From fc709fd69d4a4b39f763b44b8b367cf47d72e6c0 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 4 Aug 2023 11:28:53 +0200
Subject: [PATCH] Bug 34478: Add missing CSRF token to POST forms

This is the result of
  % perl csrf_add_missing_csrf.pl
---
 .../prog/en/includes/acquisitions-search.inc     |  2 ++
 .../prog/en/includes/acquisitions-toolbar.inc    |  1 +
 .../prog/en/includes/budgets-admin-search.inc    |  1 +
 .../prog/en/includes/checkin-search-box.inc      |  1 +
 .../prog/en/includes/checkouts-table.inc         |  1 +
 .../intranet-tmpl/prog/en/includes/circ-menu.inc |  2 ++
 .../prog/en/includes/cities-admin-search.inc     |  1 +
 .../prog/en/includes/contracts-admin-search.inc  |  1 +
 .../prog/en/includes/currencies-admin-search.inc |  1 +
 .../prog/en/includes/desks-admin-search.inc      |  1 +
 .../prog/en/includes/letters-search.inc          |  1 +
 .../prog/en/includes/mana/mana-share-report.inc  |  1 +
 .../prog/en/includes/member-search-box.inc       |  1 +
 .../prog/en/includes/members-toolbar.inc         |  1 +
 .../en/includes/modals/cataloguing_create_av.inc |  1 +
 .../includes/modals/serials_multi_receiving.inc  |  1 +
 .../prog/en/includes/patron-detail-tabs.inc      |  3 +++
 .../prog/en/includes/patron-restrictions-tab.inc |  1 +
 .../prog/en/includes/patron-search-box.inc       |  1 +
 .../prog/en/includes/patron_messages.inc         |  1 +
 .../prog/en/includes/patrons-admin-search.inc    |  1 +
 .../prog/en/includes/renew-search-box.inc        |  1 +
 .../prog/en/includes/virtualshelves-toolbar.inc  |  1 +
 .../prog/en/includes/waiting_holds.inc           |  1 +
 .../prog/en/includes/z3950-admin-search.inc      |  1 +
 .../prog/en/modules/acqui/acqui-home.tt          |  1 +
 .../prog/en/modules/acqui/addorder.tt            |  1 +
 .../prog/en/modules/acqui/addorderiso2709.tt     |  1 +
 .../prog/en/modules/acqui/basket.tt              |  6 ++++++
 .../prog/en/modules/acqui/basketgroup.tt         |  1 +
 .../prog/en/modules/acqui/basketheader.tt        |  1 +
 .../prog/en/modules/acqui/cancelorder.tt         |  1 +
 .../prog/en/modules/acqui/duplicate_orders.tt    |  3 +++
 .../prog/en/modules/acqui/histsearch.tt          |  1 +
 .../prog/en/modules/acqui/invoice-files.tt       |  1 +
 .../prog/en/modules/acqui/invoice.tt             |  2 ++
 .../prog/en/modules/acqui/invoices.tt            |  1 +
 .../prog/en/modules/acqui/lateorders.tt          |  3 +++
 .../prog/en/modules/acqui/moddeliverydate.tt     |  1 +
 .../prog/en/modules/acqui/modordernotes.tt       |  1 +
 .../prog/en/modules/acqui/neworderempty.tt       |  2 ++
 .../prog/en/modules/acqui/supplier.tt            |  1 +
 .../prog/en/modules/acqui/uncertainprice.tt      |  2 ++
 .../prog/en/modules/acqui/vendor_issues.tt       |  2 ++
 .../prog/en/modules/acqui/z3950_search.tt        |  2 ++
 .../prog/en/modules/admin/additional-fields.tt   |  1 +
 .../prog/en/modules/admin/admin-home.tt          |  1 +
 .../prog/en/modules/admin/adveditorshortcuts.tt  |  1 +
 .../prog/en/modules/admin/aqbudgetperiods.tt     |  5 +++++
 .../prog/en/modules/admin/aqbudgets.tt           |  2 ++
 .../prog/en/modules/admin/aqcontract.tt          |  4 ++++
 .../prog/en/modules/admin/aqplan.tt              |  3 +++
 .../prog/en/modules/admin/audio_alerts.tt        |  2 ++
 .../en/modules/admin/auth_subfields_structure.tt |  2 ++
 .../prog/en/modules/admin/auth_tag_structure.tt  |  5 +++++
 .../prog/en/modules/admin/authorised_values.tt   |  2 ++
 .../prog/en/modules/admin/authtypes.tt           |  3 +++
 .../prog/en/modules/admin/biblio_framework.tt    |  4 ++++
 .../en/modules/admin/branch_transfer_limits.tt   |  1 +
 .../prog/en/modules/admin/branches.tt            |  2 ++
 .../prog/en/modules/admin/cash_registers.tt      |  1 +
 .../prog/en/modules/admin/categories.tt          |  2 ++
 .../prog/en/modules/admin/cities.tt              |  2 ++
 .../prog/en/modules/admin/classsources.tt        |  3 +++
 .../prog/en/modules/admin/clone-rules.tt         |  1 +
 .../prog/en/modules/admin/columns_settings.tt    |  1 +
 .../prog/en/modules/admin/credit_types.tt        |  1 +
 .../prog/en/modules/admin/curbside_pickup.tt     |  1 +
 .../prog/en/modules/admin/currency.tt            |  4 ++++
 .../prog/en/modules/admin/debit_types.tt         |  1 +
 .../intranet-tmpl/prog/en/modules/admin/desks.tt |  2 ++
 .../prog/en/modules/admin/didyoumean.tt          |  1 +
 .../prog/en/modules/admin/edi_accounts.tt        |  2 ++
 .../prog/en/modules/admin/edi_ean_accounts.tt    |  2 ++
 .../modules/admin/identity_provider_domains.tt   |  2 ++
 .../prog/en/modules/admin/identity_providers.tt  |  2 ++
 .../prog/en/modules/admin/items_search_field.tt  |  1 +
 .../prog/en/modules/admin/items_search_fields.tt |  1 +
 .../prog/en/modules/admin/itemtypes.tt           |  3 +++
 .../prog/en/modules/admin/koha2marclinks.tt      |  1 +
 .../prog/en/modules/admin/localization.tt        |  1 +
 .../prog/en/modules/admin/marc-overlay-rules.tt  |  2 ++
 .../en/modules/admin/marc_subfields_structure.tt |  3 +++
 .../prog/en/modules/admin/marctagstructure.tt    |  5 +++++
 .../prog/en/modules/admin/matching-rules.tt      |  2 ++
 .../prog/en/modules/admin/oai_set_mappings.tt    |  1 +
 .../prog/en/modules/admin/oai_sets.tt            |  1 +
 .../prog/en/modules/admin/overdrive.tt           |  1 +
 .../prog/en/modules/admin/patron-attr-types.tt   |  2 ++
 .../prog/en/modules/admin/preferences.tt         |  1 +
 .../prog/en/modules/admin/restrictions.tt        |  2 ++
 .../admin/searchengine/elasticsearch/mappings.tt |  3 +++
 .../prog/en/modules/admin/share_content.tt       |  3 +++
 .../prog/en/modules/admin/smart-rules.tt         |  9 +++++++++
 .../prog/en/modules/admin/sms_providers.tt       |  1 +
 .../prog/en/modules/admin/smtp_servers.tt        |  2 ++
 .../prog/en/modules/admin/sru_modmapping.tt      |  1 +
 .../prog/en/modules/admin/sru_modmapping_auth.tt |  1 +
 .../prog/en/modules/admin/systempreferences.tt   |  5 +++++
 .../en/modules/admin/transport-cost-matrix.tt    |  1 +
 .../prog/en/modules/admin/usage_statistics.tt    |  1 +
 .../prog/en/modules/admin/z3950servers.tt        |  1 +
 koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt  |  2 ++
 .../prog/en/modules/authorities/authorities.tt   |  1 +
 .../prog/en/modules/authorities/merge.tt         |  2 ++
 .../prog/en/modules/basket/downloadcart.tt       |  1 +
 .../prog/en/modules/basket/sendbasketform.tt     |  1 +
 .../prog/en/modules/catalogue/moredetail.tt      |  6 ++++++
 .../prog/en/modules/catalogue/results.tt         |  1 +
 .../prog/en/modules/catalogue/search-history.tt  |  4 ++++
 .../prog/en/modules/catalogue/stockrotation.tt   |  1 +
 .../prog/en/modules/cataloguing/addbiblio.tt     |  1 +
 .../prog/en/modules/cataloguing/additem.tt       |  1 +
 .../prog/en/modules/cataloguing/linkitem.tt      |  3 +++
 .../prog/en/modules/cataloguing/merge.tt         |  2 ++
 .../prog/en/modules/cataloguing/moveitem.tt      |  2 ++
 .../value_builder/marc21_linking_section.tt      |  1 +
 .../value_builder/unimarc_field_210c.tt          |  1 +
 .../value_builder/unimarc_field_4XX.tt           |  1 +
 .../en/modules/cataloguing/z3950_auth_search.tt  |  2 ++
 .../prog/en/modules/cataloguing/z3950_search.tt  |  2 ++
 .../prog/en/modules/circ/article-requests.tt     |  1 +
 .../prog/en/modules/circ/branchoverdues.tt       |  1 +
 .../prog/en/modules/circ/branchtransfers.tt      |  4 ++++
 .../prog/en/modules/circ/checkout-notes.tt       |  1 +
 .../prog/en/modules/circ/circulation.tt          |  4 ++++
 .../modules/circ/circulation_batch_checkouts.tt  |  2 ++
 .../prog/en/modules/circ/curbside_pickups.tt     | 10 ++++++++++
 .../prog/en/modules/circ/overdue.tt              |  1 +
 .../prog/en/modules/circ/pendingreserves.tt      |  3 +++
 .../intranet-tmpl/prog/en/modules/circ/renew.tt  |  9 +++++++++
 .../prog/en/modules/circ/request-article.tt      |  1 +
 .../prog/en/modules/circ/reserveratios.tt        |  1 +
 .../prog/en/modules/circ/returns.tt              | 10 ++++++++++
 .../prog/en/modules/circ/set-library.tt          |  2 ++
 .../prog/en/modules/circ/waitingreserves.tt      |  3 +++
 .../prog/en/modules/clubs/clubs-add-modify.tt    |  1 +
 .../en/modules/clubs/templates-add-modify.tt     |  1 +
 .../modules/course_reserves/add_items-step1.tt   |  1 +
 .../modules/course_reserves/add_items-step2.tt   |  1 +
 .../modules/course_reserves/batch_add_items.tt   |  1 +
 .../en/modules/course_reserves/batch_rm_items.tt |  1 +
 .../prog/en/modules/course_reserves/course.tt    |  1 +
 .../prog/en/modules/ill/ill-requests.tt          |  7 +++++++
 .../prog/en/modules/installer/auth.tt            |  1 +
 .../prog/en/modules/installer/step1.tt           |  1 +
 .../prog/en/modules/installer/step2.tt           |  2 ++
 .../prog/en/modules/installer/step3.tt           |  6 ++++++
 .../prog/en/modules/labels/barcode-print.tt      |  1 +
 .../prog/en/modules/labels/label-bib-search.tt   |  1 +
 .../prog/en/modules/labels/label-edit-batch.tt   |  1 +
 .../prog/en/modules/labels/label-edit-range.tt   |  1 +
 .../prog/en/modules/labels/label-print.tt        |  1 +
 .../prog/en/modules/labels/search.tt             |  1 +
 .../prog/en/modules/labels/spinelabel-home.tt    |  1 +
 .../prog/en/modules/members/apikeys.tt           |  3 +++
 .../prog/en/modules/members/boraccount.tt        |  1 +
 .../prog/en/modules/members/discharge.tt         |  1 +
 .../prog/en/modules/members/files.tt             |  1 +
 .../prog/en/modules/members/housebound.tt        |  2 ++
 .../prog/en/modules/members/mancredit.tt         |  1 +
 .../prog/en/modules/members/maninvoice.tt        |  1 +
 .../prog/en/modules/members/member-password.tt   |  1 +
 .../prog/en/modules/members/member.tt            |  1 +
 .../prog/en/modules/members/memberentrygen.tt    |  1 +
 .../prog/en/modules/members/members-update.tt    |  1 +
 .../prog/en/modules/members/notices.tt           |  1 +
 .../intranet-tmpl/prog/en/modules/members/pay.tt |  1 +
 .../prog/en/modules/members/paycollect.tt        |  6 +++---
 .../prog/en/modules/members/update-child.tt      |  1 +
 .../prog/en/modules/offline_circ/process_koc.tt  |  3 +++
 .../en/modules/onboarding/onboardingstep1.tt     |  1 +
 .../en/modules/onboarding/onboardingstep2.tt     |  1 +
 .../en/modules/onboarding/onboardingstep3.tt     |  1 +
 .../en/modules/onboarding/onboardingstep4.tt     |  1 +
 .../en/modules/onboarding/onboardingstep5.tt     |  1 +
 .../prog/en/modules/patron_lists/add-modify.tt   |  1 +
 .../prog/en/modules/patron_lists/list.tt         |  2 ++
 .../prog/en/modules/patroncards/edit-batch.tt    |  1 +
 .../prog/en/modules/patroncards/edit-layout.tt   |  1 +
 .../prog/en/modules/patroncards/edit-profile.tt  |  1 +
 .../prog/en/modules/patroncards/edit-template.tt |  1 +
 .../prog/en/modules/patroncards/image-manage.tt  |  2 ++
 .../prog/en/modules/patroncards/print.tt         |  1 +
 .../prog/en/modules/plugins/plugins-upload.tt    |  1 +
 .../intranet-tmpl/prog/en/modules/pos/pay.tt     |  2 ++
 .../prog/en/modules/pos/register.tt              |  2 ++
 .../prog/en/modules/pos/registers.tt             |  1 +
 .../prog/en/modules/recalls/recalls_overdue.tt   |  1 +
 .../prog/en/modules/recalls/recalls_queue.tt     |  1 +
 .../prog/en/modules/recalls/recalls_to_pull.tt   |  1 +
 .../prog/en/modules/recalls/recalls_waiting.tt   |  2 ++
 .../prog/en/modules/recalls/request.tt           |  1 +
 .../en/modules/reports/acquisitions_stats.tt     |  1 +
 .../prog/en/modules/reports/bor_issues_top.tt    |  1 +
 .../prog/en/modules/reports/borrowers_out.tt     |  1 +
 .../prog/en/modules/reports/borrowers_stats.tt   |  1 +
 .../en/modules/reports/cash_register_stats.tt    |  1 +
 .../prog/en/modules/reports/cat_issues_top.tt    |  1 +
 .../prog/en/modules/reports/catalogue_out.tt     |  1 +
 .../prog/en/modules/reports/catalogue_stats.tt   |  1 +
 .../prog/en/modules/reports/dictionary.tt        |  6 ++++++
 .../en/modules/reports/guided_reports_start.tt   | 16 ++++++++++++++++
 .../prog/en/modules/reports/issues_avg_stats.tt  |  1 +
 .../prog/en/modules/reports/issues_stats.tt      |  1 +
 .../prog/en/modules/reports/itemslost.tt         |  1 +
 .../prog/en/modules/reports/itemtypes.tt         |  1 +
 .../prog/en/modules/reports/orders_by_budget.tt  |  1 +
 .../prog/en/modules/reports/reserves_stats.tt    |  1 +
 .../prog/en/modules/reports/serials_stats.tt     |  1 +
 .../prog/en/modules/reserve/request.tt           |  5 +++++
 .../en/modules/rotating_collections/addItems.tt  |  1 +
 .../rotating_collections/editCollections.tt      |  1 +
 .../rotating_collections/transferCollection.tt   |  1 +
 .../prog/en/modules/serials/acqui-search.tt      |  1 +
 .../prog/en/modules/serials/claims.tt            |  2 ++
 .../prog/en/modules/serials/routing-preview.tt   |  1 +
 .../prog/en/modules/serials/routing.tt           |  1 +
 .../en/modules/serials/serials-collection.tt     |  1 +
 .../prog/en/modules/serials/serials-edit.tt      |  1 +
 .../prog/en/modules/serials/serials-search.tt    |  1 +
 .../prog/en/modules/serials/subscription-add.tt  |  1 +
 .../en/modules/serials/subscription-batchedit.tt |  1 +
 .../en/modules/serials/subscription-detail.tt    |  1 +
 .../modules/serials/subscription-frequencies.tt  |  1 +
 .../en/modules/serials/subscription-history.tt   |  1 +
 .../serials/subscription-numberpatterns.tt       |  1 +
 .../en/modules/serials/subscription-renew.tt     |  1 +
 .../prog/en/modules/suggestion/suggestion.tt     |  2 ++
 .../intranet-tmpl/prog/en/modules/tags/review.tt |  3 +++
 .../prog/en/modules/tools/additional-contents.tt |  3 +++
 .../tools/automatic_item_modification_by_age.tt  |  1 +
 .../prog/en/modules/tools/batchMod-del.tt        |  1 +
 .../prog/en/modules/tools/batchMod-edit.tt       |  1 +
 .../prog/en/modules/tools/batchMod.tt            |  1 +
 .../en/modules/tools/batch_delete_records.tt     |  2 ++
 .../en/modules/tools/batch_extend_due_dates.tt   |  2 ++
 .../modules/tools/batch_record_modification.tt   |  2 ++
 .../prog/en/modules/tools/cleanborrowers.tt      |  2 ++
 .../prog/en/modules/tools/csv-profiles.tt        |  2 ++
 .../prog/en/modules/tools/export.tt              |  4 ++++
 .../prog/en/modules/tools/holidays.tt            |  3 +++
 .../prog/en/modules/tools/import_borrowers.tt    |  1 +
 .../prog/en/modules/tools/inventory.tt           |  2 ++
 .../prog/en/modules/tools/letter.tt              |  5 +++++
 .../prog/en/modules/tools/manage-marc-import.tt  |  5 +++++
 .../modules/tools/marc_modification_templates.tt |  2 ++
 .../prog/en/modules/tools/modborrowers.tt        |  2 ++
 .../prog/en/modules/tools/overduerules.tt        |  2 ++
 .../prog/en/modules/tools/picture-upload.tt      |  1 +
 .../prog/en/modules/tools/problem-reports.tt     |  1 +
 .../prog/en/modules/tools/quotes.tt              |  2 ++
 .../prog/en/modules/tools/scheduler.tt           |  2 ++
 .../prog/en/modules/tools/stage-marc-import.tt   |  2 ++
 .../prog/en/modules/tools/stockrotation.tt       |  5 +++++
 .../prog/en/modules/tools/upload-images.tt       |  2 ++
 .../prog/en/modules/tools/upload.tt              |  4 ++++
 .../prog/en/modules/tools/viewlog.tt             |  1 +
 .../modules/virtualshelves/addbybiblionumber.tt  |  1 +
 .../en/modules/virtualshelves/downloadshelf.tt   |  1 +
 .../en/modules/virtualshelves/sendshelfform.tt   |  1 +
 .../prog/en/modules/virtualshelves/shelves.tt    |  4 ++++
 .../bootstrap/en/includes/account-table.inc      |  1 +
 .../bootstrap/en/includes/holds-table.inc        |  7 +++++++
 .../opac-tmpl/bootstrap/en/includes/masthead.inc |  1 +
 .../en/includes/opac-detail-sidebar.inc          |  1 +
 .../bootstrap/en/includes/opac-note.inc          |  1 +
 .../bootstrap/en/includes/overdrive-checkout.inc |  1 +
 .../bootstrap/en/includes/overdrive-login.inc    |  1 +
 .../en/modules/opac-addbybiblionumber.tt         |  3 +++
 .../bootstrap/en/modules/opac-alert-subscribe.tt |  2 ++
 .../opac-tmpl/bootstrap/en/modules/opac-auth.tt  |  1 +
 .../en/modules/opac-authorities-home.tt          |  1 +
 .../bootstrap/en/modules/opac-basket.tt          |  1 +
 .../en/modules/opac-curbside-pickups.tt          |  3 +++
 .../bootstrap/en/modules/opac-detail.tt          |  2 ++
 .../bootstrap/en/modules/opac-downloadcart.tt    |  1 +
 .../bootstrap/en/modules/opac-downloadshelf.tt   |  1 +
 .../bootstrap/en/modules/opac-illrequests.tt     |  4 ++++
 .../bootstrap/en/modules/opac-issue-note.tt      |  1 +
 .../opac-tmpl/bootstrap/en/modules/opac-main.tt  |  1 +
 .../bootstrap/en/modules/opac-memberentry.tt     |  1 +
 .../bootstrap/en/modules/opac-passwd.tt          |  2 ++
 .../en/modules/opac-password-recovery.tt         |  2 ++
 .../bootstrap/en/modules/opac-patron-consent.tt  |  1 +
 .../bootstrap/en/modules/opac-privacy.tt         |  4 ++++
 .../bootstrap/en/modules/opac-recall.tt          |  1 +
 .../bootstrap/en/modules/opac-recalls.tt         |  1 +
 .../en/modules/opac-registration-confirmation.tt |  1 +
 .../bootstrap/en/modules/opac-reportproblem.tt   |  1 +
 .../bootstrap/en/modules/opac-request-article.tt |  1 +
 .../bootstrap/en/modules/opac-reserve.tt         |  1 +
 .../bootstrap/en/modules/opac-reset-password.tt  |  1 +
 .../bootstrap/en/modules/opac-review.tt          |  1 +
 .../bootstrap/en/modules/opac-search-history.tt  |  4 ++++
 .../bootstrap/en/modules/opac-sendbasketform.tt  |  1 +
 .../bootstrap/en/modules/opac-sendshelfform.tt   |  1 +
 .../bootstrap/en/modules/opac-serial-issues.tt   |  1 +
 .../bootstrap/en/modules/opac-shelves.tt         | 12 ++++++++++++
 .../bootstrap/en/modules/opac-suggestions.tt     |  2 ++
 .../opac-tmpl/bootstrap/en/modules/opac-tags.tt  |  1 +
 .../bootstrap/en/modules/opac-tags_subject.tt    |  1 +
 .../opac-tmpl/bootstrap/en/modules/opac-user.tt  |  5 +++++
 .../bootstrap/en/modules/sci/sci-main.tt         |  2 ++
 .../bootstrap/en/modules/sco/sco-main.tt         |  9 +++++++++
 305 files changed, 579 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc
index 4fabdd4c341..7403c312db9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc
@@ -3,6 +3,7 @@
     <div class="tab-content">
         <div id="supplier_search" role="tabpanel" class="tab-pane active">
             <form name="findsupplier" action="/cgi-bin/koha/acqui/booksellers.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="supplier"><span class="control-text">Vendor search</span> <i class="fa fa-fw fa-upload" aria-hidden="true"></i></label>
                 </div>
@@ -16,6 +17,7 @@
 
         <div id="orders_search" role="tabpanel" class="tab-pane">
             <form action="/cgi-bin/koha/acqui/histsearch.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="order_title"><span class="control-text">Orders search</span> <i class="fa fa-fw fa-download" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
index 1dfd5955ab3..7060b7ca0e3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
@@ -25,6 +25,7 @@
                 [% UNLESS ( basketcount OR subscriptioncount ) %]
                     <div class="btn-group">
                         <form action="/cgi-bin/koha/acqui/supplier.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete" />
                             <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                             <button class="btn btn-default" id="deletesupplier" type="submit"><i class="fa fa-trash-can"></i> Delete vendor</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc
index a4222469861..f8267a45a9d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc
@@ -6,6 +6,7 @@
     <div class="tab-content">
         <div id="budgets_search" role="tabpanel" class="tab-pane active">
             <form action="/cgi-bin/koha/admin/aqbudgets.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
 
                 <div class="form-title">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search-box.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search-box.inc
index a8a03d7b5d4..1565d098b54 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search-box.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search-box.inc
@@ -6,6 +6,7 @@
         <div id="checkin_search" role="tabpanel" class="tab-pane">
     [% END %]
         <form method="post" action="/cgi-bin/koha/circ/returns.pl" autocomplete="off">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="form-title">
                 <label class="control-label" for="ret_barcode"><span class="control-text">Check in</span> <i class="fa fa-fw fa-download" aria-hidden="true"></i></label>
             </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc
index 05c888f0559..313fe2b49c9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc
@@ -16,6 +16,7 @@
         </p>
     </div>
     <form name="issues" action="/cgi-bin/koha/tools/export.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <table id="issues-table" style="width: 100% !Important;">
             <thead>
                 <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
index 61a132f8b67..4c4cfa75ebe 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
@@ -200,6 +200,7 @@
                 <div id="upload-patron-image" class="patroninfo-section">
                     <h5>Upload patron photo</h5>
                     <form method="post" id="picture-upload" action="/cgi-bin/koha/tools/picture-upload.pl"
+                        [% INCLUDE 'csrf-token.inc' %]
                         enctype="multipart/form-data">
                         [% IF ( patron.image ) %]
                             <div class="hint">
@@ -232,6 +233,7 @@
                 <div id="capture-patron-image" class="patroninfo-section">
                     <h5>Take patron photo</h5>
                     <form method="post" id="camera-upload" action="/cgi-bin/koha/tools/picture-upload.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="btn-toolbar">
                             <div class="btn-group">
                                 <button class="btn btn-default" id="takebutton"><i class="fa fa-camera"></i> Take photo</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc
index f389a646141..66ce3e7b2e7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="city_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="city_name_filter"><span class="control-text">Search cities</span> <i class="fa fa-fw fa-building" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc
index 5cbf959059d..31ab12cab27 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="contract_description_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="searchfield"><span class="control-text">Search contracts</span> <i class="fa-solid fa-fw fa-pen-to-square" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc
index 9b51f4fa70f..d7a5b4d824a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="currency_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="description"><span class="control-text">Search currencies</span> <i class="fa-solid fa-fw fa-dollar-sign" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/desks-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/desks-admin-search.inc
index 53d15e7dd44..52aa016d58b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/desks-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/desks-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="desk_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name|html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="desk_name"><span class="control-text">Search desks</span> <i class="fa fa-fw fa-desktop" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc
index dc7e1092276..0237ba3cdbf 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="notices_search" role="tabpanel" class="tab-pane active">
             <form action="/cgi-bin/koha/tools/letter.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="searchfield"><span class="control-text">Search notices</span> <i class="fa-solid fa-fw fa-comment-dots" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-share-report.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-share-report.inc
index a181062892d..3ddf2c6fa7e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-share-report.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-share-report.inc
@@ -2,6 +2,7 @@
     <div class="modal-dialog modal-wide" role="document">
         <div class="modal-content">
             <form method="post" id="mana_share_form" action="/cgi-bin/koha/reports/guided_reports.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
                     <h3 id="mana_share_modal_label">Share with Mana</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/member-search-box.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/member-search-box.inc
index 70c22389d27..a530a13d58f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/member-search-box.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/member-search-box.inc
@@ -11,6 +11,7 @@
         <div id="patron_search" role="tabpanel" class="tab-pane">
     [% END %]
         <form method="post" action="/cgi-bin/koha/members/member.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="quicksearch" value="1" />
 
             <div class="form-title">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
index 8e277919a6b..ac3dfc60e54 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
@@ -112,6 +112,7 @@
     <div class="modal-dialog">
         <div class="modal-content">
             <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-header">
                     <h3>Leave a message</h3>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cataloguing_create_av.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cataloguing_create_av.inc
index 06184747407..abdc4b3f978 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cataloguing_create_av.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cataloguing_create_av.inc
@@ -6,6 +6,7 @@
                 <h3 id="avCreateLabel">Create a new authorized value</h3>
             </div>
             <form id="add_new_av" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                     <fieldset class="rows">
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc
index 74e9be3e350..17035f431c5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc
@@ -2,6 +2,7 @@
     <div class="modal-dialog">
         <div class="modal-content">
             <form action="/cgi-bin/koha/serials/serials-collection.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                     <fieldset class="rows">
                         <legend>Multi receiving</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-detail-tabs.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-detail-tabs.inc
index fa6ff2f34f0..ad76abbfeed 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-detail-tabs.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-detail-tabs.inc
@@ -138,6 +138,7 @@
             [% WRAPPER tab_panel tabname="holds" %]
                 [% IF ( holds_count ) %]
                     <form action="/cgi-bin/koha/reserve/modrequest.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="from" value="circ" />
                         <table id="holds-table" style="width: 100% !Important;">
                             <thead>
@@ -175,6 +176,7 @@
 
                     [% IF Koha.Preference('SuspendHoldsIntranet') %]
                         <form action="/cgi-bin/koha/reserve/modrequest_suspendall.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="action">
                                 <input type="hidden" name="from" value="[% patronpage | html %]" />
                                 <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
@@ -189,6 +191,7 @@
                         </form>
 
                         <form action="/cgi-bin/koha/reserve/modrequest_suspendall.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="action">
                                 <input type="hidden" name="from" value="borrower" />
                                 <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
index 20a9eaf19cd..bc83ea093ae 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
@@ -47,6 +47,7 @@
 [% IF CAN_user_borrowers_edit_borrowers && CAN_user_circulate_manage_restrictions %]
     <p><a href="#" id="add_manual_restriction"><i class="fa fa-plus"></i> Add manual restriction</a></p>
     <form method="post" action="/cgi-bin/koha/members/mod_debarment.pl" class="clearfix">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
         <input type="hidden" name="action" value="add" />
         <fieldset class="rows" id="manual_restriction_form">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc
index 2e616a532bd..2dc39f81c4c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc
@@ -6,6 +6,7 @@
         <div id="circ_search" role="tabpanel" class="tab-pane">
     [% END %]
         <form action="/cgi-bin/koha/circ/circulation.pl" id="patronsearch" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="form-title">
                 <label class="control-label" for="findborrower"><span class="control-text">Check out</span> <i class="fa fa-fw fa-upload" aria-hidden="true"></i></label>
             </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
index 3a52c777c74..61b9ad0935b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
@@ -335,6 +335,7 @@
             <div class="modal-dialog">
                 <div class="modal-content">
                     <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="message_id" value="[% pm.message_id | html %]"/>
                         <div class="modal-header">
                             <h3>Edit message</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc
index 9ad20aa7137..3275d24520f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="patron_category_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="category_search"><span class="control-text">Search patron categories</span> <i class="fa fa-fw fa-id-card" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/renew-search-box.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/renew-search-box.inc
index 027d0f9eb24..ccd148026c9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/renew-search-box.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/renew-search-box.inc
@@ -6,6 +6,7 @@
         <div id="renew_search" role="tabpanel" class="tab-pane">
     [% END %]
         <form method="post" action="/cgi-bin/koha/circ/renew.pl" autocomplete="off">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="form-title">
                 <label class="control-label" for="ren_barcode"><span class="control-text">Renew</span> <i class="fa fa-fw fa-retweet" aria-hidden="true"></i></label>
             </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
index c00b73d7c2a..20e47cd7261 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
@@ -20,6 +20,7 @@
                 <li>
                     <a id="deleteshelf_toolbar" href="#">Delete list</a>
                     <form id="deleteshelf_toolbar_form" action="shelves.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="delete">
                         <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/waiting_holds.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/waiting_holds.inc
index 484f1d609be..03644ba2b3b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/waiting_holds.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/waiting_holds.inc
@@ -67,6 +67,7 @@
                 <td>[% reserveloo.item.enumchron | html %]</td>
                 <td>
                     <form name="cancelReserve" action="waitingreserves.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="borrowernumber" value="[% reserveloo.borrower.borrowernumber | html %]" />
                         <input type="hidden" name="itemnumber" value="[% reserveloo.item.itemnumber | html %]" />
                         <input type="hidden" name="fbr" value="[% reserveloo.item.holdingbranch | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc
index 671eb3552aa..1519bbbb688 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="z3950_search" role="tabpanel" class="tab-pane active">
             <form action="/cgi-bin/koha/admin/z3950servers.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="searchfield"><span class="control-text">Search Z39.50/SRU servers</span> <i class="fa fa-fw fa-search" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt
index de4aedbcd29..5f464482d36 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt
@@ -53,6 +53,7 @@
     <fieldset>
         <legend>Manage orders</legend>
         <form name="findsupplier" action="/cgi-bin/koha/acqui/booksellers.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <p><label for="supplierpage">Vendor: </label><input type="text" size="25" name="supplier" id="supplierpage" class="focus" />
             <input type="submit" class="btn btn-primary" value="Search" />
             </p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt
index 46ac8d57146..4318829b3e7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt
@@ -15,6 +15,7 @@
     <div class="container-fluid">
       [% IF (not_enough_budget) %]
         <form action="/cgi-bin/koha/acqui/addorder.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
           [% FOREACH var IN vars_loop %]
             [% FOREACH val IN var.values %]
               <input type="hidden" name="[% var.name | html %]" value="[% val | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt
index e598629e03e..47b6cca043d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt
@@ -94,6 +94,7 @@
                         ([% file_name | html %] staged on [% upload_timestamp | $KohaDates  with_hours => 1 %])
                     </h1>
                     <form action="/cgi-bin/koha/acqui/addorderiso2709.pl" method="post" id="Aform" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% WRAPPER tabs id= "tabs" %]
                             [% WRAPPER tabs_nav %]
                                 [% WRAPPER tab_item tabname= "records_to_import" bt_active= 1 %] <span>Select to import</span> [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
index f79f8896f74..44a84b18bff 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
@@ -106,6 +106,7 @@
                                         [% IF ( active && books_loop ) %]
                                             <div class="btn-group">
                                                 <form action="/cgi-bin/koha/acqui/basket.pl" method="post">
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="op" value="email" />
                                                     <input type="hidden" name="basketno" value="[% basketno | html %]" />
                                                     <button type="submit" class="btn btn-default" id="emailvendorbutton"><i class="fa-solid fa-envelope"></i> E-mail order</button>
@@ -309,6 +310,7 @@
                                                     <ol>
                                                         <li id="managedby">
                                                             <form action="/cgi-bin/koha/acqui/basket.pl" method="post">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <span class="label">[% tp('Acquisitions basket managed by user', 'Managed by:') | html %]</span>
                                                                 <div style="display:inline-block">
                                                                     <ul id="users_names" style="padding-left:0">
@@ -347,6 +349,7 @@
                                                                 <span class="label">&nbsp;</span>
                                                                 <div>
                                                                     <form action="/cgi-bin/koha/acqui/basket.pl" method="post">
+                                                                        [% INCLUDE 'csrf-token.inc' %]
                                                                         <select id="select_managing_library" name="branch">
                                                                             <option value="">(no library)</option>
                                                                             [% FOREACH branch IN branches_loop %]
@@ -406,6 +409,7 @@
                                                                     <span class="label">&nbsp;</span>
                                                                     <div style="float:left">
                                                                         <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="post">
+                                                                            [% INCLUDE 'csrf-token.inc' %]
                                                                             <select id="basketgroupid" name="basketgroupid">
                                                                                 <option value="">No group</option>
                                                                                 [% FOREACH bg IN basketgroups %]
@@ -884,6 +888,7 @@
     <div class="modal" id="noteEditor" tabindex="-1" role="dialog" aria-labelledby="noteEditorLabel">
         <div class="modal-dialog" role="document">
             <form id="modify_order_notes" action="/cgi-bin/koha/acqui/modordernotes.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-content">
                     <div class="modal-header">
                         <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
@@ -908,6 +913,7 @@
     <div class="modal" id="dateEditor" tabindex="-1" role="dialog" aria-labelledby="dateEditorLabel">
         <div class="modal-dialog" role="document">
             <form id="modify_estimated_delivery_date" action="/cgi-bin/koha/acqui/moddeliverydate.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-content">
                     <div class="modal-header">
                         <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt
index 48824adea36..847887ce49b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt
@@ -121,6 +121,7 @@
                             <div class="col-xs-6 col-xs-pull-6">
                         [% END %]
                             <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="post" id="groupingform">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset id="various" class="brief">
                                     <ol>
                                         [% UNLESS (closedbg) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
index 88bda81a430..17bf8cfd761 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
@@ -56,6 +56,7 @@
         [% ELSE %]<h1>Add a basket to [% booksellername | html %]</h1>
         [% END %]
     <form name="Aform" action="[% script_name | html %]" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
         <fieldset class="rows">
             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt
index 4098f2fe175..bcc8a30e5c9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt
@@ -35,6 +35,7 @@
 
       [% UNLESS ( confirmcancel ) %]
       <form method="post" action="">
+          [% INCLUDE 'csrf-token.inc' %]
         <div class="dialog alert">
           <h1>Are you sure you want to cancel this order ([% ordernumber | html %])</h1>
           <p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt
index e069fe6e601..bef6481440b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt
@@ -55,6 +55,7 @@
 
 [% IF op == 'search' || op == 'select' %]
 <form action="/cgi-bin/koha/acqui/duplicate_orders.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
         <legend>
             [% IF op == 'search' %]
@@ -137,6 +138,7 @@
 
 [% IF op == 'select' && ( result_order_loop || selected_order_loop ) %]
 <form method="post" action="/cgi-bin/koha/acqui/duplicate_orders.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     <div id="orders_to_copy" class="page-section">
         <table id="table_orders">
             <caption>
@@ -184,6 +186,7 @@
 [% ELSIF op == "batch_edit" %]
 
 <form method="post" action="/cgi-bin/koha/acqui/duplicate_orders.pl" id="batch_edit_form">
+    [% INCLUDE 'csrf-token.inc' %]
     <div id="accounting_details">
       <p>Duplicate all the orders with the following accounting details:</p>
       <fieldset class="rows" style="float:none;">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt
index 45fb4ff1028..cf263bf43b2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt
@@ -202,6 +202,7 @@
 
 [% BLOCK filter_form %]
     <form action="/cgi-bin/koha/acqui/histsearch.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         [% IF ( context == "sidebar" ) %]
             <fieldset class="brief">
                 <h4>Search orders</h4>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
index 7411687e6fa..f754ad6379c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
@@ -87,6 +87,7 @@
       [% IF invoiceid %]
           <br />
           <form method="post" action="/cgi-bin/koha/acqui/invoice-files.pl" enctype="multipart/form-data">
+              [% INCLUDE 'csrf-token.inc' %]
               <fieldset class="rows">
                   <legend>Upload new file</legend>
                   <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
index c45df84eb7d..1f42002f7d9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
@@ -61,6 +61,7 @@
                 <p>Vendor: <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | uri %]">[% suppliername | html %]</a></p>
 
                 <form action="/cgi-bin/koha/acqui/invoice.pl" method="post" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <ol>
                             <li>
@@ -147,6 +148,7 @@
                 </form>
 
                 <form action="/cgi-bin/koha/acqui/invoice.pl" method="post" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <input type="hidden" name="invoiceid" value="[% invoiceid | html %]" />
                         <h3>Adjustments</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
index 7e160a8318d..572952a5340 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
@@ -168,6 +168,7 @@
 
                         <div id="merge_invoices">
                             <form id="merge_invoice_form" class="validated" action="/cgi-bin/koha/acqui/invoice.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="rows">
                                     <ol>
                                         <li><h2>Merge invoices</h2></li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
index aa04abec747..395b21c68b2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
@@ -53,6 +53,7 @@
 [% END %]
 [% IF lateorders.size %]
 <form action="lateorders.pl" name="claim" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="send_alert" />
   <input type="hidden" name="delay" value="[% delay | html %]" />
   <input type="hidden" name="booksellerid" value="[% bookseller_filter.id | html %]" />
@@ -277,6 +278,7 @@
 <div class="modal" id="noteEditor" tabindex="-1" role="dialog" aria-labelledby="noteEditorLabel">
     <div class="modal-dialog" role="document">
         <form id="modify_order_notes" action="/cgi-bin/koha/acqui/modordernotes.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="modal-content">
                 <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
@@ -301,6 +303,7 @@
 <div class="modal" id="dateEditor" tabindex="-1" role="dialog" aria-labelledby="dateEditorLabel">
     <div class="modal-dialog" role="document">
         <form id="modify_estimated_delivery_date" action="/cgi-bin/koha/acqui/moddeliverydate.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="modal-content">
                 <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/moddeliverydate.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/moddeliverydate.tt
index b33e4fb4d7e..de4ea9f661c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/moddeliverydate.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/moddeliverydate.tt
@@ -37,6 +37,7 @@
 
       <h1>Change estimated delivery date</h1>
       <form action="/cgi-bin/koha/acqui/moddeliverydate.pl" method="post">
+          [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="brief">
           <label for="estimated_delivery_date">Estimated delivery date:</label>
           <input type="text" id="estimated_delivery_date" size="10" name="estimated_delivery_date" class="flatpickr" value="[% estimated_delivery_date | html %]"/>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt
index dada233a8a9..68a0c0c2cf8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt
@@ -47,6 +47,7 @@
           <h1>Change order internal note (order no. [% ordernumber | html %])</h1>
       [% END %]
       <form action="/cgi-bin/koha/acqui/modordernotes.pl" method="post">
+          [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="brief">
           <label for="ordernotes">Note:</label>
           <textarea id="ordernotes" name="ordernotes" rows="3" cols="30" class="focus">[% ordernotes | html %]</textarea>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
index 7e2fa8d6539..40f5eea49fd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
@@ -291,6 +291,7 @@
         [% IF ( creationdate ) %]<li><span class="label">Open on:</span>  [% creationdate | $KohaDates %]</li>[% END %]
         [% IF ( closedate ) %]
         <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
         <li><span class="label">Closed on:</span>  [% closedate | $KohaDates %]</li>
         [% IF ( basketgroups ) %]
             <li>Basketgroup: <select id="basketgroupid" name="basketgroupid">
@@ -316,6 +317,7 @@
 [% END %]
 
 <form action="/cgi-bin/koha/acqui/addorder.pl" method="post" class="validated noEnterSubmit" id="Aform" onsubmit="return Check(this);" >
+    [% INCLUDE 'csrf-token.inc' %]
 
     <fieldset class="rows">
         <legend>Patrons</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
index 6aff9ea0ada..5edcf115ecd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
@@ -202,6 +202,7 @@ div.rows { padding: 1rem; }
 [% UNLESS ( enter ) %][% INCLUDE 'acquisitions-toolbar.inc' %][% END %]
 [% IF ( enter ) %]
     <form action="updatesupplier.pl" name="updatesupplier" style="display:block" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <div id="toolbar" class="btn-toolbar">
             <button class="btn btn-primary" type="submit"><i class="fa fa-save"></i> Save</button>
             [% IF ( booksellerid ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt
index f5ead805071..590ee06f557 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt
@@ -88,6 +88,7 @@
         <div class="page-section">
             <h2>Order lines with uncertain prices</h2>
             <form action="[% scriptname | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                 <label for="owner">Orders from:</label>
                 <select id="owner" name="owner">
@@ -103,6 +104,7 @@
             </form>
         </div> <!-- /.page-section -->
         <form action="[% scriptname | html %]" method="post" id="uncertainprices">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                 <input type="hidden" name="op" value="validate" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt
index 0a9de738a76..09333b4492b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt
@@ -92,6 +92,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/acqui/vendor_issues.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="booksellerid" value="[% vendor.id | html %]" />
         <input type="hidden" name="issue_id" value="[% issue.issue_id| html %]" />
@@ -133,6 +134,7 @@
     <div class="dialog alert">
         <h1>Delete issue #[% issue.issue_id | html %]?<h1>
         <form action="/cgi-bin/koha/acqui/vendor_issues.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="issue_id" value="[% issue.issue_id | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt
index a458291dbaf..01338c939e4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt
@@ -82,6 +82,7 @@ tr.selected td {
 <div class="main container-fluid">
       [% IF ( opsearch ) %]
     <form method="post" action="z3950_search.pl" name="f" class="checkboxed">
+        [% INCLUDE 'csrf-token.inc' %]
     <div class="row">
     <div class="col-sm-6">
     <h1>Order from external source</h1>
@@ -246,6 +247,7 @@ tr.selected td {
     </div>
 
     <form method="post" action="z3950_search.pl" id="page_form" name="page_form" class="checkboxed">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" id="op" value="do_search" />
         <input type="hidden" name="current_page" id="current_page" value="[% current_page | html %]" />
         <input type="hidden" id="searchtitle"  name="title" value="[% title | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
index a569c43fc8a..bc769b8c72c 100755
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
@@ -196,6 +196,7 @@
             <h1>[% tx("New field for table '{table_name}'", { table_name = tablename } ) | html %]</h1>
         [% END %]
         <form action="" name="add_form" id="add_field" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <ol>
                     <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
index 790851940c5..52ee1d22bfe 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
@@ -56,6 +56,7 @@
             <div class="col-md-6 sysprefs">
             [% IF ( CAN_user_parameters_manage_sysprefs ) %]
                 <form action="/cgi-bin/koha/admin/preferences.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                 <fieldset>
                     <h4><a href="/cgi-bin/koha/admin/preferences.pl">System preferences</a></h4>
                     <p>Manage system preferences like MARC flavor, date format, administrator email, and templates.</p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/adveditorshortcuts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/adveditorshortcuts.tt
index 4b8428e395c..85dc311d75d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/adveditorshortcuts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/adveditorshortcuts.tt
@@ -44,6 +44,7 @@
                     </ul>
 
                     <form id="adveditor_shortcuts" method="post" action="/cgi-bin/koha/admin/adveditorshortcuts.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset>
                         <input type=hidden name="op" value="save" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt
index 84e44e25a09..e040f9b9d25 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt
@@ -148,6 +148,7 @@
 [% IF ( duplicate_form ) %]
 <h1>Duplicate budget</h1>
 <form action="/cgi-bin/koha/admin/aqbudgetperiods.pl" id="add_modify_budget" name="f" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <input type="hidden" name="op" value="duplicate_budget" />
     <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
@@ -217,6 +218,7 @@
         <h1>Add budget</h1>
 	[% END %]
 <form action="/cgi-bin/koha/admin/aqbudgetperiods.pl" id="add_modify_budget" name="f" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <!-- ################################################################################# -->
     <!-- display information about the budget period that must be added or modified -->
@@ -309,11 +311,13 @@
     <!-- ############################################################# -->
 
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="delete_confirmed" />
         <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
         <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
     </form>
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not delete</button>
     </form>
     [% END %]
@@ -355,6 +359,7 @@
           </tbody>
         </table>
         <form action="/cgi-bin/koha/admin/aqbudgetperiods.pl" name="f" method="post" id="move_form">
+            [% INCLUDE 'csrf-token.inc' %]
           <fieldset class="rows">
             <ol>
               <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt
index fb1d387c166..561c861d5d3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt
@@ -250,6 +250,7 @@
 <!-- create add/mod entry form -->
 [% IF op == 'add_form' && !error_not_authorised_to_modify %]
 <form action="/cgi-bin/koha/admin/aqbudgets.pl" id="edit_fund" name="Aform" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
         <legend><h1>[% IF ( budget_id ) %]<span>Modify fund</span>[% ELSE %]<span>Add fund</span>[% END %]
     [% IF ( budget_period_description ) %]
@@ -430,6 +431,7 @@
         </table>
 
         <form action="/cgi-bin/koha/admin/aqbudgets.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="budget_id" value="[% budget_id | html %]" />
             <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt
index 4d3338e9a0e..90136bbe8fb 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt
@@ -102,6 +102,7 @@
             [% IF ( add_form ) %]
                 <div class="page-section">
                     <form name="Aform" action="/cgi-bin/koha/admin/aqcontract.pl" id="add_modify_contract" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_validate" />
                         <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                         <input type="hidden" name="checked" value="0" />
@@ -146,6 +147,7 @@
             [% IF ( add_validate ) %]
                 <h1>Data recorded</h1>
                 <form action="[% script_name | html %]" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="submit" class="btn btn-primary" value="OK" />
                 </form>
             [% END %]
@@ -161,6 +163,7 @@
                             <tr><th scope="row">Vendor:</th><td>[% booksellername | html %]</td></tr>
                         </table>
                         <form action="[% script_name | html %]" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_confirmed" />
                             <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                             <input type="hidden" name="contractnumber" value="[% contractnumber | html %]" />
@@ -176,6 +179,7 @@
             [% IF ( delete_confirmed ) %]
                 <h1>Contract deleted</h1>
                 <form action="[% script_name | html %]" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                     <input type="submit" class="btn btn-primary" value="OK" />
                 </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt
index 25613238a50..e7ff39bce26 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt
@@ -46,6 +46,7 @@
 [% INCLUDE 'budgets-admin-toolbar.inc' %]
 
 <form method="post" id="Aform" name="Aform"  action="/cgi-bin/koha/admin/aqplan.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <h1>Planning for [% budget_period_description | html %] [% PROCESS planning plan=authcat %]</h1>
 <input type="hidden" name="authcat" value="[% authcat | html %]" />
 <!-- Budget Lines -->
@@ -202,6 +203,7 @@
             <aside>
 
 <form method="post" action="/cgi-bin/koha/admin/aqplan.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
 <fieldset class="brief">
 <h4>Filter</h4>
@@ -262,6 +264,7 @@
 </form>
 [% IF ( budget_lines ) %]
 <form method="post" action="/cgi-bin/koha/admin/aqplan.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="brief">
 <h4>Export</h4>
     <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt
index 80f36551d1b..f904c4eb3d2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt
@@ -39,6 +39,7 @@
 
 
                 <form id="new-alert-form" action="audio_alerts.pl" method="post" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <h1><span class="create-alert">New alert</span><span class="edit-alert">Edit alert</span></h1>
                     <fieldset class="rows">
                         <legend class="sr-only">Audio alert details</legend>
@@ -88,6 +89,7 @@
                 </form>
 
                 <form id="delete-alert-form" action="audio_alerts.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <h1>Audio alerts</h1>
                     [%IF !( Koha.Preference('AudioAlerts') ) %]
                         <div class="dialog alert">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt
index c7591dbdd18..e7d3ee27bcf 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt
@@ -82,6 +82,7 @@
     [% ELSE %][% action | html %][% END %]</h1>
     <div class="hint">You can drag and drop the subfield tabs to change the order.</div>
     <form action="[% script_name | html %]" name="Aform" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
         <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
@@ -284,6 +285,7 @@
     <div class="dialog alert">
         <h1>Delete subfield <span class="ex">'[% ass.tagsubfield | html %]'?</span></h1>
         <form action="[% delete_link | html %]" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <table>
                 <tr><th scope="row">Subfield:</th> <td>[% ass.tagsubfield | html %]</td></tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
index b967e80737b..bf5257a2a72 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
@@ -143,6 +143,7 @@
         [% END %]
     </h2>
     <form action="[% script_name | html %]" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         [% IF ( heading_modify_tag_p ) %]<input type="hidden" name="modif" value="1" />[% END %]
         <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
@@ -198,6 +199,7 @@
     <div class="dialog alert">
         <h3>Confirm deletion</h3>
         <form action="[% script_name | html %]" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <table>
                 <tr><th scope="row">Tag: </th><td>[% searchfield | html %] [% liblibrarian | html %]</td></tr>
             </table>
@@ -216,6 +218,7 @@
 
   <div class="dialog message">  <h3>Data deleted</h3>
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
     <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
     <input type="submit" value="OK" class="btn btn-primary" />
@@ -224,6 +227,7 @@
 [% IF ( authtype_create ) %]
 
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="authtype_create_confirm" />
         <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
         Create authority framework for [% authtypecode | html %] using
@@ -249,6 +253,7 @@
 
 <h2>Select an authority framework</h2>
 <form action="[% script_name | html %]" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <select name="authtypecode">
     [% FOREACH authority_type IN authority_types%]
         [% IF authority_type.authtypecode == authtypecode%]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
index 436572b1b90..968068e3570 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
@@ -123,6 +123,7 @@
                     [% END %]
 
                     <form action="/cgi-bin/koha/admin/authorised_values.pl" name="Aform" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             [% IF action_add_category %]
                                 <ol>
@@ -311,6 +312,7 @@
                                 </form>
                                 [% UNLESS category.is_system %]
                                     <form id="delete_category" action="/cgi-bin/koha/admin/authorised_values.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="op" value="delete_category" />
                                         <input type="hidden" name="category_name" value="[% category.category_name | html %]" />
                                         <button type="submit"><i class="fa fa-plus"></i> Delete category '[% category.category_name | html %]' </button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt
index e0128143e96..9a36036548d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt
@@ -89,6 +89,7 @@
 
 [% IF op == 'add_form' %]
     <form action="/cgi-bin/koha/admin/authtypes.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <legend>
                 <h1>
@@ -149,6 +150,7 @@
         [% ELSE %]
             <h1>Confirm deletion of authority structure definition for <span class="ex">'[% authority_type.authtypetext | html %]' ([% authority_type.authtypecode | html %])</span></h1>
             <form action="/cgi-bin/koha/admin/authtypes.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <input type="hidden" name="authtypecode" value="[% authority_type.authtypecode | html %]" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
@@ -235,6 +237,7 @@
                                     <h3 id="importLabelexportModal_[% authority_type.authtypecode | html %][% loop.count | html %]">Import [% authority_type.authtypecode | html %] authority type (fields and subfields) from a spreadsheet file (.csv, .ods)</h3>
                                 </div>
                                 <form action="/cgi-bin/koha/admin/import_export_authtype.pl" name="form_i_[% authority_type.authtypecode | html %]" id="form_i_[% authority_type.authtypecode | html %]" method="post" enctype="multipart/form-data" class="form_import">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <div class="modal-body">
                                         <input type="hidden" name="authtypecode" value="[% authority_type.authtypecode | html %]" />
                                         <input type="hidden" name="action" value="import" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
index 6acf1b92cf9..cf57b923a1b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
@@ -100,6 +100,7 @@
 [% IF op == 'add_form' %]
     <h1>[% IF framework %]Modify framework text[% ELSE %]Add framework[% END %]</h1>
     <form action="/cgi-bin/koha/admin/biblio_framework.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <fieldset class="rows">
             <ol>
@@ -141,6 +142,7 @@
         [% ELSE %]
             <h1>Delete framework for [% framework.frameworktext | html %] ([% framework.frameworkcode | html %])?</h1>
             <form class="inline" action="/cgi-bin/koha/admin/biblio_framework.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this framework</button>
@@ -214,6 +216,7 @@
                         <h1 id="importLabelexportModal_[% framework.frameworkcode | html %][% frameworks.count | html %]">Import default framework structure (fields and subfields) from a spreadsheet file (.csv or .ods)</h1>
                     </div> <!-- /.modal-header -->
                     <form action="/cgi-bin/koha/admin/import_export_framework.pl" name="form_i_default" id="form_i_default" method="post" enctype="multipart/form-data" class="form_import">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="modal-body">
                             <input type="hidden" name="frameworkcode" value="default" />
                             <input type="hidden" name="action" value="import" />
@@ -284,6 +287,7 @@
                             <h1 id="importLabelexportModal_[% loo.frameworkcode | html %][% loop.count | html %]">Import [% loo.frameworkcode | html %] framework structure (fields and subfields) from a spreadsheet file (.csv or .ods)</h1>
                         </div> <!-- /.modal-header -->
                         <form action="/cgi-bin/koha/admin/import_export_framework.pl" name="form_i_[% loo.frameworkcode | html %]" id="form_i_[% loo.frameworkcode | html %]" method="post" enctype="multipart/form-data" class="form_import">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <div class="modal-body">
                                 <input type="hidden" name="frameworkcode" value="[% loo.frameworkcode | html %]" />
                                 <input type="hidden" name="action" value="import" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt
index fb5b811c8e1..8a455f235b3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt
@@ -64,6 +64,7 @@
     [% END %]
 
     <form method="post" action="branch_transfer_limits.pl">
+        [% INCLUDE 'csrf-token.inc' %]
         [% WRAPPER tab_panels %]
             [% FOREACH codes_loo IN codes_loop %]
                 [% WRAPPER tab_panel tabname=codes_loo.code %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
index 9f4b1e09e21..91dc65a676d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
@@ -124,6 +124,7 @@
         [% END %]
     </h1>
     <form action="/cgi-bin/koha/admin/branches.pl" id="Aform" name="Aform" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <input type="hidden" name="op" value="add_validate" />
             [% IF library %]
@@ -298,6 +299,7 @@
 [% IF op == 'delete_confirm' and not ( items_count or patrons_count )%]
     <div class="dialog alert">
         <form action="/cgi-bin/koha/admin/branches.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <h1>Are you sure you want to delete [% library.branchname | html %] ([% library.branchcode | html %])?</h1>
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="branchcode" value="[% library.branchcode | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt
index 2c5cf2236a3..9c7b8b48cee 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt
@@ -96,6 +96,7 @@
                 [% IF op == 'add_form' %]
                 <h1>[% IF cash_register %]Modify cash register[% ELSE %]Add new cash register[% END %]</h1>
                 <form action="/cgi-bin/koha/admin/cash_registers.pl" id="Aform" name="Aform" class="validated" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
 
                     <fieldset class="rows">
                         <input type="hidden" name="op" value="add_validate" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
index 1e360ca394f..1e21e95f3bd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
@@ -114,6 +114,7 @@
 
 [% IF op == 'add_form' %]
     <form id="category_form" action="/cgi-bin/koha/admin/categories.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="checked" value="0" />
         [% IF category %]
@@ -504,6 +505,7 @@
     </div> <!-- /.page-section -->
 
     <form action="/cgi-bin/koha/admin/categories.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="action">
             [% IF patrons_in_category > 0 %]
                 <input type="submit" class="btn btn-primary" value="OK" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
index c5b756a1253..d897a43ad1d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
@@ -101,6 +101,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/admin/cities.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="cityid" value="[% city.cityid | html %]" />
 
@@ -158,6 +159,7 @@
             </tr>
         </table>
         <form action="/cgi-bin/koha/admin/cities.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="cityid" value="[% city.cityid | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt
index e5a3981c912..a6d289c9939 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt
@@ -148,6 +148,7 @@
 <h1>Add classification source</h1>
   [% END %]
 <form action="[% script_name | html %]" name="Aform" class="validated" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="add_source_validate" />
   <fieldset class="rows">
     <ol>
@@ -212,6 +213,7 @@
 <h1>Add filing rule</h1>
   [% END %]
 <form action="[% script_name | html %]" name="Aform" class="validated" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="add_sort_rule_validate" />
   <fieldset class="rows">
     <ol>
@@ -258,6 +260,7 @@
 <h1>Add splitting rule</h1>
   [% END %]
 <form action="[% script_name | html %]" name="Aform" class="validated" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="add_split_rule_validate" />
   <fieldset class="rows">
     <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/clone-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/clone-rules.tt
index ecc7b3b0db6..ebf2e7c3e9a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/clone-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/clone-rules.tt
@@ -52,6 +52,7 @@
 
     <p class="help">Use carefully! If the destination library already has circulation and fine rules, they will be deleted without warning!</p>
     <form action="/cgi-bin/koha/admin/clone-rules.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         [% UNLESS ( frombranch ) %]
             <fieldset>
                 <legend>Please choose a library to clone rules from:</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt
index 526391b4bda..7cabed19835 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt
@@ -13,6 +13,7 @@
     [% END %]
     <div class="pagelist">
         <form method="post" action="/cgi-bin/koha/admin/columns_settings.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="action" value="save" />
             <input type="hidden" name="module" value="[% modulename | html %]" />
             [% IF module.keys and module.keys.size > 0 %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt
index bba0dcb8b1d..8838af042a7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt
@@ -83,6 +83,7 @@
                     [% END %]
 
                     <form action="/cgi-bin/koha/admin/credit_types.pl" name="Aform" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_validate" />
                         <fieldset class="rows">
                             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt
index 85743caf236..be5e5e79be7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt
@@ -63,6 +63,7 @@
         <div class="dialog message">The [% pref_CurbsidePickup_link | $raw | $KohaSpan %] preference is not enabled, do not forget to enable it to turn the feature on.</div>
     [% END %]
     <form method="post" class="form">
+        [% INCLUDE 'csrf-token.inc' %]
         <div id="curbside_pickup_tabs" class="toptabs">
             <ul class="nav nav-tabs" role="tablist">
                 [% FOREACH l IN libraries %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt
index 83644f7133b..addc3f46e42 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt
@@ -109,6 +109,7 @@
 </h1>
 
 <form action="/cgi-bin/koha/admin/currency.pl" name="Aform" method="post" class="validated">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="op" value="add_validate" />
     <fieldset class="rows">
         <legend class="sr-only">New currency entry form</legend>
@@ -179,6 +180,7 @@
             <span>Deletion not possible</span>
         </p>
         <form action="/cgi-bin/koha/admin/currency.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
         </form>
     </div>
@@ -194,11 +196,13 @@
             </tr>
         </table>
         <form action="/cgi-bin/koha/admin/currency.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="currency_code" value="[% currency.currency | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this currency</button>
         </form>
         <form action="/cgi-bin/koha/admin/currency.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not delete</button>
         </form>
     </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt
index c28a95cc8e9..2ae4ff34006 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt
@@ -82,6 +82,7 @@
                     [% END %]
 
                     <form action="/cgi-bin/koha/admin/debit_types.pl" name="Aform" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_validate" />
                         <fieldset class="rows">
                             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt
index 62ee07a5288..faead4f6d2e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt
@@ -98,6 +98,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/admin/desks.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="desk_id" value="[% desk.desk_id | html %]" />
 
@@ -154,6 +155,7 @@
             </tr>
         </table>
         <form action="/cgi-bin/koha/admin/desks.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="desk_id" value="[% desk.desk_id | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt
index eed01c96621..c82f9c5295f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt
@@ -67,6 +67,7 @@
             plugins that you want to use.
         </div>
         <form action="/cgi-bin/koha/admin/didyoumean.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset id="didyoumeanopac">
                 <legend>OPAC</legend>
                 [% PROCESS pluginlist plugins=OPACpluginlist type='opac' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt
index 9ca20268fe2..c18b172d40f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt
@@ -84,6 +84,7 @@
 
 [% IF acct_form %]
 <form action="/cgi-bin/koha/admin/edi_accounts.pl" name="Actform" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="save" />
   [% IF account %]
   <input type="hidden" name="id" value="[% account.id | html %]" />
@@ -281,6 +282,7 @@
     </tr>
 </table>
 <form action="/cgi-bin/koha/admin/edi_accounts.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <table>
     </table>
     <input type="hidden" name="op" value="delete_confirmed" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt
index 9ece1370357..35a0af4c0ac 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt
@@ -75,6 +75,7 @@
 
 [% IF ean_form %]
 <form action="/cgi-bin/koha/admin/edi_ean_accounts.pl" name="Eanform" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="save" />
   [% IF ean %]
       <input type="hidden" name="oldbranchcode" value="[% ean.branch.branchcode | html %]" />
@@ -144,6 +145,7 @@
 <div class="dialog alert">
 <h1>Delete EAN [% ean.ean | html %] for [% ean.branch.branchname | html %]?</h1>
 <form action="/cgi-bin/koha/admin/edi_ean_accounts.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="op" value="delete_confirmed" />
     <input type="hidden" name="id" value="[% ean.id | html %]" />
     <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt
index eb58e7b7df1..9c093280f5d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt
@@ -85,6 +85,7 @@
     <h1>New email domain</h1>
     <div class="page-section">
         <form action="/cgi-bin/koha/admin/identity_providers.pl" id="add" name="add" class="validated" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="add" />
             <input type="hidden" name="domain_ops" value="1" />
             <input type="hidden" name="identity_provider_id" value="[%- identity_provider_id | html -%]" />
@@ -166,6 +167,7 @@
     <h1>Edit identity provider domain</h1>
     <div class="page-section">
         <form action="/cgi-bin/koha/admin/identity_providers.pl" id="edit_save" name="edit_save" class="validated" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="edit_save" />
             <input type="hidden" name="domain_ops" value="1" />
             <input type="hidden" name="identity_provider_id" value="[%- identity_provider_id | html -%]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt
index 239c1166933..791a44d20bf 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt
@@ -82,6 +82,7 @@
     <h1>New identity provider</h1>
     <div class="page-section">
         <form action="/cgi-bin/koha/admin/identity_providers.pl" id="add" name="add" class="validated" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="add" />
             <fieldset class="rows">
                 <legend id="identity_provider_basic">Basic configuration</legend>
@@ -236,6 +237,7 @@
     <h1>Edit identity provider</h1>
     <div class="page-section">
         <form action="/cgi-bin/koha/admin/identity_providers.pl" id="edit_save" name="edit_save" class="validated" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="edit_save" />
             <input type="hidden" name="identity_provider_id" value="[%- identity_provider.identity_provider_id | html -%]" />
             <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt
index 564fa8a2639..cfea8ff70a6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt
@@ -47,6 +47,7 @@
                     <h1>Item search field: [% field.label | html %]</h1>
 
                     <form action="/cgi-bin/koha/admin/items_search_field.pl" method="POST" id="edit_search_fields">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                         <legend>Edit field</legend>
                         [% INCLUDE 'admin-items-search-field-form.inc' field=field %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt
index 000cc01017b..b7d0c8e7240 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt
@@ -109,6 +109,7 @@
                     [% END %]
 
                     <form id="add_field_form" action="/cgi-bin/koha/admin/items_search_fields.pl" method="POST">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <legend><h1>Add a new field</h1></legend>
                             [% INCLUDE 'admin-items-search-field-form.inc' field=undef %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
index 5a093affbe9..b4319ff3409 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
@@ -149,6 +149,7 @@
         <h1>New item type</h1>
     [% END %]
     <form action="/cgi-bin/koha/admin/itemtypes.pl" name="Aform" method="post" id="itemtypeentry">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <fieldset class="rows">
             <ol>
@@ -373,10 +374,12 @@
             <tr><th scope="row">Rental charge</th><td>[% itemtype.rentalcharge | $Price %]</td></tr>
         </table>
         <form action="/cgi-bin/koha/admin/itemtypes.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" /><input type="hidden" name="itemtype" value="[% itemtype.itemtype | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this item type</button>
         </form>
         <form action="/cgi-bin/koha/admin/itemtypes.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not delete</button>
         </form>
     </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt
index 70976c367f9..b15784528f5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt
@@ -36,6 +36,7 @@
 <br/>
 <div class="dialog message">If you make any change to the mappings, you must ask your administrator to run misc/batchRebuildBiblioTables.pl.</div>
 <form action="/cgi-bin/koha/admin/koha2marclinks.pl" method="post" id="koha2marc">
+    [% INCLUDE 'csrf-token.inc' %]
 
 [% IF error_add %]
     <div class="dialog alert">Failed to add mapping for [% error_info | html %]</div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
index 408be93034a..78993469366 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
@@ -17,6 +17,7 @@
             <div class="col-sm-12">
                 <h1>Localization</h1>
 <form id="add_translation" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="entity" value="[% entity | html %]" />
     <input type="hidden" name="code" value="[% code | html %]" />
     <input type="hidden" name="interface" value="[% interface_side | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt
index 8a6f1d89731..77c4d42fce8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt
@@ -78,6 +78,7 @@
 
                 <div class="page-section">
                 <form action="/cgi-bin/koha/admin/marc-overlay-rules.pl" method="POST" id="marc-overlay-rules-form">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <table id="marc-overlay-rules">
                         <thead><tr>
                             <th>Rule</th>
@@ -259,6 +260,7 @@
                 </div> <!-- /.page-section -->
 
                 <form action="/cgi-bin/koha/admin/marc-overlay-rules.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="redo-matching" />
                 </form>
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
index 7bf53635304..24e701c024e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
@@ -109,6 +109,7 @@
                         <div class="hint">You can drag and drop the subfield tabs to change the order.</div>
 
                         <form action="[% script_name | html %]" name="Aform" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="add_validate" />
                             <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
                             <input type="hidden" name="frameworkcode" value="[% frameworkcode | html %]" />
@@ -336,6 +337,7 @@
                             <p>Description: [% mss.liblibrarian | html_entity %]</p>
 
                             <form action="[% delete_link | html %]" method="post"><input type="hidden" name="op" value="delete_confirmed" />
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="tagfield" value="[% mss.tagfield | html %]" />
                                 <input type="hidden" name="tagsubfield" value="[% mss.tagsubfield | html %]" />
                                 <input type="hidden" name="frameworkcode" value="[% mss.frameworkcode | html %]" />
@@ -344,6 +346,7 @@
 
 
                             <form action="[% script_name | html %]" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="tagfield" value="[% mss.tagfield | html %]" />
                                 <input type="hidden" name="tagsubfield" value="[% mss.tagsubfield | html %]" />
                                 <input type="hidden" name="frameworkcode" value="[% mss.frameworkcode | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt
index 6568a2070fc..681c068860f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt
@@ -116,6 +116,7 @@
 [% IF ( add_form ) %]
 
     <form action="[% script_name | html %]" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
 
       <fieldset class="rows">
             <legend>
@@ -189,6 +190,7 @@
         <p>Tag: [% searchfield | html %]</p>
         <p>Description: [% liblibrarian | html %]</p>
         <form action="[% script_name | html %]" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
             <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
@@ -204,12 +206,14 @@
 
     <div class="dialog message"><h3>Tag deleted</h3>
     <form action="[% script_name | html %]" method="post"><input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
+        [% INCLUDE 'csrf-token.inc' %]
         <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
     </form></div>
 [% END %]
 [% IF ( framework_create ) %]
 
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="framework_create_confirm" />
         <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
         Create framework for [% framework.frameworkcode | html %] ([% framework.frameworktext | html %]) using
@@ -226,6 +230,7 @@
 
 [% IF ( else ) %]
 <form name="f" action="[% script_name | html %]" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset style="padding:.5em;">
         <label for="tag_search"><strong>Search for tag:</strong> </label>
         <input type="text" name="searchfield" id="tag_search" size="4" value="[% searchfield | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt
index 0c1e2922155..b9da6d364b1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt
@@ -113,6 +113,7 @@
                         <h1>Add record matching rule</h1>
                     [% END %]
                     <form action="[% script_name | html %]" name="Aform" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="[% confirm_op | html %]" />
                         <fieldset class="rows">
                             <ol>
@@ -423,6 +424,7 @@
                     <div class="dialog alert">
                         <h1>Confirm deletion of record matching rule <span class="ex">'[% code | html %]' ([% description | html %])</span>?</h1>
                         <form action="[% script_name | html %]" name="Aform" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="[% confirm_op | html %]" />
                             <input type="hidden" name="matcher_id" value="[% matcher_id | html %]" />
                             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete record matching rule</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
index cd7c46481a6..5a1f519aa57 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
@@ -48,6 +48,7 @@
       [% END %]
 
         <form action="/cgi-bin/koha/admin/oai_set_mappings.pl" method="post" id="mappingform">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="page-section">
                 <table id="mappings">
                     <thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
index 8a82e5f44db..c86f2aa4b25 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
@@ -58,6 +58,7 @@
 
         [% IF ( op_new || op_mod ) %]
             <form method="post" action="/cgi-bin/koha/admin/oai_sets.pl" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
             [% IF ( op_new ) %]
                 <h1>New OAI set</h1>
                 <input type="hidden" name="op" value="savenew" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt
index 8aec826fe6f..2c78c3c39ea 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt
@@ -38,6 +38,7 @@
                 <h1>OverDrive library authnames</h1>
 
                 <form action="/cgi-bin/koha/admin/overdrive.pl" name="overdrive_form" method="post" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="update" />
                     <fieldset>
                         <table id="od_info">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
index 2129798b317..625ef9c5c5d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
@@ -85,6 +85,7 @@
 </div>
 [% END %]
 <form action="[% script_name | html %]" class="validated" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="[% confirm_op | html %]" />
   <fieldset class="rows">
     <ol>
@@ -249,6 +250,7 @@
     <div class="dialog alert">
         <h1>Confirm deletion of patron attribute type <span class="ex">'[% code | html %]' ([% description | html %])</span>?</h1>
         <form action="[% script_name | html %]" name="Aform" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="[% confirm_op | html %]" />
             <input type="hidden" name="code" value="[% code | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete patron attribute type</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt
index 4c8f1cefc9a..14317a6a376 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt
@@ -58,6 +58,7 @@
     <div class="prefs-tab">
     <h2>[% TAB.tab_title | html %] preferences</h2>
     <form action="/cgi-bin/koha/admin/preferences.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         [% UNLESS ( searchfield ) %]<div id="toolbar"><button class="save-all btn btn-primary" type="submit">Save all [% TAB.tab_title | html %] preferences</button></div>[% END %]
         <input type="hidden" name="op" value="save" />
         <input type="hidden" name="tab" value="[% TAB.tab_id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt
index dd530d964f8..20978687d9a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt
@@ -93,6 +93,7 @@
 
 [% IF op == 'add_form' %]
     <form id="restriction_form" action="/cgi-bin/koha/admin/restrictions.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="checked" value="0" />
         [% IF restriction %]
@@ -140,6 +141,7 @@
         <h1>Confirm restriction type deletion</h1>
         <p>Are you sure you want to delete '[% PROCESS restriction_type_description restriction_type=restriction %]'?</p>
         <form action="/cgi-bin/koha/admin/restrictions.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="code" value="[% restriction.code | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
index 1990c52e6db..b00b27f22e5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
@@ -92,11 +92,13 @@ a.add, a.delete {
         <div class="dialog alert">
             <h3>The current mappings you see on the screen will be erased and replaced by the mappings in the mappings.yaml file.</h3>
             <form method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="reset_confirmed" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, reset mappings</button>
             </form>
 
             <form method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not reset mappings</button>
             </form>
         </div>
@@ -115,6 +117,7 @@ a.add, a.delete {
     </div>
 
     <form id="es_mappings" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
 
         [% WRAPPER tabs id= "tabs" %]
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt
index f7228989560..041e819f95e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt
@@ -67,6 +67,7 @@
                     [% END %]
 
                     <form id="mana_preference" method="post" class="clearfix">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <ol>
                                 <li>
@@ -116,6 +117,7 @@
 
                     [% IF Koha.Preference('ManaToken') %]
                         <form id="mana_token" method="post" class="clearfix">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                             <legend>Mana KB token</legend>
                                 <ol>
@@ -133,6 +135,7 @@
                         </form>
                     [% ELSE %]
                         <form id="mana_request" method="post" class="clearfix">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows" id="mana_subscription">
                                 <ol>
                                     <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
index 96ec772e940..553cb03993a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
@@ -91,6 +91,7 @@
                         </form>
                         [% IF ( definedbranch ) %]
                             <form action="/cgi-bin/koha/admin/clone-rules.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <label for="tobranch"><strong>Clone these rules to:</strong></label>
                                 <input type="hidden" name="frombranch" value="[% current_branch | html %]" />
                                 <select name="tobranch" id="tobranch">
@@ -104,6 +105,7 @@
 
                 <div class="page-section">
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table id="default-circulation-rules">
@@ -607,6 +609,7 @@
                     <h2>Default checkout, hold and return policy[% IF humanbranch %] for [% Branches.GetName( humanbranch ) | html %][% END %]</h2>
                     <p>You can set a default maximum number of checkouts, hold policy and return policy that will be used if none is defined below for a particular item type or category.</p>
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="set-branch-defaults" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -794,6 +797,7 @@
                        no limit applies, except possibly for a limit you define for a specific item type.
                     </p>
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add-branch-cat" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -873,6 +877,7 @@
                 [% END %]
                     <p>Specify if waiting holds can be cancelled for a given patron category.</p>
                     <form id="set-waiting-hold-cancellation" method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="set-waiting-hold-cancellation" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -957,6 +962,7 @@
                 [% END %]
                     <p>Specify the maximum number simultaneous current article requests a patron of a given category can have.</p>
                     <form id="set-article-requests-daily-limit" method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add-open-article-requests-limit" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -1011,6 +1017,7 @@
                 [% END %]
                     <p>Specify the article request fee for a given patron category.</p>
                     <form id="set-article-request-fee" method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="set-article-request-fee" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -1071,6 +1078,7 @@
                 [% END %]
                     <p>Specify the default policy for lost item fees on return.</p>
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="mod-refund-lost-item-fee-rule" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]" />
                         <table>
@@ -1272,6 +1280,7 @@
                     </ul>
 
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add-branch-item" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt
index 716c5342987..75a3e15e2b0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt
@@ -79,6 +79,7 @@
 
                 <div id="sms_add_form">
                     <form id="sms_form" action="sms_providers.pl" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <legend>Add an SMS cellular provider</legend>
                             <input type="hidden" id="id" name="id" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
index beefae38598..5cf8127566b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
@@ -79,6 +79,7 @@
 [% IF op == 'add_form' %]
     <h1>New SMTP server</h1>
     <form action="/cgi-bin/koha/admin/smtp_servers.pl" id="add" name="add" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add" />
         <fieldset class="rows">
             <ol>
@@ -152,6 +153,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/admin/smtp_servers.pl" id="edit_save" name="edit_save" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="edit_save" />
         <input type="hidden" name="smtp_server_id" value="[%- smtp_server.id | html -%]" />
         <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt
index e06d1c2be6b..a3b45d9ea11 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt
@@ -20,6 +20,7 @@
         <h1>SRU search field mapping for bibliographic records</h1>
 
         <form id="form01" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <div class="row">
                     <div class="col-xs-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt
index 7c12e278d05..02ca1aa9255 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt
@@ -17,6 +17,7 @@
     <main>
         <h1>SRU search field mapping for authorities</h1>
         <form id="form01" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <div class="row">
                     <div class="col-xs-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt
index cc1d9063a5f..0b0b071ad47 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt
@@ -93,6 +93,7 @@
             <form action="[% script_name | html %]" name="Aform" method="post" enctype="multipart/form-data">
         [% ELSE %]
             <form action="[% script_name | html %]" name="Aform" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
         [% END %]
         <fieldset class="rows">
             <legend class="sr-only">System preference details</legend>
@@ -279,12 +280,14 @@
                 </tr>
             </table>
             <form class="inline" action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
                 <input type="hidden" name="Tvalue" value="[% Tvalue | html %]" />
                 <button type="submit" class="approve"><i class="fa fa-check" aria-hidden="true"></i> Yes, delete</button>
             </form>
             <form class="inline" action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <button type="submit" class="deny"><i class="fa fa-remove" aria-hidden="true"></i> No, do not delete</button>
             </form>
         </div>
@@ -294,6 +297,7 @@
         <div class="dialog message">
             <h1>Data deleted</h1>
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <button type="submit">Back to system preferences</button>
             </form>
         </div>
@@ -332,6 +336,7 @@
             <form action="/cgi-bin/koha/admin/systempreferences.pl" method="post" enctype="multipart/form-data">
         [% ELSE %]
             <form action="/cgi-bin/koha/admin/systempreferences.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
         [% END %]
                 [% IF ( loo.type_free ) %]
                 <input type="text" name="value" size="[% loo.fieldlength | html %]" value="[% loo.value | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt
index c4bec409555..e575e04873a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt
@@ -55,6 +55,7 @@
     </div>[% END %]
 
         <form method="post" action="/cgi-bin/koha/admin/transport-cost-matrix.pl" id="cost_matrix_form">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="set-cost-matrix" />
             <fieldset id="transport-cost-matrix">
                 <div class="help">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt
index a6630da114e..d0fda0c3fc9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt
@@ -64,6 +64,7 @@
 [% END %]
 
     <form id="category_form" action="/cgi-bin/koha/admin/usage_statistics.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <h1>Modify the statistics you share with the Koha community</h1>
         <div class="row">
             <div class="col-xs-12 col-sm-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt
index 8167404fdc9..50a25772740 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt
@@ -82,6 +82,7 @@
 
 [% IF ( add_form ) %]
     <form action="[% script_name | html %]" name="Aform" method="post" id="serverentry">
+        [% INCLUDE 'csrf-token.inc' %]
         [% IF op == 'edit' %]
             <h1>[% tx("Modify {servertype} server '{servername}'", { servertype = servertype, servername = server.servername }) | html %]</h1>
             <input type="hidden" name="id" value="[% server.id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
index e87cb438c4c..059396416dd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
@@ -103,6 +103,7 @@
     [% END # /IF  identity_providers.size %]
 
     <form action="[% script_name | html %]" method="post" name="loginform" id="loginform">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="koha_login_context" value="intranet" />
     [% FOREACH INPUT IN INPUTS %]
         <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
@@ -176,6 +177,7 @@
     [% END %]
 [% ELSIF TwoFA_prompt %]
     <form action="[% script_name | html %]" method="post" name="loginform" id="loginform" autocomplete="off">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="koha_login_context" value="intranet" />
         [% FOREACH INPUT IN INPUTS %]
             <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
index 689d62857aa..598c554331a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
@@ -414,6 +414,7 @@
                 [% END # /IF duplicateauthid %]
 
                 <form method="post" id="f" name="f" action="/cgi-bin/koha/authorities/authorities.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="add" />
                     <input type="hidden" name="addfield_field" value="" />
                     <input type="hidden" name="repeat_field" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt
index cc2e0ffee66..a82cf0e5e8a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt
@@ -68,6 +68,7 @@ div#result { margin-top: 1em; }
 
 <p>Please choose which record will be the reference for the merge. The record chosen as reference will be kept, and the other will be deleted.</p>
 <form id="mergeform" action="/cgi-bin/koha/authorities/merge.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <legend>Merge reference</legend>
     <ol>
@@ -101,6 +102,7 @@ div#result { margin-top: 1em; }
 [% ELSE %]
 
 <form id="mergeform" action="/cgi-bin/koha/authorities/merge.pl" method="post" onsubmit="return mergeformsubmit()">
+    [% INCLUDE 'csrf-token.inc' %]
 
     <div class="row">
         <div class="col-sm-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt
index f61355622c5..55db8c1b1f2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt
@@ -7,6 +7,7 @@
     <p>Your download should begin automatically.</p>
 [% ELSE %]
 <form method="post" action="/cgi-bin/koha/basket/downloadcart.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows">
 	<legend>Download cart</legend>
 	<ol><li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
index 6d449fb77bc..a641b7f2da9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
@@ -18,6 +18,7 @@
 
 [% INCLUDE 'blocking_errors.inc' %]
 <form action="/cgi-bin/koha/basket/sendbasket.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 
 <fieldset class="rows"> 
 <legend>Sending your cart</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
index 4ff7adc54e4..9ea20204f18 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
@@ -193,6 +193,7 @@
                                                 [% IF ( CAN_user_circulate ) %]
                                                     [% SET ClaimReturnedLostValue = Koha.Preference('ClaimReturnedLostValue') %]
                                                     <form action="updateitem.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                         <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                         <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -242,6 +243,7 @@
                                                 <span class="label">Damaged status:</span>
                                                 [% IF ( CAN_user_circulate ) %]
                                                     <form action="updateitem.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                         <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                         <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -276,6 +278,7 @@
                                                 <span class="label">Withdrawn status:</span>
                                                 [% IF ( CAN_user_circulate ) %]
                                                     <form action="updateitem.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                         <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                         <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -315,6 +318,7 @@
                                         <li>
                                             <span class="label">Exclude from local holds priority:</span>
                                             <form action="updateitem.pl" method="post">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                 <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                 <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -428,6 +432,7 @@
                                             <span class="label">Public note:</span>
                                             [% IF ( CAN_user_editcatalogue_edit_items ) %]
                                                 <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
                                                     <input type="hidden" name="op" value="set_public_note" />
                                                     <textarea name="itemnotes" rows="2" cols="30">[% ITEM_DAT.itemnotes | html %]</textarea><input type="submit" name="submit" class="btn btn-primary btn-xs" value="Update" />
@@ -441,6 +446,7 @@
                                             <span class="label">Non-public note:</span>
                                             [% IF ( CAN_user_editcatalogue_edit_items ) %]
                                                 <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
                                                     <input type="hidden" name="op" value="set_non_public_note" />
                                                     <textarea name="itemnotes_nonpublic" rows="2" cols="30">[% ITEM_DAT.itemnotes_nonpublic | html %]</textarea><input type="submit" name="submit" class="btn btn-primary btn-xs" value="Update" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
index 231eec76d37..cb42584358e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
@@ -341,6 +341,7 @@
 
                 [% ELSE # /IF total %]
                     <form method="post" name="fz3950" class="fz3950bigrpad">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div id="toolbar" class="btn-toolbar" style="background-color:transparent"><div>
                             <button class="btn btn-default" type="button" id="z3950submit"><i class="fa fa-search"></i> Z39.50/SRU search</button>
                         </div></div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt
index 1aee560715e..ca8e473e07c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt
@@ -42,6 +42,7 @@
                         [% IF ( current_biblio_searches ) %]
                             <h2>Current session</h2>
                             <form id="current_cat" action="/cgi-bin/koha/catalogue/search-history.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p class="selections-toolbar">
                                     <a class="CheckAll" data-form="current_cat" href="#"><i class="fa fa-check"></i> Select all visible rows</a>
                                     <span class="sep">|</span>
@@ -83,6 +84,7 @@
                         [% IF ( previous_biblio_searches ) %]
                             <h2>Previous sessions</h2>
                             <form id="previous_cat" action="/cgi-bin/koha/catalogue/search-history.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p class="selections-toolbar">
                                     <a class="CheckAll" data-form="previous_cat" href="#"><i class="fa fa-check"></i> Select all visible rows</a>
                                     <span class="sep">|</span>
@@ -126,6 +128,7 @@
                         [% IF ( current_authority_searches ) %]
                             <h2>Current session</h2>
                             <form id="current_auth" action="/cgi-bin/koha/catalogue/search-history.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p class="selections-toolbar">
                                     <a class="CheckAll" data-form="current_auth" href="#"><i class="fa fa-check"></i> Select all visible rows</a>
                                     <span class="sep">|</span>
@@ -167,6 +170,7 @@
                         [% IF ( previous_authority_searches ) %]
                             <h2>Previous sessions</h2>
                             <form id="previous_auth" action="/cgi-bin/koha/catalogue/search-history.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p class="selections-toolbar">
                                     <a class="CheckAll" data-form="previous_auth" href="#"><i class="fa fa-check"></i> Select all visible rows</a>
                                     <span class="sep">|</span>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt
index 8fbf62a7835..28e0d3db413 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt
@@ -134,6 +134,7 @@
                                         </a>
                                     [% ELSE %]
                                         <form class="rota_select_form" method="post" enctype="multipart/form-data">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <select class="item_select_rota" name="rota_id">
                                                 [% FOREACH rota IN rotas %]
                                                     <option value="[% rota.rota_id | uri %]">[% rota.title | html %]</option>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
index 787d19cb566..f9fb359f86b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
@@ -887,6 +887,7 @@ $(document).ready(function(){
                     </script>
                 [% ELSE %]
                     <form method="post" name="f" id="f" action="/cgi-bin/koha/cataloguing/addbiblio.pl" onsubmit="return Check();">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" value="[% IF ( biblionumber ) %]view[% ELSE %]items[% END %]" id="redirect" name="redirect" />
                         <input type="hidden" value="" id="current_tab" name="current_tab" />
                         <input type="hidden" value="0" id="confirm_not_duplicate" name="confirm_not_duplicate" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt
index 9326db28b65..6ca813cd27d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt
@@ -176,6 +176,7 @@
 
 <div id="cataloguing_additem_newitem" class="item_edit_form page-section">
     <form id="f" method="post" action="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblio.biblionumber | html %]" name="f">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="op" value="[% op | html %]" />
     [% IF (popup) %]
         <input type="hidden" name="popup" value="1" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt
index 03e7f2b4b54..6d0ad685b67 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt
@@ -37,6 +37,7 @@
 	[% IF ( errornohostitemnumber ) %]ERROR: Unable to get the item number from this barcode.[% END %]
     </div>
     <form action="/cgi-bin/koha/catalogue/MARCdetail.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="submit" class="btn btn-primary" value="OK" />
 	<input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
     </form>
@@ -44,12 +45,14 @@
     [% IF ( success ) %]
     <div class="dialog message">The item has successfully been linked to <em>[% bibliotitle | html %]</em>.</div>
 	<form action="/cgi-bin/koha/catalogue/MARCdetail.pl" method="post">
+	    [% INCLUDE 'csrf-token.inc' %]
         <input type="submit" class="btn btn-primary" value="OK" />
 	    <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
 	</form>
     [% ELSE %]
 	[% IF ( missingparameter ) %]
 	<form method="post" action="/cgi-bin/koha/cataloguing/linkitem.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	    [% IF ( missingbiblionumber ) %]
 	    <fieldset id="biblionumber_fieldset">
 		<label for="biblionumber_fieldset">Select the biblionumber to link the item to</label>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt
index 9ed117f7c62..487d96ff77b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt
@@ -105,6 +105,7 @@ div#result { margin-top: 1em; }
 [% IF ( choosereference ) %]
 <p>Please choose which record will be the reference for the merge. The record chosen as reference will be kept, and the other will be deleted.</p>
 <form id="mergeform" action="/cgi-bin/koha/cataloguing/merge.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <legend>Merge reference</legend>
     <ol>
@@ -168,6 +169,7 @@ div#result { margin-top: 1em; }
     </div>
 [% ELSE %]
 <form id="mergeform" action="/cgi-bin/koha/cataloguing/merge.pl" method="post" onsubmit="return mergeformsubmit()">
+    [% INCLUDE 'csrf-token.inc' %]
 
 <div class="col-sm-6">
 [% PROCESS mergesource sourcerecords=records %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt
index 175e731ac04..79c2af00897 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt
@@ -42,6 +42,7 @@
                              <form action="/cgi-bin/koha/catalogue/ISBDdetail.pl" method="post">
                         [% ELSE %]
                              <form action="/cgi-bin/koha/catalogue/detail.pl" method="post">
+                                 [% INCLUDE 'csrf-token.inc' %]
                         [% END %]
 [% END %]
 
@@ -103,6 +104,7 @@
     [% ELSE %]
 	[% IF ( missingparameter ) %]
 	<form method="post" action="/cgi-bin/koha/cataloguing/moveitem.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	    [% IF ( missingbiblionumber ) %]
 	    <fieldset id="biblionumber_fieldset">
 		<label for="biblionumber">Select the biblionumber to attach the item to</label>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt
index ad1e3c2949a..a0694d4a7cb 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt
@@ -22,6 +22,7 @@
         <div id="MARC21_Linking_section_search" class="page-section">
             <h2>Search for</h2>
             <form name="f" method="post" action="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl">
+                [% INCLUDE 'csrf-token.inc' %]
 
                 <p>
                     <input type="hidden" name="plugin_name" value="marc21_linking_section.pl" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt
index 90b13ea4112..af5704e418f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt
@@ -15,6 +15,7 @@
 <h1>UNIMARC field 210c builder</h1>
     <h4>Search for authority type: EDITORS</h4>
         <form name="f" method="post" action="plugin_launcher.pl">
+            [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <input type="hidden" name="plugin_name" value="unimarc_field_210c.pl" />
             <input type="hidden" name="op" value="do_search" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
index e66b570563f..25c95ca804d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
@@ -19,6 +19,7 @@
             <div id="UNIMARC_Field_4XX_search" class="page-section">
                 <h2> Search on  </h2>
                 <form name="f" method="post" action="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
 
                     <p>
                         <input type="hidden" name="plugin_name" value="unimarc_field_4XX.pl" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt
index 7b9e0a52582..652015c883b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt
@@ -22,6 +22,7 @@
     [% IF ( opsearch ) %]
         <h1>Z39.50 authority search points</h1>
         <form method="post" action="z3950_auth_search.pl" name="f" class="checkboxed">
+            [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" id="op" value="do_search" />
         <input type="hidden" name="authid" value="[% authid | html %]" />
         <input type="hidden" name="index" value="[% index | html %]" />
@@ -122,6 +123,7 @@
     </div>
 
     <form method="post" action="z3950_auth_search.pl" id="page_form" name="page_form" class="checkboxed">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" id="op" value="do_search" />
         <input type="hidden" name="current_page" id="current_page" value="[% current_page | html %]" />
         <input type="hidden" id="nameany"  name="nameany" value="[% nameany | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt
index 8478c72695f..1884ea37f7c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt
@@ -42,6 +42,7 @@
         [% IF ( opsearch ) %]
             <h1>Z39.50/SRU search</h1>
             <form method="post" action="z3950_search.pl" name="f" class="checkboxed">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="row">
                     <div class="col-xs-6">
                         <input type="hidden" name="op" id="op" value="do_search" />
@@ -225,6 +226,7 @@
                             </div>
 
                             <form method="post" action="z3950_search.pl" id="page_form" name="page_form" class="checkboxed">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="op" id="op" value="do_search" />
                                 <input type="hidden" name="current_page" id="current_page" value="[% current_page | html %]" />
                                 <input type="hidden" id="title"  name="title" value="[% title | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt
index 0cfcab953a2..3b7a683feac 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt
@@ -162,6 +162,7 @@
                 [% PROCESS urls_modal %]
 
                 <form id="ar-branchcode-form" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <select name="branchcode" id="branchcode">
                         <option value="">All libraries</option>
                         [% FOREACH b IN Branches.all( only_from_group => 1 ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt
index d631828b696..9a6c842e695 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt
@@ -40,6 +40,7 @@
 <h1>Circulation: Overdues at [% Branches.GetLoggedInBranchname | html %]</h1>
 
 <form name="selectlocation" action="branchoverdues.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <label for="location">Shelving location selected: </label><select id="location" name="location">
         <option value="">All shelving locations</option>
         [% FOREACH locationsloo IN locationsloop %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
index 73570f27507..9cc0241be40 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
@@ -64,6 +64,7 @@
                 </th>
                 <td>
                     <form method="post" name="mainform" id="mainform" action="branchtransfers.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% FOREACH trsfitemloo IN trsfitemloop %]
                             <input type="hidden" name="bc-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.item.barcode | html %]" />
                             <input type="hidden" name="fb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.frombrcd | html %]" />
@@ -90,6 +91,7 @@
                         <th>Cancel hold and then attempt transfer:</th>
                         <td>
                             <form method="post" name="mainform" id="mainform" action="branchtransfers.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 [% FOREACH trsfitemloo IN trsfitemloop %]
                                     <input type="hidden" name="bc-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.item.barcode | html %]" />
                                     <input type="hidden" name="fb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.frombrcd | html %]" />
@@ -110,6 +112,7 @@
                         <th>Ignore and return to transfers: </th>
                             <td>
                                 <form method="post" name="mainform" id="mainform" action="branchtransfers.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="tobranchcd" value="[% tobranchcd | html %]" />
                                     <input type="hidden" name="barcode" />
                                     [% FOREACH trsfitemloo IN trsfitemloop %]
@@ -175,6 +178,7 @@
 
 <div id="branchtransfers">
     <form method="post" name="mainform" id="mainform" action="/cgi-bin/koha/circ/branchtransfers.pl">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="brief">
             <legend>Transfer</legend>
             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt
index 04a5dbcc801..c3067a9d011 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt
@@ -61,6 +61,7 @@
 
             [% IF ( notes.count ) %]
                 <form id="mark_selected" method="post" action="/cgi-bin/koha/circ/checkout-notes.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <div id="toolbar" class="btn-toolbar">
                         <button type="submit" class="btn btn-default markseen" name="mark_selected-seen" value="seen" disabled="disabled"><i class="fa-solid fa-eye"></i> Mark seen</button>
                         <button type="submit" class="btn btn-default markseen" name="mark_selected-notseen" value="notseen" disabled="disabled"><i class="fa-solid fa-eye-slash"></i> Mark not seen</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
index 3388e387a53..ec40efac1af 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
@@ -244,6 +244,7 @@
 
                             [% IF CAN_user_circulate_force_checkout or HIGHHOLDS %]
                                 <form method="post" action="/cgi-bin/koha/circ/circulation.pl" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="restoreduedatespec" />
 
                                     [% IF (forceallow) %]<input type="hidden" name="forceallow" value="1">[% END %]
@@ -336,6 +337,7 @@
 
                             [% IF ADDITIONAL_MATERIALS && !CAN_user_circulate_force_checkout %]
                                 <form method="post" action="/cgi-bin/koha/circ/circulation.pl" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="restoreduedatespec" />
 
                                     [% IF (forceallow) %]<input type="hidden" name="forceallow" value="1">[% END %]
@@ -574,6 +576,7 @@
                                                             [% END %]
                                                             <td>
                                                                 <form method="post" action="/cgi-bin/koha/circ/circulation.pl" autocomplete="off">
+                                                                    [% INCLUDE 'csrf-token.inc' %]
                                                                     [% IF (forceallow) %]
                                                                         <input type="hidden" name="forceallow" value="1">
                                                                     [% END %]
@@ -633,6 +636,7 @@
                             [% IF ( !noissues ) || ( Koha.Preference('OnSiteCheckouts') && Koha.Preference('OnSiteCheckoutsForce') )%]
                                 <div class="col-sm-6">
                                     <form method="post" action="/cgi-bin/koha/circ/circulation.pl" id="mainform" name="mainform" autocomplete="off">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="restoreduedatespec" />
                                         [% IF ( issue ) %]
                                             <fieldset id="circ_circulation_issue" class="lastchecked">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
index f9f31a02129..1a45acc0d16 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
@@ -83,6 +83,7 @@
   </div>
 [% ELSIF patron and not checkout_infos %]
   <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/circ/circulation.pl">
+      [% INCLUDE 'csrf-token.inc' %]
     <fieldset id="circ_circulation_issue">
       <label for="barcode">Checking out to [% INCLUDE 'patron-title.inc' %]</label>
       <fieldset class="rows">
@@ -121,6 +122,7 @@
   [% IF confirmation_needed && CAN_user_circulate_force_checkout %]
     <h3>Batch checkout confirmation [% IF patron %] for [% INCLUDE 'patron-title.inc' invert_name = 1 %] [% END %]</h3>
     <form method="post" action="/cgi-bin/koha/circ/circulation.pl" id="mainform" name="mainform" autocomplete="off">
+        [% INCLUDE 'csrf-token.inc' %]
   [% ELSE %]
     <h3>Batch checkout information [% IF patron.borrowernumber %] for [% INCLUDE 'patron-title.inc' invert_name = 1 %] |[% batch | html %]|[% END %]</h3>
   [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt
index 962002e704a..0337561ced2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt
@@ -126,6 +126,7 @@
                 [% END %]
 
                 <form method="post" class="refresh-form">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <p>
                         <input type="hidden" name="tab" id="current-tab" value="[% tab | html %]" />
                         <button type="submit" class="btn btn-default"><i class="fa-solid fa-rotate" aria-hidden="true"></i> Refresh</button>
@@ -215,6 +216,7 @@
                                                     </td>
                                                     <td>
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-staged"/>
                                                             <input type="hidden" name="tab" value="to-be-staged"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -224,6 +226,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="cancel"/>
                                                             <input type="hidden" name="tab" value="to-be-staged"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -274,6 +277,7 @@
                                                     </td>
                                                     <td>
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-patron-has-arrived"/>
                                                             <input type="hidden" name="tab" value="staged-and-ready"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -283,6 +287,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-delivered"/>
                                                             <input type="hidden" name="tab" value="staged-and-ready"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -292,6 +297,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-unstaged"/>
                                                             <input type="hidden" name="tab" value="staged-and-ready"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -342,6 +348,7 @@
                                                     </td>
                                                     <td>
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-delivered"/>
                                                             <input type="hidden" name="tab" value="patron-is-outside"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -351,6 +358,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-staged"/>
                                                             <input type="hidden" name="tab" value="patron-is-outside"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -360,6 +368,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-unstaged"/>
                                                             <input type="hidden" name="tab" value="patron-is-outside"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -439,6 +448,7 @@
                             [% SET waiting_holds = patron.holds.search( found => 'W', branchcode => Branches.GetLoggedInBranchcode ) %]
                             [% IF !policy.enable_waiting_holds_only || waiting_holds.count > 0 %]
                                 <form id="create-pickup" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="rows" style="float: none;">
                                         <input type="hidden" name="borrowernumber" value="[% patron.id | html %]"/>
                                         <input type="hidden" name="op" value="create-pickup"/>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt
index 530e1d1e2d5..1f7b945ba56 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt
@@ -163,6 +163,7 @@
             <aside>
 
 <form method="post" action="/cgi-bin/koha/circ/overdue.pl">
+    [% INCLUDE 'csrf-token.inc' %]
   <fieldset class="brief">
 <h4>Filter on:</h4>
     <fieldset><legend>Date due:</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
index 8c47fe74f20..f81e9161527 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
@@ -205,6 +205,7 @@
         </td>
         <td>
             <form name="cancelReserve" action="/cgi-bin/koha/circ/pendingreserves.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="cancel_reserve" />
                 <input type="hidden" name="reserve_id" value="[% hold.reserve_id | html %]" />
 
@@ -231,6 +232,7 @@
         [% IF Koha.Preference('CanMarkHoldsToPullAsLost') != 'do_not_allow' %]
             [% IF hold.itemnumber %]
                 <form name="cancelReserve" action="/cgi-bin/koha/circ/pendingreserves.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="reserve_id" value="[% hold.reserve_id | html %]" />
                     [% IF Koha.Preference('CanMarkHoldsToPullAsLost') == 'allow' %]
                         <input type="hidden" name="op" value="mark_as_lost" />
@@ -285,6 +287,7 @@
 <div id="filters">
 
 <form action="/cgi-bin/koha/circ/pendingreserves.pl" method="post" >
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="brief">
 <h4>Refine results</h4>
 <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt
index d3c48b93973..a3245966db4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt
@@ -61,6 +61,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override limit and renew</button>
@@ -73,6 +74,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override limit and renew</button>
@@ -85,6 +87,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override and renew</button>
@@ -97,6 +100,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override and renew</button>
@@ -109,6 +113,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <input type="submit" class="approve" value="Override and renew" />
@@ -121,6 +126,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <input type="submit" class="approve" value="Override and renew" />
@@ -133,6 +139,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override limit and renew</button>
@@ -144,6 +151,7 @@
                                 <p>[% INCLUDE 'biblio-title.inc' biblio=item.biblio link = 1 %] ( [% item.barcode | html %] ): This item is on hold for another patron.</p>
 
                                 <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                     <input type="hidden" name="override_limit" value="1" />
                                     <input type="hidden" name="override_holds" value="1" />
@@ -196,6 +204,7 @@
 
             [% UNLESS error %]
                 <form method="post" action="/cgi-bin/koha/circ/renew.pl" autocomplete="off" >
+                    [% INCLUDE 'csrf-token.inc' %]
 
                     <fieldset>
                         <h1>Renew</h1>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt
index 652dc0418a6..951a20b3d58 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt
@@ -117,6 +117,7 @@
                                 </div>
                             [% END %]
                             <form id="place-article-request" method="post" action="/cgi-bin/koha/circ/request-article.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="action" value="create" />
                                 <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblio.biblionumber | html %]" />
                                 <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt
index 222f695d0eb..5d5af063491 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt
@@ -137,6 +137,7 @@
             <aside>
 
 <form action="/cgi-bin/koha/circ/reserveratios.pl" method="post" >
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="brief">
 <h4>Refine results:</h4>
 <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
index b15efad24f5..f744844590c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
@@ -416,6 +416,7 @@
                                         </div>
                                         <div class="modal-footer">
                                             <form method="post" action="/cgi-bin/koha/circ/returns.pl" autocomplete="off">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="barcode" value="[% item.barcode | html %]" />
                                                 <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" />
                                                 <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" />
@@ -440,6 +441,7 @@
                             <div class="modal-dialog modal-wide">
                                 <div class="modal-content">
                                     <form method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <div class="modal-header">
                                             <h3>Please confirm bundle contents for [% item.barcode | html %]</h3>
                                         </div>
@@ -526,6 +528,7 @@
                                 <div class="modal-dialog">
                                     <div class="modal-content">
                                         <form method="post" action="returns.pl" name="mainform" id="mainform">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <div class="modal-header">
                                                 <h3>
                                                     Cannot check in
@@ -570,6 +573,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="returns.pl" name="wrongtransferform" id="wrongtransferform">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" />
                                                 <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" />
                                                 <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />
@@ -615,6 +619,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="returns.pl" class="confirm">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <div class="modal-header">
                                                     <h3>
                                                         Hold found (item is already waiting):
@@ -716,6 +721,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="returns.pl" name="mainform" id="mainform">
+                                                [% INCLUDE 'csrf-token.inc' %]
 
                                                 <input type="hidden" name="print_slip" value="0" />
 
@@ -774,6 +780,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="returns.pl" class="confirm">
+                                                [% INCLUDE 'csrf-token.inc' %]
 
                                                 <input type="hidden" name="print_slip" value="0" />
 
@@ -890,6 +897,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="/cgi-bin/koha/circ/returns.pl" class="confirm">
+                                                [% INCLUDE 'csrf-token.inc' %]
 
                                                 <div class="modal-header">
                                                     <h3>
@@ -991,6 +999,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="/cgi-bin/koha/circ/returns.pl" class="confirm">
+                                                [% INCLUDE 'csrf-token.inc' %]
 
                                                 <div class="modal-header">
                                                     <h3>
@@ -1083,6 +1092,7 @@
                         </div>
 
                         <form id="checkin-form" method="post" action="/cgi-bin/koha/circ/returns.pl" autocomplete="off" >
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset id="circ_returns_checkin">
                                 <div class="show_checkin_dialog" style="float:right;display:none"><button type="button" class="btn btn-default btn-sm" data-toggle="tooltip" title="Show the last checkin message"><i class="fa fa-info"></i></button></div>
                                 <h1>Check in</h1>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt
index 4cb3da7fbe3..b71e47c6596 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt
@@ -73,6 +73,7 @@ Updated:<ul>
     [% END %]
     </ul>
 <form method="post" action="[% referer or "/cgi-bin/koha/circ/circulation.pl" %]">
+    [% INCLUDE 'csrf-token.inc' %]
     <div class="noshow">
         [% FOREACH recycle_loo IN recycle_loop %]
         <input type="text" name="[% recycle_loo.param | html %]" value="[% recycle_loo.value | html %]" />
@@ -84,6 +85,7 @@ Updated:<ul>
 [% ELSE %]
 
 <form method="post" action="set-library.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 [% IF ( CAN_user_superlibrarian || CAN_user_loggedinlibrary ) %]
 <fieldset class="rows">
     <legend>Set library</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt
index 45c8d1414be..5085df72c58 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt
@@ -69,6 +69,7 @@
                                         Please retain this item and check it in to process the hold.
                                         </p>
                                         <form name="cancelReservewithtransfert" action="waitingreserves.pl#[% tab | html %]" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
                                         </form>
                                     </div>
@@ -80,6 +81,7 @@
                                         Please retain this item and check it in to process the hold.
                                         </p>
                                         <form name="cancelReservewithwaiting" action="waitingreserves.pl#[% tab | html %]" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
                                         </form>
                                     </div>
@@ -126,6 +128,7 @@
                                             <span id="holdsover-cancel-all">
                                                 <button class="cancel_selected_holds" data-bulk="true"></button>
                                                 <form name="cancelAllReserve" action="waitingreserves.pl" method="post">
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="cancelall" value="1" />
                                                     <input type="hidden" name="allbranches" value="[% allbranches | html %]" />
                                                     <input type="hidden" name="tab" value="holdsover">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt
index ebbb27897ad..e0b16516535 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt
@@ -43,6 +43,7 @@
         <div class="col-md-8 col-md-offset-2">
 
             <form method="post" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="id" value="[% club.id | html %]" />
                 <input type="hidden" name="club_template_id" value="[% club_template.id | html %]" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt
index bb4d3e57382..f9c5081a8c3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt
@@ -48,6 +48,7 @@
         <div class="col-md-8 col-md-offset-2">
 
             <form method="post" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="id" value="[% club_template.id | html %]" />
 
                 <h1>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt
index cbf154227b6..744188c5687 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt
@@ -46,6 +46,7 @@
         [% END %]
 
         <form method="post" action="/cgi-bin/koha/course_reserves/add_items.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="course_id" value="[% course.course_id | html %]" />
             <input type="hidden" name="action" value="lookup" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt
index 284fd5acd6d..0be55850737 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt
@@ -59,6 +59,7 @@
         [% END %]
 
         <form method="post" action="/cgi-bin/koha/course_reserves/add_items.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="course_id" value="[% course.course_id | html %]" />
             <input type="hidden" name="return" value="[% return | html %]" />
             <input type="hidden" name="action" value="add" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt
index 4735ae20f36..0f74e1eb555 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt
@@ -44,6 +44,7 @@
 
         [% IF action == 'display_form' %]
             <form method="post" action="/cgi-bin/koha/course_reserves/batch_add_items.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="course_id" value="[% course.course_id | html %]" />
                 <input type="hidden" name="action" value="add" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt
index b390d5e755a..3e9ae261a86 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt
@@ -33,6 +33,7 @@
             <h1>Batch remove reserves</h1>
         [% IF action == 'display_form' %]
             <form method="post" action="/cgi-bin/koha/course_reserves/batch_rm_items.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="action" value="batch_rm" />
                 <fieldset class="rows">
                     <legend>Remove items: scan barcodes</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
index b74f4b37a76..ed6b8ea5f6c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
@@ -58,6 +58,7 @@
                 </h1>
 
             <form method="post" action="/cgi-bin/koha/course_reserves/mod_course.pl" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
                 [% IF course_id %]<input type="hidden" name="course_id" value="[% course_id | html %]" />[% END %]
                 <fieldset class="rows">
                     <legend>[% IF course_id %]Edit course[% ELSE %]Create course[% END %]</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
index 32b62601e2e..b8be4df96c3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
@@ -178,6 +178,7 @@
                         [% END %]
                         [% IF request.biblio_id && request.biblio_id.length > 0  && !whole.value.check_out_errors.error.STATS %]
                             <form method="POST" action="/cgi-bin/koha/ill/ill-requests.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="rows">
                                     <legend>Check out details</legend>
                                     [% items = whole.value.biblio.items.unblessed %]
@@ -318,6 +319,7 @@
                     [% IF whole.value.partners %]
                        [% ill_url = "/cgi-bin/koha/ill/ill-requests.pl?method=illview&illrequest_id=" _ request.illrequest_id %]
                         <form method="POST" action="/cgi-bin/koha/ill/ill-requests.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 <legend>Interlibrary loan request details</legend>
                                 <ol>
@@ -396,6 +398,7 @@
 
                 [% ELSIF query_type == 'edit_action' %]
                     <form method="POST" action="/cgi-bin/koha/ill/ill-requests.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <legend>Request details</legend>
                             <ol>
@@ -481,6 +484,7 @@
                     <div class="dialog alert">
                         <h3>Are you sure you wish to delete this request?</h3>
                         <form action="/cgi-bin/koha/ill/ill-requests.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="method" value="delete" />
                             <input type="hidden" name="confirmed" value="1" />
                             <input type="hidden" name="illrequest_id" value="[% request.id | html %]" />
@@ -757,6 +761,7 @@
                                 <h3><a id="toggle_addcomment" href="#">Add comment</a></h3>
                                 <div id="addcomment" class="content_hidden">
                                     <form class="validated" method="post" action="/cgi-bin/koha/ill/ill-requests.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" value="save_comment" name="method">
                                         [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" value="[% request.illrequest_id | html %]" name="illrequest_id">
@@ -790,6 +795,7 @@
                     <div id="results" class="page-section">
                         <h3>Displaying availability results</h3>
                         <form method="POST" action="/cgi-bin/koha/ill/ill-requests.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             [% FOREACH key IN whole.keys %]
                                 [% value = whole.$key %]
                                 [% IF key != 'method' && key != 'custom_key' && key != 'custom_value' %]
@@ -823,6 +829,7 @@
                     <h1>Request type disclaimer</h1>
                     <div id="results" class="page-section">
                         <form method="post" id="typedisclaimer-form">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 [% disclaimer.text | $raw %]
                                 [% SET disc_av_category_code = AuthorisedValues.GetAuthValueDropbox(disclaimer.av_cat) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt
index 863c17e5423..6a30ec6d81d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt
@@ -52,6 +52,7 @@
                     <p>Before we begin, please verify you have the correct credentials to continue. Please log in with the username and password given to you by your systems administrator and located in your <code>koha-conf.xml</code> configuration file.</p>
 
                     <form action="[% url | html %]" method="post" id="mainform">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% FOREACH INPUT IN INPUTS %]
                             <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
                         [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt
index f9fe7293dcc..2481e4a861b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt
@@ -45,6 +45,7 @@
                     <p>Please pick your language from the following list. If your language is not listed, please inform your system administrator.</p>
 
                     <form name="language" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="form-group">
                             <label for="language">Select a language: </label>
                             <select id="language" name="language">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt
index 0bca0ed0b61..5a17faf0ac7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt
@@ -41,6 +41,7 @@
 
                 [% IF ( dbconnection ) %]
                     <form name="checkdbparameters" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF ( checkdatabaseaccess ) %]
                             <div class="alert alert-success" role="alert"><p>Connection established.</p></div>
                             [% IF ( checkdatabasecreated ) %]
@@ -87,6 +88,7 @@
                     </form>
                 [% ELSE %]
                     <form name="checkinformation" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="step" value="2" />
                         <input type="hidden" name="checkdb" value="1" />
                         <p><input value="Continue to the next step" class="btn btn-primary" type="submit" /> </p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt
index 3198cddd9d4..fb945f1b131 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt
@@ -81,6 +81,7 @@
                     </div>
 
                     <form name="frameworkselection" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="selectframeworks" />
 
@@ -120,6 +121,7 @@
                     </div>
 
                     <form name="frameworkselection" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="addframeworks" />
                         [% IF ( frameworksloop ) %]
@@ -249,6 +251,7 @@
                     <p>In the next steps you will be guided through some basic requirements like defining Koha user with all administrative privileges (superlibrarian).</p>
 
                     <form action="/cgi-bin/koha/installer/install.pl" method="post" name="finish">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <h4>
                             You can help the Koha community by sharing your statistics with us.
                         </h4>
@@ -286,6 +289,7 @@
                         </div>
 
                         <form action="install.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="step" value="3" />
                             <p><input value="Continue to the next step" class="btn btn-primary" type="submit" /></p>
                         </form>
@@ -308,6 +312,7 @@
 
                     <p>Now we're ready to create the database tables and fill them with some default data.</p>
                     <form action="install.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="importdatastructure" />
                         <p><input value="Continue to the next step" class="btn btn-primary" type="submit" /></p>
@@ -335,6 +340,7 @@
 
                         <p>We are ready to do some basic configuration.</p>
                         <form action="install.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="step" value="3" />
                             <input type="hidden" name="op" value="choosemarc" />
                             <p><input value="Continue to the next step" class="btn btn-primary" type="submit" /></p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt
index e2e7d0ebb43..03f02c8dc5d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt
@@ -62,6 +62,7 @@
                 <h2>Barcode image generator</h2>
 
                 <form action="/cgi-bin/koha/svc/barcode" method="post" id="barcodegen">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="brief">
                         <div class="row">
                             <div class="col-sm-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt
index f054c2e058a..dc23dfaec4b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt
@@ -6,6 +6,7 @@
 <h1>Search</h1>
 
 <form name="f" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 	<input type="hidden" name="op" value="do_search" />
 	<input type="hidden" name="type" value="intranet" />
 	<div class="details">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
index cae46b81a4e..0511b57eabc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
@@ -78,6 +78,7 @@
 
                         <div id="manage-label-batches">
                             <form name="add_by_number" action="/cgi-bin/koha/labels/label-edit-batch.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <div>
                                     <fieldset class="rows" style="border-bottom: 0px; border: 0px;">
                                     <ol><li id="description">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt
index e15fe31d4fa..d1a5e3b249a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt
@@ -31,6 +31,7 @@
                     [% INCLUDE 'labels-toolbar.inc' %]
                     <h1>Print barcode range</h1>
                     <form name="add_by_number" action="/cgi-bin/koha/labels/label-edit-batch.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add" />
                         <fieldset class="rows">
                             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
index 04d910c739a..2b1c62a41f2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
@@ -66,6 +66,7 @@
                 [% END %]
             </h3>
             <form name="exporting" method="post" action="/cgi-bin/koha/labels/label-print.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="export" />
                 <input type="hidden" name="referer" value="[% referer | html %]" />
                 [% FOREACH batch_id IN batch_ids %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt
index edf948b8024..a5b9f77c626 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt
@@ -14,6 +14,7 @@ to add to Batch [% batch_id | html %]
 </h1>
 
 <form name="f" method="post" action="/cgi-bin/koha/labels/label-item-search.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 	<input type="hidden" name="op" value="do_search" />
 	<input type="hidden" name="batch_id" value="[% batch_id | html %]" />
 	<input type="hidden" name="type" value="[% type | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt
index 3b400b0e0c2..7a43a46565b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt
@@ -28,6 +28,7 @@
 
 <h1>Quick spine label creator</h1>
                 <form action="/cgi-bin/koha/labels/spinelabel-print.pl" method="post" id="spinelabelprint">
+                    [% INCLUDE 'csrf-token.inc' %]
 				<fieldset class="brief">
 				<ol>
 					<li><label for="barcode">Barcode: </label>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
index cc1934b574f..8dab1df5f4b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
@@ -61,6 +61,7 @@
             [% END %]
 
                 <form id="add-api-key" action="/cgi-bin/koha/members/apikeys.pl" method="post" style="display:none">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
                     [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="generate" />
@@ -99,6 +100,7 @@
                                         <td>[% IF key.active %]Yes[% ELSE %]No[% END %]</td>
                                         <td>
                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
                                                 <input type="hidden" name="key" value="[% key.id | html %]" />
                                                 [% INCLUDE 'csrf-token.inc' %]
@@ -106,6 +108,7 @@
                                                 <button class="btn btn-default btn-xs delete" type="submit"><i class="fa fa-trash-can"></i> Delete</button>
                                             </form>
                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
                                                 <input type="hidden" name="key" value="[% key.id | html %]" />
                                                 [% INCLUDE 'csrf-token.inc' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
index ca7d032358c..513526039d7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
@@ -159,6 +159,7 @@
         [% END %]
         [% IF account.is_debit && account.amount == account.amountoutstanding && account.status != 'CANCELLED' && !(account.debit_type_code == 'PAYOUT') %]
           <form method="post" action="/cgi-bin/koha/members/cancel-charge.pl">
+              [% INCLUDE 'csrf-token.inc' %]
             [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]">
             <input type="hidden" name="accountlines_id" value="[% account.accountlines_id | html %]">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
index f45c8f9b5e0..fb167a15673 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
@@ -58,6 +58,7 @@
     [% END %]
     <div class="btn-toolbar">
         <form method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="submit" name="discharge" class="btn btn-primary" value="Generate discharge" />
             <input type="hidden" value="[% patron.borrowernumber | html %]" name="borrowernumber" />
         </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
index 7192a62d207..41eddb5a884 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
@@ -82,6 +82,7 @@
                 [% END %]
 
                 <form method="post" action="/cgi-bin/koha/members/files.pl" enctype="multipart/form-data">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <legend>Upload new file</legend>
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
index 23775159b6c..bd3257b280f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
@@ -112,6 +112,7 @@
             <!-- Create or edit housebound_profile -->
             [% IF ( method == 'update_or_create' ) %]
               <form id="editform" method="post" name="editform"
+                  [% INCLUDE 'csrf-token.inc' %]
                     action="/cgi-bin/koha/members/housebound.pl">
                 <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                 [% IF ( housebound_profile ) %]
@@ -249,6 +250,7 @@
             [% ELSIF ( method == 'visit_update_or_create' ) %]
               <h4>Manage housebound deliveries</h4>
               <form name="form" id="instance_form" method="post"
+                  [% INCLUDE 'csrf-token.inc' %]
                     action="/cgi-bin/koha/members/housebound.pl">
                 [% IF ( visit ) %]
                   <input type="hidden" name="method" value="editvisitconfirm" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
index 2871a6d999d..0d85edc13ea 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
@@ -65,6 +65,7 @@
                 <div class="tab-content">
                     <div role="tabpanel" class="tab-pane active">
                         <form action="/cgi-bin/koha/members/mancredit.pl" method="post" id="mancredit">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
                             [% INCLUDE 'csrf-token.inc' %]
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
index 6e7e2e7fa67..043e953d612 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
@@ -74,6 +74,7 @@
                     </div>
                 [% END %]
                 <form action="/cgi-bin/koha/members/maninvoice.pl" method="post" id="maninvoice">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
                     [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
index bd4208173f1..00ffd23c4a9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
@@ -53,6 +53,7 @@
 [% ELSE %]
 
 <form method="post" id="changepasswordf" action="/cgi-bin/koha/members/member-password.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="destination" value="[% destination | html %]" />
 <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
 	[% IF ( errormsg ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
index 48cdbf6b25e..1528bd6997f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
@@ -112,6 +112,7 @@
           </div>
         [% IF CAN_user_tools_edit_patrons %]
             <form id="patron_batchmod_form" method="post" action="/cgi-bin/koha/tools/modborrowers.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="show" />
                 <textarea style="display:none" id="borrowernumberlist" name="borrowernumberlist"></textarea>
             </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
index 3f1d2481554..2ad9f45eeba 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
@@ -229,6 +229,7 @@ legend:hover {
                         [% END %]
 
                         <form name="form" id="entryform" action="/cgi-bin/koha/members/memberentry.pl" method="post" autocomplete="off" class="toggler">
+                            [% INCLUDE 'csrf-token.inc' %]
                             [% UNLESS ( check_member ) %]
                                 <input type="hidden" name="nodouble"  value="[% nodouble | html %]" />
                             [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt
index c5ea3677cb7..6f65e009397 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt
@@ -114,6 +114,7 @@
             <h1>Update patron records</h1>
             [% IF PendingModifications %]
                 <form method="post" action="members-update-do.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <div id="pending_updates" class="panel-group" role="tablist" aria-multiselectable="true">
                         [% FOREACH pm IN PendingModifications %]
                             [% SET borrowernumber = pm.borrowernumber %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt
index d231e610c44..85429d3a384 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt
@@ -83,6 +83,7 @@
                                                 [% IF ( QUEUED_MESSAGE.status != 'pending' ) %]
                                                     <div class="notice">
                                                         <form id="resend_notice[% QUEUED_MESSAGE.message_id | html %]" action="/cgi-bin/koha/members/notices.pl?borrowernumber=[% borrowernumber | html %]" method="POST">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="resend_notice" />
                                                             <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
                                                             <input type="hidden" name="message_id" value="[% QUEUED_MESSAGE.message_id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
index d60d910ad5f..aff11a35ca3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
@@ -74,6 +74,7 @@
 [% INCLUDE 'renew_results.inc' renew_results=renew_results %]
 [% IF ( accounts ) %]
     <form action="/cgi-bin/koha/members/pay.pl" method="post" id="pay-fines-form">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     [% INCLUDE 'csrf-token.inc' %]
 <p><span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> | <span class="clearall"><a id="CheckNone" href="#"><i class="fa fa-times"></i> Clear all</a></span></p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
index 1b4f2bf1c0b..b26e0471042 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
@@ -135,7 +135,7 @@
     </ul>
 
     <form name="payindivfine" id="payindivfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
-    [% INCLUDE 'csrf-token.inc' %]
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual | html %]" />
     <input type="hidden" name="itemnumber" id="itemnumber" value="[% itemnumber | html %]" />
@@ -231,7 +231,7 @@
     </ul>
 
     <form name="woindivfine" id="woindivfine" action="/cgi-bin/koha/members/pay.pl" method="post" >
-    [% INCLUDE 'csrf-token.inc' %]
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <legend>Write off an individual charge</legend>
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
@@ -298,7 +298,7 @@
     [% END %]
 
     <form name="payfine" id="payfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
-    [% INCLUDE 'csrf-token.inc' %]
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="selected_accts" id="selected_accts" value="[% selected_accts | html %]" />
     <input type="hidden" name="total" id="total" value="[% total | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt
index 1acdf6546ac..ff5beccab41 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt
@@ -20,6 +20,7 @@
 
     [% IF patron_categories %]
         <form method="post" action="update-child.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset>
                 <table id="catst">
                     <thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt
index cf392039fe2..5f68a7a32c7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt
@@ -70,6 +70,7 @@
 
    <div id="fileuploadform">
      <form method="post" action="/cgi-bin/koha/offline_circ/process_koc.pl" enctype="multipart/form-data" class="validated">
+         [% INCLUDE 'csrf-token.inc' %]
 		<fieldset class="brief">
        <ol><li><label for="fileToUpload">Choose .koc file: </label>
             <input class="required" required="required" type="file" id="fileToUpload" size="50" name="fileToUpload" />
@@ -85,12 +86,14 @@
    </div>
 
    <form action="enqueue_koc.pl" id="processfile" method="post" enctype="multipart/form-data">
+       [% INCLUDE 'csrf-token.inc' %]
      <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
      <input type="hidden" name="action" value="add_to_queue" />
      <input type="submit" value="Add to offline circulation queue" id="queueformsubmit" />
    </form>
 
    <form action="process_koc.pl" id="enqueuefile" method="post" enctype="multipart/form-data">
+       [% INCLUDE 'csrf-token.inc' %]
      <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
      <!-- <input type="submit" value="Apply directly" id="mainformsubmit" /> -->
    </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep1.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep1.tt
index e1cf606bf73..22bba760ff0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep1.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep1.tt
@@ -35,6 +35,7 @@
                 </div>
 
                 <form name="LibraryCreation" method="post" action="onboarding.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows" >
                         <input type="hidden" name="step" value="1"/>
                         <input type="hidden" name="op" value="add_validate_library"/>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt
index 07e58dae05e..b86f5d35dde 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt
@@ -47,6 +47,7 @@
                 <p> The patron category you create will be used by the <span class="bg-info">administrator account</span>.</p>
 
                 <form id="category_form" method="post" action="onboarding.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <input type="hidden" name="step" value="2" />
                         <input type="hidden" name="op" value="add_validate_category" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt
index bc8c777f58b..40dfd307edf 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt
@@ -39,6 +39,7 @@
                 Now we will create a patron with superlibrarian permissions. Log in with this to access Koha as a staff member with all permissions.
                 </p>
                 <form name="createpatron" id="createpatron" method="post" action="onboarding.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="add_validate_patron" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt
index 8bdde97a7b5..c4169b9d816 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt
@@ -40,6 +40,7 @@
                     <p> Important: Item types are what you apply circulation rules to. Circulation rules govern how your institution will lend its items: Checkout length, renewal policy, hold policy, etc. For example a circulation rule applied to the DVD item type may enforce a payment of $1.00 for checking out any DVD.</p>
 
                     <form id="createitemform" method="post" action="onboarding.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <input type="hidden" name="step" value="4" />
                         <input type="hidden" name="op" value="add_validate_itemtype" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt
index 4105d079db0..37a7285c114 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt
@@ -56,6 +56,7 @@
                     </div>
 
                     <form name="createcirculationrule" method="post" action="onboarding.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <input type="hidden" name="step" value="5"/>
                             <input type="hidden" name="op" value="add_validate_circ_rule" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt
index 142efe84a37..2de0a2587f6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt
@@ -51,6 +51,7 @@
         </h1>
 
         <form method="post" action="/cgi-bin/koha/patron_lists/add-modify.pl" class="validated">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
 
                 <legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
index be8c885b878..8d64f3e14de 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
@@ -105,6 +105,7 @@
         [% END %]
 
         <form action="list.pl" id="add_patrons" method="post" class="clearfix">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <legend>Add patrons</legend>
                 <ol>
@@ -156,6 +157,7 @@
         </form>
 
         <form action="list.pl" id="remove_patrons" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
 
             <div class="searchheader" id="searchheader">
                 <span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> |
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
index 49810c17ee1..cf859f774cd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
@@ -55,6 +55,7 @@
                     [% INCLUDE 'patroncards-errors.inc' %]
                     <div id="manage-patroncard-batches">
                             <form name="add_by_bor_num" action="/cgi-bin/koha/patroncards/edit-batch.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <div>
                                     <fieldset class="rows" style="border-bottom: 0px; border: 0px;">
                                     <ol><li id="description">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt
index cbb46554976..b98c3aeb8b1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt
@@ -44,6 +44,7 @@
 
                 <!-- NOTE: The order of the elements on this form is crictical to correct processing. You've been warned...  -->
                 <form name="input" action="/cgi-bin/koha/patroncards/edit-layout.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                 <div class="row">
                 <div class="col-sm-6">
                         <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt
index ade2605ee6c..b1fda7baa3a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt
@@ -47,6 +47,7 @@
                                 [% IF (profile_id) %] ([% profile_id | html %])[% END %]
                             </h1>
                                     <form name="input" action="/cgi-bin/koha/patroncards/edit-profile.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="rows"><legend>Profile settings</legend>
                                         <ol>
                                             <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt
index 46a1ee8da6d..505f7a1dafc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt
@@ -47,6 +47,7 @@
                         [% IF (template_id) %] ([% template_id | html %])[% END %]
                     </h1>
                     <form name="input" action="/cgi-bin/koha/patroncards/edit-template.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="row">
                         <div class="col-sm-6">
                             <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt
index 7c9c49d79b5..658b95a801d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt
@@ -38,6 +38,7 @@
                         <h2>Upload additional images for patron cards</h2>
                         <p>Manage additional images to use as logo, decoration or background on a patron card layout.</p>
                         <form name="upload_images" method="post" action="/cgi-bin/koha/patroncards/image-manage.pl" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="brief">
                                 <div class="hint">Only PNG, GIF, JPEG, XPM formats are supported. Maximum image size is 2MB.</div>
                                 <ol>
@@ -76,6 +77,7 @@
                     <h2>Delete images</h2>
                         [% IF ( TABLE ) %]
                         <form name="delete_images" method="post" action="/cgi-bin/koha/patroncards/image-manage.pl" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="brief">
                                 <div class="hint">
                                     Select one or more images to delete.
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
index 41a2ebc31a0..d8c14ca4367 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
@@ -55,6 +55,7 @@
                     [% END %]
             </h3>
             <form id="exportingf" name="exporting" method="post" action="/cgi-bin/koha/patroncards/print.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="export" />
                 <input type="hidden" name="referer" value="[% referer | html %]" />
                 [% FOREACH batch_id IN batch_ids %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt
index 3756de7f781..f96eb9529eb 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt
@@ -44,6 +44,7 @@
                 </div>
                 [% END %]
                 <form method="post" action="/cgi-bin/koha/plugins/plugins-upload.pl" enctype="multipart/form-data">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="brief">
                          <div class="hint"><strong>NOTE:</strong> Only KPZ file format is supported.</div>
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt
index 3cb0116eab2..d188557a376 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt
@@ -42,6 +42,7 @@
                 </p>
                 [% IF ( CAN_user_parameters_manage_cash_registers ) %]
                     <form action="/cgi-bin/koha/admin/cash_registers.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_form" />
                         <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button>
                     </form>
@@ -56,6 +57,7 @@
         [% END %]
 
         <form name="payForm" id="payForm" method="post" action="/cgi-bin/koha/pos/pay.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="row">
 
                 <div class="col-md-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt
index 046d6d26803..3db12c47efd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt
@@ -40,6 +40,7 @@
                     </p>
                     [% IF ( CAN_user_parameters_manage_cash_registers ) %]
                         <form action="/cgi-bin/koha/admin/cash_registers.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="add_form" />
                             <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button>
                         </form>
@@ -308,6 +309,7 @@
     <!-- Issue refund modal -->
     <div class="modal" id="issueRefundModal" tabindex="-1" role="dialog" aria-labelledby="issueRefundLabel">
         <form id="refund_form" method="post" enctype="multipart/form-data" class="validated">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="accountline" value="" id="refundline">
             <div class="modal-dialog" role="document">
                 <div class="modal-content">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt
index 3d4025814c9..4bbe6ab4978 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt
@@ -37,6 +37,7 @@
                             </p>
                             [% IF ( CAN_user_parameters_manage_cash_registers ) %]
                                 <form action="/cgi-bin/koha/admin/cash_registers.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="add_form" />
                                     <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button>
                                 </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_overdue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_overdue.tt
index 68a98664aaf..720d8b85f63 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_overdue.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_overdue.tt
@@ -42,6 +42,7 @@
             [% IF recalls.count %]
                 <div class="page-section">
                     <form method="post" action="/cgi-bin/koha/recalls/recalls_overdue.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="cancel_multiple_recalls">
                         <input type="checkbox" id="select_all"> <span id="select_all_text">Select all</span>
                         [% INCLUDE 'recalls.inc' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_queue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_queue.tt
index 8b833c3ab63..2e355a52bd0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_queue.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_queue.tt
@@ -42,6 +42,7 @@
             [% IF recalls.count %]
                 <div class="page-section">
                     <form method="post" action="/cgi-bin/koha/recalls/recalls_queue.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="cancel_multiple_recalls">
                         <input type="checkbox" id="select_all"> <span id="select_all_text">Select all</span>
                         [% INCLUDE 'recalls.inc' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt
index feed9372df1..1ec3ec13c46 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt
@@ -124,6 +124,7 @@
                                 </td>
                                 <td class="recall-action">
                                     <form action="/cgi-bin/koha/recalls/recalls_to_pull.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="recall_id" value="[% recall.first_recall.id | html %]">
                                         <input type="hidden" name="op" value="cancel">
                                         [% IF recall.first_recall.in_transit %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt
index ce3bc20852a..2e47874b06e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt
@@ -78,6 +78,7 @@
                                                 <td class="recall-library">[% recall.library.branchname | html %]</td>
                                                 <td class="recall-action actions">
                                                     <form action="/cgi-bin/koha/recalls/recalls_waiting.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="recall_id" value="[% recall.id | html %]">
                                                         <input type="hidden" name="op" value="modify">
                                                         <fieldset class="action">
@@ -122,6 +123,7 @@
                                                     <td class="recall-library">[% recall.library.branchname | html %]</td>
                                                     <td class="recall-action actions">
                                                         <form action="/cgi-bin/koha/recalls/recalls_waiting.pl" method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="recall_id" value="[% recall.id | html %]">
                                                             <input type="hidden" name="op" value="modify">
                                                             <fieldset class="action">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/request.tt
index 206c83c4efe..f1e17e3ad67 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/request.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/request.tt
@@ -42,6 +42,7 @@
         [% IF recalls.count %]
             <div class="page-section">
                 <form method="post" action="/cgi-bin/koha/recalls/request.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="cancel_multiple_recalls">
                     <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]">
                     <input type="checkbox" id="select_all"> <span id="select_all_text">Select all</span>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt
index e717fd904ad..bd70f9a8ba4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt
@@ -106,6 +106,7 @@
 	[% END %]
 [% ELSE %]
 	<form method="post" action="/cgi-bin/koha/reports/acquisitions_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
 	<legend>Acquisitions statistics</legend>
 	<table>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt
index 2cbeb322923..0daa5198661 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt
@@ -116,6 +116,7 @@
 [% ELSE %]
     <h1>Patrons with the most checkouts</h1>
 	<form method="post" action="/cgi-bin/koha/reports/bor_issues_top.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
         <ol>
             <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt
index aa895c994c7..e24a584e23c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt
@@ -71,6 +71,7 @@
 [% ELSE %]
     <h1>Patrons with no checkouts</h1>
     <form method="post" action="/cgi-bin/koha/reports/borrowers_out.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
 		<ol>
             <li><label for="patroncategory">Patron category: </label> <select name="Filter" id="patroncategory"><option value="" > Any category code</option>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt
index b1d18ce69d5..26e7168947e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt
@@ -94,6 +94,7 @@
 [% ELSE %]
 
 	<form method="post" action="/cgi-bin/koha/reports/borrowers_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows"><legend>Patrons statistics</legend>
 	<table>
 		<thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt
index 5667a6defe5..a16c7209519 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt
@@ -63,6 +63,7 @@
 
     <h1>Cash register statistics</h1>
     <form method="post" action="/cgi-bin/koha/reports/cash_register_stats.pl" id="frmCashRegister">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <legend>Cash register statistics [% beginDate | $KohaDates %] to [% endDate | $KohaDates %]</legend>
             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
index 8ff885af24a..3069df8879e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
@@ -90,6 +90,7 @@
 [% ELSE %]
     <h1>Most-circulated items</h1>
 	<form method="post" action="/cgi-bin/koha/reports/cat_issues_top.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
 	<ol>
         <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt
index 6194de328a9..3d55b8c07c1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt
@@ -163,6 +163,7 @@
                     <h1>Items with no checkouts</h1>
 
                     <form method="post" action="/cgi-bin/koha/reports/catalogue_out.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <ol>
                                 <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt
index 997497e3aa7..b9473255cef 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt
@@ -98,6 +98,7 @@
 [% ELSE %]
 
 	<form method="post" action="/cgi-bin/koha/reports/catalogue_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
 	<legend>Catalog statistics</legend>
 	<table>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
index 05e5d9f7369..0d7b4e2e839 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
@@ -87,6 +87,7 @@
             <div class="page-section">
                 <h2>Current terms</h2>
                 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="phase" value="View Dictionary" />
                     [% IF ( areas ) %]
                         Filter by area
@@ -135,6 +136,7 @@
 [% IF ( new_dictionary ) %]
 <h3>Add new definition</h3>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows"><legend>Step 1 of 5: Name the new definition</legend><ol>
 <li>
 <label for="definition_name">Definition name:</label>
@@ -154,6 +156,7 @@
 [%- IF ( step_2 ) -%]
 <h3>Add new definition</h3>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <fieldset class="rows">
     <legend>Step 2 of 5: Choose the area</legend>
     <ol>
@@ -176,6 +179,7 @@
 [% IF ( step_3 ) %]
 <h3>Add new definition</h3>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">      
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows">
 <legend>Step 3 of 5: Choose a column</legend>
 <input type="hidden" name="area" value="[% area | html %]" />
@@ -212,6 +216,7 @@
 [% IF ( step_4 ) %]
 <h3>Add new definition</h3>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows">
 <legend>Step 4 of 5: Specify a value</legend>
 <input type="hidden" name="area" value="[% area | html %]" />
@@ -261,6 +266,7 @@
 
 [% IF ( step_5 ) %]
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="area" value="[% area | html %]" />
 <input type="hidden" name="definition_name" value="[% definition_name | html %]" />
 <input type="hidden" name="definition_description" value="[% definition_description | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
index e452fe4162e..9d1ffe199ed 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
@@ -266,6 +266,7 @@
                                     [% END %]
 
                                     <form action="/cgi-bin/koha/reports/guided_reports.pl" id="reports_form" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="phase" value="Delete Multiple" />
                                         <table id="table_reports">
                                             <thead>
@@ -514,6 +515,7 @@
                 [% IF ( build2 ) %]
                     <h1>Build a report</h1>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="public" value="[% public | html %]" />
                         <input type="hidden" name="cache_expiry" value="[% cache_expiry | html %]" />
@@ -545,6 +547,7 @@
                     <p>Note: Be careful selecting when selecting columns. If your choice is too broad it could result in a very large report that will either not complete, or slow your system down.</p>
 
                     <form id="column_submit" action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="public" value="[% public | html %]" />
@@ -597,6 +600,7 @@
                 [% IF ( build4 ) %]
                     <h1>Build a report</h1>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" >
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="column" value="[% column | html %]" />
@@ -685,6 +689,7 @@
                     <h1>Build a report</h1>
                     <h3>Step 5 of 6: Pick which columns to total</h3>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="column" value="[% column | html %]" />
@@ -723,6 +728,7 @@
                     <h1>Build a report</h1>
                     <h3>Step 6 of 6: Choose how you want the report ordered</h3>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="column" value="[% column | html %]" />
@@ -765,6 +771,7 @@
                     </p>
 
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="sql" value="[% sql | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="public" value="[% public | html %]" />
@@ -778,6 +785,7 @@
 
                 [% IF ( save ) %]
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" id="sql_report_form">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="sql" value="[% sql | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="area" value="[% area | html %]" />
@@ -933,6 +941,7 @@
                         [% IF ( execute ) %]
                             [% UNLESS ( errors ) %]
                                 <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/batch_record_modification.pl" id="batch_record_modification" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="recordtype" value="biblio" />
                                     <input type="hidden" name="op" value="list" />
                                     [% # Preserve the whitespace of the following textarea in order to format the values correctly %]
@@ -942,6 +951,7 @@
                                 </form>
 
                                 <form method="POST" action="/cgi-bin/koha/tools/batch_delete_records.pl" id="batch_record_deletion" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="recordtype" value="biblio" />
                                     <input type="hidden" name="op" value="list" />
                                     [% # Preserve the whitespace of the following textarea in order to format the values correctly %]
@@ -951,6 +961,7 @@
                                 </form>
 
                                 <form method="POST" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_modification" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="show" />
                                     [% FOREACH result IN results %]
                                         [% FOREACH cells IN result.cells %]
@@ -966,6 +977,7 @@
                                 </form>
 
                                 <form method="POST" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_deletion" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="show" />
                                     <input type="hidden" name="del" value="1" />
                                     [% FOREACH result IN results %]
@@ -996,6 +1008,7 @@
                                 </form>
 
                                 <form method="POST" action="/cgi-bin/koha/tools/modborrowers.pl" id="batch_patron_modification" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="show" />
                                     [% # Preserve the whitespace of the following textarea in order to format the values correctly %]
                                     <textarea style="display:none" name="cardnumberlist" id="cardnumberlist">
@@ -1201,6 +1214,7 @@
                 [% IF ( create ) %]
                     <h1>Create from SQL</h1>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" id="sql_report_form">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <legend>Create report from SQL</legend>
                             <ol>
@@ -1319,6 +1333,7 @@
 
                 [% IF ( editsql ) %]
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" id="sql_report_form">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="id" value="[% id | html %]"/>
                         <fieldset class="rows">
                             <legend><h1>Edit SQL report</h1></legend>
@@ -1385,6 +1400,7 @@
 
                 [% IF ( errors ) %]
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="dialog alert">
                             <strong>The following error was encountered:</strong><br />
                             [% FOREACH error IN errors %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt
index 0843aa4212e..e4fd20a1b08 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt
@@ -87,6 +87,7 @@
 [% ELSE %]
 
 	<form method="post" action="/cgi-bin/koha/reports/issues_avg_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
 	<legend>Average checkout period statistics</legend>
 	<table>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt
index 6702b45055f..9f084cc6526 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt
@@ -113,6 +113,7 @@
 [% ELSE %]
 
     <form method="post" action="/cgi-bin/koha/reports/issues_stats.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
 	<legend>Circulation statistics</legend><table>
         <thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt
index fb20f860dac..923c67c4bcc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt
@@ -142,6 +142,7 @@
 	[% ELSE %]
 	
 	<form name="f" action="/cgi-bin/koha/reports/itemslost.pl" method="post">
+	    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
         <ol>
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
index f8d55e3f325..675a2451468 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
@@ -75,6 +75,7 @@
 [% ELSE %]
         <h1>View a count of items held at your library grouped by item type</h1>
         <form method="post" action="/cgi-bin/koha/reports/manager.pl?report_name=itemtypes">
+            [% INCLUDE 'csrf-token.inc' %]
           <fieldset class="rows">
             <ol>
               <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt
index 80f0100fbe4..d6e26768ee4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt
@@ -100,6 +100,7 @@
     [% END %]
     [% ELSE %]
         <form name="f" action="/cgi-bin/koha/reports/orders_by_fund.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
         <legend>Filters</legend>
         <ol><li><label for="budgetfilter">Fund: </label>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt
index b0c781a06aa..d7a8424c77d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt
@@ -99,6 +99,7 @@
 [% ELSE %]
 
     <form method="post" action="/cgi-bin/koha/reports/reserves_stats.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
 	<legend>Holds statistics</legend><table>
         <thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt
index a5e24e25c82..a99a25700e8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt
@@ -86,6 +86,7 @@
 
 [% ELSE %]
 	<form method="post" action="/cgi-bin/koha/reports/serials_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 
 	<fieldset class="rows">
 		<ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
index 59f90bb2d8b..ce1cac43326 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
@@ -173,6 +173,7 @@
                     <p>Hold placed by : <strong> [% nextreservsurname | html %] [% nextreservfirstname | html %]</strong> at : <strong> [% branchname | html %] </strong>, Please transfer this item.
                     </p>
                     <form name="cancelReservewithtransfert" action="branchreserves.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="submit" class="button" />
                     </form>
                 </div>
@@ -234,6 +235,7 @@
                             [% IF clubcount %]
                                 [% WRAPPER tab_panel tabname="holds_clubsearch_pane" %]
                                     <form id="holds_clubsearch" action="request.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <div class="hint">Enter club ID or partial name:</div>
                                         <input type="text" size="40" id="club" class="focus" name="findclub" autocomplete="off" />
                                         <input type="submit" class="btn btn-primary" value="Search" />
@@ -256,6 +258,7 @@
                 <fieldset class="rows">
                     <legend>Hold details</legend>
                     <form action="/api/v1/clubs/[% club.id | html %]/holds" method="post" name="form" id="club-request-form">
+                        [% INCLUDE 'csrf-token.inc' %]
 
                         [% IF ( multi_hold ) %]
                             <input type="hidden" name="request" value="any"/>
@@ -501,6 +504,7 @@
                 <fieldset class="rows">
                     <legend>Hold details</legend>
                     <form action="placerequest.pl" method="post" name="form" id="hold-request-form">
+                        [% INCLUDE 'csrf-token.inc' %]
 
                         <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                         [% FOREACH biblionumber IN biblionumbers %]
@@ -1056,6 +1060,7 @@
                 [% END %]
                 [% IF ( reserveloop ) %]
                     <form id="existing_holds" name="T[% time | html %]" action="modrequest.pl" method="post" style="display:block">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF ( multi_hold ) %]
                             [% FOREACH biblionumber IN biblionumbers %]
                             <input type="hidden" name="biblionumber" value="[% biblionumber | html %]"/>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
index a13bc572d06..46ecc2015a8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
@@ -90,6 +90,7 @@
 
               <div>
                 <form action="addItems.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="brief">
                         <legend>Add or remove items</legend>
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt
index bf4370550b4..4fc51ef1bf2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt
@@ -123,6 +123,7 @@
                     [% END %]
 
                     <form action="editCollections.pl" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF ( previousActionEdit ) %]
                             <input type="hidden" name="action" value="update" />
                             <input type="hidden" name="colId" value="[% editColId | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt
index fb54c8f80a1..cc9f08ef0ee 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt
@@ -71,6 +71,7 @@
                 [% ELSE %]
                     <div>
                         <form action="transferCollection.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="colId" value="[% colId | html %]" />
                             <fieldset class="rows">
                                 <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search.tt
index 37ae608d428..3835e31c6d1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search.tt
@@ -9,6 +9,7 @@
 
 <h1>Serial subscription: search for vendor </h1>
     <form action="/cgi-bin/koha/serials/acqui-search-result.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <label for="text">Vendor name: </label>
         <input id="text" type="text"  size="25" name="supplier" autofocus="autofocus" />
         <input type="submit" class="btn btn-primary" value="OK" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt
index 613650f5ab8..6d6a61a0b99 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt
@@ -77,6 +77,7 @@
                 [% END %]
 
                 <form id="claims" name="claims" action="claims.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset>
                         <label for="supplierid">Vendor: </label>
                         <select id="supplierid" name="supplierid">
@@ -116,6 +117,7 @@
 
                     <fieldset>
                         <form action="claims.pl" method="post" id="claims_form">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <table id="claimst">
                                 <thead>
                                     <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt
index c44d66271f2..842186eea4a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt
@@ -32,6 +32,7 @@
 <h1>Preview routing list for <em>[% title | html %]</em></h1>
 
 <form method="post" action="routing-preview.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" id="subscriptionid" name="subscriptionid" value="[% subscriptionid | html %]" />
     <input type="hidden" id="issue_escaped" name="issue_escaped" value="[% issue_escaped | html %]" />
 <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt
index e74b373f74e..7c6413c1563 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt
@@ -43,6 +43,7 @@
 
 [% INCLUDE 'blocking_errors.inc' %]
 <form method="post" action="routing.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="op" value="save" />
 <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
 <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt
index cb662a179af..0d1491bac35 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt
@@ -143,6 +143,7 @@
 
                 [% IF ( years ) %]
                     <form name="edition" action="/cgi-bin/koha/serials/serials-edit.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% WRAPPER tabs id= "subscription_years" %]
                             [% WRAPPER tabs_nav %]
                                 [% FOREACH year IN years %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt
index 172a015e6e1..5973222bf52 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt
@@ -109,6 +109,7 @@ $(document).ready(function() {
 
 [% IF internalnotes %]<p>Nonpublic note: [% internalnotes | html | html_line_break %]</p>[% END %]
 <form method="post" name="f" class="noEnterSubmit" action="serials-edit.pl" id="serials_edit">
+    [% INCLUDE 'csrf-token.inc' %]
 
 [% IF ( Errors ) %]
 <div class="dialog alert">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
index c1a95eab945..bffb8040a81 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
@@ -46,6 +46,7 @@
 
     [% BLOCK subscriptions_table %]
         <form method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             [% IF closed %]
                 [% SET tab = 'closed' %]
             [% ELSE %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
index 19d53a1c330..298fd94c481 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
@@ -55,6 +55,7 @@ fieldset.rows table { clear: none; margin: 0; }
         </div>
     </div>
     <form method="post" id="subscription_add_form" name="f" action="/cgi-bin/koha/serials/subscription-add.pl" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
                 <div class="row" id="page_1">
                     <div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
                         [% IF ( modify ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt
index 1f9050e60f5..559389ea563 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt
@@ -76,6 +76,7 @@
                     </div>
 
                     <form method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% FOREACH subscription IN subscriptions %]
                             <input type="hidden" name="subscriptionid" value="[% subscription.subscriptionid | html %]"/>
                         [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
index 3d3d5a5052a..78c9599aae6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
@@ -61,6 +61,7 @@
                         </ul>
 
                         <form method="post" action="/cgi-bin/koha/serials/subscription-detail.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
                             <input type="hidden" name="issueconfirmed" value="1" />
                             <input type="hidden" name="op" value="del" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
index 5d67731a069..153ba95e017 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
@@ -42,6 +42,7 @@
           <h1>Edit frequency: [% description | html %]</h1>
         [% END %]
         <form action="/cgi-bin/koha/serials/subscription-frequencies.pl" id="add_frequency_form" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
           [% IF (modify) %]
             <input type="hidden" name="id" value="[% id | html %]" />
             <input type="hidden" name="op" value="savemod" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt
index 5507a38c44f..e3fff2b861b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt
@@ -34,6 +34,7 @@
 
         <div id="subscription_form_history">
           <form method="post" action="/cgi-bin/koha/serials/subscription-history.pl">
+              [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="mod" />
             <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
             <p>Hint : you can update the serial history manually. This can be useful for an old subscription or to clean the existing history. Modify those fields with care, as future serial receive will continue to update them automatically.</p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt
index 6bc37ca6f0a..dbc342c8702 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt
@@ -60,6 +60,7 @@
           [% END %]
 
           <form action="/cgi-bin/koha/serials/subscription-numberpatterns.pl" method="post">
+              [% INCLUDE 'csrf-token.inc' %]
             [% IF (new) %]
               <input type="hidden" name="op" value="savenew" />
             [% ELSE %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt
index 1ad3540a202..da6a1f09f1f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt
@@ -30,6 +30,7 @@
 [% ELSE %]
 
 <form name="f" action="/cgi-bin/koha/serials/subscription-renew.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 		<input type="hidden" name="op" value="renew" />
 		<input type="hidden" name="subscriptionid" value="[% subscription.subscriptionid | html %]" />
 		<fieldset class="rows"><legend>Subscription renewal for [% subscription.bibliotitle | html %]</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
index 1ff0fb6c83e..6bb2e93b805 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
@@ -338,6 +338,7 @@
             [% END %]
 
             <form id="add_edit" action="suggestion.pl" method="post" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
                 [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="redirect" id="redirect" value="[% redirect | html %]" />
                 <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrowernumber | html %]" />
@@ -711,6 +712,7 @@
                     [% FOREACH suggestion IN suggestions %]
                         [% WRAPPER tab_panel tabname= suggestion.suggestiontype %]
                             <form class="update_suggestions" name="f" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl#[% suggestion.suggestiontype| uri %]">
+                                [% INCLUDE 'csrf-token.inc' %]
                             [% INCLUDE 'csrf-token.inc' %]
 
                                 [% IF suggestion.suggestions.size %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt
index 7c66bfb0248..0a04f30e937 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt
@@ -40,6 +40,7 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
 <div class="col-sm-8 col-sm-push-2">
 <h1>Tags</h1>
 <form method="post" action="/cgi-bin/koha/tags/review.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     <h4>
     [% IF ( filter_approved_all ) %]<span>Displaying all terms</span>[% END %]
     [% IF ( filter_approved_ok ) %]<span>Displaying approved terms</span>[% END %]
@@ -186,6 +187,7 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
    <h4>Check lists</h4>
    <div class="description">Enter a word or phrase to check against approved/rejected lists: </div>
    <form method="post" action="/cgi-bin/koha/tags/review.pl">
+       [% INCLUDE 'csrf-token.inc' %]
    <input type="text" size="14" name="test" id="test" />
    <fieldset class="action"><button type="submit" value="Test" class="approval_btn btn btn-default btn-sm" id="test_button" name="op-test"><i class="fas fa-check-square" aria-hidden="true"></i> Test</button></fieldset>
    <div id="verdict">
@@ -206,6 +208,7 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
 <div class="col-sm-2 col-sm-pull-10">
     <aside>
 <form method="post" action="/cgi-bin/koha/tags/review.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="brief">
   <h4>Filters</h4>
 	<ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt
index dbf97f69f08..2be8c25dbe3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt
@@ -201,6 +201,7 @@
     </div>
 
     <form id="add_additional_content" method="post" action="/cgi-bin/koha/tools/additional-contents.pl" class="validate">
+        [% INCLUDE 'csrf-token.inc' %]
         [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="category" value="[% category | html %]" />
@@ -342,6 +343,7 @@
     [% IF additional_contents.count %]
         <div class="page-section">
             <form id="del_form" method="post" action="/cgi-bin/koha/tools/additional-contents.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <table id="table_additional_contents">
                     <thead>
                         <tr>
@@ -455,6 +457,7 @@
                 <fieldset class="action"><input type="submit" class="btn btn-primary" value="Delete selected" /></fieldset>
             </form>
             <form action="/cgi-bin/koha/tools/additional-contents.pl" method="post" id="delete_single">
+                [% INCLUDE 'csrf-token.inc' %]
                 [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" id="del_op" name="op" value="delete_confirmed" />
                 <input type="hidden" id="del_category" name="category" value="[% category | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt
index 22683cef3b7..21194d0aea2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt
@@ -39,6 +39,7 @@
 
         [% IF ( op == 'edit_form' ) %]
           <form method="post" id="rules_form" action="/cgi-bin/koha/tools/automatic_item_modification_by_age.pl">
+              [% INCLUDE 'csrf-token.inc' %]
             <h1>Rules for automatic item modifications by age</h1>
             <div id="toolbar" class="btn-toolbar">
                 <div class="btn-group">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
index 1608d37c64c..1826e5231b7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
@@ -105,6 +105,7 @@
 
 
 <form name="f" action="batchMod.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
      <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber | html %]" />
      <input type="hidden" name="op" value="[% op | html %]" />
      <input type="hidden" name="searchid" value="[% searchid | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
index 580c8b12df4..4e67c419595 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
@@ -128,6 +128,7 @@
 
 
         <form name="f" action="batchMod.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="[% op | html %]" />
             <input type="hidden" name="searchid" value="[% searchid | html %]" />
             <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt
index df5a93df6a9..73b8529ab98 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt
@@ -35,6 +35,7 @@
 
                 <h1>Batch item [% IF ( del ) %]deletion[% ELSE %]modification[% END %]</h1>
                         <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/batchMod.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 <legend>Use a file</legend>
                                   <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
index 6e30e93dd24..557c505a1ea 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
@@ -56,6 +56,7 @@
   [% END %]
   [% IF op == 'form' %]
     <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/batch_delete_records.pl" id="record_ids_selection">
+        [% INCLUDE 'csrf-token.inc' %]
       <fieldset class="rows">
         <legend>Record type</legend>
         <ol>
@@ -165,6 +166,7 @@
           | <a id="clearlinkedtobiblio" href="#">Clear used authorities</a>
         </div>
         <form action="/cgi-bin/koha/tools/batch_delete_records.pl" method="post" id="selectauths">
+            [% INCLUDE 'csrf-token.inc' %]
           <table id="authorities" class="records">
             <thead>
               <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt
index 36d14f5eeb1..f5048ea2422 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt
@@ -58,6 +58,7 @@
 
                     [% IF view == 'form' %]
                         <form method="post" action="/cgi-bin/koha/tools/batch_extend_due_dates.pl" id="extend_due_dates_form">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 <legend>Checkout criteria:</legend>
                                 <ol>
@@ -122,6 +123,7 @@
                     [% ELSIF view == 'list' %]
                         [% IF checkouts.count %]
                             <form action="/cgi-bin/koha/tools/batch_extend_due_dates.pl" method="post" id="process">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <div class="page-section">
                                     <div class="btn-toolbar selections-toolbar">
                                         <a id="selectall" href="#"><i class="fa fa-check"></i> Select all</a>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt
index 2c83052eb1a..01765d5bf33 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt
@@ -71,6 +71,7 @@
 
                     [% IF view == 'form' %]
                         <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/batch_record_modification.pl" id="record_ids_selection">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 <legend>Record type</legend>
                                 <ol class="radio">
@@ -153,6 +154,7 @@
                     [% ELSIF view == 'list' %]
                         [% IF records %]
                             <form action="/cgi-bin/koha/tools/batch_record_modification.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <label for="marc_modification_template_id" class="required">Modify record using the following template: </label>
                                 <select name="marc_modification_template_id" id="marc_modification_template_id" required="required">
                                     <option value="">Select a template</option>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt
index 3f7607347ed..a389ab431dc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt
@@ -95,6 +95,7 @@
 </div>
 <div id="step1">
     <form name="f1" id="delete_patrons_form" action="/cgi-bin/koha/tools/cleanborrowers.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset>
     <legend>Delete patrons</legend>
         <h3><input id="checkborrower" type="checkbox" name="checkbox" value="borrower" /><label for="checkborrower"> Verify you want to delete patrons</label></h3>
@@ -172,6 +173,7 @@
 <!-- STEP 2 START -->
 <div id="step2">
         <form name="f2" action="/cgi-bin/koha/tools/cleanborrowers.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
 
         <div class="dialog alert">
             <h3>Warning</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
index 6b604e77f23..99402816c64 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
@@ -137,6 +137,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/tools/csv-profiles.pl" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id | html %]" />
         <fieldset class="rows">
@@ -265,6 +266,7 @@
         [% IF csv_profile %]
             <h1>Delete CSV Profile "[% csv_profile.profile | html %]?"</h1>
             <form action="/cgi-bin/koha/tools/csv-profiles.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id | html %]" />
                 <input type="submit" class="approve" value="Yes, delete" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt
index 59f850f22be..5a4aecb6124 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt
@@ -63,6 +63,7 @@
             </p>
 
             <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/export.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <fieldset class="rows">
                     <legend> Select records to export </legend>
                     <ol>
@@ -193,6 +194,7 @@
 
         [% WRAPPER tab_panel tabname="auths" %]
             <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/export.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <fieldset class="rows">
                     <legend> Select records to export </legend>
                     <ol>
@@ -268,6 +270,7 @@
         [% IF ( allow_db_export ) %]
             [% WRAPPER tab_panel tabname="db" %]
                 <form method="post" class="clearfix" action="/cgi-bin/koha/tools/export.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <p><strong>Note : This export file will be very large, and is generated nightly.</strong></p>
                     <fieldset class="rows">
                         <legend> Choose a file </legend>
@@ -294,6 +297,7 @@
         [% IF ( allow_conf_export ) %]
             [% WRAPPER tab_panel tabname="conf" %]
                 <form method="post" class="clearfix" action="/cgi-bin/koha/tools/export.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <p><strong>Note : This export file will be very large, and is generated nightly.</strong></p>
                     <fieldset class="rows">
                         <legend> Choose a file </legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt
index f03db0c0ff0..2f09d0154ea 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt
@@ -41,6 +41,7 @@
 
                             <div class="panel" id="showHoliday">
                                 <form action="/cgi-bin/koha/tools/exceptionHolidays.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" id="showHolidayType" name="showHolidayType" value="" />
                                     <fieldset class="brief">
                                         <h3>Edit this holiday</h3>
@@ -137,6 +138,7 @@
                             <!-- Panel to deal with new holidays -->
                             <div class="panel" id="newHoliday">
                                 <form action="/cgi-bin/koha/tools/newHolidays.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="brief">
                                         <h3>Add new holiday</h3>
                                         <ol>
@@ -228,6 +230,7 @@
                             </div>
                             <div style="margin-top: 2em;">
                                 <form action="copy-holidays.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="from_branchcode" value="[% branch | html %]" />
                                     <label for="branchcode">Copy holidays to:</label>
                                     <select id="branchcode" name="branchcode">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
index 53050a7e362..d10dae84ef4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
@@ -200,6 +200,7 @@
     </ul>
 
     <form method="post" action="[% SCRIPT_NAME | html %]" enctype="multipart/form-data">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <legend>Import into the borrowers table</legend>
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt
index a430a3fc248..6d5d4d2ba46 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt
@@ -60,6 +60,7 @@
        [% UNLESS op %]
 
     <form method="post" id="inventory_form" action="/cgi-bin/koha/tools/inventory.pl" enctype="multipart/form-data">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
           <legend>Use a barcode file</legend>
           <ol>
@@ -235,6 +236,7 @@
     [% END %]
     [% IF (op) %]
     <form method="post" action="/cgi-bin/koha/tools/inventory.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="minlocation" value="[% minlocation | html %]" />
     <input type="hidden" name="maxlocation" value="[% maxlocation | html %]" />
     <input type="hidden" name="location" value="[% location | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
index 15e2633ef04..3e3ccf4dee5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
@@ -224,6 +224,7 @@
                                             <td class="actions">
                                                 [% IF !independant_branch || !lette.branchcode %]
                                                     <form method="post" action="/cgi-bin/koha/tools/letter.pl">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="op" value="copy_form" />
                                                         <input type="hidden" name="oldbranchcode" value="[% lette.branchcode | html %]" />
                                                         <input type="hidden" name="module" value="[% lette.module | html %]" />
@@ -284,6 +285,7 @@
                     </div> <!-- /#toolbar -->
 
                     <form id="add_notice" name="Aform" method="post" enctype="multipart/form-data" class="validate">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF add_form %]
                             <input type="hidden" name="op" id="op" value="add_validate" />
                         [% ELSE %]
@@ -468,6 +470,7 @@
                 [% IF ( add_validate or copy_validate) %]
                     Data recorded
                     <form action="[% action | html %]" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="submit" class="btn btn-primary" value="OK" />
                     </form>
                 [% END %]
@@ -492,6 +495,7 @@
                             </tr>
                         </table>
                         <form action="[% action | html %]" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_confirmed">
                             <input type="hidden" name="branchcode" value="[% letter.branchcode | html %]" />
                             <input type="hidden" name="code" value="[% letter.code | html %]" />
@@ -508,6 +512,7 @@
                 [% IF ( delete_confirmed ) %]
                     <span>Data deleted</span>
                     <form action="[% action | html %]" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                     <input type="submit" class="btn btn-primary" value="OK" />
                     </form>
                 [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt
index e11c2611a1a..3f81e9f4158 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt
@@ -107,6 +107,7 @@
                     [% IF ( batch_info ) %]
                         [% IF ( can_commit ) %]
                             <form method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="op" value="redo-matching" />
                                 <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
                                 <input type="hidden" name="current_matcher_id" value="[% current_matcher_id | html %]" />
@@ -255,6 +256,7 @@
                         <div>
                             [% IF ( can_commit ) %]
                                 <form method="post" id="import_batch_form">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="commit-batch" />
                                     <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
                                     [% IF ( record_type != 'auth' ) %]
@@ -291,6 +293,7 @@
                             [% END # /IF can_commit %]
                             [% IF ( can_revert ) %]
                                 <form method="post" id="revert_batch_form">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="revert-batch" />
                                     <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
                                     <fieldset class="action"><input type="submit" class="button" name="mainformsubmit" value="Undo import into catalog" /></fieldset>
@@ -358,12 +361,14 @@
                                             <td class="actions">
                                                 [% IF ( batch_lis.can_clean ) %]
                                                     <form method="post" name="clean_batch_[% batch_lis.import_batch_id | html %]" id="clean_batch_[% batch_lis.import_batch_id | html %]" class="batch_form batch_clean">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="import_batch_id" value="[% batch_lis.import_batch_id | html %]" />
                                                         <input type="hidden" name="op" value="clean-batch" />
                                                         <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-eraser"></i> Clean</button>
                                                     </form>
                                                 [% ELSIF ( batch_lis.import_status == 'cleaned' ) %]
                                                     <form method="post" action="/cgi-bin/koha/tools/manage-marc-import.pl" name="delete_batch_[% batch_lis.import_batch_id | html %]" id="delete_batch_[% batch_lis.import_batch_id | html %]" class="batch_form batch_delete">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="import_batch_id" value="[% batch_lis.import_batch_id | html %]" />
                                                         <input type="hidden" name="op" value="delete-batch" />
                                                         <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-trash-can"></i> Delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt
index 160a82f7a8d..8d1a737bb9e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt
@@ -206,6 +206,7 @@
                     [% END # /IF ActionsLoop %]
 
                     <form method="post" action="/cgi-bin/koha/tools/marc_modification_templates.pl" id="add_action" >
+                        [% INCLUDE 'csrf-token.inc' %]
                         <a name="modaction"></a>
                         <fieldset>
                             <legend id="modaction_legend">Add a new action</legend>
@@ -316,6 +317,7 @@
                     <h2 id="LabelcreateTemplate">Create a new template</h2>
                 </div>
                 <form method="post" action="/cgi-bin/koha/tools/marc_modification_templates.pl" id="add_template" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <div class="modal-body">
                         <fieldset>
                             <p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt
index d66fd48da5d..58f38f937b9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt
@@ -35,6 +35,7 @@
                 [% IF ( op == 'show_form' ) %]
                     <h1>Batch patron modification</h1>
                     <form id="patron_batchmod_form" method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/modborrowers.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="show" />
 
                         [% WRAPPER tabs id= "batch_patron_options" %]
@@ -194,6 +195,7 @@
 
                     [% IF ( op == 'show' ) %]
                     <form name="f" action="modborrowers.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="do" />
                         [% IF ( borrowers ) %]
                             <div class="btn-toolbar selections-toolbar"><a id="selectallbutton" href="#"><i class="fa fa-check"></i> Select all</a> | <a id="clearallbutton" href="#"><i class="fa fa-times"></i> Clear all</a></div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt
index 953de54febe..367285e6444 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt
@@ -37,6 +37,7 @@
             <p>Columns must be filled left to right: if the first column is blank, other columns will be ignored. </p>
         </div>
             <form method="post" action="/cgi-bin/koha/tools/overduerules.pl" id="selectlibrary">
+                [% INCLUDE 'csrf-token.inc' %]
             <label for="branch">Select a library:</label>
                 <select id="branch" name="branch">
                     <option value="">Default</option>
@@ -63,6 +64,7 @@
             [% END %]
             [% IF ( table ) %]
                 <form method="post" action="/cgi-bin/koha/tools/overduerules.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="save" />
                     <input type="hidden" name="branch" value="[% branch | html %]" />
                     <h3>Rules for overdue actions: [% IF ( branch ) %][% Branches.GetName( branch ) | html %][% ELSE %] default library [% END %]</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
index 96628472123..ac6b8757f41 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
@@ -122,6 +122,7 @@
                 </div>
                 [% END %]
             <form method="post" action="/cgi-bin/koha/tools/picture-upload.pl" enctype="multipart/form-data" id="upload_form">
+                [% INCLUDE 'csrf-token.inc' %]
                 <fieldset class="rows">
                     <p><strong>NOTE:</strong> Only PNG, GIF, JPEG, XPM formats are supported. Maximum image size is 2MB.</p>
                         <ol class="radio">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt
index 5d6da9b6277..e9aa4eccf9a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt
@@ -50,6 +50,7 @@
 
             [% IF ( problem_reports.count ) %]
                 <form id="mark_selected" method="post" action="/cgi-bin/koha/tools/problem-reports.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <div id="toolbar" class="btn-toolbar">
                         <button type="submit" class="btn btn-default markviewed" name="mark_selected-viewed" value="viewed" disabled="disabled"><i class="fa-solid fa-eye"></i> Mark viewed</button>
                         <button type="submit" class="btn btn-default markclosed" name="mark_selected-closed" value="closed" disabled="disabled"><i class="fa fa-times-circle"></i> Mark closed</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt
index 39876554e22..b64f9aa9a2b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt
@@ -66,6 +66,7 @@
 [% IF op == 'add_form' %]
     <h1>[% IF quote %]Modify quote[% ELSE %]New quote[% END %]</h1>
     <form action="/cgi-bin/koha/tools/quotes.pl" id="Aform" name="Aform" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <input type="hidden" name="op" value="add_validate" />
             <ol>
@@ -92,6 +93,7 @@
 [% IF op == 'delete_confirm' %]
     <div class="dialog alert">
         <form action="/cgi-bin/koha/tools/quotes.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <h1>Are you sure you want to delete the following quote?</h1>
             [% quote.source | html %] - [% quote.text | html %]
             <input type="hidden" name="op" value="delete_confirmed" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt
index 033d819884d..a9637290458 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt
@@ -34,6 +34,7 @@
 [% END %]
 
 <form name="form1" action="scheduler.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="mode" value="job_add" />
 
 <fieldset class="rows">
@@ -83,6 +84,7 @@
 </tr>
 [% FOREACH JOB IN JOBS %]
 <form action="scheduler.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="mode" value="job_change" />
 
 <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt
index be7669afff7..f4f556904a9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt
@@ -79,6 +79,7 @@
     <li>You can enter a name for this import. It may be useful, when creating a record, to remember where the suggested MARC data comes from!</li>
 </ul>
 <form method="post" id="uploadfile" enctype="multipart/form-data">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows" id="uploadform">
 <legend>Upload a file to stage</legend>
 <ol>
@@ -119,6 +120,7 @@
 </fieldset>
 
     <form method="post" id="processfile" enctype="multipart/form-data">
+        [% INCLUDE 'csrf-token.inc' %]
 [% IF basketno && booksellerid %]
     <input type="hidden" name="basketno" id="basketno" value="[% basketno | html %]" />
     <input type="hidden" name="booksellerid" id="booksellerid" value="[% booksellerid | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt
index 75bb35ecd40..8e38d6f55ab 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt
@@ -151,6 +151,7 @@
                     [% END %]
 
                     <form id="rota_form" method="post" enctype="multipart/form-data" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <ol>
                                 <li>
@@ -212,6 +213,7 @@
                     <!-- Add stage modal -->
                     <div class="modal" id="addStageModal" tabindex="-1" role="dialog" aria-labelledby="addStageLabel">
                         <form id="stage_form" method="post" enctype="multipart/form-data" class="validated">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <div class="modal-dialog" role="document">
                                 <div class="modal-content">
                                     <div class="modal-header">
@@ -311,6 +313,7 @@
                     [% END %]
 
                     <form id="stage_form" method="post" enctype="multipart/form-data" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <ol>
                                 <li>
@@ -402,6 +405,7 @@
                     <!-- Add items modal -->
                     <div class="modal" id="addItemsModal" tabindex="-1" role="dialog" aria-labelledby="addItemsLabel">
                         <form id="add_rota_item_form" method="post" enctype="multipart/form-data" class="validated">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <div class="modal-dialog" role="document">
                                 <div class="modal-content">
                                     <div class="modal-header">
@@ -564,6 +568,7 @@
 
                     [% IF barcode_status.on_other.size > 0 %]
                         <form id="add_rota_item_form" method="post" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset>
                                 <legend>Select items to move to this rota:</legend>
                                 [% FOREACH item_on_other IN barcode_status.on_other %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt
index aef69c110aa..cc9211cf4ca 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt
@@ -183,6 +183,7 @@
                     [% END %]
 
                         <form method="post" action="/cgi-bin/koha/tools/upload-cover-image.pl" id="uploadfile" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows" >
                                 <div id="fileuploadform">
                                     <label for="fileToUpload">Select the file to upload: </label>
@@ -206,6 +207,7 @@
                         </form> <!-- /#uploadfile -->
 
                         <form method="post" id="processfile" action="/cgi-bin/koha/tools/upload-cover-image.pl" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
 
                             [% IF itemnumber %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt
index c6c13cb9b50..71912c03105 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt
@@ -23,6 +23,7 @@
 
 [% BLOCK form_new %]
     <form method="post" action="/cgi-bin/koha/tools/upload.pl" id="uploadfile" enctype="multipart/form-data">
+        [% INCLUDE 'csrf-token.inc' %]
         [% PROCESS plugin_pars %]
         <fieldset class="rows" id="uploadform">
         <legend>Upload new files</legend>
@@ -91,6 +92,7 @@
 [% BLOCK form_browse %]
     [% IF uploadcategories %]
     <form method="post" id="browsefile" action="/cgi-bin/koha/tools/upload.pl">
+        [% INCLUDE 'csrf-token.inc' %]
         [% PROCESS plugin_pars %]
         <input type="hidden" name="op" value="browse"/>
         <fieldset class="brief">
@@ -120,6 +122,7 @@
 
 [% BLOCK form_search %]
     <form method="post" id="searchfile" action="/cgi-bin/koha/tools/upload.pl">
+        [% INCLUDE 'csrf-token.inc' %]
         [% PROCESS plugin_pars %]
         <input type="hidden" name="op" value="search"/>
         <fieldset class="brief">
@@ -139,6 +142,7 @@
 
 [% BLOCK submitter %]
     <form id="submitter" style="display:none;" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         [% PROCESS plugin_pars %]
         <input type="hidden" name="op" id="op" value=""/>
         <input type="hidden" name="id" id="id" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
index c4c3d3d6d96..6152711524c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
@@ -194,6 +194,7 @@
 
 				<h1>Browse system logs</h1>
 				<form method="post" action="/cgi-bin/koha/tools/viewlog.pl">
+				    [% INCLUDE 'csrf-token.inc' %]
 					[% IF ( do_it ) %]
 						<input type="hidden" name="do_it" value="[% do_it | html %]" />
 					[% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
index 51b9dde8e6c..c4076d42a8d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
@@ -29,6 +29,7 @@
                 </ul>
 
         <form name="f1" action="/cgi-bin/koha/virtualshelves/addbybiblionumber.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
                         [% FOREACH biblio IN biblios %] <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]" />[% END %]
             <input type="hidden" name="confirmed" value="1" />
             [% IF ( shelfnumber ) %]<input type="hidden" name="shelfnumber" value="[% shelfnumber | html %]" />[% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt
index ebc7d8d9a1b..ccb80bf5c20 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt
@@ -24,6 +24,7 @@
 [% ELSE %]
 <div id="export" class="detailtagcell">    <form method="post" action="/cgi-bin/koha/virtualshelves/downloadshelf.pl">
 <form method="post" action="/cgi-bin/koha/virtualshelves/downloadshelf.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
         <legend><h1>Download list</h1></legend>
 	<ol><li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
index 3817c570344..53f5bb1ccd9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
@@ -18,6 +18,7 @@
 [% ELSE %]
 
 <form action="/cgi-bin/koha/virtualshelves/sendshelf.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 
 <fieldset class="rows"> 
     <legend><h1>Sending your list</h1></legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
index ee7b98290c8..e57af820f46 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
@@ -204,6 +204,7 @@
                 <h1>Transfer ownership of public list [% shelf.shelfname | html %]</h1>
 
                 <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="transferform" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     [% INCLUDE 'csrf-token.inc' %]
                     <fieldset>
                         <input type="hidden" name="op" value="transfer" />
@@ -239,6 +240,7 @@
                     [% IF ( contents.count ) %]<p>This list contains [% contents.count | html %] titles</p>[% END %]
                     <div class="pages">[% pagination_bar | $raw %]</div>
                     <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="listform" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="remove_biblios" />
                         <input type="hidden" name="referer" value="view" />
@@ -391,6 +393,7 @@
             [% IF op == 'add_form' OR op == 'edit_form' %]
 
                 <form method="post" action="/cgi-bin/koha/virtualshelves/shelves.pl" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         [% IF op == 'add_form' %]
@@ -549,6 +552,7 @@
     <div class="modal" id="addToList" tabindex="-1" role="dialog" aria-labelledby="addToListLabel">
         <div class="modal-dialog" role="document">
             <form action="/cgi-bin/koha/virtualshelves/shelves.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-content">
                     <div class="modal-header">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/account-table.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/account-table.inc
index 3605fcab1d5..a65541f9a24 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/account-table.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/account-table.inc
@@ -1,5 +1,6 @@
 [% PROCESS 'accounts.inc' %]
 <form method="post" action="opac-account-pay.pl" class="form-horizontal">
+    [% INCLUDE 'csrf-token.inc' %]
     [% IF ( ACCOUNT_LINES ) %]
         <table class="table table-bordered table-striped finestable" id="finestable">
             <caption class="sr-only">Your charges</caption>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/holds-table.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/holds-table.inc
index 483f0264530..53f1e5d38f9 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/holds-table.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/holds-table.inc
@@ -93,6 +93,7 @@
                             <div class="modal" id="changePickup[% HOLD.reserve_id | html %]" tabindex="-1" aria-labelledby="changePickup[% HOLD.reserve_id | html %]Label" aria-hidden="true">
                                 <div class="modal-dialog">
                                     <form id="change_branch_form[% HOLD.reserve_id | html %]" action="/cgi-bin/koha/opac-modrequest.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <div class="modal-content">
                                             <div class="modal-header">
                                                 <h5 class="modal-title" id="changePickup[% HOLD.reserve_id | html %]Label">Change pickup location for <em>[% INCLUDE 'biblio-title.inc' biblio=HOLD.biblio %]</em></h5>
@@ -167,6 +168,7 @@
                         [% IF ( HOLD.is_cancelable_from_opac ) %]
                             [% IF HOLD.suspend %]
                                 <form class="form-inline" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="reserve_id" value="[% HOLD.reserve_id | html %]" />
                                     <button class="btn btn-link" type="submit" name="submit"><i class="fa fa-play" aria-hidden="true"></i> Resume</button>
                                 </form>
@@ -175,6 +177,7 @@
                                     <a class="btn btn-link suspend_hold js-show" href="#" role="button" data-title="[% HOLD.biblio.title | html %] [% FOREACH subtitle IN HOLD.biblio.subtitle.split(' \| ') %][% IF Koha.Preference('marcflavour')=='UNIMARC' %],[% END %][% subtitle | html %][% END %]" data-reserve_id="[% HOLD.reserve_id | html %]"><i class="fa fa-pause" aria-hidden="true"></i> Suspend</a>
                                 [% ELSE %]
                                     <form class="form-inline" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="reserve_id" value="[% HOLD.reserve_id | html %]" />
                                         <button class="btn btn-link" type="submit" name="submit"><i class="fa fa-pause" aria-hidden="true"></i> Suspend</button>
                                     </form>
@@ -187,12 +190,14 @@
                     <td class="modify">
                         [% IF ( HOLD.is_cancelable_from_opac ) %]
                             <form id="delete_hold_[% HOLD.reserve_id | html %]" action="/cgi-bin/koha/opac-modrequest.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="biblionumber" value="[% HOLD.biblionumber | html %]" />
                                 <input type="hidden" name="reserve_id" value="[% HOLD.reserve_id | html %]" />
                                 <button data-title="[% INCLUDE 'biblio-title-head.inc' biblio=HOLD.biblio %]" data-reserve_id="[% HOLD.reserve_id | html %]" type="submit" class="btn btn-sm btn-danger btn-delete-hold"><i class="fa fa-times" aria-hidden="true"></i> [% tp('Cancel hold button', 'Cancel') | html %]</button>
                             </form>
                         [% ELSIF HOLD.is_waiting && HOLD.cancellation_requestable_from_opac %]
                             <form id="req_cancel_hold_[% HOLD.reserve_id | html %]" action="/cgi-bin/koha/opac-modrequest.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="biblionumber" value="[% HOLD.biblionumber | html %]" />
                                 <input type="hidden" name="reserve_id" value="[% HOLD.reserve_id | html %]" />
                                 <input type="hidden" name="cancellation_request" value="1" />
@@ -211,6 +216,7 @@
     [% UNLESS ( all_holds_waiting ) %]
         <div>
             <form class="form-inline" id="suspend_all_holds" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <button type="submit" id="suspend_all_submit" class="btn btn-primary"><i class="fa fa-pause" aria-hidden="true"></i> Suspend all holds</button>
                 <input type="hidden" name="suspend" value="1" />
 
@@ -224,6 +230,7 @@
         <br/>
         <div>
             <form id="resume_all_holds" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <button type="submit" id="resume_all_submit" class="btn btn-primary"><i class="fa fa-play" aria-hidden="true"></i> Resume all suspended holds</button>
                 <input type="hidden" name="suspend" value="0" />
             </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
index dbe22e3bebd..d2e9e59a697 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
@@ -385,6 +385,7 @@
                     </button>
                 </div>
                 <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="modalAuth">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="has-search-query" id="has-search-query" value="" />
                     <div class="modal-body">
                         [% IF ( Koha.Preference('GoogleOpenIDConnect') == 1 ) %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc
index a91aa475695..5e17ee20007 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc
@@ -119,6 +119,7 @@
                 <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">&times;</button>
             </div>
             <form method="post" action="/cgi-bin/koha/opac-export.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                     <fieldset id="dc_fieldset">
                         <input id="input-simple" type="radio" name="format" value="rdfdc">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc
index 6ed5e724f2c..9e12aeed288 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc
@@ -8,6 +8,7 @@
                     &nbsp;&nbsp;&nbsp;<em>Written on [% message.message_date | $KohaDates %] by [% Branches.GetName(message.branchcode) | html %]</em>
                 </li>
                 <form id="dismiss-message-form" action="/cgi-bin/koha/opac-dismiss-message.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="message_id" value="[% message.message_id | html %]">
                     <input type="hidden" name="patron_id" value="[% message.borrowernumber | html %]">
                     <button type="submit" class="dismiss-message-button btn btn-primary"><i class="fa fa-trash" aria-hidden="true"></i> Dismiss</button>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-checkout.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-checkout.inc
index 17f734d10d4..7f1c76adba2 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-checkout.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-checkout.inc
@@ -8,6 +8,7 @@
                 </button>
             </div>
             <form action="#" method="post" id="overdrive-checkout-form">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                     <input type="hidden" name="id" value="" />
                     <div id="overdrive-format-list">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc
index 10e862d41f7..80f0bbfc8d6 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc
@@ -8,6 +8,7 @@
                 </button>
             </div>
             <form action="#" method="post" id="overdrive-login-form">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                         <fieldset class="brief">
                             <label for="ODpassword">Password:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt
index 25b997f3ec9..fe6b54c9d70 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt
@@ -25,6 +25,7 @@
                                 </ul>
                                 [% IF private_shelves.count or public_shelves.count or private_shelves_shared_with_me.count %]
                                     <form name="f1" action="/cgi-bin/koha/opac-addbybiblionumber.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <fieldset>
                                             <legend>Select a list</legend>
                                             <label for="shelfnumber">Add to list:</label> <select name="shelfnumber" id="shelfnumber">
@@ -58,6 +59,7 @@
                                 [% ELSE %]
                                     [% IF ( singleshelf ) %]
                                         <form name="f1" action="/cgi-bin/koha/opac-addbybiblionumber.pl" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             [% FOREACH biblio IN biblios %]
                                                 <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]">
                                             [% END %]
@@ -74,6 +76,7 @@
 
                             [% UNLESS ( singleshelf ) %]
                                 <form name="f2" method="post" action="/cgi-bin/koha/opac-addbybiblionumber.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset>
                                         <legend>Add to a new list:</legend>
                                             <label for="newvirtualshelf">List name:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt
index 802c5f6f135..afd949ecc54 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt
@@ -36,6 +36,7 @@
                         [% IF ( typeissue ) %]
                             <h2>Subscribe to a subscription alert</h2>
                             <form action="opac-alert-subscribe.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p>Do you want to receive an email when a new issue for this subscription arrives?</p>
                                 <h3>[% bibliotitle | html %]</h3>
                                 [% IF ( notes ) %]<p>[% notes | html %]</p>[% END %]
@@ -50,6 +51,7 @@
                         [% IF ( typeissuecancel ) %]
                             <h2>Unsubscribe from a subscription alert</h2>
                             <form action="opac-alert-subscribe.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p>Please confirm that you do not want to receive email when a new issue arrives for this subscription.</p>
                                 <h3>[% bibliotitle | html %]</h3>
                                 [% IF ( notes ) %]<p>[% notes | html %]</p>[% END %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
index 00d238066ef..c5c818b83ed 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
@@ -213,6 +213,7 @@
                                 <form action="/cgi-bin/koha/sci/sci-main.pl" name="auth" id="auth" method="post" autocomplete="off">
                             [% ELSE %]
                                 <form action="[% script_name | html %]" name="auth" id="auth" method="post" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                             [% END %]
                                 <input type="hidden" name="koha_login_context" value="opac" />
 
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt
index bc220619059..8374caff2f1 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt
@@ -36,6 +36,7 @@
                 [% END %]
                     <div id="userauthhome" class="maincontent">
                         <form name="f" action="/cgi-bin/koha/opac-authorities-home.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="do_search" />
                             <input type="hidden" name="type" value="opac" />
                             <fieldset class="rows">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt
index 47676322d7c..7f18914af05 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt
@@ -350,6 +350,7 @@
                                 <input type="hidden" name="records" id="records" />
                             </form>
                             <form method="post" id="download_cart" action="/cgi-bin/koha/opac-downloadcart.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="format" id="download_format" value="" />
                                 <input type="hidden" name="bib_list" value="[% bib_list | html %]" />
                             </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt
index 2eb281fd040..a518dcddb41 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt
@@ -190,6 +190,7 @@
                                                     <td>[% p.notes | html %]</td>
                                                     <td>
                                                         <form method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="arrival-alert" />
                                                             <input type="hidden" name="pickup_id" value="[% p.id | html %]" />
                                                             [% IF ! p.staged_datetime || p.arrival_datetime %]
@@ -202,6 +203,7 @@
                                                         </form>
                                                         <p>
                                                         <form method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="cancel-pickup" />
                                                             <input type="hidden" name="pickup_id" value="[% p.id | html %]" />
                                                             [% IF p.delivered_datetime %]
@@ -229,6 +231,7 @@
                                 <div role="tabpanel" class="tab-pane active" id="user-schedule-pickup" aria-labelledby="tab-user-schedule-pickup">
                                 [% END %]
                                     <form id="create-pickup" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <fieldset class="rows">
                                             <ol>
                                                 <li>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
index f89db262e4e..b101785ffd4 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
@@ -238,6 +238,7 @@
                     [% IF ( TagsInputEnabled ) %]
                         [% IF ( loggedinusername ) %]
                             <form id="tagform[% biblio.biblionumber | html %]" method="post" action="/cgi-bin/koha/opac-tags.pl" style="display:none;">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Tags</legend>
                                 <div class="form-row">
                                     <div class="col-3">
@@ -300,6 +301,7 @@
 
                     [% IF ( OpacStarRatings != 'disable' ) %]
                         <form method="post" action="/cgi-bin/koha/opac-ratings.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Star ratings</legend>
                             <div class="results_summary ratings" id="rating-[% biblio.biblionumber | html %]">
 
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt
index 090936c72a2..f618893d1dc 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt
@@ -11,6 +11,7 @@
                     <div id="userdownloadcart" class="maincontent">
                         <h1>Download cart</h1>
                         <form method="post" action="/cgi-bin/koha/opac-downloadcart.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <select name="format" id="format">
                                 <option value="">-- Choose format --</option>
                                 <option value="ris">RIS (Zotero, EndNote, others)</option>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt
index 076fed519f8..e48a686d426 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt
@@ -59,6 +59,7 @@
                                 </div>
                             [% ELSE %]
                                 <form method="post" action="/cgi-bin/koha/opac-downloadshelf.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset>
                                         <select name="format" id="dlformat" required="required">
                                             <legend>Choose format</legend>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt
index b49a94c4cd2..44ed3e1be43 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt
@@ -95,6 +95,7 @@
                                 [% INCLUDE messages %]
                                 [% IF backends %]
                                     <form method="post" id="illrequestcreate-form" novalidate="novalidate">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <legend class="sr-only">Backends</legend>
                                         <fieldset class="rows">
                                             <label for="backend">Provider:</label>
@@ -180,6 +181,7 @@
                             [% INCLUDE messages %]
                             [% status = request.status %]
                             <form method="post" action="?method=update" id="illrequestupdate-form" novalidate="novalidate">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="rows">
                                     <legend id="library_legend">Details from library</legend>
                                     <ol>
@@ -253,6 +255,7 @@
                             <h1>Interlibrary loan item availability</h1>
                             <div id="results">
                                 <form method="POST" action="/cgi-bin/koha/opac-illrequests.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend><h2>Displaying availability results</h2></legend>
                                     [% FOREACH key IN whole.keys %]
                                         [% value = whole.$key %]
@@ -285,6 +288,7 @@
                             <div id="results" class="page-section">
                                 [% INCLUDE messages %]
                                 <form method="post" id="typedisclaimer-form">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="rows">
                                         [% disclaimer.text | $raw %]
                                         [% SET disc_av_category_code = AuthorisedValues.GetAuthValueDropbox(disclaimer.av_cat) %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt
index 4ee19b6e2c8..34d63dc8d2b 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt
@@ -41,6 +41,7 @@
                             Issue notes have not been enabled. Please contact the library.
                         [% ELSE %]
                             <form id="issue-note" action="/cgi-bin/koha/opac-issue-note.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Edit issue note</legend>
                                 <fieldset>
                                     <label for="note" class="required">Note:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
index 482e3bd98bd..4b79b28ff09 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
@@ -180,6 +180,7 @@
                         [% UNLESS ( casAuthentication || shibbolethAuthentication || Koha.Preference('opacShibOnly') ) %]
                             <div id="login">
                                 <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="auth" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="koha_login_context" value="opac" />
                                     <fieldset class="brief">
                                         <legend>Log in to your account:</legend>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
index a57bc0c9321..7519331952e 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
@@ -213,6 +213,7 @@
                 [% END %]
 
                 <form method="post" action="/cgi-bin/koha/opac-memberentry.pl" id="memberentry-form" autocomplete="off">
+                    [% INCLUDE 'csrf-token.inc' %]
 
                 [% FOREACH field = ['streetnumber' 'streettype'  'cardnumber' 'branchcode' 'categorycode' 'title' 'surname' 'firstname' 'middle_name' 'dateofbirth' 'initials' 'pronouns' 'othernames' 'address' 'address2' 'city' 'state' 'zipcode' 'country' 'phone' 'phonepro' 'mobile' 'email' 'emailpro' 'fax' 'B_streettype' 'B_streetnumber' 'B_address' 'B_address2' 'B_city' 'B_state' 'B_zipcode' 'B_country' 'B_phone' 'B_email' 'contactnote' 'altcontactsurname' 'altcontactfirstname' 'altcontactaddress1' 'altcontactaddress2' 'altcontactaddress3' 'altcontactstate' 'altcontactzipcode' 'altcontactcountry' 'altcontactphone' 'password' ] %]
                     [% IF mandatory.defined( field ) %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
index 8f08befe98e..eb80aebddf3 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
@@ -65,6 +65,7 @@
                     [% IF logged_in_user.category.effective_change_password %]
                         [% IF ( Ask_data ) %]
                             <form action="/cgi-bin/koha/opac-passwd.pl" name="mainform" id="mainform" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Change your password</legend>
                                 <fieldset>
                                     [% IF ( logged_in_user.category.effective_require_strong_password ) %]
@@ -102,6 +103,7 @@
                             Your password has been changed
                         </div>
                         <form action="/cgi-bin/koha/opac-user.pl" method="post" autocomplete="off">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
                             <p><input type="submit" class="btn btn-primary" value="Return to my account" /></p>
                         </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
index 8d3ff120a36..5ecaca87c83 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
@@ -120,6 +120,7 @@
                         <div class="alert alert-info">You can't reset your password.</div>
                     [% ELSIF (password_recovery) %]
                         <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Password recovery</legend>
                             <input type="hidden" name="koha_login_context" value="opac" />
                             <p>To reset your password, enter your login or your email address.</p>
@@ -142,6 +143,7 @@
                     [% ELSIF (new_password) %]
                         [% UNLESS ( errLinkNotValid ) %]
                             <form id="mainform" name="mainform" action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Password not valid</legend>
                                 <input type="hidden" name="koha_login_context" value="opac" />
                                 <fieldset class="brief">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt
index 94f4f2fb67a..fe79f835101 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt
@@ -47,6 +47,7 @@
                     <h1>Your consents</h1>
 
                     <form action="/cgi-bin/koha/opac-patron-consent.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF Koha.Preference('PrivacyPolicyConsent') %]
                         <legend><h2 id="GDPR_consents">Privacy policy consents</h2></legend>
                             <input type="hidden" name="op" value="gdpr_proc_save"/>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt
index f3af3f48d50..72fcf81c113 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt
@@ -74,6 +74,7 @@
                         <p id="note1">Please note that information on any book still checked-out must be kept by the library no matter which privacy option you choose.</p>
                         <p id="note2">Please also note that the library staff can't update these values for you: it's your privacy!</p>
                         <form action="/cgi-bin/koha/opac-privacy.pl" method="post" id="opac-privacy-update-form">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Privacy rule</legend>
                             <input type="hidden" name="op" value="update_privacy" />
                             <fieldset>
@@ -157,16 +158,19 @@
                         <p>You can delete all your checkout and hold history immediately by clicking here. <strong>BE CAREFUL</strong>. Once you've confirmed the deletion, no one can retrieve the list!</p>
 
                         <form action="/cgi-bin/koha/opac-privacy.pl" method="post" id="opac-privacy-delete-checkouts">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_record" />
                             <input type="hidden" name="checkouts" value="1" />
                         </form>
 
                         <form action="/cgi-bin/koha/opac-privacy.pl" method="post" id="opac-privacy-delete-holds">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_record" />
                             <input type="hidden" name="holds" value="1" />
                         </form>
 
                         <form action="/cgi-bin/koha/opac-privacy.pl" method="post" id="opac-privacy-delete-all">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_record" />
                             <input type="hidden" name="all" value="1" />
                         </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt
index 1be130282ab..e1a2970c893 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt
@@ -66,6 +66,7 @@
                                 <div class="dialog">
 
                                     <form id="recallform" action="/cgi-bin/koha/opac-recall.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <fieldset class="rows" id="options">
                                             <legend>Place a recall on <b>[% biblio.title | html %]</b> ([% biblio.author | html %])?</legend>
                                             <ul>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt
index c523cc9fdae..c9d9dd40526 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt
@@ -113,6 +113,7 @@
                                                     <td class="cancelrecall">
                                                         [% IF ( RECALL.requested or RECALL.overdue ) %]
                                                             <form action="/cgi-bin/koha/opac-recall.pl" method="post">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <input type="hidden" name="op" value="cancel">
                                                                 <input type="hidden" name="recall_id" value="[% RECALL.id | html %]">
                                                                 <input type="hidden" name="biblionumber" value="[% RECALL.biblio_id | html %]">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
index dc5e3a7388b..0dcf2452e0d 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
@@ -83,6 +83,7 @@
                         [% UNLESS ( casAuthentication ) %]
                             <div id="login">
                                 <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="auth" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="koha_login_context" value="opac" />
                                     <fieldset class="brief">
                                         <legend>Log in to your account:</legend>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt
index 6367abd469e..b2a1e9b92a9 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt
@@ -55,6 +55,7 @@
 
                     <div id="reportproblem" class="maincontent toptabs">
                         <form name="reportlibform" action="/cgi-bin/koha/opac-reportproblem.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Report a problem</legend>
                             <input type="hidden" name="op" value="addreport" />
                             <fieldset class="rows">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt
index 4ba935bb8d5..89484913bf9 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt
@@ -65,6 +65,7 @@
                     [% END %]
 
                         <form id="place-article-request" method="post" action="/cgi-bin/koha/opac-request-article.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Place article request</legend>
                             <input type="hidden" name="action" value="create" />
                             <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblio.biblionumber | html %]" />
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt
index 982da833065..0b537b90aac 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt
@@ -148,6 +148,7 @@
                 [% END %]
 
             <form action="/cgi-bin/koha/opac-reserve.pl" method="post" id="hold-request-form">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Hold requests</legend>
                 <input type="hidden" name="place_reserve" value="1"/>
                 <!-- These values are set dynamically by js -->
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt
index 440fdac4571..48542d804d0 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt
@@ -75,6 +75,7 @@
                             </div>
                         [% ELSE %]
                         <form action="/cgi-bin/koha/opac-reset-password.pl" name="mainform" id="mainform" method="post" autocomplete="off">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Reset your password</legend>
 
                             <fieldset class="brief">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt
index ba7c3a89f94..698acf4c28a 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt
@@ -40,6 +40,7 @@
                         <h2>Comments on <em>[% INCLUDE 'biblio-title.inc' %]</em></h2>
                         [% IF ( biblio.author ) %]<h3>[% biblio.author | html %]</h3>[% END %]
                         <form id="reviewf" action="/cgi-bin/koha/opac-review.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Comments</legend>
                             <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]" />
                             [% IF ( reviewid ) %]<input type="hidden" name="reviewid" value="[% reviewid | html %]" />[% END %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt
index 2030dcab2ba..5d1af00b45c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt
@@ -86,6 +86,7 @@
         [% IF ( current_biblio_searches ) %]
             <h2>Current session</h2>
             <form action="/cgi-bin/koha/opac-search-history.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Toolbar control</legend>
 
                 [% INCLUDE 'toolbar_controls' %]
@@ -133,6 +134,7 @@
         [% IF ( previous_biblio_searches ) %]
             <h2>Previous sessions</h2>
             <form action="/cgi-bin/koha/opac-search-history.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Toolbar control</legend>
                 [% INCLUDE 'toolbar_controls' %]
 
@@ -188,6 +190,7 @@
         [% IF ( current_authority_searches ) %]
             <h2>Current session</h2>
             <form action="/cgi-bin/koha/opac-search-history.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Toolbar control</legend>
                 [% INCLUDE 'toolbar_controls' %]
                 <input type="hidden" name="action" value="delete" />
@@ -229,6 +232,7 @@
         [% IF ( previous_authority_searches ) %]
             <h2>Previous sessions</h2>
             <form action="/cgi-bin/koha/opac-search-history.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Toolbar control</legend>
                 [% INCLUDE 'toolbar_controls' %]
                 <input type="hidden" name="action" value="delete" />
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
index 2f1ef6bbcec..33ee1dc137b 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
@@ -28,6 +28,7 @@
 
                         [% ELSE %]
                             <form action="/cgi-bin/koha/opac-sendbasket.pl" method="post" id="sendbasketform">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="brief">
                                     <legend><h1>Sending your cart</h1></legend>
                                     <label for="email_add">Email address:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt
index a446e8b5a99..71d6a2b1b25 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt
@@ -31,6 +31,7 @@
                                 <p><a class="button close" href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelfid | html %]">Back to lists</a></p>
                             [% ELSE %]
                                 <form action="/cgi-bin/koha/opac-sendshelf.pl" method="post" id="sendshelfform">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="brief">
                                         <legend><h1>Sending your list</h1></legend>
                                         <label for="email">Email address:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt
index 86dd33578c4..1d0c41c126f 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt
@@ -55,6 +55,7 @@
                             <span class="view"><a id="Fullhistory" href="opac-serial-issues.pl?selectview=full&amp;biblionumber=[% biblionumber | html %]" class="button">Full history</a></span>
                         </div>
                         <form method="post" name="f">
+                            [% INCLUDE 'csrf-token.inc' %]
                             [% FOREACH subscription_LOO IN subscription_LOOP %]
                                 <div id="subscriptionline[% subscription_LOO.subscriptionid | html %]" class="subscriptionline">
                                     <caption><h2>Subscription information for [% subscription_LOO.bibliotitle | html %]</h2><caption>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
index 823f907329a..1c20bcb82bf 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
@@ -10,6 +10,7 @@
 
 [% BLOCK delete_shelf %]
     <form action="/cgi-bin/koha/opac-shelves.pl" method="post" id="deleteshelf[% shelf.shelfnumber | html %]" class="d-inline">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="delete" />
         <input type="hidden" name="referer" value="list" />
         <input type='hidden' name='public' value='[% public | html %]' />
@@ -249,6 +250,7 @@
                                         [% IF can_manage_shelf %]
                                             <span class="sep">|</span>
                                             <form method="post" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="op" value="edit_form" />
                                                 <input type="hidden" name="referer" value="view" />
                                                 <input type='hidden' name='public' value='[% shelf.public | html %]' />
@@ -263,6 +265,7 @@
                                             [% END %]
                                         [% ELSIF !public # not manageshelf and private means shared %]
                                             <form action="/cgi-bin/koha/opac-shelves.pl" method="post" id="unshare[% shelf.shelfnumber | html %]" class="d-inline">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="op" value="remove_share" />
                                                 <input type="hidden" name="referer" value="list" />
                                                 <input type='hidden' name='public' value='[% public | html %]' />
@@ -384,6 +387,7 @@
                             </div> <!-- /#floating -->
 
                             <form action="/cgi-bin/koha/opac-shelves.pl" method="post" id="myform" name="myform">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 [% IF can_manage_shelf %]
                                     <input type="hidden" name="op" value="remove_biblios" />
                                     <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
@@ -547,6 +551,7 @@
                                     [% IF can_manage_shelf %]
                                         <span class="sep">|</span>
                                         <form method="post" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <input type="hidden" name="op" value="edit_form" />
                                             <input type="hidden" name="referer" value="view" />
                                             <input type="hidden" name="public" value="[% shelf.public | html %]" />
@@ -569,6 +574,7 @@
 
                             [% IF can_manage_shelf %]
                                 <form method="post" action="opac-shelves.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="delete" />
                                     <input type="hidden" name="referer" value="list" />
                                     <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]"/>
@@ -580,6 +586,7 @@
 
                     [% IF op == 'add_form' OR op == 'edit_form' %]
                         <form method="post" action="/cgi-bin/koha/opac-shelves.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 [% IF op == 'add_form' %]
                                     <div id="addshelf">
@@ -668,6 +675,7 @@
                         <h1>Transfer ownership of shared list '[% shelf.shelfname | html %]'</h1>
                         <br/>
                         <form action="/cgi-bin/koha/opac-shelves.pl" id="transferform" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                         <fieldset>
                             <input type="hidden" name="op" value="transfer" />
                             <input type="hidden" name="public" value="0" />
@@ -764,6 +772,7 @@
                                                     <td>
                                                         [% IF s.can_be_managed( loggedinusernumber ) %]
                                                             <form action="/cgi-bin/koha/opac-shelves.pl" method="post" class="d-inline">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <input type="hidden" name="shelfnumber" value="[% s.shelfnumber | html %]" />
                                                                 <input type="hidden" name="public" value="[% s.public | html %]" />
                                                                 <input type="hidden" name="op" value="edit_form" />
@@ -779,6 +788,7 @@
                                                         [% END %]
                                                         [% IF s.is_shared AND s.can_be_managed( loggedinusernumber ) %]
                                                             <form action="/cgi-bin/koha/opac-shelves.pl" method="post" class="d-inline">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <input type="hidden" name="shelfnumber" value="[% s.shelfnumber | html %]" />
                                                                 <input type="hidden" name="public" value="0" />
                                                                 <input type="hidden" name="op" value="transfer" />
@@ -788,6 +798,7 @@
                                                         [% END %]
                                                         [% IF s.is_shared_with( loggedinusernumber ) %]
                                                             <form action="opac-shelves.pl" method="post" id="unshare[% s.shelfnumber | html %]" class="d-inline">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <input type="hidden" name="op" value="remove_share" />
                                                                 <input type="hidden" name="referer" value="list" />
                                                                 <input type='hidden' name='public' value='[% public | html %]' />
@@ -823,6 +834,7 @@
 </div> <!-- / .main -->
 
 <form method="post" id="download_list" action="/cgi-bin/koha/opac-downloadshelf.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
     <input type="hidden" name="format" id="download_format" value="" />
 </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt
index da92b75578a..0f168e21cb7 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt
@@ -75,6 +75,7 @@
                             [% END %]
 
                             <form action="/cgi-bin/koha/opac-suggestions.pl" method="post" id="add_suggestion_form">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="rows">
                                     <ol>
                                         [% IF Koha.Preference( 'OPACSuggestionAutoFill' ) %]
@@ -368,6 +369,7 @@
                             [% IF suggestions.size > 0 %]
                                 [% SET can_delete_suggestion = 0 %]
                                 <form action="/cgi-bin/koha/opac-suggestions.pl" method="post" id="delete_suggestions">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="delete_confirm" />
                                     [% IF ( loggedinusername || ( Koha.Preference( 'AnonSuggestions' ) == 1 ) ) %]
                                         <div id="toolbar" class="toolbar clearfix">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt
index 87e4d00045d..5d78a2e5069 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt
@@ -133,6 +133,7 @@
 
                         [% IF ( MY_TAGS ) %]
                         <form id="deletetags" method="post" action="opac-tags.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <table id="mytagst" class="table table-bordered table-striped">
                             <caption>Your tags</caption>
                                 <thead>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt
index a357a5712f1..8b89b83af02 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt
@@ -43,6 +43,7 @@
                                     <fieldset>
                                         <legend>Show</legend>
                                         <form class="form-inline" action="/cgi-bin/koha/opac-tags_subject.pl" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <p>up to <input type="text" name="number" value="[% number | html %]" size="4" maxlength="4" /> subjects <input type="submit" class="btn btn-primary" value="OK" /></p>
                                         </form>
                                     </fieldset>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
index e2801bf32a7..50734dbbf2c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
@@ -221,6 +221,7 @@
 
                     [% IF Koha.Preference('AllowPatronToControlAutorenewal') %]
                     <form id="autorenewal_option" action="/cgi-bin/koha/opac-user.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <legend class="sr-only">Auto-renewal</legend>
                             <label for="yes-autorenew_checkouts">
                                 Allow auto-renewal:
@@ -320,6 +321,7 @@
                             [% WRAPPER tab_panel tabname="opac-user-checkouts" %]
                                 [% IF ( issues_count ) %]
                                     <form id="renewselected" action="/cgi-bin/koha/opac-renew.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <legend class="sr-only">Renew selected</legend>
                                         <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]">
                                         <input type="hidden" name="from" value="opac_user" />
@@ -559,6 +561,7 @@
 
                                     [% IF ( canrenew && !userdebarred && OpacRenewalAllowed && !( logged_in_user.is_expired && logged_in_user.category.effective_BlockExpiredPatronOpacActions ) ) %]
                                         <form id="renewall" class="js-hide" action="/cgi-bin/koha/opac-renew.pl" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <legend class="sr-only">Renew</legend>
                                             <input type="hidden" name="from" value="opac_user" />
                                             <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
@@ -903,6 +906,7 @@
                                                 <td class="cancelrecall">
                                                     [% IF ( RECALL.requested or RECALL.overdue ) %]
                                                         <form action="/cgi-bin/koha/opac-recall.pl" method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="cancel">
                                                             <input type="hidden" name="recall_id" value="[% RECALL.id | html %]">
                                                             <input type="hidden" name="biblionumber" value="[% RECALL.biblio_id | html %]">
@@ -1043,6 +1047,7 @@
     <div class="modal-dialog">
         <div class="modal-content">
             <form action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-header">
                     [% IF HOLD.suspend %]
                         <h5 class="modal-title" id="suspendModalLabel">Resume hold</h5>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
index cc044a6845a..fac1905c506 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
@@ -101,6 +101,7 @@
                                     </table>
                                     <div>
                                         <form method="post" action="#" id="finish_form">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <legend class="sr-only">Finish</legend>
                                             <button id="sci_finish_button" type="submit" class="btn btn-primary"><i class="fa fa-check" aria-hidden="true"></i> Finish</button>
                                         </form>
@@ -115,6 +116,7 @@
                         [%# Prompt for barcodes %]
                         <div id="new_checkins" class="sci_entry">
                             <form id="scan_form" name="scan_form" method="post" action="/cgi-bin/koha/sci/sci-main.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Scan</legend>
                                 <div class="row">
                                     <div class="col-auto">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
index 003c792402f..e5fc2c2267c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
@@ -94,6 +94,7 @@
 
                             [% IF ( returnitem && Koha.Preference('SCOAllowCheckin') ) %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="errorForm" class="inline" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend class="sr-only">Return</legend>
                                     <input type="hidden" name="op" value="returnbook" />
                                     <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -104,6 +105,7 @@
                             [% END %]
 
                             <form action="/cgi-bin/koha/sco/sco-main.pl" name="errorForm" class="inline" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Error</legend>
                                 <input type="hidden" name="op" value="" />
                                 <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -123,6 +125,7 @@
 
                             [% IF ( renew && Koha.Preference('SCOAllowCheckin') ) %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend class="sr-only">Return</legend>
                                     <input type="hidden" name="op" value="returnbook" />
                                     <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -135,6 +138,7 @@
 
                             [% UNLESS ( renew ) %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend class="sr-only">Renew</legend>
                                     <input type="hidden" name="op" value="renew" />
                                     <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -145,6 +149,7 @@
                                   </form>
                             [% ELSE %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend class="sr-only">Renew</legend>
                                     <input type="hidden" name="op" value="renew" />
                                     <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -156,6 +161,7 @@
                             [% END %]
 
                             <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Cancel</legend>
                                 <input type="hidden" name="op" value="" />
                                 <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -242,6 +248,7 @@
                         [% IF ( validuser ) %]
                             <div id="newcheckout" class="sco_entry">
                                 <form id="scan_form" name="scan_form" method="post" action="/cgi-bin/koha/sco/sco-main.pl" onsubmit="return checkout_confirm('[% patronid | html %]');">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend><h2>
                                         [% IF ( Koha.Preference('SCOAllowCheckin') ) %]
                                             <span>Check out, return, or renew an item:</span>
@@ -343,6 +350,7 @@
                                                     [% END %]
                                                     <td>
                                                         <form action="/cgi-bin/koha/sco/sco-main.pl" method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <legend class="sr-only">Issue renews</legend>
                                                             <input type="hidden" name="patronid" value="[% patronid | html %]" />
                                                             <input type="hidden" name="barcode" value="[% ISSUE.barcode | html %]" />
@@ -403,6 +411,7 @@
                         [% ELSE # IF validuser %]
                             <div class="sco_entry" >
                                 <form id="mainform" action="/cgi-bin/koha/sco/sco-main.pl" name="mainform" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset>
                                         [% IF ( Koha.Preference('SelfCheckoutByLogin') ) %]
                                             <legend>Log in to your account</legend>
-- 
2.25.1