From 9f3ebef35b65bd69f092d2d5fd5a5a1ebaa230ad Mon Sep 17 00:00:00 2001
From: Thibaud Guillot <thibaud.guillot@biblibre.com>
Date: Mon, 10 Jun 2024 12:15:03 +0200
Subject: [PATCH] Bug 36789: (follow-up) Fix CSRF Token missing

Sponsored-by: LMS Cloud <https://www.lmscloud.de/>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Olivier V <olivier.vezina@inLibro.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 087ffd0eeac8fb0d1939aa5f15ed4bf3ca25c2e0)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt
index e385fa57bd..796308b53e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt
@@ -403,6 +403,7 @@
                             );
                             result += `
                                 <form name="checkout-transform" method="post" action="/cgi-bin/koha/circ/circulation.pl?borrowernumber=%s">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="cud-checkout"/>
                                     <input type="hidden" name="borrowernumber" value="%s"/>
                                     <input type="hidden" name="barcode" value="%s"/>