From 8efffebe2eef4bd1b659636179fb5201731ad966 Mon Sep 17 00:00:00 2001
From: Regis Houssin <regis@dolibarr.fr>
Date: Fri, 15 May 2009 14:32:44 +0000
Subject: [PATCH] =?UTF-8?q?Fix:=20ajout=20d'un=20jeton=20al=E9atoire=20dan?=
 =?UTF-8?q?s=20les=20requetes=20POST?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 htdocs/categories/categorie.php    |  1 +
 htdocs/categories/edit.php         |  1 +
 htdocs/categories/fiche.php        |  1 +
 htdocs/categories/index.php        |  1 +
 htdocs/comm/action/fiche.php       |  2 ++
 htdocs/comm/action/index.php       |  1 +
 htdocs/comm/action/listactions.php |  1 +
 htdocs/comm/adresse_livraison.php  |  2 ++
 htdocs/comm/index.php              |  2 ++
 htdocs/comm/mailing/cibles.php     | 10 ++++++++--
 htdocs/comm/mailing/fiche.php      |  2 ++
 htdocs/comm/mailing/index.php      |  1 +
 htdocs/comm/multiprix.php          |  1 +
 htdocs/comm/propal.php             |  9 +++++++++
 htdocs/comm/propal/contact.php     |  2 ++
 htdocs/comm/propal/note.php        |  2 ++
 htdocs/comm/prospect/index.php     |  1 +
 htdocs/comm/remise.php             |  1 +
 htdocs/comm/remx.php               |  1 +
 htdocs/commande/contact.php        |  2 ++
 20 files changed, 42 insertions(+), 2 deletions(-)

diff --git a/htdocs/categories/categorie.php b/htdocs/categories/categorie.php
index ab9f00014d8..11f75c4f3e5 100644
--- a/htdocs/categories/categorie.php
+++ b/htdocs/categories/categorie.php
@@ -284,6 +284,7 @@ function formCategory($db,$object,$type,$typeid)
 	print '<br>';
 	print_fiche_titre($title,'','');
 	print '<form method="post" action="'.DOL_URL_ROOT.'/categories/categorie.php?'.$nameId.'='.$object->id.'">';
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<input type="hidden" name="typeid" value="'.$typeid.'">';
 	print '<table class="noborder" width="100%">';
 	print '<tr class="liste_titre"><td>';
diff --git a/htdocs/categories/edit.php b/htdocs/categories/edit.php
index 885be31dce8..42a5aace8f9 100644
--- a/htdocs/categories/edit.php
+++ b/htdocs/categories/edit.php
@@ -114,6 +114,7 @@ print '<tr><td class="notopnoleft" valign="top" width="30%">';
 
 print "\n";
 print '<form method="post" action="'.$_SERVER['PHP_SELF'].'">';
+print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 print '<input type="hidden" name="action" value="update">';
 print '<input type="hidden" name="id" value="'.$categorie->id.'">';
 print '<input type="hidden" name="type" value="'.$type.'">';
diff --git a/htdocs/categories/fiche.php b/htdocs/categories/fiche.php
index 6ea75c4c76b..6ef76012192 100644
--- a/htdocs/categories/fiche.php
+++ b/htdocs/categories/fiche.php
@@ -179,6 +179,7 @@ if ($user->rights->categorie->creer)
 			print '</div>';
 		}
 		print '<form action="'.$_SERVER['PHP_SELF'].'?type='.$_GET['type'].'" method="post">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		print '<input type="hidden" name="action" value="add">';
 		print '<input type="hidden" name="addcat" value="addcat">';
 		//print '<input type="hidden" name="id" value="'.$_GET['id'].'">';			Mis dans origin
diff --git a/htdocs/categories/index.php b/htdocs/categories/index.php
index e120f5844c9..2671c53c10e 100644
--- a/htdocs/categories/index.php
+++ b/htdocs/categories/index.php
@@ -62,6 +62,7 @@ print '<tr><td valign="top" width="30%" class="notopnoleft">';
  * Zone recherche produit/service
  */
 print '<form method="post" action="index.php?type='.$type.'">';
+print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 print '<input type="hidden" name="type" value="'.$type.'">';
 print '<table class="noborder" width="100%">';
 print '<tr class="liste_titre">';
diff --git a/htdocs/comm/action/fiche.php b/htdocs/comm/action/fiche.php
index c67aabac974..0e3e8b6c61e 100644
--- a/htdocs/comm/action/fiche.php
+++ b/htdocs/comm/action/fiche.php
@@ -438,6 +438,7 @@ if ($_GET["action"] == 'create')
 	}
 
 	print '<form name="formaction" action="fiche.php" method="post">';
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<input type="hidden" name="action" value="add_action">';
 	if (! empty($_REQUEST["backtopage"])) print '<input type="hidden" name="backtopage" value="'.($_REQUEST["backtopage"] != 1 ? $_REQUEST["backtopage"] : $_SERVER["HTTP_REFERER"]).'">';
 
@@ -651,6 +652,7 @@ if ($_GET["id"])
 	{
 		// Fiche action en mode edition
 		print '<form name="formaction" action="fiche.php" method="post">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		print '<input type="hidden" name="action" value="update">';
 		print '<input type="hidden" name="id" value="'.$_REQUEST["id"].'">';
 		if (! empty($_REQUEST["backtopage"])) print '<input type="hidden" name="from" value="'.($_REQUEST["from"] ? $_REQUEST["from"] : $_SERVER["HTTP_REFERER"]).'">';
diff --git a/htdocs/comm/action/index.php b/htdocs/comm/action/index.php
index 109c9cd897b..d736175b52e 100644
--- a/htdocs/comm/action/index.php
+++ b/htdocs/comm/action/index.php
@@ -161,6 +161,7 @@ print_fiche_titre($title,$nav);
 if ($canedit)
 {
 	print '<form name="listactionsfilter" action="'.$_SERVER["PHP_SELF"].'" method="POST">';
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<input type="hidden" name="status" value="'.$status.'">';
 	print '<input type="hidden" name="time" value="'.$_REQUEST["time"].'">';
 	print '<input type="hidden" name="year" value="'.$year.'">';
diff --git a/htdocs/comm/action/listactions.php b/htdocs/comm/action/listactions.php
index 6b886b2f597..0fb1127828b 100644
--- a/htdocs/comm/action/listactions.php
+++ b/htdocs/comm/action/listactions.php
@@ -177,6 +177,7 @@ if ($resql)
 	if ($canedit)
 	{
 		print '<form name="listactionsfilter" action="'.$_SERVER["PHP_SELF"].'" method="POST">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		print '<input type="hidden" name="status" value="'.$status.'">';
 		print '<input type="hidden" name="time" value="'.$_REQUEST["time"].'">';
 		print '<table class="border" width="100%">';
diff --git a/htdocs/comm/adresse_livraison.php b/htdocs/comm/adresse_livraison.php
index 633dca01925..3c59386289a 100644
--- a/htdocs/comm/adresse_livraison.php
+++ b/htdocs/comm/adresse_livraison.php
@@ -214,6 +214,7 @@ if ($_GET["action"] == 'create' || $_POST["action"] == 'create')
         }
 
         print '<form action="adresse_livraison.php" method="post" name="formsoc">';
+        print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
         print '<input type="hidden" name="socid" value="'.$socid.'">';
         print '<input type="hidden" name="origin" value="'.$origin.'">';
         print '<input type="hidden" name="originid" value="'.$originid.'">';
@@ -318,6 +319,7 @@ elseif ($_GET["action"] == 'edit' || $_POST["action"] == 'edit')
         }
 
         print '<form action="adresse_livraison.php?socid='.$livraison->socid.'" method="post" name="formsoc">';
+        print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
         print '<input type="hidden" name="action" value="update">';
         print '<input type="hidden" name="socid" value="'.$livraison->socid.'">';
         print '<input type="hidden" name="origin" value="'.$origin.'">';
diff --git a/htdocs/comm/index.php b/htdocs/comm/index.php
index 162b2e3414d..0930ae5e132 100644
--- a/htdocs/comm/index.php
+++ b/htdocs/comm/index.php
@@ -104,6 +104,7 @@ if ($conf->propal->enabled && $user->rights->propale->lire)
 {
 	$var=false;
 	print '<form method="post" action="'.DOL_URL_ROOT.'/comm/propal.php">';
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<table class="noborder" width="100%">';
 	print '<tr class="liste_titre"><td colspan="3">'.$langs->trans("SearchAProposal").'</td></tr>';
 	print '<tr '.$bc[$var].'>';
@@ -122,6 +123,7 @@ if ($conf->contrat->enabled && $user->rights->contrat->lire)
 {
 	$var=false;
 	print '<form method="post" action="'.DOL_URL_ROOT.'/contrat/liste.php">';
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<table class="noborder" width="100%">';
 	print '<tr class="liste_titre"><td colspan="3">'.$langs->trans("SearchAContract").'</td></tr>';
 	print '<tr '.$bc[$var].'>';
diff --git a/htdocs/comm/mailing/cibles.php b/htdocs/comm/mailing/cibles.php
index 3ad9476a92b..7b723da0320 100644
--- a/htdocs/comm/mailing/cibles.php
+++ b/htdocs/comm/mailing/cibles.php
@@ -240,7 +240,7 @@ if ($mil->fetch($_REQUEST["id"]) >= 0)
 									if (! $conf->$key->enabled || (! $user->admin && $obj->require_admin))
 									{
 										$qualified=0;
-										//print "Les pr�requis d'activation du module mailing ne sont pas respect�s. Il ne sera pas actif";
+										//print "Les prerequis d'activation du module mailing ne sont pas respectes. Il ne sera pas actif";
 										break;
 									}
 								}
@@ -251,7 +251,11 @@ if ($mil->fetch($_REQUEST["id"]) >= 0)
 									$var = !$var;
 									print '<tr '.$bc[$var].'>';
 
-									if ($mil->statut == 0) print '<form name="'.$modulename.'" action="cibles.php?action=add&rowid='.$mil->id.'&module='.$modulename.'" method="POST" enctype="multipart/form-data">';
+									if ($mil->statut == 0)
+									{
+										print '<form name="'.$modulename.'" action="cibles.php?action=add&rowid='.$mil->id.'&module='.$modulename.'" method="POST" enctype="multipart/form-data">';
+										print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+									}
 
 									print '<td>';
 									if (! $obj->picto) $obj->picto='generic';
@@ -309,6 +313,7 @@ if ($mil->fetch($_REQUEST["id"]) >= 0)
 		print '<br>';
 
 		print '<form action="cibles.php?action=clear&rowid='.$mil->id.'" method="POST">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		print_titre($langs->trans("ToClearAllRecipientsClickHere"));
 		print '<table class="noborder" width="100%">';
 		print '<tr class="liste_titre">';
@@ -324,6 +329,7 @@ if ($mil->fetch($_REQUEST["id"]) >= 0)
 	// List of selected targets
 	print "\n<!-- Liste destinataires selectionnes -->\n";
 	print '<form method="post" action="'.$_SERVER["PHP_SELF"].'">';
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<input type="hidden" name="sortfield" value="'.$sortfield.'">';
 	print '<input type="hidden" name="sortorder" value="'.$sortorder.'">';
 	print '<input type="hidden" name="id" value="'.$mil->id.'">';
diff --git a/htdocs/comm/mailing/fiche.php b/htdocs/comm/mailing/fiche.php
index d1629161a9f..2215cda898a 100644
--- a/htdocs/comm/mailing/fiche.php
+++ b/htdocs/comm/mailing/fiche.php
@@ -466,6 +466,7 @@ if ($_GET["action"] == 'create')
 {
 	// EMailing in creation mode
 	print '<form action="fiche.php" method="post">'."\n";
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<input type="hidden" name="action" value="add">';
 
 	print_fiche_titre($langs->trans("NewMailing"));
@@ -737,6 +738,7 @@ else
 			 * Mailing en mode edition
 			 */
 			print '<form action="fiche.php" method="post">'."\n";
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="update">';
 			print '<input type="hidden" name="id" value="'.$mil->id.'">';
 			print '<table class="border" width="100%">';
diff --git a/htdocs/comm/mailing/index.php b/htdocs/comm/mailing/index.php
index 73b0bdea375..4005f169b40 100644
--- a/htdocs/comm/mailing/index.php
+++ b/htdocs/comm/mailing/index.php
@@ -50,6 +50,7 @@ print '<tr><td valign="top" width="30%" class="notopnoleft">';
 // Recherche emails
 $var=false;
 print '<form method="post" action="'.DOL_URL_ROOT.'/comm/mailing/liste.php">';
+print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 print '<table class="noborder" width="100%">';
 print '<tr class="liste_titre"><td colspan="3">'.$langs->trans("SearchAMailing").'</td></tr>';
 print '<tr '.$bc[$var].'><td nowrap>';
diff --git a/htdocs/comm/multiprix.php b/htdocs/comm/multiprix.php
index ee4ab3caee8..510a26ee481 100644
--- a/htdocs/comm/multiprix.php
+++ b/htdocs/comm/multiprix.php
@@ -86,6 +86,7 @@ if ($_socid > 0)
 
 
 	print '<form method="POST" action="multiprix.php?id='.$objsoc->id.'">';
+	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<input type="hidden" name="action" value="setpricelevel">';
 	print '<table width="100%" border="0">';
 	print '<tr><td valign="top">';
diff --git a/htdocs/comm/propal.php b/htdocs/comm/propal.php
index 12342673dc8..2718169d1b1 100644
--- a/htdocs/comm/propal.php
+++ b/htdocs/comm/propal.php
@@ -974,6 +974,7 @@ if ($id > 0 || ! empty($ref))
 	if ($user->rights->propale->creer && $_GET['action'] == 'refclient')
 	{
 		print '<form action="propal.php?propalid='.$propal->id.'" method="post">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		print '<input type="hidden" name="action" value="set_ref_client">';
 		print '<input type="text" class="flat" size="20" name="ref_client" value="'.$propal->ref_client.'">';
 		print ' <input type="submit" class="button" value="'.$langs->trans('Modify').'">';
@@ -1034,6 +1035,7 @@ if ($id > 0 || ! empty($ref))
 	if ($propal->brouillon && $_GET['action'] == 'editdate')
 	{
 		print '<form name="editdate" action="'.$_SERVER["PHP_SELF"].'?propalid='.$propal->id.'" method="post">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		print '<input type="hidden" name="action" value="setdate">';
 		$html->select_date($propal->date,'re','','',0,"editdate");
 		print '<input type="submit" class="button" value="'.$langs->trans('Modify').'">';
@@ -1071,6 +1073,7 @@ if ($id > 0 || ! empty($ref))
 	if ($propal->brouillon && $_GET['action'] == 'editecheance')
 	{
 		print '<form name="editecheance" action="'.$_SERVER["PHP_SELF"].'?propalid='.$propal->id.'" method="post">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		print '<input type="hidden" name="action" value="setecheance">';
 		$html->select_date($propal->fin_validite,'ech','','','',"editecheance");
 		print '<input type="submit" class="button" value="'.$langs->trans('Modify').'">';
@@ -1103,6 +1106,7 @@ if ($id > 0 || ! empty($ref))
 	if ($_GET['action'] == 'editdate_livraison')
 	{
 		print '<form name="editdate_livraison" action="'.$_SERVER["PHP_SELF"].'?propalid='.$propal->id.'" method="post">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		print '<input type="hidden" name="action" value="setdate_livraison">';
 		$html->select_date($propal->date_livraison,'liv_','','','',"editdate_livraison");
 		print '<input type="submit" class="button" value="'.$langs->trans('Modify').'">';
@@ -1359,6 +1363,7 @@ if ($id > 0 || ! empty($ref))
 				if ($conf->global->PRODUIT_USE_MARKUP && $conf->use_javascript_ajax)
 				{
 					$formMarkup = '<form id="formMarkup" action="'.$_SERVER["PHP_SELF"].'?propalid='.$propal->id.'" method="post">'."\n";
+					$formMarkup.= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">'."\n";
 					$formMarkup.= '<table class="border" width="100%">'."\n";
 					if ($objp->fk_product > 0)
 					{
@@ -1494,6 +1499,7 @@ if ($id > 0 || ! empty($ref))
 			if ($propal->statut == 0 && $_GET["action"] == 'editline' && $user->rights->propale->creer && $_GET["lineid"] == $objp->rowid)
 			{
 				print '<form action="'.$_SERVER["PHP_SELF"].'?propalid='.$propal->id.'#'.$objp->rowid.'" method="post">';
+				print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 				print '<input type="hidden" name="action" value="updateligne">';
 				print '<input type="hidden" name="propalid" value="'.$propal->id.'">';
 				print '<input type="hidden" name="lineid" value="'.$_GET["lineid"].'">';
@@ -1594,6 +1600,7 @@ if ($id > 0 || ! empty($ref))
 
 		// Add free products/services form
 		print '<form action="'.$_SERVER["PHP_SELF"].'?propalid='.$propal->id.'#add" method="post">';
+		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		print '<input type="hidden" name="propalid" value="'.$propal->id.'">';
 		print '<input type="hidden" name="action" value="addligne">';
 
@@ -1658,6 +1665,7 @@ if ($id > 0 || ! empty($ref))
 			print '<td colspan="4">&nbsp;</td>';
 			print '</tr>';
 			print '<form id="addpredefinedproduct" action="'.$_SERVER["PHP_SELF"].'?propalid='.$propal->id.'#add" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="propalid" value="'.$propal->id.'">';
 			print '<input type="hidden" name="action" value="addligne">';
 
@@ -1710,6 +1718,7 @@ if ($id > 0 || ! empty($ref))
 		 * Formulaire cloture (signe ou non)
 		 */
 		$form_close = '<form action="'.$_SERVER["PHP_SELF"].'?propalid='.$propal->id.'" method="post">';
+		$form_close.= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		$form_close.= '<table class="border" width="100%">';
 		$form_close.= '<tr><td width="150" align="left">'.$langs->trans('Note').'</td><td align="left"><textarea cols="70" rows="'.ROWS_3.'" wrap="soft" name="note">';
 		$form_close.= $propal->note;
diff --git a/htdocs/comm/propal/contact.php b/htdocs/comm/propal/contact.php
index f3cd5134621..9beb20b4592 100644
--- a/htdocs/comm/propal/contact.php
+++ b/htdocs/comm/propal/contact.php
@@ -229,6 +229,7 @@ if ($id > 0)
 			$var = false;
 
 			print '<form action="contact.php?propalid='.$id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="addcontact">';
 			print '<input type="hidden" name="source" value="internal">';
 			print '<input type="hidden" name="propalid" value="'.$id.'">';
@@ -258,6 +259,7 @@ if ($id > 0)
 			print '</form>';
 
 			print '<form action="contact.php?propalid='.$id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="addcontact">';
 			print '<input type="hidden" name="source" value="external">';
 			print '<input type="hidden" name="propalid" value="'.$id.'">';
diff --git a/htdocs/comm/propal/note.php b/htdocs/comm/propal/note.php
index b785f7a6367..77f1b59085e 100644
--- a/htdocs/comm/propal/note.php
+++ b/htdocs/comm/propal/note.php
@@ -154,6 +154,7 @@ if ($_GET['propalid'])
 		  if ($_GET["action"] == 'edit')
 		  {
 		  	print '<form method="post" action="note.php?propalid='.$propal->id.'">';
+		  	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		    print '<input type="hidden" name="action" value="update_public">';
 		    print '<textarea name="note_public" cols="80" rows="8">'.$propal->note_public."</textarea><br>";
 		    print '<input type="submit" class="button" value="'.$langs->trans("Save").'">';
@@ -173,6 +174,7 @@ if ($_GET['propalid'])
 			  if ($_GET["action"] == 'edit')
 			  {
 			  	print '<form method="post" action="note.php?propalid='.$propal->id.'">';
+			  	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			    print '<input type="hidden" name="action" value="update">';
 			    print '<textarea name="note" cols="80" rows="8">'.$propal->note."</textarea><br>";
 			    print '<input type="submit" class="button" value="'.$langs->trans("Save").'">';
diff --git a/htdocs/comm/prospect/index.php b/htdocs/comm/prospect/index.php
index 05db92d4902..cb1934d7607 100644
--- a/htdocs/comm/prospect/index.php
+++ b/htdocs/comm/prospect/index.php
@@ -55,6 +55,7 @@ if ($conf->propal->enabled)
   $var=false;
   print '<table class="noborder" width="100%">';
   print '<form method="post" action="'.DOL_URL_ROOT.'/comm/propal.php">';
+  print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
   print '<tr class="liste_titre"><td colspan="3">'.$langs->trans("SearchAProposal").'</td></tr>';
   print '<tr '.$bc[$var].'><td>';
   print $langs->trans("Ref").':</td><td><input type="text" class="flat" name="sf_ref" size="18"></td><td rowspan="2"><input type="submit" value="'.$langs->trans("Search").'" class="button"></td></tr>';
diff --git a/htdocs/comm/remise.php b/htdocs/comm/remise.php
index 97c77fc8966..f61fdebd14b 100644
--- a/htdocs/comm/remise.php
+++ b/htdocs/comm/remise.php
@@ -96,6 +96,7 @@ if ($_socid > 0)
      *
      */
     print '<form method="POST" action="remise.php?id='.$objsoc->id.'">';
+    print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
     print '<input type="hidden" name="action" value="setremise">';
     print '<table width="100%" border="0">';
     print '<tr><td valign="top">';
diff --git a/htdocs/comm/remx.php b/htdocs/comm/remx.php
index 95bb336eeb6..d801e111263 100644
--- a/htdocs/comm/remx.php
+++ b/htdocs/comm/remx.php
@@ -127,6 +127,7 @@ if ($_socid > 0)
 
 
     print '<form method="POST" action="remx.php?id='.$objsoc->id.'">';
+    print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
     print '<input type="hidden" name="action" value="setremise">';
 
     print '<table class="border" width="100%">';
diff --git a/htdocs/commande/contact.php b/htdocs/commande/contact.php
index 1562fe17a2f..ab8acab7dba 100644
--- a/htdocs/commande/contact.php
+++ b/htdocs/commande/contact.php
@@ -228,6 +228,7 @@ if ($id > 0 || ! empty($ref))
 			$var = false;
 
 			print '<form action="contact.php?id='.$id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="addcontact">';
 			print '<input type="hidden" name="source" value="internal">';
 			print '<input type="hidden" name="id" value="'.$id.'">';
@@ -256,6 +257,7 @@ if ($id > 0 || ! empty($ref))
 			print '</form>';
 
 			print '<form action="contact.php?id='.$id.'" method="post">';
+			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 			print '<input type="hidden" name="action" value="addcontact">';
 			print '<input type="hidden" name="source" value="external">';
 			print '<input type="hidden" name="id" value="'.$id.'">';