diff --git a/htdocs/expedition/commande.php b/htdocs/expedition/commande.php
index 3f9f65c1713..03b7e07174a 100644
--- a/htdocs/expedition/commande.php
+++ b/htdocs/expedition/commande.php
@@ -178,6 +178,7 @@ if ($id > 0 || ! empty($ref))
 		if ($user->rights->commande->creer && $_GET['action'] == 'RefCustomerOrder')
 		{
 			print '<form action="fiche.php?id='.$id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="set_ref_client">';
 			print '<input type="text" class="flat" size="20" name="ref_client" value="'.$commande->ref_client.'">';
 			print ' <input type="submit" class="button" value="'.$langs->trans('Modify').'">';
@@ -251,6 +252,7 @@ if ($id > 0 || ! empty($ref))
 		if ($_GET['action'] == 'editdate_livraison')
 		{
 			print '<form name="setdate_livraison" action="'.$_SERVER["PHP_SELF"].'?id='.$commande->id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="setdate_livraison">';
 			$html->select_date($commande->date_livraison,'liv_','','','',"setdate_livraison");
 			print '<input type="submit" class="button" value="'.$langs->trans('Modify').'">';
diff --git a/htdocs/expedition/fiche.php b/htdocs/expedition/fiche.php
index 30cf3e6fdcc..35c744c34bf 100644
--- a/htdocs/expedition/fiche.php
+++ b/htdocs/expedition/fiche.php
@@ -242,6 +242,7 @@ if ($_GET["action"] == 'create')
 			 *   Document source
 			 */
 			print '<form action="fiche.php" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="add">';
 			print '<input type="hidden" name="origin" value="'.$origin.'">';
 			print '<input type="hidden" name="object_id" value="'.$object->id.'">';
diff --git a/htdocs/expedition/index.php b/htdocs/expedition/index.php
index c5e32ac9630..edb212820dd 100644
--- a/htdocs/expedition/index.php
+++ b/htdocs/expedition/index.php
@@ -44,6 +44,7 @@ print '<tr><td valign="top" width="30%" class="notopnoleft">';
 $var=false;
 print '<table class="noborder" width="100%">';
 print '<form method="post" action="liste.php">';
+print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 print '<tr class="liste_titre"><td colspan="3">'.$langs->trans("SearchASending").'</td></tr>';
 print '<tr '.$bc[$var].'><td>';
 print $langs->trans("Ref").':</td><td><input type="text" class="flat" name="sf_ref" size="18"></td><td><input type="submit" value="'.$langs->trans("Search").'" class="button"></td></tr>';
diff --git a/htdocs/exports/export.php b/htdocs/exports/export.php
index 6c014e039c7..890f5820791 100644
--- a/htdocs/exports/export.php
+++ b/htdocs/exports/export.php
@@ -363,6 +363,7 @@ if ($step == 2 && $datatoexport)
 
     // Liste deroulante des modeles d'export
     print '<form action="export.php" method="post">';
+    print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
     print '<input type="hidden" name="action" value="select_model">';
     print '<input type="hidden" name="step" value="2">';
     print '<input type="hidden" name="datatoexport" value="'.$datatoexport.'">';
@@ -581,6 +582,7 @@ if ($step == 3 && $datatoexport)
         print $langs->trans("SaveExportModel");
 
 		print '<form class="nocellnopadd" action="export.php" method="post">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
         print '<input type="hidden" name="action" value="add_export_model">';
         print '<input type="hidden" name="step" value="'.$step.'">';
         print '<input type="hidden" name="datatoexport" value="'.$datatoexport.'">';
diff --git a/htdocs/fichinter/contact.php b/htdocs/fichinter/contact.php
index d44f2363da6..f5d2cf4177c 100644
--- a/htdocs/fichinter/contact.php
+++ b/htdocs/fichinter/contact.php
@@ -217,6 +217,7 @@ if ($id > 0)
 			$var = false;
 
 			print '<form action="contact.php?id='.$id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="addcontact">';
 			print '<input type="hidden" name="source" value="internal">';
 			print '<input type="hidden" name="id" value="'.$id.'">';
@@ -245,6 +246,7 @@ if ($id > 0)
 			print '</form>';
 
 			print '<form action="contact.php?id='.$id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="addcontact">';
 			print '<input type="hidden" name="source" value="external">';
 			print '<input type="hidden" name="id" value="'.$id.'">';
diff --git a/htdocs/fichinter/fiche.php b/htdocs/fichinter/fiche.php
index 027932fc779..af676496a01 100644
--- a/htdocs/fichinter/fiche.php
+++ b/htdocs/fichinter/fiche.php
@@ -571,6 +571,7 @@ elseif ($_GET["id"] > 0)
 	if ($_GET['action'] == 'editdescription')
 	{
 		print '<form name="editdescription" action="'.$_SERVER["PHP_SELF"].'?id='.$fichinter->id.'" method="post">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		print '<input type="hidden" name="action" value="setdescription">';
 		print '<textarea name="description" wrap="soft" cols="70" rows="'.ROWS_3.'">'.dol_htmlentitiesbr_decode($fichinter->description).'</textarea><br>';
 		print '<input type="submit" class="button" value="'.$langs->trans('Modify').'">';
@@ -679,6 +680,7 @@ elseif ($_GET["id"] > 0)
 			if ($fichinter->statut == 0 && $_GET["action"] == 'editline' && $user->rights->ficheinter->creer && $_GET["ligne"] == $objp->rowid)
 			{
 				print '<form action="'.$_SERVER["PHP_SELF"].'?id='.$fichinter->id.'#'.$objp->rowid.'" method="post">';
+				print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 				print '<input type="hidden" name="action" value="updateligne">';
 				print '<input type="hidden" name="fichinterid" value="'.$fichinter->id.'">';
 				print '<input type="hidden" name="ligne" value="'.$_GET["ligne"].'">';
@@ -740,6 +742,7 @@ elseif ($_GET["id"] > 0)
 
 			// Ajout ligne d'intervention
 			print '<form action="'.$_SERVER["PHP_SELF"].'?id='.$fichinter->id.'#add" name="addinter" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="fichinterid" value="'.$fichinter->id.'">';
 			print '<input type="hidden" name="action" value="addligne">';
 
diff --git a/htdocs/fichinter/note.php b/htdocs/fichinter/note.php
index 6ef8f2663a4..5ae80d49ca6 100644
--- a/htdocs/fichinter/note.php
+++ b/htdocs/fichinter/note.php
@@ -114,6 +114,7 @@ if ($_GET['id'])
 			if ($_GET["action"] == 'edit')
 			{
 				print '<form method="post" action="note.php?id='.$fichinter->id.'">';
+				print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 				print '<input type="hidden" name="action" value="update_public">';
 				print '<textarea name="note_public" cols="80" rows="8">'.$fichinter->note_public."</textarea><br>";
 				print '<input type="submit" class="button" value="'.$langs->trans("Save").'">';
@@ -133,6 +134,7 @@ if ($_GET['id'])
 				if ($_GET["action"] == 'edit')
 				{
 					print '<form method="post" action="note.php?id='.$fichinter->id.'">';
+					print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 					print '<input type="hidden" name="action" value="update">';
 					print '<textarea name="note_private" cols="80" rows="8">'.$fichinter->note_private."</textarea><br>";
 					print '<input type="submit" class="button" value="'.$langs->trans("Save").'">';
diff --git a/htdocs/fourn/commande/contact.php b/htdocs/fourn/commande/contact.php
index b7808edf7df..791d0e1d310 100644
--- a/htdocs/fourn/commande/contact.php
+++ b/htdocs/fourn/commande/contact.php
@@ -224,6 +224,7 @@ if ($id > 0 || ! empty($ref))
 			$var = false;
 
 			print '<form action="contact.php?id='.$id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="addcontact">';
 			print '<input type="hidden" name="source" value="internal">';
 			print '<input type="hidden" name="id" value="'.$id.'">';
@@ -252,6 +253,7 @@ if ($id > 0 || ! empty($ref))
 			print '</form>';
 
 			print '<form action="contact.php?id='.$id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="addcontact">';
 			print '<input type="hidden" name="source" value="external">';
 			print '<input type="hidden" name="id" value="'.$id.'">';
diff --git a/htdocs/fourn/commande/dispatch.php b/htdocs/fourn/commande/dispatch.php
index 2b91f6c16cb..f0f1990942c 100644
--- a/htdocs/fourn/commande/dispatch.php
+++ b/htdocs/fourn/commande/dispatch.php
@@ -166,6 +166,7 @@ if ($id > 0 || ! empty($ref))
 		if ($commande->statut == 3 || $commande->statut == 4 || $commande->statut == 5)
 		{
 			print '<form method="POST" action="dispatch.php?id='.$commande->id.'">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="dispatch">';
 			print '<table class="noborder" width="100%">';
 
diff --git a/htdocs/fourn/commande/fiche.php b/htdocs/fourn/commande/fiche.php
index 83ffb0de972..4334e61078a 100644
--- a/htdocs/fourn/commande/fiche.php
+++ b/htdocs/fourn/commande/fiche.php
@@ -777,6 +777,7 @@ if ($id > 0 || ! empty($ref))
 			if ($_GET["action"]	== 'editline' && $user->rights->fournisseur->commande->creer && ($_GET["rowid"] == $commandline->id))
 			{
 				print '<form action="'.$_SERVER["PHP_SELF"].'?id='.$commande->id.'&amp;etat=1&amp;ligne_id='.$commandline->id.'" method="post">';
+				print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 				print '<input type="hidden" name="action" value="updateligne">';
 				print '<input type="hidden" name="id" value="'.$_REQUEST["id"].'">';
 				print '<input type="hidden" name="elrowid" value="'.$_GET['rowid'].'">';
@@ -842,6 +843,7 @@ if ($id > 0 || ! empty($ref))
 
 			// Add free products/services form
 			print '<form action="'.$_SERVER["PHP_SELF"].'?id='.$commande->id.'#add" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden"	name="action" value="addligne">';
 			print '<input type="hidden"	name="id" value="'.$commande->id.'">';
 
@@ -899,6 +901,7 @@ if ($id > 0 || ! empty($ref))
 				print '</tr>';
 
 				print '<form id="addpredefinedproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$commande->id.'#add" method="post">';
+				print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 				print '<input type="hidden" name="action" value="addligne">';
 				print '<input type="hidden" name="id" value="'.$commande->id.'">';
 
@@ -1010,6 +1013,7 @@ if ($id > 0 || ! empty($ref))
 			 */
 			print '<br>';
 			print '<form name="commande" action="fiche.php?id='.$commande->id.'&amp;action=commande" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden"	name="action" value="commande">';
 			print '<table class="border" width="100%">';
 			print '<tr class="liste_titre"><td colspan="2">'.$langs->trans("ToOrder").'</td></tr>';
@@ -1035,6 +1039,7 @@ if ($id > 0 || ! empty($ref))
 			 */
 			print '<br>';
 			print '<form action="fiche.php?id='.$commande->id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden"	name="action" value="livraison">';
 			print '<table class="border" width="100%">';
 			print '<tr class="liste_titre"><td colspan="2">'.$langs->trans("Receive").'</td></tr>';
diff --git a/htdocs/fourn/commande/note.php b/htdocs/fourn/commande/note.php
index 620d0e4ca64..fd2b74925de 100644
--- a/htdocs/fourn/commande/note.php
+++ b/htdocs/fourn/commande/note.php
@@ -98,6 +98,7 @@ if ($id > 0 || ! empty($ref))
 		*   Commande
 		*/
 		print '<form action="note.php?id='.$commande->id.'" method="post">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		print '<input type="hidden" name="action" value="updatenote">';
 
 		print '<table class="border" width="100%">';
diff --git a/htdocs/fourn/facture/contact.php b/htdocs/fourn/facture/contact.php
index 9ca5d05c2f4..81e6bce37ff 100644
--- a/htdocs/fourn/facture/contact.php
+++ b/htdocs/fourn/facture/contact.php
@@ -214,6 +214,7 @@ if ($id > 0)
 			$var = false;
 
 			print '<form action="contact.php?facid='.$id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="addcontact">';
 			print '<input type="hidden" name="source" value="internal">';
 			print '<input type="hidden" name="id" value="'.$id.'">';
@@ -242,6 +243,7 @@ if ($id > 0)
             print '</form>';
 
 			print '<form action="contact.php?facid='.$id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="addcontact">';
 			print '<input type="hidden" name="source" value="external">';
 			print '<input type="hidden" name="id" value="'.$id.'">';
diff --git a/htdocs/fourn/facture/fiche.php b/htdocs/fourn/facture/fiche.php
index 45fc5940d0b..1481772714c 100644
--- a/htdocs/fourn/facture/fiche.php
+++ b/htdocs/fourn/facture/fiche.php
@@ -386,6 +386,7 @@ if ($_GET['action'] == 'create')
 	$dateinvoice=($datefacture==''?(empty($conf->global->MAIN_AUTOFILL_DATE)?-1:0):$datefacture);
 
 	print '<form name="add" action="fiche.php" method="post">';
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<input type="hidden" name="action" value="add">';
 	print '<table class="border" width="100%">';
 
@@ -478,6 +479,7 @@ else
 			print_fiche_titre($langs->trans('SupplierInvoice'));
 
 			print '<form name="update" action="fiche.php?facid='.$fac->id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="update">';
 
 			print '<table class="border" width="100%">';
@@ -812,6 +814,7 @@ else
 				if ($fac->statut == 0 && $_GET['action'] == 'mod_ligne' && $_GET['etat'] == '0' && $_GET['ligne_id'] == $fac->lignes[$i]->rowid)
 				{
 					print '<form action="fiche.php?facid='.$fac->id.'&amp;etat=1&amp;ligne_id='.$fac->lignes[$i]->rowid.'" method="post">';
+					print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 					print '<input type="hidden" name="action" value="update_line">';
 					print '<tr '.$bc[$var].'>';
 
@@ -954,6 +957,7 @@ else
 
 				// Add free products/services form
 				print '<form action="fiche.php?facid='.$fac->id.'&amp;action=add_ligne" method="post">';
+				print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 				print '<input type="hidden" name="facid" value="'.$fac->id.'">';
 				print '<input type="hidden" name="socid" value="'.$societe->id.'">';
 
@@ -1018,6 +1022,7 @@ else
 					print '</tr>';
 
 					print '<form name="addligne_predef" action="fiche.php?facid='.$fac->id.'&amp;action=add_ligne" method="post">';
+					print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 					print '<input type="hidden" name="socid" value="'. $fac->socid .'">';
 					print '<input type="hidden" name="facid" value="'.$fac->id.'">';
 					print '<input type="hidden" name="socid" value="'.$fac->socid.'">';
diff --git a/htdocs/fourn/facture/note.php b/htdocs/fourn/facture/note.php
index fca7a176f08..01e52d9d15e 100644
--- a/htdocs/fourn/facture/note.php
+++ b/htdocs/fourn/facture/note.php
@@ -118,6 +118,7 @@ if ($_GET["facid"])
     if ($_GET["action"] == 'edit')
     {
         print '<form method="post" action="note.php?facid='.$fac->id.'">';
+        print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
         print '<input type="hidden" name="action" value="update_public">';
         print '<textarea name="note_public" cols="80" rows="8">'.$fac->note_public."</textarea><br>";
         print '<input type="submit" class="button" value="'.$langs->trans("Save").'">';
@@ -137,6 +138,7 @@ if ($_GET["facid"])
 	    if ($_GET["action"] == 'edit')
 	    {
 	        print '<form method="post" action="note.php?facid='.$fac->id.'">';
+	        print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	        print '<input type="hidden" name="action" value="update">';
 	        print '<textarea name="note" cols="80" rows="8">'.$fac->note."</textarea><br>";
 	        print '<input type="submit" class="button" value="'.$langs->trans("Save").'">';
diff --git a/htdocs/fourn/facture/paiement.php b/htdocs/fourn/facture/paiement.php
index 0a9cfdd3c51..ef26fde6b30 100644
--- a/htdocs/fourn/facture/paiement.php
+++ b/htdocs/fourn/facture/paiement.php
@@ -221,6 +221,7 @@ if ($action == 'create' || $action == 'add_paiement')
 			print_fiche_titre($langs->trans('DoPayment'));
 
 			print '<form name="addpaiement" action="paiement.php" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="add_paiement">';
 			print '<input type="hidden" name="facid" value="'.$facid.'">';
 			print '<input type="hidden" name="facnumber" value="'.$obj->facnumber.'">';
diff --git a/htdocs/fourn/paiement/fiche.php b/htdocs/fourn/paiement/fiche.php
index 4c84b6629dd..82a768acf32 100644
--- a/htdocs/fourn/paiement/fiche.php
+++ b/htdocs/fourn/paiement/fiche.php
@@ -193,6 +193,7 @@ else
 	print '<td valign="top" width="140" colspan="2">'.$langs->trans('Date').'</td>';
 	print '<td colspan="3">';
 	print '<form name="formsoc" method="post" action="'.DOL_URL_ROOT.'/fourn/paiement/fiche.php?id='.$paiement->id.'"><input type="hidden" name="action" value="update_date" />';
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	if (!empty($_POST['remonth']) && !empty($_POST['reday']) && !empty($_POST['reyear']))
 	$sel_date=dol_mktime(12, 0 , 0, $_POST['remonth'], $_POST['reday'], $_POST['reyear']);
 	else
@@ -224,6 +225,7 @@ else
 	print '<td valign="top" width="140" colspan="2">'.$langs->trans('Numero').'</td>';
 	print '<td colspan="3">';
 	print '<form name="formsoc" method="post" action="'.DOL_URL_ROOT.'/fourn/paiement/fiche.php?id='.$paiement->id.'"><input type="hidden" name="action" value="update_num" />';
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	if (!empty($_POST['new_num']))
 	$num = $this->db->escape($_POST['new_num']);
 	else
diff --git a/htdocs/fourn/product/fourn.php b/htdocs/fourn/product/fourn.php
index 728bd5167c3..44629d2eb67 100644
--- a/htdocs/fourn/product/fourn.php
+++ b/htdocs/fourn/product/fourn.php
@@ -173,6 +173,7 @@ if ($_GET["id"])
 	  $action = 'fourn.php?id='.$product->id.'&amp;id_fourn='.$product->fourn->id;
 
 	  print '<form action="'.$action.'" method="post">';
+	  print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	  print '<input type="hidden" name="action" value="update">';
 	  print '<br /><table class="border" width="100%">';
 	  print '<tr><td width="20%">'.$langs->trans("Price").'</td>';
diff --git a/htdocs/fourn/product/index.php b/htdocs/fourn/product/index.php
index 9d0b1368950..31f4148213f 100644
--- a/htdocs/fourn/product/index.php
+++ b/htdocs/fourn/product/index.php
@@ -49,6 +49,7 @@ print '<tr><td valign="top" width="30%">';
  * Zone recherche produit/service
  */
 print '<form method="post" action="liste.php">';
+print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 print '<table class="noborder" width="100%">';
 print "<tr class=\"liste_titre\">\n";
 print '<td colspan="3">'.$langs->trans("Search").'</td></tr>';
diff --git a/htdocs/fourn/product/liste.php b/htdocs/fourn/product/liste.php
index 347aacb5523..c1abf85fcb9 100644
--- a/htdocs/fourn/product/liste.php
+++ b/htdocs/fourn/product/liste.php
@@ -189,6 +189,7 @@ if ($resql)
 
 	// Lignes des champs de filtre
 	print '<form action="liste.php" method="post">';
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	if ($fourn_id > 0) print '<input type="hidden" name="fourn_id" value="'.$fourn_id.'">';
 	print '<input type="hidden" name="sortfield" value="'.$sortfield.'">';
 	print '<input type="hidden" name="sortorder" value="'.$sortorder.'">';
diff --git a/htdocs/fourn/product/photos.php b/htdocs/fourn/product/photos.php
index f644aa0725f..e6528dc915b 100644
--- a/htdocs/fourn/product/photos.php
+++ b/htdocs/fourn/product/photos.php
@@ -116,6 +116,7 @@ if ($_GET["id"])
 			print_titre($langs->trans("AddPhoto"));
 
 			print '<form name="userfile" action="photos.php?id='.$product->id.'" enctype="multipart/form-data" METHOD="POST">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="max_file_size" value="'.$conf->maxfilesize.'">';
 
 			print '<table class="border" width="100%"><tr>';
diff --git a/htdocs/imports/import.php b/htdocs/imports/import.php
index 4f5ed4e2033..590a7ad6fc3 100644
--- a/htdocs/imports/import.php
+++ b/htdocs/imports/import.php
@@ -342,7 +342,8 @@ if ($step == 2 && $datatoimport)
     dol_fiche_head($head, $hselected, $langs->trans("NewImport"));
 
 	
-	print '<form name="userfile" action="index.php" enctype="multipart/form-data" METHOD="POST">';      
+	print '<form name="userfile" action="index.php" enctype="multipart/form-data" METHOD="POST">';
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';     
 	print '<input type="hidden" name="max_file_size" value="'.$conf->maxfilesize.'">';
 	
 	print '<table class="noborder" width="100%" cellspacing="0" cellpadding="4">';
@@ -398,6 +399,7 @@ if ($step == 2 && $datatoimport)
 
     // Liste deroulante des modeles d'import
     print '<form action="import.php" method="post">';
+    print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
     print '<input type="hidden" name="action" value="select_model">';
     print '<input type="hidden" name="step" value="2">';
     print '<input type="hidden" name="datatoimport" value="'.$datatoimport.'">';
@@ -616,6 +618,7 @@ if ($step == 3 && $datatoimport)
         print $langs->trans("SaveImportModel");
 
 		print '<form class="nocellnopadd" action="import.php" method="post">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
         print '<input type="hidden" name="action" value="add_import_model">';
         print '<input type="hidden" name="step" value="'.$step.'">';
         print '<input type="hidden" name="datatoimport" value="'.$datatoimport.'">';
diff --git a/htdocs/includes/barcode/html.formbarcode.class.php b/htdocs/includes/barcode/html.formbarcode.class.php
index d45b915afdd..dfd0c6673db 100644
--- a/htdocs/includes/barcode/html.formbarcode.class.php
+++ b/htdocs/includes/barcode/html.formbarcode.class.php
@@ -69,6 +69,7 @@ class FormBarCode
 		}
 		
 		$select_encoder = '<form action="barcode.php" method="post" id="'.$idForm.'">';
+		$select_encoder.= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		$select_encoder.= '<input type="hidden" name="action" value="update">';
 		$select_encoder.= '<input type="hidden" name="code_id" value="'.$code_id.'">';
 		$select_encoder.= '<select class="flat" name="coder" onChange="barcode_coder_save(\''.$idForm.'\')">';
@@ -150,6 +151,7 @@ class FormBarCode
         if ($htmlname != "none")
         {
             print '<form method="post" action="'.$page.'">';
+            print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
             print '<input type="hidden" name="action" value="setbarcodetype">';
             print '<table class="noborder" cellpadding="0" cellspacing="0">';
             print '<tr><td>';
diff --git a/htdocs/includes/modules/commande/mod_commande_saphir.php b/htdocs/includes/modules/commande/mod_commande_saphir.php
index 90ad538d2ec..fd42edd4366 100644
--- a/htdocs/includes/modules/commande/mod_commande_saphir.php
+++ b/htdocs/includes/modules/commande/mod_commande_saphir.php
@@ -54,6 +54,7 @@ class mod_commande_saphir extends ModeleNumRefCommandes
 
 		$texte = $langs->trans('GenericNumRefModelDesc')."<br>\n";
 		$texte.= '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
+		$texte.= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		$texte.= '<input type="hidden" name="action" value="updateMask">';
 		$texte.= '<input type="hidden" name="maskconstorder" value="COMMANDE_SAPHIR_MASK">';
 		$texte.= '<table class="nobordernopadding" width="100%">';
diff --git a/htdocs/includes/modules/facture/mercure/mercure.modules.php b/htdocs/includes/modules/facture/mercure/mercure.modules.php
index 6d4c8edb0f0..8bb37566889 100644
--- a/htdocs/includes/modules/facture/mercure/mercure.modules.php
+++ b/htdocs/includes/modules/facture/mercure/mercure.modules.php
@@ -53,6 +53,7 @@ class mod_facture_mercure extends ModeleNumRefFactures
 
 		$texte = $langs->trans('GenericNumRefModelDesc')."<br>\n";
 		$texte.= '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
+		$texte.= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		$texte.= '<input type="hidden" name="action" value="updateMask">';
 		$texte.= '<input type="hidden" name="maskconstinvoice" value="FACTURE_MERCURE_MASK_INVOICE">';
 		$texte.= '<input type="hidden" name="maskconstcredit" value="FACTURE_MERCURE_MASK_CREDIT">';
diff --git a/htdocs/includes/modules/fichinter/mod_arctic.php b/htdocs/includes/modules/fichinter/mod_arctic.php
index dfb8a4c6073..c0504a5fe34 100644
--- a/htdocs/includes/modules/fichinter/mod_arctic.php
+++ b/htdocs/includes/modules/fichinter/mod_arctic.php
@@ -59,6 +59,7 @@ class mod_arctic extends ModeleNumRefFicheinter
 
 		$texte = $langs->trans('GenericNumRefModelDesc')."<br>\n";
 		$texte.= '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
+		$texte.= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		$texte.= '<input type="hidden" name="action" value="updateMask">';
 		$texte.= '<input type="hidden" name="maskconst" value="FICHINTER_ARTIC_MASK">';
 		$texte.= '<table class="nobordernopadding" width="100%">';
diff --git a/htdocs/includes/modules/livraison/mod_livraison_saphir.php b/htdocs/includes/modules/livraison/mod_livraison_saphir.php
index 9bf9247e8b7..b18c95bd624 100644
--- a/htdocs/includes/modules/livraison/mod_livraison_saphir.php
+++ b/htdocs/includes/modules/livraison/mod_livraison_saphir.php
@@ -52,6 +52,7 @@ class mod_livraison_saphir extends ModeleNumRefDeliveryOrder
 
 		$texte = $langs->trans('GenericNumRefModelDesc')."<br>\n";
 		$texte.= '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
+		$texte.= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		$texte.= '<input type="hidden" name="action" value="updateMask">';
 		$texte.= '<input type="hidden" name="maskconstdelivery" value="LIVRAISON_SAPHIR_MASK">';
 		$texte.= '<table class="nobordernopadding" width="100%">';
diff --git a/htdocs/includes/modules/propale/mod_propale_saphir.php b/htdocs/includes/modules/propale/mod_propale_saphir.php
index 5b4ddad22f2..b70c4215754 100644
--- a/htdocs/includes/modules/propale/mod_propale_saphir.php
+++ b/htdocs/includes/modules/propale/mod_propale_saphir.php
@@ -54,6 +54,7 @@ class mod_propale_saphir extends ModeleNumRefPropales
 
 		$texte = $langs->trans('GenericNumRefModelDesc')."<br>\n";
 		$texte.= '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
+		$texte.= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		$texte.= '<input type="hidden" name="action" value="updateMask">';
 		$texte.= '<input type="hidden" name="maskconstpropal" value="PROPALE_SAPHIR_MASK">';
 		$texte.= '<table class="nobordernopadding" width="100%">';
diff --git a/htdocs/includes/modules/societe/mod_codeclient_elephant.php b/htdocs/includes/modules/societe/mod_codeclient_elephant.php
index bb784aeb029..e178ad3edf3 100644
--- a/htdocs/includes/modules/societe/mod_codeclient_elephant.php
+++ b/htdocs/includes/modules/societe/mod_codeclient_elephant.php
@@ -76,6 +76,7 @@ class mod_codeclient_elephant extends ModeleThirdPartyCode
 
 		$texte = $langs->trans('GenericNumRefModelDesc')."<br>\n";
 		$texte.= '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
+		$texte.= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		$texte.= '<input type="hidden" name="action" value="updateMask">';
 		$texte.= '<input type="hidden" name="maskcustomer" value="COMPANY_ELEPHANT_MASK_CUSTOMER">';
 		$texte.= '<input type="hidden" name="masksupplier" value="COMPANY_ELEPHANT_MASK_SUPPLIER">';
diff --git a/htdocs/includes/modules/supplier_order/mod_commande_fournisseur_orchidee.php b/htdocs/includes/modules/supplier_order/mod_commande_fournisseur_orchidee.php
index 9b2db4cce99..a4551267284 100644
--- a/htdocs/includes/modules/supplier_order/mod_commande_fournisseur_orchidee.php
+++ b/htdocs/includes/modules/supplier_order/mod_commande_fournisseur_orchidee.php
@@ -54,6 +54,7 @@ class mod_commande_fournisseur_orchidee extends ModeleNumRefSuppliersOrders
 
 		$texte = $langs->trans('GenericNumRefModelDesc')."<br>\n";
 		$texte.= '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
+		$texte.= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		$texte.= '<input type="hidden" name="action" value="updateMask">';
 		$texte.= '<input type="hidden" name="maskconstorder" value="COMMANDE_FOURNISSEUR_ORCHIDEE_MASK">';
 		$texte.= '<table class="nobordernopadding" width="100%">';