From 384c732685bb4f27adef4291c2b52edbf1a59a5e Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Mon, 11 Mar 2019 15:58:37 +0100
Subject: [PATCH] FIX Missing token in POST of form

---
 htdocs/modulebuilder/index.php | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/htdocs/modulebuilder/index.php b/htdocs/modulebuilder/index.php
index 22c83222b8b..af51071d674 100644
--- a/htdocs/modulebuilder/index.php
+++ b/htdocs/modulebuilder/index.php
@@ -1226,7 +1226,7 @@ if ($module == 'initmodule')
 }
 elseif ($module == 'deletemodule')
 {
-	print '<form name="delete">';
+	print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST" name="delete">';
 	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<input type="hidden" name="action" value="confirm_delete">';
 	print '<input type="hidden" name="module" value="deletemodule">';
@@ -1514,7 +1514,7 @@ elseif (! empty($module))
 				print '<br>';
 
 
-				print '<form method="POST" action="'.$_SERVER["PHP_SELF"].'">';
+				print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
 				print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 				print '<input type="hidden" name="action" value="addlanguage">';
 				print '<input type="hidden" name="file" value="'.dol_escape_htmltag($file).'">';
@@ -1820,21 +1820,19 @@ elseif (! empty($module))
 							//var_dump($reflectorpropdefault);
 
 							print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
-
-							print '<input class="button" type="submit" name="regenerateclasssql" value="'.$langs->trans("RegenerateClassAndSql").'">';
-							print '<input class="button" type="submit" name="regeneratemissing" value="'.$langs->trans("RegenerateMissingFiles").'">';
-							print '<br><br>';
-
-
-							print load_fiche_titre($langs->trans("Properties"), '', '');
-
-
 							print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 							print '<input type="hidden" name="action" value="addproperty">';
 							print '<input type="hidden" name="tab" value="objects">';
 							print '<input type="hidden" name="module" value="'.dol_escape_htmltag($module.($forceddirread?'@'.$dirread:'')).'">';
 							print '<input type="hidden" name="tabobj" value="'.dol_escape_htmltag($tabobj).'">';
 
+							print '<input class="button" type="submit" name="regenerateclasssql" value="'.$langs->trans("RegenerateClassAndSql").'">';
+							print '<input class="button" type="submit" name="regeneratemissing" value="'.$langs->trans("RegenerateMissingFiles").'">';
+							print '<br><br>';
+
+							print load_fiche_titre($langs->trans("Properties"), '', '');
+
+
 							print '<div class="div-table-responsive">';
 							print '<table class="noborder">';
 							print '<tr class="liste_titre">';
@@ -2834,7 +2832,8 @@ elseif (! empty($module))
 
 			print '<br>';
 
-			print '<form name="generatepackage">';
+			print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST" name="generatepackage">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="generatepackage">';
 			print '<input type="hidden" name="tab" value="'.dol_escape_htmltag($tab).'">';
 			print '<input type="hidden" name="module" value="'.dol_escape_htmltag($module).'">';
@@ -2857,7 +2856,8 @@ elseif (! empty($module))
 
 			print '<br>';
 
-			print '<form name="generatedoc">';
+			print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST" name="generatedoc">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="generatedoc">';
 			print '<input type="hidden" name="tab" value="'.dol_escape_htmltag($tab).'">';
 			print '<input type="hidden" name="module" value="'.dol_escape_htmltag($module).'">';