             <thead>
@@ -498,6 +499,7 @@
                 [% IF ( build2 ) %]
                     <h1>Build a report</h1>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="public" value="[% public | html %]" />
                         <input type="hidden" name="cache_expiry" value="[% cache_expiry | html %]" />
@@ -529,6 +531,7 @@
                     <p>Note: Be careful selecting when selecting columns. If your choice is too broad it could result in a very large report that will either not complete, or slow your system down.</p>
 
                     <form id="column_submit" action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="public" value="[% public | html %]" />
@@ -581,6 +584,7 @@
                 [% IF ( build4 ) %]
                     <h1>Build a report</h1>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" >
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="column" value="[% column | html %]" />
@@ -669,6 +673,7 @@
                     <h1>Build a report</h1>
                     <h3>Step 5 of 6: Pick which columns to total</h3>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="column" value="[% column | html %]" />
@@ -707,6 +712,7 @@
                     <h1>Build a report</h1>
                     <h3>Step 6 of 6: Choose how you want the report ordered</h3>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="column" value="[% column | html %]" />
@@ -749,6 +755,7 @@
                     </p>
 
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="sql" value="[% sql | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="public" value="[% public | html %]" />
@@ -762,6 +769,7 @@
 
                 [% IF ( save ) %]
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" id="sql_report_form">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="sql" value="[% sql | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="area" value="[% area | html %]" />
@@ -917,6 +925,7 @@
                         [% IF ( execute ) %]
                             [% UNLESS ( errors ) %]
                                 <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/batch_record_modification.pl" id="batch_record_modification" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="recordtype" value="biblio" />
                                     <input type="hidden" name="op" value="list" />
                                     [% # Preserve the whitespace of the following textarea in order to format the values correctly %]
@@ -926,6 +935,7 @@
                                 </form>
 
                                 <form method="POST" action="/cgi-bin/koha/tools/batch_delete_records.pl" id="batch_record_deletion" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="recordtype" value="biblio" />
                                     <input type="hidden" name="op" value="list" />
                                     [% # Preserve the whitespace of the following textarea in order to format the values correctly %]
@@ -935,6 +945,7 @@
                                 </form>
 
                                 <form method="POST" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_modification" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="show" />
                                     [% FOREACH result IN results %]
                                         [% FOREACH cells IN result.cells %]
@@ -950,6 +961,7 @@
                                 </form>
 
                                 <form method="POST" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_deletion" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="show" />
                                     <input type="hidden" name="del" value="1" />
                                     [% FOREACH result IN results %]
@@ -980,6 +992,7 @@
                                 </form>
 
                                 <form method="POST" action="/cgi-bin/koha/tools/modborrowers.pl" id="batch_patron_modification" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="show" />
                                     [% # Preserve the whitespace of the following textarea in order to format the values correctly %]
                                     <textarea style="display:none" name="cardnumberlist" id="cardnumberlist">
@@ -1185,6 +1198,7 @@
                 [% IF ( create ) %]
                     <h1>Create from SQL</h1>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" id="sql_report_form">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <legend>Create report from SQL</legend>
                             <ol>
@@ -1303,6 +1317,7 @@
 
                 [% IF ( editsql ) %]
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" id="sql_report_form">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="id" value="[% id | html %]"/>
                         <fieldset class="rows">
                             <legend><h1>Edit SQL report</h1></legend>
@@ -1369,6 +1384,7 @@
 
                 [% IF ( errors ) %]
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="dialog alert">
                             <strong>The following error was encountered:</strong><br />
                             [% FOREACH error IN errors %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt
index d647883a0d5..87da1741cef 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt
@@ -82,6 +82,7 @@
 [% ELSE %]
 
 	<form method="post" action="/cgi-bin/koha/reports/issues_avg_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
 	<legend>Average checkout period statistics</legend>
 	<table>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt
index ab28f1f1989..003317123a0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt
@@ -105,6 +105,7 @@
 [% ELSE %]
 
     <form method="post" action="/cgi-bin/koha/reports/issues_stats.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
 	<legend>Circulation statistics</legend><table>
         <thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt
index 0be4a3ba7c7..5aa583644fe 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt
@@ -137,6 +137,7 @@
 	[% ELSE %]
 	
 	<form name="f" action="/cgi-bin/koha/reports/itemslost.pl" method="post">
+	    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
         <ol>
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
index e24cff8ff7e..346af1b666d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
@@ -70,6 +70,7 @@
 [% ELSE %]
         <h1>View a count of items held at your library grouped by item type</h1>
         <form method="post" action="/cgi-bin/koha/reports/manager.pl?report_name=itemtypes">
+            [% INCLUDE 'csrf-token.inc' %]
           <fieldset class="rows">
             <ol>
               <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt
index ed2fc4bddce..02fca79f89a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt
@@ -95,6 +95,7 @@
     [% END %]
     [% ELSE %]
         <form name="f" action="/cgi-bin/koha/reports/orders_by_fund.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
         <legend>Filters</legend>
         <ol><li><label for="budgetfilter">Fund: </label>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt
index 8e0e16a1724..fc714509d98 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt
@@ -91,6 +91,7 @@
 [% ELSE %]
 
     <form method="post" action="/cgi-bin/koha/reports/reserves_stats.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
 	<legend>Holds statistics</legend><table>
         <thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt
index 80bc26d369f..e3382fed577 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt
@@ -81,6 +81,7 @@
 
 [% ELSE %]
 	<form method="post" action="/cgi-bin/koha/reports/serials_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 
 	<fieldset class="rows">
 		<ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
index 682b44e9677..481addb94dd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
@@ -167,6 +167,7 @@
                     <p>Hold placed by : <strong> [% nextreservsurname | html %] [% nextreservfirstname | html %]</strong> at : <strong> [% branchname | html %] </strong>, Please transfer this item.
                     </p>
                     <form name="cancelReservewithtransfert" action="branchreserves.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="submit" class="button" />
                     </form>
                 </div>
@@ -228,6 +229,7 @@
                             [% IF clubcount %]
                                 [% WRAPPER tab_panel tabname="holds_clubsearch_pane" %]
                                     <form id="holds_clubsearch" action="request.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <div class="hint">Enter club ID or partial name:</div>
                                         <input type="text" size="40" id="club" class="focus" name="findclub" autocomplete="off" />
                                         <input type="submit" class="btn btn-primary" value="Search" />
@@ -250,6 +252,7 @@
                 <fieldset class="rows">
                     <legend>Hold details</legend>
                     <form action="/api/v1/clubs/[% club.id | html %]/holds" method="post" name="form" id="club-request-form">
+                        [% INCLUDE 'csrf-token.inc' %]
 
                         [% IF ( multi_hold ) %]
                             <input type="hidden" name="request" value="any"/>
@@ -495,6 +498,7 @@
                 <fieldset class="rows">
                     <legend>Hold details</legend>
                     <form action="placerequest.pl" method="post" name="form" id="hold-request-form">
+                        [% INCLUDE 'csrf-token.inc' %]
 
                         <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                         [% FOREACH biblionumber IN biblionumbers %]
@@ -1050,6 +1054,7 @@
                 [% END %]
                 [% IF ( reserveloop ) %]
                     <form id="existing_holds" name="T[% time | html %]" action="modrequest.pl" method="post" style="display:block">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF ( multi_hold ) %]
                             [% FOREACH biblionumber IN biblionumbers %]
                             <input type="hidden" name="biblionumber" value="[% biblionumber | html %]"/>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
index 01d9086ff15..4a6d3a6f942 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
@@ -83,6 +83,7 @@
 
               <div>
                 <form action="addItems.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="brief">
                         <legend>Add or remove items</legend>
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt
index 001558e1f6c..350b5b4def4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt
@@ -116,6 +116,7 @@
                     [% END %]
 
                     <form action="editCollections.pl" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF ( previousActionEdit ) %]
                             <input type="hidden" name="action" value="update" />
                             <input type="hidden" name="colId" value="[% editColId | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt
index 994604372e9..be042210d8f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt
@@ -64,6 +64,7 @@
                 [% ELSE %]
                     <div>
                         <form action="transferCollection.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="colId" value="[% colId | html %]" />
                             <fieldset class="rows">
                                 <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search.tt
index 37ae608d428..3835e31c6d1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search.tt
@@ -9,6 +9,7 @@
 
 <h1>Serial subscription: search for vendor </h1>
     <form action="/cgi-bin/koha/serials/acqui-search-result.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <label for="text">Vendor name: </label>
         <input id="text" type="text"  size="25" name="supplier" autofocus="autofocus" />
         <input type="submit" class="btn btn-primary" value="OK" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt
index 613650f5ab8..6d6a61a0b99 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt
@@ -77,6 +77,7 @@
                 [% END %]
 
                 <form id="claims" name="claims" action="claims.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset>
                         <label for="supplierid">Vendor: </label>
                         <select id="supplierid" name="supplierid">
@@ -116,6 +117,7 @@
 
                     <fieldset>
                         <form action="claims.pl" method="post" id="claims_form">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <table id="claimst">
                                 <thead>
                                     <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt
index c44d66271f2..842186eea4a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt
@@ -32,6 +32,7 @@
 <h1>Preview routing list for <em>[% title | html %]</em></h1>
 
 <form method="post" action="routing-preview.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" id="subscriptionid" name="subscriptionid" value="[% subscriptionid | html %]" />
     <input type="hidden" id="issue_escaped" name="issue_escaped" value="[% issue_escaped | html %]" />
 <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt
index e74b373f74e..7c6413c1563 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt
@@ -43,6 +43,7 @@
 
 [% INCLUDE 'blocking_errors.inc' %]
 <form method="post" action="routing.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="op" value="save" />
 <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
 <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt
index cb662a179af..0d1491bac35 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt
@@ -143,6 +143,7 @@
 
                 [% IF ( years ) %]
                     <form name="edition" action="/cgi-bin/koha/serials/serials-edit.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% WRAPPER tabs id= "subscription_years" %]
                             [% WRAPPER tabs_nav %]
                                 [% FOREACH year IN years %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt
index 172a015e6e1..5973222bf52 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt
@@ -109,6 +109,7 @@ $(document).ready(function() {
 
 [% IF internalnotes %]<p>Nonpublic note: [% internalnotes | html | html_line_break %]</p>[% END %]
 <form method="post" name="f" class="noEnterSubmit" action="serials-edit.pl" id="serials_edit">
+    [% INCLUDE 'csrf-token.inc' %]
 
 [% IF ( Errors ) %]
 <div class="dialog alert">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
index c1a95eab945..bffb8040a81 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
@@ -46,6 +46,7 @@
 
     [% BLOCK subscriptions_table %]
         <form method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             [% IF closed %]
                 [% SET tab = 'closed' %]
             [% ELSE %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
index 19d53a1c330..298fd94c481 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
@@ -55,6 +55,7 @@ fieldset.rows table { clear: none; margin: 0; }
         </div>
     </div>
     <form method="post" id="subscription_add_form" name="f" action="/cgi-bin/koha/serials/subscription-add.pl" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
                 <div class="row" id="page_1">
                     <div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
                         [% IF ( modify ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt
index 1f9050e60f5..559389ea563 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt
@@ -76,6 +76,7 @@
                     </div>
 
                     <form method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% FOREACH subscription IN subscriptions %]
                             <input type="hidden" name="subscriptionid" value="[% subscription.subscriptionid | html %]"/>
                         [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
index 3d3d5a5052a..78c9599aae6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
@@ -61,6 +61,7 @@
                         </ul>
 
                         <form method="post" action="/cgi-bin/koha/serials/subscription-detail.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
                             <input type="hidden" name="issueconfirmed" value="1" />
                             <input type="hidden" name="op" value="del" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
index 5d67731a069..153ba95e017 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
@@ -42,6 +42,7 @@
           <h1>Edit frequency: [% description | html %]</h1>
         [% END %]
         <form action="/cgi-bin/koha/serials/subscription-frequencies.pl" id="add_frequency_form" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
           [% IF (modify) %]
             <input type="hidden" name="id" value="[% id | html %]" />
             <input type="hidden" name="op" value="savemod" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt
index 5507a38c44f..e3fff2b861b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt
@@ -34,6 +34,7 @@
 
         <div id="subscription_form_history">
           <form method="post" action="/cgi-bin/koha/serials/subscription-history.pl">
+              [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="mod" />
             <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
             <p>Hint : you can update the serial history manually. This can be useful for an old subscription or to clean the existing history. Modify those fields with care, as future serial receive will continue to update them automatically.</p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt
index 6bc37ca6f0a..dbc342c8702 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt
@@ -60,6 +60,7 @@
           [% END %]
 
           <form action="/cgi-bin/koha/serials/subscription-numberpatterns.pl" method="post">
+              [% INCLUDE 'csrf-token.inc' %]
             [% IF (new) %]
               <input type="hidden" name="op" value="savenew" />
             [% ELSE %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt
index 1ad3540a202..da6a1f09f1f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt
@@ -30,6 +30,7 @@
 [% ELSE %]
 
 <form name="f" action="/cgi-bin/koha/serials/subscription-renew.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 		<input type="hidden" name="op" value="renew" />
 		<input type="hidden" name="subscriptionid" value="[% subscription.subscriptionid | html %]" />
 		<fieldset class="rows"><legend>Subscription renewal for [% subscription.bibliotitle | html %]</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
index 649874488c2..ea093533daf 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
@@ -339,6 +339,7 @@
             [% END %]
 
             <form id="add_edit" action="suggestion.pl" method="post" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
                 [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="redirect" id="redirect" value="[% redirect | html %]" />
                 <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrowernumber | html %]" />
@@ -712,6 +713,7 @@
                     [% FOREACH suggestion IN suggestions %]
                         [% WRAPPER tab_panel tabname= suggestion.suggestiontype %]
                             <form class="update_suggestions" name="f" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl#[% suggestion.suggestiontype| uri %]">
+                                [% INCLUDE 'csrf-token.inc' %]
                             [% INCLUDE 'csrf-token.inc' %]
 
                                 [% IF suggestion.suggestions.size %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt
index d3ab56fef42..e38addb76d8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt
@@ -39,6 +39,7 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
 <div class="col-sm-8 col-sm-push-2">
 <h1>Tags</h1>
 <form method="post" action="/cgi-bin/koha/tags/review.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     <h4><span>Displaying</span>
     [% IF ( filter_approved_all ) %]<span>all</span>[% END %]
     [% IF ( filter_approved_ok ) %]<span>approved</span>[% END %]
@@ -186,6 +187,7 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
    <h4>Check lists</h4>
    <div class="description">Enter a word or phrase to check against approved/rejected lists: </div>
    <form method="post" action="/cgi-bin/koha/tags/review.pl">
+       [% INCLUDE 'csrf-token.inc' %]
    <input type="text" size="14" name="test" id="test" />
    <fieldset class="action"><button type="submit" value="Test" class="approval_btn btn btn-default btn-sm" id="test_button" name="op-test"><i class="fas fa-check-square" aria-hidden="true"></i> Test</button></fieldset>
    <div id="verdict">
@@ -206,6 +208,7 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
 <div class="col-sm-2 col-sm-pull-10">
     <aside>
 <form method="post" action="/cgi-bin/koha/tags/review.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="brief">
   <h4>Filters</h4>
 	<ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt
index 650ee9de53c..ab1f5db7dc1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt
@@ -201,6 +201,7 @@
     </div>
 
     <form id="add_additional_content" method="post" action="/cgi-bin/koha/tools/additional-contents.pl" class="validate">
+        [% INCLUDE 'csrf-token.inc' %]
         [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="category" value="[% category | html %]" />
@@ -342,6 +343,7 @@
     [% IF additional_contents.count %]
         <div class="page-section">
             <form id="del_form" method="post" action="/cgi-bin/koha/tools/additional-contents.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <table id="table_additional_contents">
                     <thead>
                         <tr>
@@ -455,6 +457,7 @@
                 <fieldset class="action"><input type="submit" class="btn btn-primary" value="Delete selected" /></fieldset>
             </form>
             <form action="/cgi-bin/koha/tools/additional-contents.pl" method="post" id="delete_single">
+                [% INCLUDE 'csrf-token.inc' %]
                 [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" id="del_op" name="op" value="delete_confirmed" />
                 <input type="hidden" id="del_category" name="category" value="[% category | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt
index 22683cef3b7..21194d0aea2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt
@@ -39,6 +39,7 @@
 
         [% IF ( op == 'edit_form' ) %]
           <form method="post" id="rules_form" action="/cgi-bin/koha/tools/automatic_item_modification_by_age.pl">
+              [% INCLUDE 'csrf-token.inc' %]
             <h1>Rules for automatic item modifications by age</h1>
             <div id="toolbar" class="btn-toolbar">
                 <div class="btn-group">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
index 1608d37c64c..1826e5231b7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
@@ -105,6 +105,7 @@
 
 
 <form name="f" action="batchMod.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
      <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber | html %]" />
      <input type="hidden" name="op" value="[% op | html %]" />
      <input type="hidden" name="searchid" value="[% searchid | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
index 580c8b12df4..4e67c419595 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
@@ -128,6 +128,7 @@
 
 
         <form name="f" action="batchMod.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="[% op | html %]" />
             <input type="hidden" name="searchid" value="[% searchid | html %]" />
             <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt
index df5a93df6a9..73b8529ab98 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt
@@ -35,6 +35,7 @@
 
                 <h1>Batch item [% IF ( del ) %]deletion[% ELSE %]modification[% END %]</h1>
                         <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/batchMod.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 <legend>Use a file</legend>
                                   <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
index 6e30e93dd24..557c505a1ea 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
@@ -56,6 +56,7 @@
   [% END %]
   [% IF op == 'form' %]
     <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/batch_delete_records.pl" id="record_ids_selection">
+        [% INCLUDE 'csrf-token.inc' %]
       <fieldset class="rows">
         <legend>Record type</legend>
         <ol>
@@ -165,6 +166,7 @@
           | <a id="clearlinkedtobiblio" href="#">Clear used authorities</a>
         </div>
         <form action="/cgi-bin/koha/tools/batch_delete_records.pl" method="post" id="selectauths">
+            [% INCLUDE 'csrf-token.inc' %]
           <table id="authorities" class="records">
             <thead>
               <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt
index 36d14f5eeb1..f5048ea2422 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt
@@ -58,6 +58,7 @@
 
                     [% IF view == 'form' %]
                         <form method="post" action="/cgi-bin/koha/tools/batch_extend_due_dates.pl" id="extend_due_dates_form">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 <legend>Checkout criteria:</legend>
                                 <ol>
@@ -122,6 +123,7 @@
                     [% ELSIF view == 'list' %]
                         [% IF checkouts.count %]
                             <form action="/cgi-bin/koha/tools/batch_extend_due_dates.pl" method="post" id="process">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <div class="page-section">
                                     <div class="btn-toolbar selections-toolbar">
                                         <a id="selectall" href="#"><i class="fa fa-check"></i> Select all</a>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt
index 2c83052eb1a..01765d5bf33 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt
@@ -71,6 +71,7 @@
 
                     [% IF view == 'form' %]
                         <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/batch_record_modification.pl" id="record_ids_selection">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 <legend>Record type</legend>
                                 <ol class="radio">
@@ -153,6 +154,7 @@
                     [% ELSIF view == 'list' %]
                         [% IF records %]
                             <form action="/cgi-bin/koha/tools/batch_record_modification.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <label for="marc_modification_template_id" class="required">Modify record using the following template: </label>
                                 <select name="marc_modification_template_id" id="marc_modification_template_id" required="required">
                                     <option value="">Select a template</option>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt
index 3f7607347ed..a389ab431dc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt
@@ -95,6 +95,7 @@
 </div>
 <div id="step1">
     <form name="f1" id="delete_patrons_form" action="/cgi-bin/koha/tools/cleanborrowers.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset>
     <legend>Delete patrons</legend>
         <h3><input id="checkborrower" type="checkbox" name="checkbox" value="borrower" /><label for="checkborrower"> Verify you want to delete patrons</label></h3>
@@ -172,6 +173,7 @@
 <!-- STEP 2 START -->
 <div id="step2">
         <form name="f2" action="/cgi-bin/koha/tools/cleanborrowers.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
 
         <div class="dialog alert">
             <h3>Warning</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
index 6b604e77f23..99402816c64 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
@@ -137,6 +137,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/tools/csv-profiles.pl" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id | html %]" />
         <fieldset class="rows">
@@ -265,6 +266,7 @@
         [% IF csv_profile %]
             <h1>Delete CSV Profile "[% csv_profile.profile | html %]?"</h1>
             <form action="/cgi-bin/koha/tools/csv-profiles.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id | html %]" />
                 <input type="submit" class="approve" value="Yes, delete" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt
index 59f850f22be..5a4aecb6124 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt
@@ -63,6 +63,7 @@
             </p>
 
             <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/export.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <fieldset class="rows">
                     <legend> Select records to export </legend>
                     <ol>
@@ -193,6 +194,7 @@
 
         [% WRAPPER tab_panel tabname="auths" %]
             <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/export.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <fieldset class="rows">
                     <legend> Select records to export </legend>
                     <ol>
@@ -268,6 +270,7 @@
         [% IF ( allow_db_export ) %]
             [% WRAPPER tab_panel tabname="db" %]
                 <form method="post" class="clearfix" action="/cgi-bin/koha/tools/export.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <p><strong>Note : This export file will be very large, and is generated nightly.</strong></p>
                     <fieldset class="rows">
                         <legend> Choose a file </legend>
@@ -294,6 +297,7 @@
         [% IF ( allow_conf_export ) %]
             [% WRAPPER tab_panel tabname="conf" %]
                 <form method="post" class="clearfix" action="/cgi-bin/koha/tools/export.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <p><strong>Note : This export file will be very large, and is generated nightly.</strong></p>
                     <fieldset class="rows">
                         <legend> Choose a file </legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt
index f03db0c0ff0..2f09d0154ea 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt
@@ -41,6 +41,7 @@
 
                             <div class="panel" id="showHoliday">
                                 <form action="/cgi-bin/koha/tools/exceptionHolidays.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" id="showHolidayType" name="showHolidayType" value="" />
                                     <fieldset class="brief">
                                         <h3>Edit this holiday</h3>
@@ -137,6 +138,7 @@
                             <!-- Panel to deal with new holidays -->
                             <div class="panel" id="newHoliday">
                                 <form action="/cgi-bin/koha/tools/newHolidays.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="brief">
                                         <h3>Add new holiday</h3>
                                         <ol>
@@ -228,6 +230,7 @@
                             </div>
                             <div style="margin-top: 2em;">
                                 <form action="copy-holidays.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="from_branchcode" value="[% branch | html %]" />
                                     <label for="branchcode">Copy holidays to:</label>
                                     <select id="branchcode" name="branchcode">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
index 5fc806d5329..44f4ee6bfef 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
@@ -200,6 +200,7 @@
     </ul>
 
     <form method="post" action="[% SCRIPT_NAME | html %]" enctype="multipart/form-data">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <legend>Import into the borrowers table</legend>
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt
index a430a3fc248..6d5d4d2ba46 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt
@@ -60,6 +60,7 @@
        [% UNLESS op %]
 
     <form method="post" id="inventory_form" action="/cgi-bin/koha/tools/inventory.pl" enctype="multipart/form-data">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
           <legend>Use a barcode file</legend>
           <ol>
@@ -235,6 +236,7 @@
     [% END %]
     [% IF (op) %]
     <form method="post" action="/cgi-bin/koha/tools/inventory.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="minlocation" value="[% minlocation | html %]" />
     <input type="hidden" name="maxlocation" value="[% maxlocation | html %]" />
     <input type="hidden" name="location" value="[% location | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
index 5fc7d0fd313..a26a9cf699a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
@@ -224,6 +224,7 @@
                                             <td class="actions">
                                                 [% IF !independant_branch || !lette.branchcode %]
                                                     <form method="post" action="/cgi-bin/koha/tools/letter.pl">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="op" value="copy_form" />
                                                         <input type="hidden" name="oldbranchcode" value="[% lette.branchcode | html %]" />
                                                         <input type="hidden" name="module" value="[% lette.module | html %]" />
@@ -284,6 +285,7 @@
                     </div> <!-- /#toolbar -->
 
                     <form id="add_notice" name="Aform" method="post" enctype="multipart/form-data" class="validate">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF add_form %]
                             <input type="hidden" name="op" id="op" value="add_validate" />
                         [% ELSE %]
@@ -468,6 +470,7 @@
                 [% IF ( add_validate or copy_validate) %]
                     Data recorded
                     <form action="[% action | html %]" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="submit" class="btn btn-primary" value="OK" />
                     </form>
                 [% END %]
@@ -492,6 +495,7 @@
                             </tr>
                         </table>
                         <form action="[% action | html %]" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_confirmed">
                             <input type="hidden" name="branchcode" value="[% letter.branchcode | html %]" />
                             <input type="hidden" name="code" value="[% letter.code | html %]" />
@@ -508,6 +512,7 @@
                 [% IF ( delete_confirmed ) %]
                     <span>Data deleted</span>
                     <form action="[% action | html %]" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                     <input type="submit" class="btn btn-primary" value="OK" />
                     </form>
                 [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt
index e11c2611a1a..3f81e9f4158 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt
@@ -107,6 +107,7 @@
                     [% IF ( batch_info ) %]
                         [% IF ( can_commit ) %]
                             <form method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="op" value="redo-matching" />
                                 <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
                                 <input type="hidden" name="current_matcher_id" value="[% current_matcher_id | html %]" />
@@ -255,6 +256,7 @@
                         <div>
                             [% IF ( can_commit ) %]
                                 <form method="post" id="import_batch_form">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="commit-batch" />
                                     <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
                                     [% IF ( record_type != 'auth' ) %]
@@ -291,6 +293,7 @@
                             [% END # /IF can_commit %]
                             [% IF ( can_revert ) %]
                                 <form method="post" id="revert_batch_form">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="revert-batch" />
                                     <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
                                     <fieldset class="action"><input type="submit" class="button" name="mainformsubmit" value="Undo import into catalog" /></fieldset>
@@ -358,12 +361,14 @@
                                             <td class="actions">
                                                 [% IF ( batch_lis.can_clean ) %]
                                                     <form method="post" name="clean_batch_[% batch_lis.import_batch_id | html %]" id="clean_batch_[% batch_lis.import_batch_id | html %]" class="batch_form batch_clean">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="import_batch_id" value="[% batch_lis.import_batch_id | html %]" />
                                                         <input type="hidden" name="op" value="clean-batch" />
                                                         <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-eraser"></i> Clean</button>
                                                     </form>
                                                 [% ELSIF ( batch_lis.import_status == 'cleaned' ) %]
                                                     <form method="post" action="/cgi-bin/koha/tools/manage-marc-import.pl" name="delete_batch_[% batch_lis.import_batch_id | html %]" id="delete_batch_[% batch_lis.import_batch_id | html %]" class="batch_form batch_delete">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="import_batch_id" value="[% batch_lis.import_batch_id | html %]" />
                                                         <input type="hidden" name="op" value="delete-batch" />
                                                         <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-trash-can"></i> Delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt
index 160a82f7a8d..8d1a737bb9e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt
@@ -206,6 +206,7 @@
                     [% END # /IF ActionsLoop %]
 
                     <form method="post" action="/cgi-bin/koha/tools/marc_modification_templates.pl" id="add_action" >
+                        [% INCLUDE 'csrf-token.inc' %]
                         <a name="modaction"></a>
                         <fieldset>
                             <legend id="modaction_legend">Add a new action</legend>
@@ -316,6 +317,7 @@
                     <h2 id="LabelcreateTemplate">Create a new template</h2>
                 </div>
                 <form method="post" action="/cgi-bin/koha/tools/marc_modification_templates.pl" id="add_template" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <div class="modal-body">
                         <fieldset>
                             <p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt
index fc692b14c7c..ffd703a6ceb 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt
@@ -35,6 +35,7 @@
                 [% IF ( op == 'show_form' ) %]
                     <h1>Batch patron modification</h1>
                     <form id="patron_batchmod_form" method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/modborrowers.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="show" />
 
                         [% WRAPPER tabs id= "batch_patron_options" %]
@@ -194,6 +195,7 @@
 
                     [% IF ( op == 'show' ) %]
                     <form name="f" action="modborrowers.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="do" />
                         [% IF ( borrowers ) %]
                             <div class="btn-toolbar selections-toolbar"><a id="selectallbutton" href="#"><i class="fa fa-check"></i> Select all</a> | <a id="clearallbutton" href="#"><i class="fa fa-times"></i> Clear all</a></div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt
index 953de54febe..367285e6444 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt
@@ -37,6 +37,7 @@
             <p>Columns must be filled left to right: if the first column is blank, other columns will be ignored. </p>
         </div>
             <form method="post" action="/cgi-bin/koha/tools/overduerules.pl" id="selectlibrary">
+                [% INCLUDE 'csrf-token.inc' %]
             <label for="branch">Select a library:</label>
                 <select id="branch" name="branch">
                     <option value="">Default</option>
@@ -63,6 +64,7 @@
             [% END %]
             [% IF ( table ) %]
                 <form method="post" action="/cgi-bin/koha/tools/overduerules.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="save" />
                     <input type="hidden" name="branch" value="[% branch | html %]" />
                     <h3>Rules for overdue actions: [% IF ( branch ) %][% Branches.GetName( branch ) | html %][% ELSE %] default library [% END %]</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
index 397e0acd07d..06a3d010f38 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
@@ -122,6 +122,7 @@
                 </div>
                 [% END %]
             <form method="post" action="/cgi-bin/koha/tools/picture-upload.pl" enctype="multipart/form-data" id="upload_form">
+                [% INCLUDE 'csrf-token.inc' %]
                 <fieldset class="rows">
                     <p><strong>NOTE:</strong> Only PNG, GIF, JPEG, XPM formats are supported. Maximum image size is 2MB.</p>
                         <ol class="radio">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt
index 5d6da9b6277..e9aa4eccf9a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt
@@ -50,6 +50,7 @@
 
             [% IF ( problem_reports.count ) %]
                 <form id="mark_selected" method="post" action="/cgi-bin/koha/tools/problem-reports.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <div id="toolbar" class="btn-toolbar">
                         <button type="submit" class="btn btn-default markviewed" name="mark_selected-viewed" value="viewed" disabled="disabled"><i class="fa-solid fa-eye"></i> Mark viewed</button>
                         <button type="submit" class="btn btn-default markclosed" name="mark_selected-closed" value="closed" disabled="disabled"><i class="fa fa-times-circle"></i> Mark closed</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt
index 3d338191659..974adac120a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt
@@ -58,6 +58,7 @@
 [% IF op == 'add_form' %]
     <h1>[% IF quote %]Modify quote[% ELSE %]New quote[% END %]</h1>
     <form action="/cgi-bin/koha/tools/quotes.pl" id="Aform" name="Aform" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <input type="hidden" name="op" value="add_validate" />
             <ol>
@@ -84,6 +85,7 @@
 [% IF op == 'delete_confirm' %]
     <div class="dialog alert">
         <form action="/cgi-bin/koha/tools/quotes.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <h1>Are you sure you want to delete the following quote?</h1>
             [% quote.source | html %] - [% quote.text | html %]
             <input type="hidden" name="op" value="delete_confirmed" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt
index 033d819884d..a9637290458 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt
@@ -34,6 +34,7 @@
 [% END %]
 
 <form name="form1" action="scheduler.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="mode" value="job_add" />
 
 <fieldset class="rows">
@@ -83,6 +84,7 @@
 </tr>
 [% FOREACH JOB IN JOBS %]
 <form action="scheduler.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="mode" value="job_change" />
 
 <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt
index 5da5e4e88a8..b06bab32909 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt
@@ -79,6 +79,7 @@
     <li>You can enter a name for this import. It may be useful, when creating a record, to remember where the suggested MARC data comes from!</li>
 </ul>
 <form method="post" id="uploadfile" enctype="multipart/form-data">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows" id="uploadform">
 <legend>Upload a file to stage</legend>
 <ol>
@@ -119,6 +120,7 @@
 </fieldset>
 
     <form method="post" id="processfile" enctype="multipart/form-data">
+        [% INCLUDE 'csrf-token.inc' %]
 [% IF basketno && booksellerid %]
     <input type="hidden" name="basketno" id="basketno" value="[% basketno | html %]" />
     <input type="hidden" name="booksellerid" id="booksellerid" value="[% booksellerid | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt
index c7f18fb8050..1b6e92b5eea 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt
@@ -151,6 +151,7 @@
                     [% END %]
 
                     <form id="rota_form" method="post" enctype="multipart/form-data" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <ol>
                                 <li>
@@ -212,6 +213,7 @@
                     <!-- Add stage modal -->
                     <div class="modal" id="addStageModal" tabindex="-1" role="dialog" aria-labelledby="addStageLabel">
                         <form id="stage_form" method="post" enctype="multipart/form-data" class="validated">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <div class="modal-dialog" role="document">
                                 <div class="modal-content">
                                     <div class="modal-header">
@@ -311,6 +313,7 @@
                     [% END %]
 
                     <form id="stage_form" method="post" enctype="multipart/form-data" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <ol>
                                 <li>
@@ -402,6 +405,7 @@
                     <!-- Add items modal -->
                     <div class="modal" id="addItemsModal" tabindex="-1" role="dialog" aria-labelledby="addItemsLabel">
                         <form id="add_rota_item_form" method="post" enctype="multipart/form-data" class="validated">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <div class="modal-dialog" role="document">
                                 <div class="modal-content">
                                     <div class="modal-header">
@@ -564,6 +568,7 @@
 
                     [% IF barcode_status.on_other.size > 0 %]
                         <form id="add_rota_item_form" method="post" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset>
                                 <legend>Select items to move to this rota:</legend>
                                 [% FOREACH item_on_other IN barcode_status.on_other %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt
index aef69c110aa..cc9211cf4ca 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt
@@ -183,6 +183,7 @@
                     [% END %]
 
                         <form method="post" action="/cgi-bin/koha/tools/upload-cover-image.pl" id="uploadfile" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows" >
                                 <div id="fileuploadform">
                                     <label for="fileToUpload">Select the file to upload: </label>
@@ -206,6 +207,7 @@
                         </form> <!-- /#uploadfile -->
 
                         <form method="post" id="processfile" action="/cgi-bin/koha/tools/upload-cover-image.pl" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
 
                             [% IF itemnumber %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt
index c6c13cb9b50..71912c03105 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt
@@ -23,6 +23,7 @@
 
 [% BLOCK form_new %]
     <form method="post" action="/cgi-bin/koha/tools/upload.pl" id="uploadfile" enctype="multipart/form-data">
+        [% INCLUDE 'csrf-token.inc' %]
         [% PROCESS plugin_pars %]
         <fieldset class="rows" id="uploadform">
         <legend>Upload new files</legend>
@@ -91,6 +92,7 @@
 [% BLOCK form_browse %]
     [% IF uploadcategories %]
     <form method="post" id="browsefile" action="/cgi-bin/koha/tools/upload.pl">
+        [% INCLUDE 'csrf-token.inc' %]
         [% PROCESS plugin_pars %]
         <input type="hidden" name="op" value="browse"/>
         <fieldset class="brief">
@@ -120,6 +122,7 @@
 
 [% BLOCK form_search %]
     <form method="post" id="searchfile" action="/cgi-bin/koha/tools/upload.pl">
+        [% INCLUDE 'csrf-token.inc' %]
         [% PROCESS plugin_pars %]
         <input type="hidden" name="op" value="search"/>
         <fieldset class="brief">
@@ -139,6 +142,7 @@
 
 [% BLOCK submitter %]
     <form id="submitter" style="display:none;" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         [% PROCESS plugin_pars %]
         <input type="hidden" name="op" id="op" value=""/>
         <input type="hidden" name="id" id="id" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
index c840d16fcc9..fb3a32b7a8a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
@@ -194,6 +194,7 @@
 
 				<h1>Browse system logs</h1>
 				<form method="post" action="/cgi-bin/koha/tools/viewlog.pl">
+				    [% INCLUDE 'csrf-token.inc' %]
 					[% IF ( do_it ) %]
 						<input type="hidden" name="do_it" value="[% do_it | html %]" />
 					[% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
index 51b9dde8e6c..c4076d42a8d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
@@ -29,6 +29,7 @@
                 </ul>
 
         <form name="f1" action="/cgi-bin/koha/virtualshelves/addbybiblionumber.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
                         [% FOREACH biblio IN biblios %] <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]" />[% END %]
             <input type="hidden" name="confirmed" value="1" />
             [% IF ( shelfnumber ) %]<input type="hidden" name="shelfnumber" value="[% shelfnumber | html %]" />[% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt
index ebc7d8d9a1b..ccb80bf5c20 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt
@@ -24,6 +24,7 @@
 [% ELSE %]
 <div id="export" class="detailtagcell">    <form method="post" action="/cgi-bin/koha/virtualshelves/downloadshelf.pl">
 <form method="post" action="/cgi-bin/koha/virtualshelves/downloadshelf.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
         <legend><h1>Download list</h1></legend>
 	<ol><li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
index 3817c570344..53f5bb1ccd9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
@@ -18,6 +18,7 @@
 [% ELSE %]
 
 <form action="/cgi-bin/koha/virtualshelves/sendshelf.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 
 <fieldset class="rows"> 
     <legend><h1>Sending your list</h1></legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
index 9882e5cecf7..ab2a5a96ba5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
@@ -204,6 +204,7 @@
                 <h1>Transfer ownership of public list [% shelf.shelfname | html %]</h1>
 
                 <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="transferform" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     [% INCLUDE 'csrf-token.inc' %]
                     <fieldset>
                         <input type="hidden" name="op" value="transfer" />
@@ -239,6 +240,7 @@
                     [% IF ( contents.count ) %]<p>This list contains [% contents.count | html %] titles</p>[% END %]
                     <div class="pages">[% pagination_bar | $raw %]</div>
                     <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="listform" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="remove_biblios" />
                         <input type="hidden" name="referer" value="view" />
@@ -391,6 +393,7 @@
             [% IF op == 'add_form' OR op == 'edit_form' %]
 
                 <form method="post" action="/cgi-bin/koha/virtualshelves/shelves.pl" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         [% IF op == 'add_form' %]
@@ -549,6 +552,7 @@
     <div class="modal" id="addToList" tabindex="-1" role="dialog" aria-labelledby="addToListLabel">
         <div class="modal-dialog" role="document">
             <form action="/cgi-bin/koha/virtualshelves/shelves.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-content">
                     <div class="modal-header">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/account-table.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/account-table.inc
index dcd0b0f1bb1..96dd3769555 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/account-table.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/account-table.inc
@@ -1,5 +1,6 @@
 [% PROCESS 'accounts.inc' %]
 <form method="post" action="opac-account-pay.pl" class="form-horizontal">
+    [% INCLUDE 'csrf-token.inc' %]
     [% IF ( ACCOUNT_LINES ) %]
         <table class="table table-bordered table-striped finestable" id="finestable">
             <caption class="sr-only">Your charges</caption>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/holds-table.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/holds-table.inc
index 84fb1057512..eb98ee8ac81 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/holds-table.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/holds-table.inc
@@ -95,6 +95,7 @@
                                     <div class="modal" id="changePickup[% HOLD.reserve_id | html %]" tabindex="-1" aria-labelledby="changePickup[% HOLD.reserve_id | html %]Label" aria-hidden="true">
                                         <div class="modal-dialog">
                                             <form id="change_branch_form[% HOLD.reserve_id | html %]" action="/cgi-bin/koha/opac-modrequest.pl" method="post">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <div class="modal-content">
                                                     <div class="modal-header">
                                                         <h5 class="modal-title" id="changePickup[% HOLD.reserve_id | html %]Label">Change pickup location for <em>[% INCLUDE 'biblio-title.inc' biblio=HOLD.biblio %]</em></h5>
@@ -169,6 +170,7 @@
                                 [% IF ( HOLD.is_cancelable_from_opac ) %]
                                     [% IF HOLD.suspend %]
                                         <form class="form-inline" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <input type="hidden" name="reserve_id" value="[% HOLD.reserve_id | html %]" />
                                             <button class="btn btn-link" type="submit" name="submit"><i class="fa fa-play" aria-hidden="true"></i> Resume</button>
                                         </form>
@@ -177,6 +179,7 @@
                                             <a class="btn btn-link suspend_hold js-show" href="#" role="button" data-title="[% HOLD.biblio.title | html %] [% FOREACH subtitle IN HOLD.biblio.subtitle.split(' \| ') %][% IF Koha.Preference('marcflavour')=='UNIMARC' %],[% END %][% subtitle | html %][% END %]" data-reserve_id="[% HOLD.reserve_id | html %]"><i class="fa fa-pause" aria-hidden="true"></i> Suspend</a>
                                         [% ELSE %]
                                             <form class="form-inline" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="reserve_id" value="[% HOLD.reserve_id | html %]" />
                                                 <button class="btn btn-link" type="submit" name="submit"><i class="fa fa-pause" aria-hidden="true"></i> Suspend</button>
                                             </form>
@@ -189,12 +192,14 @@
                             <td class="modify">
                                 [% IF ( HOLD.is_cancelable_from_opac ) %]
                                     <form id="delete_hold_[% HOLD.reserve_id | html %]" action="/cgi-bin/koha/opac-modrequest.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="biblionumber" value="[% HOLD.biblionumber | html %]" />
                                         <input type="hidden" name="reserve_id" value="[% HOLD.reserve_id | html %]" />
                                         <button data-title="[% INCLUDE 'biblio-title-head.inc' biblio=HOLD.biblio %]" data-reserve_id="[% HOLD.reserve_id | html %]" type="submit" class="btn btn-sm btn-danger btn-delete-hold"><i class="fa fa-times" aria-hidden="true"></i> [% tp('Cancel hold button', 'Cancel') | html %]</button>
                                     </form>
                                 [% ELSIF HOLD.is_waiting && HOLD.cancellation_requestable_from_opac %]
                                     <form id="req_cancel_hold_[% HOLD.reserve_id | html %]" action="/cgi-bin/koha/opac-modrequest.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="biblionumber" value="[% HOLD.biblionumber | html %]" />
                                         <input type="hidden" name="reserve_id" value="[% HOLD.reserve_id | html %]" />
                                         <input type="hidden" name="cancellation_request" value="1" />
@@ -213,6 +218,7 @@
             [% UNLESS ( all_holds_waiting ) %]
                 <div>
                     <form class="form-inline" id="suspend_all_holds" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <button type="submit" id="suspend_all_submit" class="btn btn-primary"><i class="fa fa-pause" aria-hidden="true"></i> Suspend all holds</button>
                         <input type="hidden" name="suspend" value="1" />
 
@@ -226,6 +232,7 @@
                 <br/>
                 <div>
                     <form id="resume_all_holds" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <button type="submit" id="resume_all_submit" class="btn btn-primary"><i class="fa fa-play" aria-hidden="true"></i> Resume all suspended holds</button>
                         <input type="hidden" name="suspend" value="0" />
                     </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
index 8ea412792d0..2af21771dc1 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
@@ -371,6 +371,7 @@
                     </button>
                 </div>
                 <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="modalAuth">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="has-search-query" id="has-search-query" value="" />
                     <div class="modal-body">
                         [% IF ( Koha.Preference('GoogleOpenIDConnect') == 1 ) %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc
index a91aa475695..5e17ee20007 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc
@@ -119,6 +119,7 @@
                 <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">&times;</button>
             </div>
             <form method="post" action="/cgi-bin/koha/opac-export.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                     <fieldset id="dc_fieldset">
                         <input id="input-simple" type="radio" name="format" value="rdfdc">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc
index 6ed5e724f2c..9e12aeed288 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc
@@ -8,6 +8,7 @@
                     &nbsp;&nbsp;&nbsp;<em>Written on [% message.message_date | $KohaDates %] by [% Branches.GetName(message.branchcode) | html %]</em>
                 </li>
                 <form id="dismiss-message-form" action="/cgi-bin/koha/opac-dismiss-message.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="message_id" value="[% message.message_id | html %]">
                     <input type="hidden" name="patron_id" value="[% message.borrowernumber | html %]">
                     <button type="submit" class="dismiss-message-button btn btn-primary"><i class="fa fa-trash" aria-hidden="true"></i> Dismiss</button>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-checkout.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-checkout.inc
index 17f734d10d4..7f1c76adba2 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-checkout.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-checkout.inc
@@ -8,6 +8,7 @@
                 </button>
             </div>
             <form action="#" method="post" id="overdrive-checkout-form">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                     <input type="hidden" name="id" value="" />
                     <div id="overdrive-format-list">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc
index 10e862d41f7..80f0bbfc8d6 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc
@@ -8,6 +8,7 @@
                 </button>
             </div>
             <form action="#" method="post" id="overdrive-login-form">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                         <fieldset class="brief">
                             <label for="ODpassword">Password:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt
index 25b997f3ec9..fe6b54c9d70 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt
@@ -25,6 +25,7 @@
                                 </ul>
                                 [% IF private_shelves.count or public_shelves.count or private_shelves_shared_with_me.count %]
                                     <form name="f1" action="/cgi-bin/koha/opac-addbybiblionumber.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <fieldset>
                                             <legend>Select a list</legend>
                                             <label for="shelfnumber">Add to list:</label> <select name="shelfnumber" id="shelfnumber">
@@ -58,6 +59,7 @@
                                 [% ELSE %]
                                     [% IF ( singleshelf ) %]
                                         <form name="f1" action="/cgi-bin/koha/opac-addbybiblionumber.pl" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             [% FOREACH biblio IN biblios %]
                                                 <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]">
                                             [% END %]
@@ -74,6 +76,7 @@
 
                             [% UNLESS ( singleshelf ) %]
                                 <form name="f2" method="post" action="/cgi-bin/koha/opac-addbybiblionumber.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset>
                                         <legend>Add to a new list:</legend>
                                             <label for="newvirtualshelf">List name:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt
index 802c5f6f135..afd949ecc54 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt
@@ -36,6 +36,7 @@
                         [% IF ( typeissue ) %]
                             <h2>Subscribe to a subscription alert</h2>
                             <form action="opac-alert-subscribe.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p>Do you want to receive an email when a new issue for this subscription arrives?</p>
                                 <h3>[% bibliotitle | html %]</h3>
                                 [% IF ( notes ) %]<p>[% notes | html %]</p>[% END %]
@@ -50,6 +51,7 @@
                         [% IF ( typeissuecancel ) %]
                             <h2>Unsubscribe from a subscription alert</h2>
                             <form action="opac-alert-subscribe.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p>Please confirm that you do not want to receive email when a new issue arrives for this subscription.</p>
                                 <h3>[% bibliotitle | html %]</h3>
                                 [% IF ( notes ) %]<p>[% notes | html %]</p>[% END %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
index 4e583500c3c..4d09f232816 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
@@ -213,6 +213,7 @@
                                 <form action="/cgi-bin/koha/sci/sci-main.pl" name="auth" id="auth" method="post" autocomplete="off">
                             [% ELSE %]
                                 <form action="[% script_name | html %]" name="auth" id="auth" method="post" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                             [% END %]
                                 <input type="hidden" name="koha_login_context" value="opac" />
 
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt
index bc220619059..8374caff2f1 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt
@@ -36,6 +36,7 @@
                 [% END %]
                     <div id="userauthhome" class="maincontent">
                         <form name="f" action="/cgi-bin/koha/opac-authorities-home.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="do_search" />
                             <input type="hidden" name="type" value="opac" />
                             <fieldset class="rows">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt
index 30969b9013d..e2f7fedd2ea 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt
@@ -350,6 +350,7 @@
                                 <input type="hidden" name="records" id="records" />
                             </form>
                             <form method="post" id="download_cart" action="/cgi-bin/koha/opac-downloadcart.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="format" id="download_format" value="" />
                                 <input type="hidden" name="bib_list" value="[% bib_list | html %]" />
                             </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt
index 2eb281fd040..a518dcddb41 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt
@@ -190,6 +190,7 @@
                                                     <td>[% p.notes | html %]</td>
                                                     <td>
                                                         <form method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="arrival-alert" />
                                                             <input type="hidden" name="pickup_id" value="[% p.id | html %]" />
                                                             [% IF ! p.staged_datetime || p.arrival_datetime %]
@@ -202,6 +203,7 @@
                                                         </form>
                                                         <p>
                                                         <form method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="cancel-pickup" />
                                                             <input type="hidden" name="pickup_id" value="[% p.id | html %]" />
                                                             [% IF p.delivered_datetime %]
@@ -229,6 +231,7 @@
                                 <div role="tabpanel" class="tab-pane active" id="user-schedule-pickup" aria-labelledby="tab-user-schedule-pickup">
                                 [% END %]
                                     <form id="create-pickup" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <fieldset class="rows">
                                             <ol>
                                                 <li>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
index 8449cc3b864..e8a93d45809 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
@@ -238,6 +238,7 @@
                     [% IF ( TagsInputEnabled ) %]
                         [% IF ( loggedinusername ) %]
                             <form id="tagform[% biblio.biblionumber | html %]" method="post" action="/cgi-bin/koha/opac-tags.pl" style="display:none;">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Tags</legend>
                                 <div class="form-row">
                                     <div class="col-3">
@@ -300,6 +301,7 @@
 
                     [% IF ( OpacStarRatings != 'disable' ) %]
                         <form method="post" action="/cgi-bin/koha/opac-ratings.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Star ratings</legend>
                             <div class="results_summary ratings" id="rating-[% biblio.biblionumber | html %]">
 
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt
index 090936c72a2..f618893d1dc 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt
@@ -11,6 +11,7 @@
                     <div id="userdownloadcart" class="maincontent">
                         <h1>Download cart</h1>
                         <form method="post" action="/cgi-bin/koha/opac-downloadcart.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <select name="format" id="format">
                                 <option value="">-- Choose format --</option>
                                 <option value="ris">RIS (Zotero, EndNote, others)</option>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt
index 076fed519f8..e48a686d426 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt
@@ -59,6 +59,7 @@
                                 </div>
                             [% ELSE %]
                                 <form method="post" action="/cgi-bin/koha/opac-downloadshelf.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset>
                                         <select name="format" id="dlformat" required="required">
                                             <legend>Choose format</legend>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt
index 1ce9da47550..15d909ecc63 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt
@@ -90,6 +90,7 @@
                                 [% INCLUDE messages %]
                                 [% IF backends %]
                                     <form method="post" id="illrequestcreate-form" novalidate="novalidate">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <legend class="sr-only">Backends</legend>
                                         <fieldset class="rows">
                                             <label for="backend">Provider:</label>
@@ -175,6 +176,7 @@
                             [% INCLUDE messages %]
                             [% status = request.status %]
                             <form method="post" action="?method=update" id="illrequestupdate-form" novalidate="novalidate">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="rows">
                                     <legend id="library_legend">Details from library</legend>
                                     <ol>
@@ -248,6 +250,7 @@
                             <h1>Interlibrary loan item availability</h1>
                             <div id="results">
                                 <form method="POST" action="/cgi-bin/koha/opac-illrequests.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend><h2>Displaying availability results</h2></legend>
                                     [% FOREACH key IN whole.keys %]
                                         [% value = whole.$key %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt
index 4ee19b6e2c8..34d63dc8d2b 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt
@@ -41,6 +41,7 @@
                             Issue notes have not been enabled. Please contact the library.
                         [% ELSE %]
                             <form id="issue-note" action="/cgi-bin/koha/opac-issue-note.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Edit issue note</legend>
                                 <fieldset>
                                     <label for="note" class="required">Note:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
index 494fbbc63bf..8fa3c938408 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
@@ -180,6 +180,7 @@
                         [% UNLESS ( casAuthentication || shibbolethAuthentication || Koha.Preference('opacShibOnly') ) %]
                             <div id="login">
                                 <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="auth" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="koha_login_context" value="opac" />
                                     <fieldset class="brief">
                                         <legend>Log in to your account:</legend>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
index 20a0305b5d1..104a43659f2 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
@@ -213,6 +213,7 @@
                 [% END %]
 
                 <form method="post" action="/cgi-bin/koha/opac-memberentry.pl" id="memberentry-form" autocomplete="off">
+                    [% INCLUDE 'csrf-token.inc' %]
 
                 [% FOREACH field = ['streetnumber' 'streettype'  'cardnumber' 'branchcode' 'categorycode' 'title' 'surname' 'firstname' 'middle_name' 'dateofbirth' 'initials' 'pronouns' 'othernames' 'address' 'address2' 'city' 'state' 'zipcode' 'country' 'phone' 'phonepro' 'mobile' 'email' 'emailpro' 'fax' 'B_streettype' 'B_streetnumber' 'B_address' 'B_address2' 'B_city' 'B_state' 'B_zipcode' 'B_country' 'B_phone' 'B_email' 'contactnote' 'altcontactsurname' 'altcontactfirstname' 'altcontactaddress1' 'altcontactaddress2' 'altcontactaddress3' 'altcontactstate' 'altcontactzipcode' 'altcontactcountry' 'altcontactphone' 'password' ] %]
                     [% IF mandatory.defined( field ) %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
index e2b4b74a7f6..d94109f852c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
@@ -41,6 +41,7 @@
                         <div class="alert alert-success"><p><strong>Settings updated</strong></p></div>
                         [% END %]
                         <form action="/cgi-bin/koha/opac-messaging.pl" method="post" name="opacmessaging">
+                            [% INCLUDE 'csrf-token.inc' %]
                             [% INCLUDE csrf-token.inc %]
                             <input type="hidden" name="modify" value="yes" />
 
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
index 8f08befe98e..eb80aebddf3 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
@@ -65,6 +65,7 @@
                     [% IF logged_in_user.category.effective_change_password %]
                         [% IF ( Ask_data ) %]
                             <form action="/cgi-bin/koha/opac-passwd.pl" name="mainform" id="mainform" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Change your password</legend>
                                 <fieldset>
                                     [% IF ( logged_in_user.category.effective_require_strong_password ) %]
@@ -102,6 +103,7 @@
                             Your password has been changed
                         </div>
                         <form action="/cgi-bin/koha/opac-user.pl" method="post" autocomplete="off">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
                             <p><input type="submit" class="btn btn-primary" value="Return to my account" /></p>
                         </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
index 8d3ff120a36..5ecaca87c83 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
@@ -120,6 +120,7 @@
                         <div class="alert alert-info">You can't reset your password.</div>
                     [% ELSIF (password_recovery) %]
                         <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Password recovery</legend>
                             <input type="hidden" name="koha_login_context" value="opac" />
                             <p>To reset your password, enter your login or your email address.</p>
@@ -142,6 +143,7 @@
                     [% ELSIF (new_password) %]
                         [% UNLESS ( errLinkNotValid ) %]
                             <form id="mainform" name="mainform" action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Password not valid</legend>
                                 <input type="hidden" name="koha_login_context" value="opac" />
                                 <fieldset class="brief">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt
index d6fe1dcafe7..73f0c4fb874 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt
@@ -47,6 +47,7 @@
                     <h1>Your consents</h1>
 
                     <form action="/cgi-bin/koha/opac-patron-consent.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF Koha.Preference('PrivacyPolicyConsent') %]
                         <legend><h2 id="GDPR_consents">Privacy policy consents</h2></legend>
                             <input type="hidden" name="op" value="gdpr_proc_save"/>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt
index 1d3c155f084..d690739c280 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt
@@ -74,6 +74,7 @@
                         <p id="note1">Please note that information on any book still checked-out must be kept by the library no matter which privacy option you choose.</p>
                         <p id="note2">Please also note that the library staff can't update these values for you: it's your privacy!</p>
                         <form action="/cgi-bin/koha/opac-privacy.pl" method="post" id="opac-privacy-update-form">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Privacy rule</legend>
                             <input type="hidden" name="op" value="update_privacy" />
                             <fieldset>
@@ -157,16 +158,19 @@
                         <p>You can delete all your checkout and hold history immediately by clicking here. <strong>BE CAREFUL</strong>. Once you've confirmed the deletion, no one can retrieve the list!</p>
 
                         <form action="/cgi-bin/koha/opac-privacy.pl" method="post" id="opac-privacy-delete-checkouts">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_record" />
                             <input type="hidden" name="checkouts" value="1" />
                         </form>
 
                         <form action="/cgi-bin/koha/opac-privacy.pl" method="post" id="opac-privacy-delete-holds">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_record" />
                             <input type="hidden" name="holds" value="1" />
                         </form>
 
                         <form action="/cgi-bin/koha/opac-privacy.pl" method="post" id="opac-privacy-delete-all">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_record" />
                             <input type="hidden" name="all" value="1" />
                         </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt
index 1be130282ab..e1a2970c893 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt
@@ -66,6 +66,7 @@
                                 <div class="dialog">
 
                                     <form id="recallform" action="/cgi-bin/koha/opac-recall.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <fieldset class="rows" id="options">
                                             <legend>Place a recall on <b>[% biblio.title | html %]</b> ([% biblio.author | html %])?</legend>
                                             <ul>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt
index c523cc9fdae..c9d9dd40526 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt
@@ -113,6 +113,7 @@
                                                     <td class="cancelrecall">
                                                         [% IF ( RECALL.requested or RECALL.overdue ) %]
                                                             <form action="/cgi-bin/koha/opac-recall.pl" method="post">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <input type="hidden" name="op" value="cancel">
                                                                 <input type="hidden" name="recall_id" value="[% RECALL.id | html %]">
                                                                 <input type="hidden" name="biblionumber" value="[% RECALL.biblio_id | html %]">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
index dc5e3a7388b..0dcf2452e0d 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
@@ -83,6 +83,7 @@
                         [% UNLESS ( casAuthentication ) %]
                             <div id="login">
                                 <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="auth" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="koha_login_context" value="opac" />
                                     <fieldset class="brief">
                                         <legend>Log in to your account:</legend>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt
index 6367abd469e..b2a1e9b92a9 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt
@@ -55,6 +55,7 @@
 
                     <div id="reportproblem" class="maincontent toptabs">
                         <form name="reportlibform" action="/cgi-bin/koha/opac-reportproblem.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Report a problem</legend>
                             <input type="hidden" name="op" value="addreport" />
                             <fieldset class="rows">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt
index 4ba935bb8d5..89484913bf9 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt
@@ -65,6 +65,7 @@
                     [% END %]
 
                         <form id="place-article-request" method="post" action="/cgi-bin/koha/opac-request-article.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Place article request</legend>
                             <input type="hidden" name="action" value="create" />
                             <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblio.biblionumber | html %]" />
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt
index 2109a26fd6b..6c260703470 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt
@@ -148,6 +148,7 @@
                 [% END %]
 
             <form action="/cgi-bin/koha/opac-reserve.pl" method="post" id="hold-request-form">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Hold requests</legend>
                 <input type="hidden" name="place_reserve" value="1"/>
                 <!-- These values are set dynamically by js -->
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt
index 440fdac4571..48542d804d0 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt
@@ -75,6 +75,7 @@
                             </div>
                         [% ELSE %]
                         <form action="/cgi-bin/koha/opac-reset-password.pl" name="mainform" id="mainform" method="post" autocomplete="off">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Reset your password</legend>
 
                             <fieldset class="brief">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt
index ba7c3a89f94..698acf4c28a 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt
@@ -40,6 +40,7 @@
                         <h2>Comments on <em>[% INCLUDE 'biblio-title.inc' %]</em></h2>
                         [% IF ( biblio.author ) %]<h3>[% biblio.author | html %]</h3>[% END %]
                         <form id="reviewf" action="/cgi-bin/koha/opac-review.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Comments</legend>
                             <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]" />
                             [% IF ( reviewid ) %]<input type="hidden" name="reviewid" value="[% reviewid | html %]" />[% END %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt
index 2030dcab2ba..5d1af00b45c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt
@@ -86,6 +86,7 @@
         [% IF ( current_biblio_searches ) %]
             <h2>Current session</h2>
             <form action="/cgi-bin/koha/opac-search-history.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Toolbar control</legend>
 
                 [% INCLUDE 'toolbar_controls' %]
@@ -133,6 +134,7 @@
         [% IF ( previous_biblio_searches ) %]
             <h2>Previous sessions</h2>
             <form action="/cgi-bin/koha/opac-search-history.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Toolbar control</legend>
                 [% INCLUDE 'toolbar_controls' %]
 
@@ -188,6 +190,7 @@
         [% IF ( current_authority_searches ) %]
             <h2>Current session</h2>
             <form action="/cgi-bin/koha/opac-search-history.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Toolbar control</legend>
                 [% INCLUDE 'toolbar_controls' %]
                 <input type="hidden" name="action" value="delete" />
@@ -229,6 +232,7 @@
         [% IF ( previous_authority_searches ) %]
             <h2>Previous sessions</h2>
             <form action="/cgi-bin/koha/opac-search-history.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Toolbar control</legend>
                 [% INCLUDE 'toolbar_controls' %]
                 <input type="hidden" name="action" value="delete" />
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
index dec384c06e5..778176b28c3 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
@@ -28,6 +28,7 @@
 
                         [% ELSE %]
                             <form action="/cgi-bin/koha/opac-sendbasket.pl" method="post" id="sendbasketform">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="brief">
                                     <legend><h1>Sending your cart</h1></legend>
                                     <label for="email_add">Email address:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt
index a446e8b5a99..71d6a2b1b25 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt
@@ -31,6 +31,7 @@
                                 <p><a class="button close" href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelfid | html %]">Back to lists</a></p>
                             [% ELSE %]
                                 <form action="/cgi-bin/koha/opac-sendshelf.pl" method="post" id="sendshelfform">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="brief">
                                         <legend><h1>Sending your list</h1></legend>
                                         <label for="email">Email address:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt
index 86dd33578c4..1d0c41c126f 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt
@@ -55,6 +55,7 @@
                             <span class="view"><a id="Fullhistory" href="opac-serial-issues.pl?selectview=full&amp;biblionumber=[% biblionumber | html %]" class="button">Full history</a></span>
                         </div>
                         <form method="post" name="f">
+                            [% INCLUDE 'csrf-token.inc' %]
                             [% FOREACH subscription_LOO IN subscription_LOOP %]
                                 <div id="subscriptionline[% subscription_LOO.subscriptionid | html %]" class="subscriptionline">
                                     <caption><h2>Subscription information for [% subscription_LOO.bibliotitle | html %]</h2><caption>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
index 8ad5cb49094..81f08b93a7d 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
@@ -10,6 +10,7 @@
 
 [% BLOCK delete_shelf %]
     <form action="/cgi-bin/koha/opac-shelves.pl" method="post" id="deleteshelf[% shelf.shelfnumber | html %]" class="d-inline">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="delete" />
         <input type="hidden" name="referer" value="list" />
         <input type='hidden' name='public' value='[% public | html %]' />
@@ -249,6 +250,7 @@
                                         [% IF can_manage_shelf %]
                                             <span class="sep">|</span>
                                             <form method="post" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="op" value="edit_form" />
                                                 <input type="hidden" name="referer" value="view" />
                                                 <input type='hidden' name='public' value='[% shelf.public | html %]' />
@@ -263,6 +265,7 @@
                                             [% END %]
                                         [% ELSIF !public # not manageshelf and private means shared %]
                                             <form action="/cgi-bin/koha/opac-shelves.pl" method="post" id="unshare[% shelf.shelfnumber | html %]" class="d-inline">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="op" value="remove_share" />
                                                 <input type="hidden" name="referer" value="list" />
                                                 <input type='hidden' name='public' value='[% public | html %]' />
@@ -384,6 +387,7 @@
                             </div> <!-- /#floating -->
 
                             <form action="/cgi-bin/koha/opac-shelves.pl" method="post" id="myform" name="myform">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 [% IF can_manage_shelf %]
                                     <input type="hidden" name="op" value="remove_biblios" />
                                     <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
@@ -547,6 +551,7 @@
                                     [% IF can_manage_shelf %]
                                         <span class="sep">|</span>
                                         <form method="post" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <input type="hidden" name="op" value="edit_form" />
                                             <input type="hidden" name="referer" value="view" />
                                             <input type="hidden" name="public" value="[% shelf.public | html %]" />
@@ -569,6 +574,7 @@
 
                             [% IF can_manage_shelf %]
                                 <form method="post" action="opac-shelves.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="delete" />
                                     <input type="hidden" name="referer" value="list" />
                                     <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]"/>
@@ -580,6 +586,7 @@
 
                     [% IF op == 'add_form' OR op == 'edit_form' %]
                         <form method="post" action="/cgi-bin/koha/opac-shelves.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 [% IF op == 'add_form' %]
                                     <div id="addshelf">
@@ -668,6 +675,7 @@
                         <h1>Transfer ownership of shared list '[% shelf.shelfname | html %]'</h1>
                         <br/>
                         <form action="/cgi-bin/koha/opac-shelves.pl" id="transferform" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                         <fieldset>
                             <input type="hidden" name="op" value="transfer" />
                             <input type="hidden" name="public" value="0" />
@@ -764,6 +772,7 @@
                                                     <td>
                                                         [% IF s.can_be_managed( loggedinusernumber ) %]
                                                             <form action="/cgi-bin/koha/opac-shelves.pl" method="post" class="d-inline">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <input type="hidden" name="shelfnumber" value="[% s.shelfnumber | html %]" />
                                                                 <input type="hidden" name="public" value="[% s.public | html %]" />
                                                                 <input type="hidden" name="op" value="edit_form" />
@@ -779,6 +788,7 @@
                                                         [% END %]
                                                         [% IF s.is_shared AND s.can_be_managed( loggedinusernumber ) %]
                                                             <form action="/cgi-bin/koha/opac-shelves.pl" method="post" class="d-inline">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <input type="hidden" name="shelfnumber" value="[% s.shelfnumber | html %]" />
                                                                 <input type="hidden" name="public" value="0" />
                                                                 <input type="hidden" name="op" value="transfer" />
@@ -788,6 +798,7 @@
                                                         [% END %]
                                                         [% IF s.is_shared_with( loggedinusernumber ) %]
                                                             <form action="opac-shelves.pl" method="post" id="unshare[% s.shelfnumber | html %]" class="d-inline">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <input type="hidden" name="op" value="remove_share" />
                                                                 <input type="hidden" name="referer" value="list" />
                                                                 <input type='hidden' name='public' value='[% public | html %]' />
@@ -823,6 +834,7 @@
 </div> <!-- / .main -->
 
 <form method="post" id="download_list" action="/cgi-bin/koha/opac-downloadshelf.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
     <input type="hidden" name="format" id="download_format" value="" />
 </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt
index 9c210086402..4e45c9377b7 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt
@@ -75,6 +75,7 @@
                             [% END %]
 
                             <form action="/cgi-bin/koha/opac-suggestions.pl" method="post" id="add_suggestion_form">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="rows">
                                     <ol>
                                         [% IF Koha.Preference( 'OPACSuggestionAutoFill' ) %]
@@ -368,6 +369,7 @@
                             [% IF suggestions.size > 0 %]
                                 [% SET can_delete_suggestion = 0 %]
                                 <form action="/cgi-bin/koha/opac-suggestions.pl" method="post" id="delete_suggestions">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="delete_confirm" />
                                     [% IF ( loggedinusername || ( Koha.Preference( 'AnonSuggestions' ) == 1 ) ) %]
                                         <div id="toolbar" class="toolbar clearfix">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt
index 60319529e66..b1de0bf5ad2 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt
@@ -133,6 +133,7 @@
 
                         [% IF ( MY_TAGS ) %]
                         <form id="deletetags" method="post" action="opac-tags.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <table id="mytagst" class="table table-bordered table-striped">
                             <caption>Your tags</caption>
                                 <thead>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt
index a357a5712f1..8b89b83af02 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt
@@ -43,6 +43,7 @@
                                     <fieldset>
                                         <legend>Show</legend>
                                         <form class="form-inline" action="/cgi-bin/koha/opac-tags_subject.pl" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <p>up to <input type="text" name="number" value="[% number | html %]" size="4" maxlength="4" /> subjects <input type="submit" class="btn btn-primary" value="OK" /></p>
                                         </form>
                                     </fieldset>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
index 0f0e0c3b5bf..79064270dbb 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
@@ -221,6 +221,7 @@
 
                     [% IF Koha.Preference('AllowPatronToControlAutorenewal') %]
                     <form id="autorenewal_option" action="/cgi-bin/koha/opac-user.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <legend class="sr-only">Auto-renewal</legend>
                             <label for="yes-autorenew_checkouts">
                                 Allow auto-renewal:
@@ -320,6 +321,7 @@
                             <div id="opac-user-checkouts" class="tab-pane active" role="tabpanel" aria-labelledby="opac-user-checkouts-tab">
                                 [% IF ( issues_count ) %]
                                     <form id="renewselected" action="/cgi-bin/koha/opac-renew.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <legend class="sr-only">Renew selected</legend>
                                         <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]">
                                         <input type="hidden" name="from" value="opac_user" />
@@ -559,6 +561,7 @@
 
                                     [% IF ( canrenew && !userdebarred && OpacRenewalAllowed && !( logged_in_user.is_expired && logged_in_user.category.effective_BlockExpiredPatronOpacActions ) ) %]
                                         <form id="renewall" class="js-hide" action="/cgi-bin/koha/opac-renew.pl" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <legend class="sr-only">Renew</legend>
                                             <input type="hidden" name="from" value="opac_user" />
                                             <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
@@ -900,6 +903,7 @@
                                                 <td class="cancelrecall">
                                                     [% IF ( RECALL.requested or RECALL.overdue ) %]
                                                         <form action="/cgi-bin/koha/opac-recall.pl" method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="cancel">
                                                             <input type="hidden" name="recall_id" value="[% RECALL.id | html %]">
                                                             <input type="hidden" name="biblionumber" value="[% RECALL.biblio_id | html %]">
@@ -1040,6 +1044,7 @@
     <div class="modal-dialog">
         <div class="modal-content">
             <form action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-header">
                     [% IF HOLD.suspend %]
                         <h5 class="modal-title" id="suspendModalLabel">Resume hold</h5>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
index cc044a6845a..fac1905c506 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
@@ -101,6 +101,7 @@
                                     </table>
                                     <div>
                                         <form method="post" action="#" id="finish_form">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <legend class="sr-only">Finish</legend>
                                             <button id="sci_finish_button" type="submit" class="btn btn-primary"><i class="fa fa-check" aria-hidden="true"></i> Finish</button>
                                         </form>
@@ -115,6 +116,7 @@
                         [%# Prompt for barcodes %]
                         <div id="new_checkins" class="sci_entry">
                             <form id="scan_form" name="scan_form" method="post" action="/cgi-bin/koha/sci/sci-main.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Scan</legend>
                                 <div class="row">
                                     <div class="col-auto">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
index 003c792402f..e5fc2c2267c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
@@ -94,6 +94,7 @@
 
                             [% IF ( returnitem && Koha.Preference('SCOAllowCheckin') ) %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="errorForm" class="inline" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend class="sr-only">Return</legend>
                                     <input type="hidden" name="op" value="returnbook" />
                                     <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -104,6 +105,7 @@
                             [% END %]
 
                             <form action="/cgi-bin/koha/sco/sco-main.pl" name="errorForm" class="inline" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Error</legend>
                                 <input type="hidden" name="op" value="" />
                                 <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -123,6 +125,7 @@
 
                             [% IF ( renew && Koha.Preference('SCOAllowCheckin') ) %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend class="sr-only">Return</legend>
                                     <input type="hidden" name="op" value="returnbook" />
                                     <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -135,6 +138,7 @@
 
                             [% UNLESS ( renew ) %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend class="sr-only">Renew</legend>
                                     <input type="hidden" name="op" value="renew" />
                                     <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -145,6 +149,7 @@
                                   </form>
                             [% ELSE %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend class="sr-only">Renew</legend>
                                     <input type="hidden" name="op" value="renew" />
                                     <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -156,6 +161,7 @@
                             [% END %]
 
                             <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Cancel</legend>
                                 <input type="hidden" name="op" value="" />
                                 <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -242,6 +248,7 @@
                         [% IF ( validuser ) %]
                             <div id="newcheckout" class="sco_entry">
                                 <form id="scan_form" name="scan_form" method="post" action="/cgi-bin/koha/sco/sco-main.pl" onsubmit="return checkout_confirm('[% patronid | html %]');">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend><h2>
                                         [% IF ( Koha.Preference('SCOAllowCheckin') ) %]
                                             <span>Check out, return, or renew an item:</span>
@@ -343,6 +350,7 @@
                                                     [% END %]
                                                     <td>
                                                         <form action="/cgi-bin/koha/sco/sco-main.pl" method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <legend class="sr-only">Issue renews</legend>
                                                             <input type="hidden" name="patronid" value="[% patronid | html %]" />
                                                             <input type="hidden" name="barcode" value="[% ISSUE.barcode | html %]" />
@@ -403,6 +411,7 @@
                         [% ELSE # IF validuser %]
                             <div class="sco_entry" >
                                 <form id="mainform" action="/cgi-bin/koha/sco/sco-main.pl" name="mainform" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset>
                                         [% IF ( Koha.Preference('SelfCheckoutByLogin') ) %]
                                             <legend>Log in to your account</legend>
-- 
2.25.1