diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc
index 4fabdd4c34..7403c312db 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc
@@ -3,6 +3,7 @@
     <div class="tab-content">
         <div id="supplier_search" role="tabpanel" class="tab-pane active">
             <form name="findsupplier" action="/cgi-bin/koha/acqui/booksellers.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="supplier"><span class="control-text">Vendor search</span> <i class="fa fa-fw fa-upload" aria-hidden="true"></i></label>
                 </div>
@@ -16,6 +17,7 @@
 
         <div id="orders_search" role="tabpanel" class="tab-pane">
             <form action="/cgi-bin/koha/acqui/histsearch.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="order_title"><span class="control-text">Orders search</span> <i class="fa fa-fw fa-download" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
index 6e21f70ce4..a93fe8c66c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
@@ -24,6 +24,7 @@
                 [% UNLESS ( basketcount OR subscriptioncount ) %]
                     <div class="btn-group">
                         <form action="/cgi-bin/koha/acqui/supplier.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete" />
                             <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                             <button class="btn btn-default" id="deletesupplier" type="submit"><i class="fa fa-trash-can"></i> Delete vendor</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc
index a422246986..f8267a45a9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc
@@ -6,6 +6,7 @@
     <div class="tab-content">
         <div id="budgets_search" role="tabpanel" class="tab-pane active">
             <form action="/cgi-bin/koha/admin/aqbudgets.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
 
                 <div class="form-title">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search-box.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search-box.inc
index a8a03d7b5d..1565d098b5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search-box.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search-box.inc
@@ -6,6 +6,7 @@
         <div id="checkin_search" role="tabpanel" class="tab-pane">
     [% END %]
         <form method="post" action="/cgi-bin/koha/circ/returns.pl" autocomplete="off">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="form-title">
                 <label class="control-label" for="ret_barcode"><span class="control-text">Check in</span> <i class="fa fa-fw fa-download" aria-hidden="true"></i></label>
             </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc
index 9efd8065d9..69beb57d1c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc
@@ -16,6 +16,7 @@
         </p>
     </div>
     <form name="issues" action="/cgi-bin/koha/tools/export.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <table id="issues-table" style="width: 100% !Important; display: none;">
             <thead>
                 <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc
index f389a64614..66ce3e7b2e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="city_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="city_name_filter"><span class="control-text">Search cities</span> <i class="fa fa-fw fa-building" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc
index 5cbf959059..31ab12cab2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="contract_description_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="searchfield"><span class="control-text">Search contracts</span> <i class="fa-solid fa-fw fa-pen-to-square" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc
index 9b51f4fa70..d7a5b4d824 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="currency_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="description"><span class="control-text">Search currencies</span> <i class="fa-solid fa-fw fa-dollar-sign" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/desks-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/desks-admin-search.inc
index 4d017c588c..7a769b4d52 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/desks-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/desks-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="desk_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name|html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="search_desk_name"><span class="control-text">Search desks</span> <i class="fa fa-fw fa-desktop" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc
index dc7e109227..0237ba3cdb 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="notices_search" role="tabpanel" class="tab-pane active">
             <form action="/cgi-bin/koha/tools/letter.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="searchfield"><span class="control-text">Search notices</span> <i class="fa-solid fa-fw fa-comment-dots" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-share-report.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-share-report.inc
index a181062892..3ddf2c6fa7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-share-report.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-share-report.inc
@@ -2,6 +2,7 @@
     <div class="modal-dialog modal-wide" role="document">
         <div class="modal-content">
             <form method="post" id="mana_share_form" action="/cgi-bin/koha/reports/guided_reports.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
                     <h3 id="mana_share_modal_label">Share with Mana</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/member-search-box.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/member-search-box.inc
index 517906860d..368215c1f8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/member-search-box.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/member-search-box.inc
@@ -11,6 +11,7 @@
         <div id="patron_search" role="tabpanel" class="tab-pane">
     [% END %]
         <form method="post" action="/cgi-bin/koha/members/member.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="quicksearch" value="1" />
 
             <div class="form-title">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
index dcf3eab648..dfabf98fa0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
@@ -119,6 +119,7 @@
     <div class="modal-dialog">
         <div class="modal-content">
             <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-header">
                     <h3>Leave a message</h3>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cataloguing_create_av.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cataloguing_create_av.inc
index 0618474740..abdc4b3f97 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cataloguing_create_av.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cataloguing_create_av.inc
@@ -6,6 +6,7 @@
                 <h3 id="avCreateLabel">Create a new authorized value</h3>
             </div>
             <form id="add_new_av" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                     <fieldset class="rows">
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc
index 74e9be3e35..17035f431c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc
@@ -2,6 +2,7 @@
     <div class="modal-dialog">
         <div class="modal-content">
             <form action="/cgi-bin/koha/serials/serials-collection.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                     <fieldset class="rows">
                         <legend>Multi receiving</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-detail-tabs.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-detail-tabs.inc
index 8b4659064b..5f6b763d00 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-detail-tabs.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-detail-tabs.inc
@@ -150,6 +150,7 @@
             [% WRAPPER tab_panel tabname="holds" %]
                 [% IF ( holds_count ) %]
                     <form action="/cgi-bin/koha/reserve/modrequest.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="from" value="circ" />
                         <table id="holds-table" style="width: 100% !Important;">
                             <thead>
@@ -188,6 +189,7 @@
 
                     [% IF Koha.Preference('SuspendHoldsIntranet') %]
                         <form action="/cgi-bin/koha/reserve/modrequest_suspendall.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="action">
                                 <input type="hidden" name="from" value="[% patronpage | html %]" />
                                 <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
@@ -202,6 +204,7 @@
                         </form>
 
                         <form action="/cgi-bin/koha/reserve/modrequest_suspendall.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="action">
                                 <input type="hidden" name="from" value="borrower" />
                                 <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
index cd5b4b2d99..9b95aae636 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
@@ -54,6 +54,7 @@
 [% IF CAN_user_borrowers_edit_borrowers && CAN_user_circulate_manage_restrictions %]
     <p><a href="#" id="add_manual_restriction"><i class="fa fa-plus"></i> Add manual restriction</a></p>
     <form method="post" action="/cgi-bin/koha/members/mod_debarment.pl" class="clearfix">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
         <input type="hidden" name="action" value="add" />
         <fieldset class="rows" id="manual_restriction_form">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc
index 2e616a532b..2dc39f81c4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc
@@ -6,6 +6,7 @@
         <div id="circ_search" role="tabpanel" class="tab-pane">
     [% END %]
         <form action="/cgi-bin/koha/circ/circulation.pl" id="patronsearch" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="form-title">
                 <label class="control-label" for="findborrower"><span class="control-text">Check out</span> <i class="fa fa-fw fa-upload" aria-hidden="true"></i></label>
             </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
index 75469d214f..2754bffb97 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
@@ -338,6 +338,7 @@
             <div class="modal-dialog">
                 <div class="modal-content">
                     <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="message_id" value="[% pm.message_id | html %]"/>
                         <div class="modal-header">
                             <h3>Edit message</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc
index 9ad20aa713..3275d24520 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="patron_category_search" role="tabpanel" class="tab-pane active">
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="category_search"><span class="control-text">Search patron categories</span> <i class="fa fa-fw fa-id-card" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/preservation-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/preservation-search.inc
index b02dd79a49..f3d2655bb9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/preservation-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/preservation-search.inc
@@ -3,6 +3,7 @@
 <div id="header_search">
     <div id="preservation_search" class="residentsearch">
         <form name="find_stuff" action="/cgi-bin/koha/preservation/home.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <span class="form-title">
                 <label class="control-label">Preservation search</label>
             </span>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/renew-search-box.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/renew-search-box.inc
index 027d0f9eb2..ccd148026c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/renew-search-box.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/renew-search-box.inc
@@ -6,6 +6,7 @@
         <div id="renew_search" role="tabpanel" class="tab-pane">
     [% END %]
         <form method="post" action="/cgi-bin/koha/circ/renew.pl" autocomplete="off">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="form-title">
                 <label class="control-label" for="ren_barcode"><span class="control-text">Renew</span> <i class="fa fa-fw fa-retweet" aria-hidden="true"></i></label>
             </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/waiting_holds.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/waiting_holds.inc
index 484f1d609b..03644ba2b3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/waiting_holds.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/waiting_holds.inc
@@ -67,6 +67,7 @@
                 <td>[% reserveloo.item.enumchron | html %]</td>
                 <td>
                     <form name="cancelReserve" action="waitingreserves.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="borrowernumber" value="[% reserveloo.borrower.borrowernumber | html %]" />
                         <input type="hidden" name="itemnumber" value="[% reserveloo.item.itemnumber | html %]" />
                         <input type="hidden" name="fbr" value="[% reserveloo.item.holdingbranch | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc
index 671eb3552a..1519bbbb68 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc
@@ -4,6 +4,7 @@
     <div class="tab-content">
         <div id="z3950_search" role="tabpanel" class="tab-pane active">
             <form action="/cgi-bin/koha/admin/z3950servers.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="form-title">
                     <label class="control-label" for="searchfield"><span class="control-text">Search Z39.50/SRU servers</span> <i class="fa fa-fw fa-search" aria-hidden="true"></i></label>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt
index bba246c216..ebeb0e1b9c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt
@@ -55,6 +55,7 @@
     <fieldset>
         <legend>Manage orders</legend>
         <form name="findsupplier" action="/cgi-bin/koha/acqui/booksellers.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <p><label for="supplierpage">Vendor: </label><input type="text" size="25" name="supplier" id="supplierpage" class="focus" />
             <input type="submit" class="btn btn-primary" value="Search" />
             </p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt
index 46ac8d5714..4318829b3e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt
@@ -15,6 +15,7 @@
     <div class="container-fluid">
       [% IF (not_enough_budget) %]
         <form action="/cgi-bin/koha/acqui/addorder.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
           [% FOREACH var IN vars_loop %]
             [% FOREACH val IN var.values %]
               <input type="hidden" name="[% var.name | html %]" value="[% val | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt
index fd597918e9..eb996c903a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt
@@ -94,6 +94,7 @@
                         ([% file_name | html %] staged on [% upload_timestamp | $KohaDates  with_hours => 1 %])
                     </h1>
                     <form action="/cgi-bin/koha/acqui/addorderiso2709.pl" method="post" id="Aform" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% WRAPPER tabs id= "tabs" %]
                             [% WRAPPER tabs_nav %]
                                 [% WRAPPER tab_item tabname= "records_to_import" bt_active= 1 %] <span>Select to import</span> [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
index 21c0351f1a..b602162d7f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
@@ -107,6 +107,7 @@
                                         [% IF ( active && books_loop ) %]
                                             <div class="btn-group">
                                                 <form action="/cgi-bin/koha/acqui/basket.pl" method="post">
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="op" value="email" />
                                                     <input type="hidden" name="basketno" value="[% basketno | html %]" />
                                                     <button type="submit" class="btn btn-default" id="emailvendorbutton"><i class="fa-solid fa-envelope"></i> E-mail order</button>
@@ -310,6 +311,7 @@
                                                     <ol>
                                                         <li id="managedby">
                                                             <form action="/cgi-bin/koha/acqui/basket.pl" method="post">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <span class="label">[% tp('Acquisitions basket managed by user', 'Managed by:') | html %]</span>
                                                                 <div style="display:inline-block">
                                                                     <ul id="users_names" style="padding-left:0">
@@ -348,6 +350,7 @@
                                                                 <span class="label">&nbsp;</span>
                                                                 <div>
                                                                     <form action="/cgi-bin/koha/acqui/basket.pl" method="post">
+                                                                        [% INCLUDE 'csrf-token.inc' %]
                                                                         <select id="select_managing_library" name="branch">
                                                                             <option value="">(no library)</option>
                                                                             [% FOREACH branch IN branches_loop %]
@@ -407,6 +410,7 @@
                                                                     <span class="label">&nbsp;</span>
                                                                     <div style="float:left">
                                                                         <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="post">
+                                                                            [% INCLUDE 'csrf-token.inc' %]
                                                                             <select id="basketgroupid" name="basketgroupid">
                                                                                 <option value="">No group</option>
                                                                                 [% FOREACH bg IN basketgroups %]
@@ -914,6 +918,7 @@
     <div class="modal" id="noteEditor" tabindex="-1" role="dialog" aria-labelledby="noteEditorLabel">
         <div class="modal-dialog" role="document">
             <form id="modify_order_notes" action="/cgi-bin/koha/acqui/modordernotes.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-content">
                     <div class="modal-header">
                         <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
@@ -938,6 +943,7 @@
     <div class="modal" id="dateEditor" tabindex="-1" role="dialog" aria-labelledby="dateEditorLabel">
         <div class="modal-dialog" role="document">
             <form id="modify_estimated_delivery_date" action="/cgi-bin/koha/acqui/moddeliverydate.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-content">
                     <div class="modal-header">
                         <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt
index d185496761..2b8121cbb9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt
@@ -122,6 +122,7 @@
                             <div class="col-xs-6 col-xs-pull-6">
                         [% END %]
                             <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="post" id="groupingform">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset id="various" class="brief">
                                     <ol>
                                         [% UNLESS (closedbg) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
index 8681745787..2010cc5717 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
@@ -57,6 +57,7 @@
         [% ELSE %]<h1>Add a basket to [% booksellername | html %]</h1>
         [% END %]
     <form name="Aform" action="[% script_name | html %]" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
         <fieldset class="rows">
             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt
index fe7e543946..30f8721053 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt
@@ -36,6 +36,7 @@
 
       [% UNLESS ( confirmcancel ) %]
       <form method="post" action="">
+          [% INCLUDE 'csrf-token.inc' %]
         <div class="dialog alert">
           <h1>Are you sure you want to cancel this order ([% ordernumber | html %])</h1>
           <p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt
index 6a1f25c222..41cb0e9ec8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt
@@ -55,6 +55,7 @@
 
 [% IF op == 'search' || op == 'select' %]
 <form action="/cgi-bin/koha/acqui/duplicate_orders.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
         <legend>
             [% IF op == 'search' %]
@@ -137,6 +138,7 @@
 
 [% IF op == 'select' && ( result_order_loop || selected_order_loop ) %]
 <form method="post" action="/cgi-bin/koha/acqui/duplicate_orders.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     <div id="orders_to_copy" class="page-section">
         <table id="table_orders">
             <caption>
@@ -184,6 +186,7 @@
 [% ELSIF op == "batch_edit" %]
 
 <form method="post" action="/cgi-bin/koha/acqui/duplicate_orders.pl" id="batch_edit_form">
+    [% INCLUDE 'csrf-token.inc' %]
     <div id="accounting_details">
       <p>Duplicate all the orders with the following accounting details:</p>
       <fieldset class="rows" style="float:none;">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt
index 4962dcad01..02e82bef3e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt
@@ -203,6 +203,7 @@
 
 [% BLOCK filter_form %]
     <form action="/cgi-bin/koha/acqui/histsearch.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         [% IF ( context == "sidebar" ) %]
             <fieldset class="brief">
                 <h4>Search orders</h4>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
index aacd5ad161..5d8ba29298 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
@@ -90,6 +90,7 @@
       [% IF invoiceid %]
           <br />
           <form method="post" action="/cgi-bin/koha/acqui/invoice-files.pl" enctype="multipart/form-data">
+              [% INCLUDE 'csrf-token.inc' %]
               <fieldset class="rows">
                   <legend>Upload new file</legend>
                   <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
index 267581e4c6..31affe4ae1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
@@ -61,6 +61,7 @@
                 <p>Vendor: <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | uri %]">[% suppliername | html %]</a></p>
 
                 <form action="/cgi-bin/koha/acqui/invoice.pl" method="post" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <ol>
                             <li>
@@ -147,6 +148,7 @@
                 </form>
 
                 <form action="/cgi-bin/koha/acqui/invoice.pl" method="post" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <input type="hidden" name="invoiceid" value="[% invoiceid | html %]" />
                         <h3>Adjustments</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
index 16108eb8eb..302c6b379a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
@@ -167,6 +167,7 @@
 
                         <div id="merge_invoices">
                             <form id="merge_invoice_form" class="validated" action="/cgi-bin/koha/acqui/invoice.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="rows">
                                     <ol>
                                         <li><h2>Merge invoices</h2></li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
index 8f697d259c..0cd37c6509 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
@@ -54,6 +54,7 @@
 [% END %]
 [% IF lateorders.size %]
 <form action="lateorders.pl" name="claim" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="send_alert" />
   <input type="hidden" name="delay" value="[% delay | html %]" />
   <input type="hidden" name="booksellerid" value="[% bookseller_filter.id | html %]" />
@@ -280,6 +281,7 @@
 <div class="modal" id="noteEditor" tabindex="-1" role="dialog" aria-labelledby="noteEditorLabel">
     <div class="modal-dialog" role="document">
         <form id="modify_order_notes" action="/cgi-bin/koha/acqui/modordernotes.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="modal-content">
                 <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
@@ -304,6 +306,7 @@
 <div class="modal" id="dateEditor" tabindex="-1" role="dialog" aria-labelledby="dateEditorLabel">
     <div class="modal-dialog" role="document">
         <form id="modify_estimated_delivery_date" action="/cgi-bin/koha/acqui/moddeliverydate.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="modal-content">
                 <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/moddeliverydate.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/moddeliverydate.tt
index a0c1aaa628..5647e2906b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/moddeliverydate.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/moddeliverydate.tt
@@ -38,6 +38,7 @@
 
       <h1>Change estimated delivery date</h1>
       <form action="/cgi-bin/koha/acqui/moddeliverydate.pl" method="post">
+          [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="brief">
           <label for="estimated_delivery_date">Estimated delivery date:</label>
           <input type="text" id="estimated_delivery_date" size="10" name="estimated_delivery_date" class="flatpickr" value="[% estimated_delivery_date | html %]"/>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt
index 2bbf17e99a..14df54e385 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt
@@ -48,6 +48,7 @@
           <h1>Change order internal note (order no. [% ordernumber | html %])</h1>
       [% END %]
       <form action="/cgi-bin/koha/acqui/modordernotes.pl" method="post">
+          [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="brief">
           <label for="ordernotes">Note:</label>
           <textarea id="ordernotes" name="ordernotes" rows="3" cols="30" class="focus">[% ordernotes | html %]</textarea>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
index 592c5411a8..11477fe3e7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
@@ -295,6 +295,7 @@
         [% IF ( creationdate ) %]<li><span class="label">Open on:</span>  [% creationdate | $KohaDates %]</li>[% END %]
         [% IF ( closedate ) %]
         <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
         <li><span class="label">Closed on:</span>  [% closedate | $KohaDates %]</li>
         [% IF ( basketgroups ) %]
             <li>Basketgroup: <select id="basketgroupid" name="basketgroupid">
@@ -320,6 +321,7 @@
 [% END %]
 
 <form action="/cgi-bin/koha/acqui/addorder.pl" method="post" class="validated noEnterSubmit" id="Aform" onsubmit="return Check(this);" >
+    [% INCLUDE 'csrf-token.inc' %]
 
     <fieldset class="rows">
         <legend>Patrons</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
index 73cf9f7220..118cceb8f3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
@@ -199,6 +199,7 @@
 [% UNLESS ( enter ) %][% INCLUDE 'acquisitions-toolbar.inc' %][% END %]
 [% IF ( enter ) %]
     <form action="updatesupplier.pl" name="updatesupplier" style="display:block" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <div id="toolbar" class="btn-toolbar">
             <button class="btn btn-primary" type="submit"><i class="fa fa-save"></i> Save</button>
             [% IF ( booksellerid ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt
index 73459473f3..b0e8b80aec 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt
@@ -89,6 +89,7 @@
         <div class="page-section">
             <h2>Order lines with uncertain prices</h2>
             <form action="[% scriptname | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                 <label for="owner">Orders from:</label>
                 <select id="owner" name="owner">
@@ -104,6 +105,7 @@
             </form>
         </div> <!-- /.page-section -->
         <form action="[% scriptname | html %]" method="post" id="uncertainprices">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                 <input type="hidden" name="op" value="validate" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt
index 9d200dc686..6d50358680 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt
@@ -93,6 +93,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/acqui/vendor_issues.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="booksellerid" value="[% vendor.id | html %]" />
         <input type="hidden" name="issue_id" value="[% issue.issue_id| html %]" />
@@ -134,6 +135,7 @@
     <div class="dialog alert">
         <h1>Delete issue [% issue.issue_id | html %]?</h1>
         <form action="/cgi-bin/koha/acqui/vendor_issues.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="issue_id" value="[% issue.issue_id | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt
index 27a6793b87..afa5344e0b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt
@@ -83,6 +83,7 @@ tr.selected td {
     [% INCLUDE 'messages.inc' %]
       [% IF ( opsearch ) %]
     <form method="post" action="z3950_search.pl" name="f" class="checkboxed">
+        [% INCLUDE 'csrf-token.inc' %]
     <div class="row">
     <div class="col-sm-6">
     <h1>Order from external source</h1>
@@ -247,6 +248,7 @@ tr.selected td {
     </div>
 
     <form method="post" action="z3950_search.pl" id="page_form" name="page_form" class="checkboxed">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" id="op" value="do_search" />
         <input type="hidden" name="current_page" id="current_page" value="[% current_page | html %]" />
         <input type="hidden" id="searchtitle"  name="title" value="[% title | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
index 4193541ce2..a16d0ad73d 100755
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
@@ -197,6 +197,7 @@
             <h1>[% tx("New field for table '{table_name}'", { table_name = tablename } ) | html %]</h1>
         [% END %]
         <form action="" name="add_form" id="add_field" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <ol>
                     <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
index d5582effc2..07843d3347 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
@@ -57,6 +57,7 @@
             <div class="col-md-6 sysprefs">
             [% IF ( CAN_user_parameters_manage_sysprefs ) %]
                 <form action="/cgi-bin/koha/admin/preferences.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                 <fieldset>
                     <h4><a href="/cgi-bin/koha/admin/preferences.pl">System preferences</a></h4>
                     <p>Manage system preferences like MARC flavor, date format, administrator email, and templates.</p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/adveditorshortcuts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/adveditorshortcuts.tt
index ff8d2333ac..4e44a18b0d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/adveditorshortcuts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/adveditorshortcuts.tt
@@ -45,6 +45,7 @@
                     </ul>
 
                     <form id="adveditor_shortcuts" method="post" action="/cgi-bin/koha/admin/adveditorshortcuts.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset>
                         <input type=hidden name="op" value="save" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt
index 97ffbf3030..25c53bac45 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt
@@ -156,6 +156,7 @@
 [% IF ( duplicate_form ) %]
 <h1>Duplicate budget</h1>
 <form action="/cgi-bin/koha/admin/aqbudgetperiods.pl" id="add_modify_budget" name="f" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <input type="hidden" name="op" value="duplicate_budget" />
     <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
@@ -225,6 +226,7 @@
         <h1>New budget</h1>
 	[% END %]
 <form action="/cgi-bin/koha/admin/aqbudgetperiods.pl" id="add_modify_budget" name="f" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <!-- ################################################################################# -->
     <!-- display information about the budget period that must be added or modified -->
@@ -317,11 +319,13 @@
     <!-- ############################################################# -->
 
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="delete_confirmed" />
         <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
         <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
     </form>
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not delete</button>
     </form>
     [% END %]
@@ -368,6 +372,7 @@
           </tbody>
         </table>
         <form action="/cgi-bin/koha/admin/aqbudgetperiods.pl" name="f" method="post" id="move_form">
+            [% INCLUDE 'csrf-token.inc' %]
           <fieldset class="rows">
             <ol>
               <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt
index c8061602be..923daefcdd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt
@@ -278,6 +278,7 @@
 <!-- create add/mod entry form -->
 [% IF op == 'add_form' && !error_not_authorised_to_modify %]
 <form action="/cgi-bin/koha/admin/aqbudgets.pl" id="edit_fund" name="Aform" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <h1>
         [% IF ( budget_id ) %]
             [% IF ( budget_period_description ) %]
@@ -468,6 +469,7 @@
         </table>
 
         <form action="/cgi-bin/koha/admin/aqbudgets.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="budget_id" value="[% budget_id | html %]" />
             <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt
index a0ed2187f5..56957f6834 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt
@@ -103,6 +103,7 @@
             [% IF ( add_form ) %]
                 <div class="page-section">
                     <form name="Aform" action="/cgi-bin/koha/admin/aqcontract.pl" id="add_modify_contract" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_validate" />
                         <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                         <input type="hidden" name="checked" value="0" />
@@ -147,6 +148,7 @@
             [% IF ( add_validate ) %]
                 <h1>Data recorded</h1>
                 <form action="[% script_name | html %]" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="submit" class="btn btn-primary" value="OK" />
                 </form>
             [% END %]
@@ -162,6 +164,7 @@
                             <tr><th scope="row">Vendor:</th><td>[% booksellername | html %]</td></tr>
                         </table>
                         <form action="[% script_name | html %]" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_confirmed" />
                             <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                             <input type="hidden" name="contractnumber" value="[% contractnumber | html %]" />
@@ -177,6 +180,7 @@
             [% IF ( delete_confirmed ) %]
                 <h1>Contract deleted</h1>
                 <form action="[% script_name | html %]" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                     <input type="submit" class="btn btn-primary" value="OK" />
                 </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt
index 2636b67f86..b0b30049c9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt
@@ -47,6 +47,7 @@
 [% INCLUDE 'budgets-admin-toolbar.inc' %]
 
 <form method="post" id="Aform" name="Aform"  action="/cgi-bin/koha/admin/aqplan.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <h1>[% PROCESS planning plan=authcat %]</h1>
 <input type="hidden" name="authcat" value="[% authcat | html %]" />
 <!-- Budget Lines -->
@@ -203,6 +204,7 @@
             <aside>
 
 <form method="post" action="/cgi-bin/koha/admin/aqplan.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
 <fieldset class="brief">
 <h4>Filter</h4>
@@ -263,6 +265,7 @@
 </form>
 [% IF ( budget_lines ) %]
 <form method="post" action="/cgi-bin/koha/admin/aqplan.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="brief">
 <h4>Export</h4>
     <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt
index 4adfa01082..afed6a17db 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt
@@ -40,6 +40,7 @@
 
 
                 <form id="new-alert-form" action="audio_alerts.pl" method="post" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <h1><span class="create-alert">New alert</span><span class="edit-alert">Edit alert</span></h1>
                     <fieldset class="rows">
                         <legend class="sr-only">Audio alert details</legend>
@@ -89,6 +90,7 @@
                 </form>
 
                 <form id="delete-alert-form" action="audio_alerts.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <h1>Audio alerts</h1>
                     [%IF !( Koha.Preference('AudioAlerts') ) %]
                         <div class="dialog alert">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt
index 14873dfdb9..9119f5928d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt
@@ -101,6 +101,7 @@
     [% ELSE %][% action | html %][% END %]</h1>
     <div class="hint">You can drag and drop the subfield tabs to change the order.</div>
     <form action="[% script_name | html %]" name="Aform" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
         <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
@@ -303,6 +304,7 @@
     <div class="dialog alert">
         <h1>Confirm deletion of subfield <span class="ex">'[% ass.tagsubfield | html %]'?</span></h1>
         <form action="[% delete_link | html %]" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <table>
                 <tr><th scope="row">Subfield:</th> <td>[% ass.tagsubfield | html %]</td></tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
index e867aeba5b..3d69d6dd0d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
@@ -138,6 +138,7 @@
         [% END %]
     </h2>
     <form action="[% script_name | html %]" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         [% IF ( heading_modify_tag_p ) %]<input type="hidden" name="modif" value="1" />[% END %]
         <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
@@ -193,6 +194,7 @@
     <div class="dialog alert">
         <h3>[% tx("Confirm deletion of tag '{searchfield}'", { searchfield = searchfield }) | html %]</h3>
         <form action="[% script_name | html %]" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <table>
                 <tr><th scope="row">Tag: </th><td>[% searchfield | html %] [% liblibrarian | html %]</td></tr>
             </table>
@@ -211,6 +213,7 @@
 
   <div class="dialog message">  <h3>Data deleted</h3>
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
     <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
     <input type="submit" value="OK" class="btn btn-primary" />
@@ -219,6 +222,7 @@
 [% IF ( authtype_create ) %]
 
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="authtype_create_confirm" />
         <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
         Create authority framework for [% authtypecode | html %] using
@@ -239,6 +243,7 @@
 [% IF ( else ) %]
 
 <form action="[% script_name | html %]" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset>
         <label for="searchfield"><strong>Search for tag:</strong></label>
         <input type="text" id="searchfield" name="searchfield" size="4" value="[% searchfield | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
index 8ae422c444..4d6af5e555 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
@@ -124,6 +124,7 @@
                     [% END %]
 
                     <form action="/cgi-bin/koha/admin/authorised_values.pl" name="Aform" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             [% IF action_add_category %]
                                 <ol>
@@ -312,6 +313,7 @@
                                 </form>
                                 [% UNLESS category.is_system %]
                                     <form id="delete_category" action="/cgi-bin/koha/admin/authorised_values.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="op" value="delete_category" />
                                         <input type="hidden" name="category_name" value="[% category.category_name | html %]" />
                                         <button type="submit"><i class="fa fa-plus"></i> Delete category '[% category.category_name | html %]' </button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt
index 363ec906c0..f4ba89d2ec 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt
@@ -106,6 +106,7 @@
 
 [% IF op == 'add_form' %]
     <form action="/cgi-bin/koha/admin/authtypes.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <h1>
             [% IF authority_type.authtypecode.defined %]
                 [% IF authority_type.authtypecode %]
@@ -172,6 +173,7 @@
         [% ELSE %]
             <h1>Confirm deletion of authority structure definition for <span class="ex">'[% authority_type.authtypetext | html %]' ([% authority_type.authtypecode | html %])</span></h1>
             <form action="/cgi-bin/koha/admin/authtypes.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <input type="hidden" name="authtypecode" value="[% authority_type.authtypecode | html %]" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
@@ -258,6 +260,7 @@
                                     <h3 id="importLabelexportModal_[% authority_type.authtypecode | html %][% loop.count | html %]">Import [% authority_type.authtypecode | html %] authority type (fields and subfields) from a spreadsheet file (.csv, .ods)</h3>
                                 </div>
                                 <form action="/cgi-bin/koha/admin/import_export_authtype.pl" name="form_i_[% authority_type.authtypecode | html %]" id="form_i_[% authority_type.authtypecode | html %]" method="post" enctype="multipart/form-data" class="form_import">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <div class="modal-body">
                                         <input type="hidden" name="authtypecode" value="[% authority_type.authtypecode | html %]" />
                                         <input type="hidden" name="action" value="import" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
index 7d56a02cef..4dc21ee892 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
@@ -115,6 +115,7 @@
         [% END %]
     </h1>
     <form action="/cgi-bin/koha/admin/biblio_framework.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <fieldset class="rows">
             <ol>
@@ -156,6 +157,7 @@
         [% ELSE %]
             <h1>[% tx("Confirm deletion of framework '{framework}' ({frameworkcode})?", { framework = framework.frameworktext, frameworkcode = framework.frameworkcode }) | html %]</h1>
             <form class="inline" action="/cgi-bin/koha/admin/biblio_framework.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this framework</button>
@@ -229,6 +231,7 @@
                         <h1 id="importLabelexportModal_[% framework.frameworkcode | html %][% frameworks.count | html %]">Import default framework structure (fields and subfields) from a spreadsheet file (.csv or .ods)</h1>
                     </div> <!-- /.modal-header -->
                     <form action="/cgi-bin/koha/admin/import_export_framework.pl" name="form_i_default" id="form_i_default" method="post" enctype="multipart/form-data" class="form_import">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="modal-body">
                             <input type="hidden" name="frameworkcode" value="default" />
                             <input type="hidden" name="action" value="import" />
@@ -299,6 +302,7 @@
                             <h1 id="importLabelexportModal_[% loo.frameworkcode | html %][% loop.count | html %]">Import [% loo.frameworkcode | html %] framework structure (fields and subfields) from a spreadsheet file (.csv or .ods)</h1>
                         </div> <!-- /.modal-header -->
                         <form action="/cgi-bin/koha/admin/import_export_framework.pl" name="form_i_[% loo.frameworkcode | html %]" id="form_i_[% loo.frameworkcode | html %]" method="post" enctype="multipart/form-data" class="form_import">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <div class="modal-body">
                                 <input type="hidden" name="frameworkcode" value="[% loo.frameworkcode | html %]" />
                                 <input type="hidden" name="action" value="import" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt
index b50f41a360..8c304cc598 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt
@@ -65,6 +65,7 @@
     [% END %]
 
     <form method="post" action="branch_transfer_limits.pl">
+        [% INCLUDE 'csrf-token.inc' %]
         [% WRAPPER tab_panels %]
             [% FOREACH codes_loo IN codes_loop %]
                 [% WRAPPER tab_panel tabname=codes_loo.code %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
index 6fdb1ad4f1..7a15a00d6b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
@@ -127,6 +127,7 @@
         [% END %]
     </h1>
     <form action="/cgi-bin/koha/admin/branches.pl" id="Aform" name="Aform" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <input type="hidden" name="op" value="add_validate" />
             [% IF library %]
@@ -318,6 +319,7 @@
 [% IF op == 'delete_confirm' and not ( items_count or patrons_count )%]
     <div class="dialog alert">
         <form action="/cgi-bin/koha/admin/branches.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <h1>Are you sure you want to delete [% library.branchname | html %] ([% library.branchcode | html %])?</h1>
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="branchcode" value="[% library.branchcode | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt
index 1e3ef0a323..a36904e864 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt
@@ -103,6 +103,7 @@
                     [% END %]
                 </h1>
                 <form action="/cgi-bin/koha/admin/cash_registers.pl" id="Aform" name="Aform" class="validated" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
 
                     <fieldset class="rows">
                         <input type="hidden" name="op" value="add_validate" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
index 766e6e80e7..701162af19 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
@@ -115,6 +115,7 @@
 
 [% IF op == 'add_form' %]
     <form id="category_form" action="/cgi-bin/koha/admin/categories.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="checked" value="0" />
         [% IF category %]
@@ -529,6 +530,7 @@
     </div> <!-- /.page-section -->
 
     <form action="/cgi-bin/koha/admin/categories.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="action">
             [% IF patrons_in_category > 0 %]
                 <input type="submit" class="btn btn-primary" value="OK" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
index a050556617..28e9f6c55f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
@@ -102,6 +102,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/admin/cities.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="cityid" value="[% city.cityid | html %]" />
 
@@ -159,6 +160,7 @@
             </tr>
         </table>
         <form action="/cgi-bin/koha/admin/cities.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="cityid" value="[% city.cityid | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt
index 51f62b73f9..9537fcc75d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt
@@ -149,6 +149,7 @@
 <h1>New classification source</h1>
   [% END %]
 <form action="[% script_name | html %]" name="Aform" class="validated" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="add_source_validate" />
   <fieldset class="rows">
     <ol>
@@ -213,6 +214,7 @@
 <h1>New filing rule</h1>
   [% END %]
 <form action="[% script_name | html %]" name="Aform" class="validated" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="add_sort_rule_validate" />
   <fieldset class="rows">
     <ol>
@@ -259,6 +261,7 @@
 <h1>New splitting rule</h1>
   [% END %]
 <form action="[% script_name | html %]" name="Aform" class="validated" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="add_split_rule_validate" />
   <fieldset class="rows">
     <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt
index 19c61db8f3..90c4ccc01c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt
@@ -13,6 +13,7 @@
     [% END %]
     <div class="pagelist">
         <form method="post" action="/cgi-bin/koha/admin/columns_settings.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="action" value="save" />
             <input type="hidden" name="module" value="[% modulename | html %]" />
             [% IF module.keys and module.keys.size > 0 %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt
index 74b6129f92..a2684e74fc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt
@@ -84,6 +84,7 @@
                     [% END %]
 
                     <form action="/cgi-bin/koha/admin/credit_types.pl" name="Aform" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_validate" />
                         <fieldset class="rows">
                             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt
index b9a59e7cf1..a0457bead1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt
@@ -64,6 +64,7 @@
         <div class="dialog message">The [% pref_CurbsidePickup_link | $raw | $KohaSpan %] preference is not enabled, do not forget to enable it to turn the feature on.</div>
     [% END %]
     <form method="post" class="form">
+        [% INCLUDE 'csrf-token.inc' %]
         <div id="curbside_pickup_tabs" class="toptabs">
             <ul class="nav nav-tabs" role="tablist">
                 [% FOREACH l IN libraries %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt
index 8d9dbc80d8..979b4e37a2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt
@@ -110,6 +110,7 @@
 </h1>
 
 <form action="/cgi-bin/koha/admin/currency.pl" name="Aform" method="post" class="validated">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="op" value="add_validate" />
     <fieldset class="rows">
         <legend class="sr-only">New currency entry form</legend>
@@ -180,6 +181,7 @@
             <span>Deletion not possible</span>
         </p>
         <form action="/cgi-bin/koha/admin/currency.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
         </form>
     </div>
@@ -195,11 +197,13 @@
             </tr>
         </table>
         <form action="/cgi-bin/koha/admin/currency.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="currency_code" value="[% currency.currency | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this currency</button>
         </form>
         <form action="/cgi-bin/koha/admin/currency.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not delete</button>
         </form>
     </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt
index 2c96ed994c..3de0729601 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt
@@ -83,6 +83,7 @@
                     [% END %]
 
                     <form action="/cgi-bin/koha/admin/debit_types.pl" name="Aform" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_validate" />
                         <fieldset class="rows">
                             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt
index bfd230ab3f..c63b24ed20 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt
@@ -99,6 +99,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/admin/desks.pl" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="desk_id" value="[% desk.desk_id | html %]" />
 
@@ -155,6 +156,7 @@
             </tr>
         </table>
         <form action="/cgi-bin/koha/admin/desks.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="desk_id" value="[% desk.desk_id | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt
index ba57383267..6724917b76 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt
@@ -85,6 +85,7 @@
 
 [% IF acct_form %]
 <form action="/cgi-bin/koha/admin/edi_accounts.pl" name="Actform" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="save" />
   [% IF account %]
   <input type="hidden" name="id" value="[% account.id | html %]" />
@@ -281,6 +282,7 @@
     </tr>
 </table>
 <form action="/cgi-bin/koha/admin/edi_accounts.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <table>
     </table>
     <input type="hidden" name="op" value="delete_confirmed" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt
index 6408f09b64..45b5298e7f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt
@@ -84,6 +84,7 @@
 
 [% IF ean_form %]
 <form action="/cgi-bin/koha/admin/edi_ean_accounts.pl" name="Eanform" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="save" />
   [% IF ean %]
       <input type="hidden" name="oldbranchcode" value="[% ean.branch.branchcode | html %]" />
@@ -160,6 +161,7 @@
     </h1>
 
 <form action="/cgi-bin/koha/admin/edi_ean_accounts.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="op" value="delete_confirmed" />
     <input type="hidden" name="id" value="[% ean.id | html %]" />
     <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt
index 4c75635000..f91e477c9c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt
@@ -87,6 +87,7 @@
     <h1>[% tx("New identity provider domain for '{identity_provider_code}'", {identity_provider_code = identity_provider_code}) | html %]</h1>
 
         <form action="/cgi-bin/koha/admin/identity_providers.pl" id="add" name="add" class="validated" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="add" />
             <input type="hidden" name="domain_ops" value="1" />
             <input type="hidden" name="identity_provider_id" value="[%- identity_provider_id | html -%]" />
@@ -168,6 +169,7 @@
     <h1>[% tx("Modify identity provider domain '{domain}'", {domain = identity_provider_domain.domain}) | html %]</h1>
 
         <form action="/cgi-bin/koha/admin/identity_providers.pl" id="edit_save" name="edit_save" class="validated" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="edit_save" />
             <input type="hidden" name="domain_ops" value="1" />
             <input type="hidden" name="identity_provider_id" value="[%- identity_provider_id | html -%]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt
index db5363c941..cf3471c177 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt
@@ -83,6 +83,7 @@
     <h1>New identity provider</h1>
 
         <form action="/cgi-bin/koha/admin/identity_providers.pl" id="add" name="add" class="validated" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="add" />
             <fieldset class="rows">
                 <legend id="identity_provider_basic">Basic configuration</legend>
@@ -237,6 +238,7 @@
     <h1>[% tx("Modify identity provider '{id_provider}'", {id_provider = identity_provider.code}) | html %]</h1>
 
         <form action="/cgi-bin/koha/admin/identity_providers.pl" id="edit_save" name="edit_save" class="validated" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="edit_save" />
             <input type="hidden" name="identity_provider_id" value="[%- identity_provider.identity_provider_id | html -%]" />
             <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/ill_batch_statuses.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/ill_batch_statuses.tt
index 8f9406c44f..8f03bf5d66 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/ill_batch_statuses.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/ill_batch_statuses.tt
@@ -74,6 +74,7 @@
                     [% END %]
 
                     <form action="/cgi-bin/koha/admin/ill_batch_statuses.pl" name="Aform" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_validate" />
                         <fieldset class="rows">
                             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt
index 9aa4881ac0..eb82f48664 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt
@@ -59,6 +59,7 @@
                     </h1>
 
                     <form action="/cgi-bin/koha/admin/items_search_field.pl" method="POST" id="search_fields">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             [% INCLUDE 'admin-items-search-field-form.inc' field=field %]
                             [% IF (field) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
index a4fe06ec16..e6ac2eb1f8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
@@ -150,6 +150,7 @@
         <h1>New item type</h1>
     [% END %]
     <form action="/cgi-bin/koha/admin/itemtypes.pl" name="Aform" method="post" id="itemtypeentry">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <fieldset class="rows">
             <ol>
@@ -374,10 +375,12 @@
             <tr><th scope="row">Rental charge</th><td>[% itemtype.rentalcharge | $Price %]</td></tr>
         </table>
         <form action="/cgi-bin/koha/admin/itemtypes.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" /><input type="hidden" name="itemtype" value="[% itemtype.itemtype | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this item type</button>
         </form>
         <form action="/cgi-bin/koha/admin/itemtypes.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not delete</button>
         </form>
     </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt
index 532bf74410..d221b25b5a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt
@@ -37,6 +37,7 @@
 
 <div class="dialog message">If you make any change to the mappings, you must ask your administrator to run misc/batchRebuildBiblioTables.pl.</div>
 <form action="/cgi-bin/koha/admin/koha2marclinks.pl" method="post" id="koha2marc">
+    [% INCLUDE 'csrf-token.inc' %]
 
 [% IF error_add %]
     <div class="dialog alert">Failed to add mapping for [% error_info | html %]</div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
index 78ebc09054..95ef15c133 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
@@ -17,6 +17,7 @@
             <div class="col-sm-12">
                 <h1>Localization</h1>
 <form id="add_translation" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="entity" value="[% entity | html %]" />
     <input type="hidden" name="code" value="[% code | html %]" />
     <input type="hidden" name="interface" value="[% interface_side | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt
index a278ed4170..76cf5c1005 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt
@@ -80,6 +80,7 @@
 
                 <div class="page-section">
                 <form action="/cgi-bin/koha/admin/marc-overlay-rules.pl" method="POST" id="marc-overlay-rules-form">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <table id="marc-overlay-rules">
                         <thead><tr>
                             <th>Rule</th>
@@ -288,6 +289,7 @@
                 </div> <!-- /.page-section -->
 
                 <form action="/cgi-bin/koha/admin/marc-overlay-rules.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="redo-matching" />
                 </form>
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
index 2a3b7e437b..31e56e0ed9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
@@ -94,6 +94,7 @@
                         <div class="hint">You can drag and drop the subfield tabs to change the order.</div>
 
                         <form action="[% script_name | html %]" name="Aform" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="add_validate" />
                             <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
                             <input type="hidden" name="frameworkcode" value="[% frameworkcode | html %]" />
@@ -321,6 +322,7 @@
                             <p>Description: [% mss.liblibrarian | html_entity %]</p>
 
                             <form action="[% delete_link | html %]" method="post"><input type="hidden" name="op" value="delete_confirmed" />
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="tagfield" value="[% mss.tagfield | html %]" />
                                 <input type="hidden" name="tagsubfield" value="[% mss.tagsubfield | html %]" />
                                 <input type="hidden" name="frameworkcode" value="[% mss.frameworkcode | html %]" />
@@ -329,6 +331,7 @@
 
 
                             <form action="[% script_name | html %]" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="tagfield" value="[% mss.tagfield | html %]" />
                                 <input type="hidden" name="tagsubfield" value="[% mss.tagsubfield | html %]" />
                                 <input type="hidden" name="frameworkcode" value="[% mss.frameworkcode | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt
index 6f69159cb0..97b89688d8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt
@@ -125,6 +125,7 @@
 [% IF ( add_form ) %]
 
     <form action="[% script_name | html %]" name="Aform" method="post" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
 
       <fieldset class="rows">
             <legend>
@@ -199,6 +200,7 @@
         <p>Tag: [% searchfield | html %]</p>
         <p>Description: [% liblibrarian | html %]</p>
         <form action="[% script_name | html %]" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
             <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
@@ -214,12 +216,14 @@
 
     <div class="dialog message"><h3>Tag deleted</h3>
     <form action="[% script_name | html %]" method="post"><input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
+        [% INCLUDE 'csrf-token.inc' %]
         <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
     </form></div>
 [% END %]
 [% IF ( framework_create ) %]
 
     <form action="[% script_name | html %]" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="framework_create_confirm" />
         <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
         Create framework for [% framework.frameworkcode | html %] ([% framework.frameworktext | html %]) using
@@ -236,6 +240,7 @@
 
 [% IF ( else ) %]
 <form name="f" action="[% script_name | html %]" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset style="padding:.5em;">
         <label for="tag_search"><strong>Search for tag:</strong> </label>
         <input type="text" name="searchfield" id="tag_search" size="4" value="[% searchfield | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt
index 36d8179655..7349551b57 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt
@@ -114,6 +114,7 @@
                         <h1>New record matching rule</h1>
                     [% END %]
                     <form action="[% script_name | html %]" name="Aform" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="[% confirm_op | html %]" />
                         <fieldset class="rows">
                             <ol>
@@ -428,6 +429,7 @@
                     <div class="dialog alert">
                         <h1>Confirm deletion of record matching rule <span class="ex">'[% code | html %]' ([% description | html %])</span>?</h1>
                         <form action="[% script_name | html %]" name="Aform" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="[% confirm_op | html %]" />
                             <input type="hidden" name="matcher_id" value="[% matcher_id | html %]" />
                             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete record matching rule</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
index 1cb6a83f98..a890751784 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
@@ -49,6 +49,7 @@
       [% END %]
 
         <form action="/cgi-bin/koha/admin/oai_set_mappings.pl" method="post" id="mappingform">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="page-section">
                 <table id="mappings">
                     <thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
index 7c789a7d6a..456eb09efc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
@@ -59,6 +59,7 @@
 
         [% IF ( op_new || op_mod ) %]
             <form method="post" action="/cgi-bin/koha/admin/oai_sets.pl" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
             [% IF ( op_new ) %]
                 <h1>New OAI set</h1>
                 <input type="hidden" name="op" value="savenew" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt
index e00d03c176..b6300ee470 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt
@@ -39,6 +39,7 @@
                 <h1>OverDrive library authnames</h1>
 
                 <form action="/cgi-bin/koha/admin/overdrive.pl" name="overdrive_form" method="post" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="update" />
                     <fieldset>
                         <table id="od_info">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
index bad4257539..22c85bd124 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
@@ -86,6 +86,7 @@
 </div>
 [% END %]
 <form action="[% script_name | html %]" class="validated" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <input type="hidden" name="op" value="[% confirm_op | html %]" />
   <fieldset class="rows">
     <ol>
@@ -266,6 +267,7 @@
             [% tx("Confirm deletion of patron attribute type '{code}' ({description})?", { code = code, description = description }) | html %]
         </h1>
         <form action="[% script_name | html %]" name="Aform" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="[% confirm_op | html %]" />
             <input type="hidden" name="code" value="[% code | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete patron attribute type</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt
index 515ef765f4..342aaa32b4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt
@@ -94,6 +94,7 @@
 
 [% IF op == 'add_form' %]
     <form id="restriction_form" action="/cgi-bin/koha/admin/restrictions.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="checked" value="0" />
         [% IF restriction %]
@@ -168,6 +169,7 @@
         <h1>Confirm restriction type deletion</h1>
         <p>Are you sure you want to delete '[% PROCESS restriction_type_description restriction_type=restriction %]'?</p>
         <form action="/cgi-bin/koha/admin/restrictions.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="code" value="[% restriction.code | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
index a6922365aa..a51a412c39 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
@@ -91,11 +91,13 @@ a.add, a.delete {
         <div class="dialog alert">
             <h3>The current mappings you see on the screen will be erased and replaced by the mappings in the mappings.yaml file.</h3>
             <form method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="reset_confirmed" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, reset mappings</button>
             </form>
 
             <form method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not reset mappings</button>
             </form>
         </div>
@@ -114,6 +116,7 @@ a.add, a.delete {
     </div>
 
     <form id="es_mappings" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
 
         [% WRAPPER tabs id= "tabs" %]
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt
index 8d4846cc96..8c1e1a7384 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt
@@ -68,6 +68,7 @@
                     [% END %]
 
                     <form id="mana_preference" method="post" class="clearfix">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <ol>
                                 <li>
@@ -117,6 +118,7 @@
 
                     [% IF Koha.Preference('ManaToken') %]
                         <form id="mana_token" method="post" class="clearfix">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                             <legend>Mana KB token</legend>
                                 <ol>
@@ -134,6 +136,7 @@
                         </form>
                     [% ELSE %]
                         <form id="mana_request" method="post" class="clearfix">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows" id="mana_subscription">
                                 <ol>
                                     <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
index d71e25ccaa..1a31ba3c12 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
@@ -92,6 +92,7 @@
                         </form>
                         [% IF ( definedbranch ) %]
                             <form action="/cgi-bin/koha/admin/clone-rules.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <label for="tobranch"><strong>Clone these rules to:</strong></label>
                                 <input type="hidden" name="frombranch" value="[% current_branch | html %]" />
                                 <select name="tobranch" id="tobranch">
@@ -105,6 +106,7 @@
 
                 <div class="page-section">
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table id="default-circulation-rules">
@@ -621,6 +623,7 @@
                     <h2>Default checkout, hold and return policy[% IF humanbranch %] for [% Branches.GetName( humanbranch ) | html %][% END %]</h2>
                     <p>You can set a default maximum number of checkouts, hold policy and return policy that will be used if none is defined below for a particular item type or category.</p>
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="set-branch-defaults" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -815,6 +818,7 @@
                        no limit applies, except possibly for a limit you define for a specific item type.
                     </p>
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add-branch-cat" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -894,6 +898,7 @@
                 [% END %]
                     <p>Specify if waiting holds can be cancelled for a given patron category.</p>
                     <form id="set-waiting-hold-cancellation" method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="set-waiting-hold-cancellation" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -978,6 +983,7 @@
                 [% END %]
                     <p>Specify the maximum number simultaneous current article requests a patron of a given category can have.</p>
                     <form id="set-article-requests-daily-limit" method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add-open-article-requests-limit" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -1032,6 +1038,7 @@
                 [% END %]
                     <p>Specify the article request fee for a given patron category.</p>
                     <form id="set-article-request-fee" method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="set-article-request-fee" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
@@ -1092,6 +1099,7 @@
                 [% END %]
                     <p>Specify the default policy for lost item fees on return.</p>
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="mod-refund-lost-item-fee-rule" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]" />
                         <table>
@@ -1294,6 +1302,7 @@
                     </ul>
 
                     <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add-branch-item" />
                         <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <table>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt
index 811582ae79..e937020909 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt
@@ -80,6 +80,7 @@
 
                 <div id="sms_add_form">
                     <form id="sms_form" action="sms_providers.pl" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <legend>Add an SMS cellular provider</legend>
                             <input type="hidden" id="id" name="id" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
index 4b326e6468..cd6a956ee5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
@@ -80,6 +80,7 @@
 [% IF op == 'add_form' %]
     <h1>New SMTP server</h1>
     <form action="/cgi-bin/koha/admin/smtp_servers.pl" id="add" name="add" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add" />
         <fieldset class="rows">
             <ol>
@@ -153,6 +154,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/admin/smtp_servers.pl" id="edit_save" name="edit_save" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="edit_save" />
         <input type="hidden" name="smtp_server_id" value="[%- smtp_server.id | html -%]" />
         <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt
index 129934caa4..f0d75d449d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt
@@ -21,6 +21,7 @@
         <h1>SRU search field mapping for bibliographic records</h1>
 
         <form id="form01" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <div class="row">
                     <div class="col-xs-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt
index d540a7a009..9d1a16c7c1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt
@@ -18,6 +18,7 @@
         [% INCLUDE 'messages.inc' %]
         <h1>SRU search field mapping for authorities</h1>
         <form id="form01" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <div class="row">
                     <div class="col-xs-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt
index f573b82d73..3cbfca123d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt
@@ -290,6 +290,7 @@
                 <button type="submit" class="approve"><i class="fa fa-check" aria-hidden="true"></i> Yes, delete</button>
             </form>
             <form class="inline" action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <button type="submit" class="deny"><i class="fa fa-remove" aria-hidden="true"></i> No, do not delete</button>
             </form>
         </div>
@@ -299,6 +300,7 @@
         <div class="dialog message">
             <h1>Data deleted</h1>
             <form action="[% script_name | html %]" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <button type="submit">Back to system preferences</button>
             </form>
         </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt
index 0fb56f49e6..c4f6e05f53 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt
@@ -56,6 +56,7 @@
     </div>[% END %]
 
         <form method="post" action="/cgi-bin/koha/admin/transport-cost-matrix.pl" id="cost_matrix_form">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="set-cost-matrix" />
             <fieldset id="transport-cost-matrix">
                 <div class="help">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt
index 95449a95e0..0db1cdd5fb 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt
@@ -65,6 +65,7 @@
 [% END %]
 
     <form id="category_form" action="/cgi-bin/koha/admin/usage_statistics.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <h1>Modify the statistics you share with the Koha community</h1>
         <div class="row">
             <div class="col-xs-12 col-sm-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt
index 2695c177cd..827d3eedbb 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt
@@ -83,6 +83,7 @@
 
 [% IF ( add_form ) %]
     <form action="[% script_name | html %]" name="Aform" method="post" id="serverentry">
+        [% INCLUDE 'csrf-token.inc' %]
         [% IF op == 'edit' %]
             <h1>[% tx("Modify {servertype} server '{servername}'", { servertype = servertype, servername = server.servername }) | html %]</h1>
             <input type="hidden" name="id" value="[% server.id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
index 1980f4dce9..b65f2bd0ee 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
@@ -123,6 +123,7 @@
     [% END # /IF  identity_providers.size %]
 
     <form action="[% script_name | html %]" method="post" name="loginform" id="loginform" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="koha_login_context" value="intranet" />
     [% FOREACH INPUT IN INPUTS %]
         [% NEXT IF INPUT.name == "koha_login_context" %]
@@ -207,6 +208,7 @@
     [% END %]
 [% ELSIF TwoFA_prompt %]
     <form action="[% script_name | html %]" method="post" name="loginform" id="loginform" autocomplete="off">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="koha_login_context" value="intranet" />
         [% FOREACH INPUT IN INPUTS %]
             <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
index 94be2063b5..3a097a1e1a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
@@ -430,6 +430,7 @@
                 [% END # /IF duplicateauthid %]
 
                 <form method="post" id="f" name="f" action="/cgi-bin/koha/authorities/authorities.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="add" />
                     <input type="hidden" name="addfield_field" value="" />
                     <input type="hidden" name="repeat_field" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt
index 7088b236b8..531852e3ae 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt
@@ -69,6 +69,7 @@ div#result { margin-top: 1em; }
 
 <p>Please choose which record will be the reference for the merge. The record chosen as reference will be kept, and the other will be deleted.</p>
 <form id="mergeform" action="/cgi-bin/koha/authorities/merge.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <legend>Merge reference</legend>
     <ol>
@@ -102,6 +103,7 @@ div#result { margin-top: 1em; }
 [% ELSE %]
 
 <form id="mergeform" action="/cgi-bin/koha/authorities/merge.pl" method="post" onsubmit="return mergeformsubmit()">
+    [% INCLUDE 'csrf-token.inc' %]
 
     <div class="row">
         <div class="col-sm-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt
index 026833d64e..541475f46e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt
@@ -12,6 +12,7 @@
     <p>Your download should begin automatically.</p>
 [% ELSE %]
 <form method="post" action="/cgi-bin/koha/basket/downloadcart.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows">
 	<legend>Download cart</legend>
 	<ol><li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
index 3463282c24..a7b67b5cda 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
@@ -280,6 +280,7 @@
       </div>
 
         <form method="POST" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_operations">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="show" />
             <input type="hidden" id="batch_mod_del" name="del" value="0" />
         </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
index 0f00e7b873..646d83399a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
@@ -207,6 +207,7 @@
                                                 [% IF ( CAN_user_circulate ) %]
                                                     [% SET ClaimReturnedLostValue = Koha.Preference('ClaimReturnedLostValue') %]
                                                     <form action="updateitem.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                         <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                         <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -256,6 +257,7 @@
                                                 <span class="label">Damaged status:</span>
                                                 [% IF ( CAN_user_circulate ) %]
                                                     <form action="updateitem.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                         <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                         <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -290,6 +292,7 @@
                                                 <span class="label">Withdrawn status:</span>
                                                 [% IF ( CAN_user_circulate ) %]
                                                     <form action="updateitem.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                         <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                         <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -330,6 +333,7 @@
                                         <li>
                                             <span class="label">Exclude from local holds priority:</span>
                                             <form action="updateitem.pl" method="post">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                 <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                 <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -350,6 +354,7 @@
                                             <span class="label">Bookable:</span>
                                             [% IF ( CAN_user_circulate ) %]
                                                 <form action="updateitem.pl" method="post">
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
                                                     <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
                                                     <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
@@ -467,6 +472,7 @@
                                             <span class="label">Public note:</span>
                                             [% IF ( CAN_user_editcatalogue_edit_items ) %]
                                                 <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
                                                     <input type="hidden" name="op" value="set_public_note" />
                                                     <textarea name="itemnotes" rows="2" cols="30">[% ITEM_DAT.itemnotes | html %]</textarea><input type="submit" name="submit" class="btn btn-primary btn-xs" value="Update" />
@@ -480,6 +486,7 @@
                                             <span class="label">Non-public note:</span>
                                             [% IF ( CAN_user_editcatalogue_edit_items ) %]
                                                 <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
                                                     <input type="hidden" name="op" value="set_non_public_note" />
                                                     <textarea name="itemnotes_nonpublic" rows="2" cols="30">[% ITEM_DAT.itemnotes_nonpublic | html %]</textarea><input type="submit" name="submit" class="btn btn-primary btn-xs" value="Update" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
index a508538ee9..35611eeb3b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
@@ -362,6 +362,7 @@
 
                 [% ELSE # /IF total %]
                     <form method="post" name="fz3950" class="fz3950bigrpad">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div id="toolbar" class="btn-toolbar" style="background-color:transparent"><div>
                             <button class="btn btn-default" type="button" id="z3950submit"><i class="fa fa-search"></i> Z39.50/SRU search</button>
                         </div></div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt
index 0a569cc010..ba1eb011fe 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt
@@ -48,6 +48,7 @@
                         [% IF ( current_biblio_searches ) %]
                             <h2>Current session</h2>
                             <form id="current_cat" action="/cgi-bin/koha/catalogue/search-history.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p class="selections-toolbar">
                                     <a class="CheckAll" data-form="current_cat" href="#"><i class="fa fa-check"></i> Select all visible rows</a>
                                     <span class="sep">|</span>
@@ -89,6 +90,7 @@
                         [% IF ( previous_biblio_searches ) %]
                             <h2>Previous sessions</h2>
                             <form id="previous_cat" action="/cgi-bin/koha/catalogue/search-history.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p class="selections-toolbar">
                                     <a class="CheckAll" data-form="previous_cat" href="#"><i class="fa fa-check"></i> Select all visible rows</a>
                                     <span class="sep">|</span>
@@ -132,6 +134,7 @@
                         [% IF ( current_authority_searches ) %]
                             <h2>Current session</h2>
                             <form id="current_auth" action="/cgi-bin/koha/catalogue/search-history.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p class="selections-toolbar">
                                     <a class="CheckAll" data-form="current_auth" href="#"><i class="fa fa-check"></i> Select all visible rows</a>
                                     <span class="sep">|</span>
@@ -173,6 +176,7 @@
                         [% IF ( previous_authority_searches ) %]
                             <h2>Previous sessions</h2>
                             <form id="previous_auth" action="/cgi-bin/koha/catalogue/search-history.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p class="selections-toolbar">
                                     <a class="CheckAll" data-form="previous_auth" href="#"><i class="fa fa-check"></i> Select all visible rows</a>
                                     <span class="sep">|</span>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt
index afc228b4eb..d236dbc97b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt
@@ -141,6 +141,7 @@
                                         </a>
                                     [% ELSE %]
                                         <form class="rota_select_form" method="post" enctype="multipart/form-data">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <select class="item_select_rota" name="rota_id">
                                                 [% FOREACH rota IN rotas %]
                                                     <option value="[% rota.rota_id | uri %]">[% rota.title | html %]</option>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
index b4d1015100..d49a5a8ecf 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
@@ -922,6 +922,7 @@ $(document).ready(function(){
                     </script>
                 [% ELSE %]
                     <form method="post" name="f" id="f" action="/cgi-bin/koha/cataloguing/addbiblio.pl" onsubmit="return Check();">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" value="[% IF ( biblionumber ) %]view[% ELSE %]items[% END %]" id="redirect" name="redirect" />
                         <input type="hidden" value="" id="current_tab" name="current_tab" />
                         <input type="hidden" value="0" id="confirm_not_duplicate" name="confirm_not_duplicate" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt
index f1eb5ebc8b..1cf3bcb028 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt
@@ -176,6 +176,7 @@
 
 <div id="cataloguing_additem_newitem" class="item_edit_form page-section">
     <form id="f" method="post" action="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblio.biblionumber | html %]" name="f">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="op" value="[% op | html %]" />
     [% IF (popup) %]
         <input type="hidden" name="popup" value="1" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt
index 03e7f2b4b5..6d0ad685b6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt
@@ -37,6 +37,7 @@
 	[% IF ( errornohostitemnumber ) %]ERROR: Unable to get the item number from this barcode.[% END %]
     </div>
     <form action="/cgi-bin/koha/catalogue/MARCdetail.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="submit" class="btn btn-primary" value="OK" />
 	<input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
     </form>
@@ -44,12 +45,14 @@
     [% IF ( success ) %]
     <div class="dialog message">The item has successfully been linked to <em>[% bibliotitle | html %]</em>.</div>
 	<form action="/cgi-bin/koha/catalogue/MARCdetail.pl" method="post">
+	    [% INCLUDE 'csrf-token.inc' %]
         <input type="submit" class="btn btn-primary" value="OK" />
 	    <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
 	</form>
     [% ELSE %]
 	[% IF ( missingparameter ) %]
 	<form method="post" action="/cgi-bin/koha/cataloguing/linkitem.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	    [% IF ( missingbiblionumber ) %]
 	    <fieldset id="biblionumber_fieldset">
 		<label for="biblionumber_fieldset">Select the biblionumber to link the item to</label>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt
index a0065df10d..c5c252bbe8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt
@@ -106,6 +106,7 @@ div#result { margin-top: 1em; }
 [% IF ( choosereference ) %]
 <p>Please choose which record will be the reference for the merge. The record chosen as reference will be kept, and the other will be deleted.</p>
 <form id="mergeform" action="/cgi-bin/koha/cataloguing/merge.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <legend>Merge reference</legend>
     <ol>
@@ -169,6 +170,7 @@ div#result { margin-top: 1em; }
     </div>
 [% ELSE %]
 <form id="mergeform" action="/cgi-bin/koha/cataloguing/merge.pl" method="post" onsubmit="return mergeformsubmit()">
+    [% INCLUDE 'csrf-token.inc' %]
 
 <div class="col-sm-6">
 [% PROCESS mergesource sourcerecords=records %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt
index b1bf1968ee..6ef311e0ca 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt
@@ -43,6 +43,7 @@
                              <form action="/cgi-bin/koha/catalogue/ISBDdetail.pl" method="post">
                         [% ELSE %]
                              <form action="/cgi-bin/koha/catalogue/detail.pl" method="post">
+                                 [% INCLUDE 'csrf-token.inc' %]
                         [% END %]
 [% END %]
 
@@ -104,6 +105,7 @@
     [% ELSE %]
 	[% IF ( missingparameter ) %]
 	<form method="post" action="/cgi-bin/koha/cataloguing/moveitem.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	    [% IF ( missingbiblionumber ) %]
 	    <fieldset id="biblionumber_fieldset">
 		<label for="biblionumber">Select the biblionumber to attach the item to</label>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt
index a2aa473000..e9264c46a2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt
@@ -22,6 +22,7 @@
         <div id="MARC21_Linking_section_search" class="page-section">
             <h2>Search for</h2>
             <form name="f" method="post" action="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl">
+                [% INCLUDE 'csrf-token.inc' %]
 
                 <p>
                     <input type="hidden" name="plugin_name" value="marc21_linking_section.pl" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt
index cf4a3e838b..6a1efb3840 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt
@@ -15,6 +15,7 @@
 <h1>UNIMARC field 210c builder</h1>
     <h4>Search for authority type: EDITORS</h4>
         <form name="f" method="post" action="plugin_launcher.pl">
+            [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <input type="hidden" name="plugin_name" value="unimarc_field_210c.pl" />
             <input type="hidden" name="op" value="do_search" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
index 4d35a0a83c..0b02315b6c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
@@ -19,6 +19,7 @@
             <div id="UNIMARC_Field_4XX_search" class="page-section">
                 <h2> Search on  </h2>
                 <form name="f" method="post" action="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
 
                     <p>
                         <input type="hidden" name="plugin_name" value="unimarc_field_4XX.pl" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt
index c2c278310d..96efa101b9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt
@@ -23,6 +23,7 @@
     [% IF ( opsearch ) %]
         <h1>Z39.50 authority search points</h1>
         <form method="post" action="z3950_auth_search.pl" name="f" class="checkboxed">
+            [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" id="op" value="do_search" />
         <input type="hidden" name="authid" value="[% authid | html %]" />
         <input type="hidden" name="index" value="[% index | html %]" />
@@ -138,6 +139,7 @@
     </div>
 
     <form method="post" action="z3950_auth_search.pl" id="page_form" name="page_form" class="checkboxed">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" id="op" value="do_search" />
         <input type="hidden" name="current_page" id="current_page" value="[% current_page | html %]" />
         <input type="hidden" id="nameany"  name="nameany" value="[% nameany | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt
index 7cdcca5b73..3ff1af4012 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt
@@ -42,6 +42,7 @@
         [% IF ( opsearch ) %]
             <h1>Z39.50/SRU search</h1>
             <form method="post" action="z3950_search.pl" name="f" class="checkboxed">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="row">
                     <div class="col-xs-6">
                         <input type="hidden" name="op" id="op" value="do_search" />
@@ -225,6 +226,7 @@
                             </div>
 
                             <form method="post" action="z3950_search.pl" id="page_form" name="page_form" class="checkboxed">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="op" id="op" value="do_search" />
                                 <input type="hidden" name="current_page" id="current_page" value="[% current_page | html %]" />
                                 <input type="hidden" id="title"  name="title" value="[% title | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt
index 754f82fb41..5751ee2569 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt
@@ -163,6 +163,7 @@
                 [% PROCESS urls_modal %]
 
                 <form id="ar-branchcode-form" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <select name="branchcode" id="branchcode">
                         <option value="">All libraries</option>
                         [% FOREACH b IN Branches.all( only_from_group => 1 ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt
index 56fa9b1f60..dfcbaf716f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt
@@ -41,6 +41,7 @@
 <h1>Circulation: Overdues at [% Branches.GetLoggedInBranchname | html %]</h1>
 
 <form name="selectlocation" action="branchoverdues.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
     <label for="location">Shelving location selected: </label><select id="location" name="location">
         <option value="">All shelving locations</option>
         [% FOREACH locationsloo IN locationsloop %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
index 84aa3ce71a..2f206ce951 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
@@ -65,6 +65,7 @@
                 </th>
                 <td>
                     <form method="post" name="mainform" id="mainform" action="branchtransfers.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% FOREACH trsfitemloo IN trsfitemloop %]
                             <input type="hidden" name="bc-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.item.barcode | html %]" />
                             <input type="hidden" name="fb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.frombrcd | html %]" />
@@ -91,6 +92,7 @@
                         <th>Cancel hold and then attempt transfer:</th>
                         <td>
                             <form method="post" name="mainform" id="mainform" action="branchtransfers.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 [% FOREACH trsfitemloo IN trsfitemloop %]
                                     <input type="hidden" name="bc-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.item.barcode | html %]" />
                                     <input type="hidden" name="fb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.frombrcd | html %]" />
@@ -111,6 +113,7 @@
                         <th>Ignore and return to transfers: </th>
                             <td>
                                 <form method="post" name="mainform" id="mainform" action="branchtransfers.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="tobranchcd" value="[% tobranchcd | html %]" />
                                     <input type="hidden" name="barcode" />
                                     [% FOREACH trsfitemloo IN trsfitemloop %]
@@ -176,6 +179,7 @@
 
 <div id="branchtransfers">
     <form method="post" name="mainform" id="mainform" action="/cgi-bin/koha/circ/branchtransfers.pl">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="brief">
             <legend>Transfer</legend>
             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt
index b91d9f07de..8003a17ee6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt
@@ -62,6 +62,7 @@
 
             [% IF ( notes.count ) %]
                 <form id="mark_selected" method="post" action="/cgi-bin/koha/circ/checkout-notes.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <div id="toolbar" class="btn-toolbar">
                         <button type="submit" class="btn btn-default markseen" name="mark_selected-seen" value="seen" disabled="disabled"><i class="fa-solid fa-eye"></i> Mark seen</button>
                         <button type="submit" class="btn btn-default markseen" name="mark_selected-notseen" value="notseen" disabled="disabled"><i class="fa-solid fa-eye-slash"></i> Mark not seen</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
index 979f916cd8..654e910852 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
@@ -274,6 +274,7 @@
 
                             [% IF CAN_user_circulate_force_checkout or HIGHHOLDS %]
                                 <form method="post" action="/cgi-bin/koha/circ/circulation.pl" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset>
                                     <input type="hidden" name="restoreduedatespec" />
 
@@ -381,6 +382,7 @@
 
                             [% IF ADDITIONAL_MATERIALS && !CAN_user_circulate_force_checkout %]
                                 <form method="post" action="/cgi-bin/koha/circ/circulation.pl" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="restoreduedatespec" />
 
                                     [% IF (forceallow) %]<input type="hidden" name="forceallow" value="1">[% END %]
@@ -405,6 +407,7 @@
 
                             [% IF ( RESERVED or RESERVE_WAITING or TRANSFERRED or PROCESSING ) %]
                                 <form method="post" action="/cgi-bin/koha/circ/circulation.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="restoreduedatespec" />
                                     <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                                     <input type="hidden" name="duedatespec" value="[% duedatespec | html %]" />
@@ -660,6 +663,7 @@
                                                             [% END %]
                                                             <td>
                                                                 <form method="post" action="/cgi-bin/koha/circ/circulation.pl" autocomplete="off">
+                                                                    [% INCLUDE 'csrf-token.inc' %]
                                                                     [% IF (forceallow) %]
                                                                         <input type="hidden" name="forceallow" value="1">
                                                                     [% END %]
@@ -719,6 +723,7 @@
                             [% IF ( !noissues ) || ( Koha.Preference('OnSiteCheckouts') && Koha.Preference('OnSiteCheckoutsForce') )%]
                                 <div class="col-sm-6">
                                     <form method="post" action="/cgi-bin/koha/circ/circulation.pl" id="mainform" name="mainform" autocomplete="off">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="restoreduedatespec" />
                                         [% IF ( issue ) %]
                                             <fieldset id="circ_circulation_issue" class="lastchecked">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
index ea304fec0f..e74bb541a7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
@@ -84,6 +84,7 @@
   </div>
 [% ELSIF patron and not checkout_infos %]
   <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/circ/circulation.pl">
+      [% INCLUDE 'csrf-token.inc' %]
     <div id="circ_circulation_issue">
         <fieldset>
             <legend>Checking out to [% INCLUDE 'patron-title.inc' %]</legend>
@@ -135,6 +136,7 @@
   [% IF confirmation_needed && CAN_user_circulate_force_checkout %]
     <h3>Batch checkout confirmation</h3>
     <form method="post" action="/cgi-bin/koha/circ/circulation.pl" id="mainform" name="mainform" autocomplete="off">
+        [% INCLUDE 'csrf-token.inc' %]
   [% ELSE %]
     <h3>Batch checkout results</h3>
   [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt
index 443f7bf2de..33d98f2094 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt
@@ -127,6 +127,7 @@
                 [% END %]
 
                 <form method="post" class="refresh-form">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <p>
                         <input type="hidden" name="tab" id="current-tab" value="[% tab | html %]" />
                         <button type="submit" class="btn btn-default"><i class="fa-solid fa-rotate" aria-hidden="true"></i> Refresh</button>
@@ -216,6 +217,7 @@
                                                     </td>
                                                     <td>
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-staged"/>
                                                             <input type="hidden" name="tab" value="to-be-staged"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -225,6 +227,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="cancel"/>
                                                             <input type="hidden" name="tab" value="to-be-staged"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -275,6 +278,7 @@
                                                     </td>
                                                     <td>
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-patron-has-arrived"/>
                                                             <input type="hidden" name="tab" value="staged-and-ready"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -284,6 +288,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-delivered"/>
                                                             <input type="hidden" name="tab" value="staged-and-ready"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -293,6 +298,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-unstaged"/>
                                                             <input type="hidden" name="tab" value="staged-and-ready"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -343,6 +349,7 @@
                                                     </td>
                                                     <td>
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-delivered"/>
                                                             <input type="hidden" name="tab" value="patron-is-outside"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -352,6 +359,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-staged"/>
                                                             <input type="hidden" name="tab" value="patron-is-outside"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -361,6 +369,7 @@
                                                         </form>
 
                                                         <form method="post" class="form">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="mark-as-unstaged"/>
                                                             <input type="hidden" name="tab" value="patron-is-outside"/>
                                                             <input type="hidden" name="id" value="[% cp.id | html %]"/>
@@ -440,6 +449,7 @@
                             [% SET waiting_holds = patron.holds.search( found => 'W', branchcode => Branches.GetLoggedInBranchcode ) %]
                             [% IF !policy.enable_waiting_holds_only || waiting_holds.count > 0 %]
                                 <form id="create-pickup" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="rows" style="float: none;">
                                         <input type="hidden" name="borrowernumber" value="[% patron.id | html %]"/>
                                         <input type="hidden" name="op" value="create-pickup"/>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt
index 0378eaa2bc..dacccb3dae 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt
@@ -164,6 +164,7 @@
             <aside>
 
 <form method="post" action="/cgi-bin/koha/circ/overdue.pl">
+    [% INCLUDE 'csrf-token.inc' %]
   <fieldset class="brief">
 <h4>Filter on:</h4>
     <fieldset><legend>Date due:</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
index 7eb29afe6b..bb93df741e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
@@ -206,6 +206,7 @@
         </td>
         <td>
             <form name="cancelReserve" action="/cgi-bin/koha/circ/pendingreserves.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="cancel_reserve" />
                 <input type="hidden" name="reserve_id" value="[% hold.reserve_id | html %]" />
 
@@ -232,6 +233,7 @@
         [% IF Koha.Preference('CanMarkHoldsToPullAsLost') != 'do_not_allow' %]
             [% IF hold.itemnumber %]
                 <form name="cancelReserve" action="/cgi-bin/koha/circ/pendingreserves.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="reserve_id" value="[% hold.reserve_id | html %]" />
                     [% IF Koha.Preference('CanMarkHoldsToPullAsLost') == 'allow' %]
                         <input type="hidden" name="op" value="mark_as_lost" />
@@ -286,6 +288,7 @@
 <div id="filters">
 
 <form action="/cgi-bin/koha/circ/pendingreserves.pl" method="post" >
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="brief">
 <h4>Refine results</h4>
 <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt
index 606a11fb42..fc7de6dc99 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt
@@ -62,6 +62,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override limit and renew</button>
@@ -74,6 +75,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override limit and renew</button>
@@ -86,6 +88,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override and renew</button>
@@ -98,6 +101,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override and renew</button>
@@ -110,6 +114,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <input type="submit" class="approve" value="Override and renew" />
@@ -122,6 +127,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <input type="submit" class="approve" value="Override and renew" />
@@ -134,6 +140,7 @@
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override limit and renew</button>
@@ -145,6 +152,7 @@
                                 <p>[% INCLUDE 'biblio-title.inc' biblio=item.biblio link = 1 %] ( [% item.barcode | html %] ): This item is on hold for another patron.</p>
 
                                 <form method="post" action="/cgi-bin/koha/circ/renew.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                     <input type="hidden" name="override_limit" value="1" />
                                     <input type="hidden" name="override_holds" value="1" />
@@ -197,6 +205,7 @@
 
             [% UNLESS error %]
                 <form method="post" action="/cgi-bin/koha/circ/renew.pl" autocomplete="off" >
+                    [% INCLUDE 'csrf-token.inc' %]
 
                     <fieldset>
                         <h1>Renew</h1>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt
index 6604d83f2c..02a20b4f71 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt
@@ -117,6 +117,7 @@
                                 </div>
                             [% END %]
                             <form id="place-article-request" method="post" action="/cgi-bin/koha/circ/request-article.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="action" value="create" />
                                 <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblio.biblionumber | html %]" />
                                 <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt
index bf6a9d8dd6..b61b95c697 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt
@@ -148,6 +148,7 @@
             <aside>
 
 <form action="/cgi-bin/koha/circ/reserveratios.pl" method="post" >
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="brief">
 <h4>Refine results:</h4>
 <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
index a177126da7..579083056a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
@@ -420,6 +420,7 @@
                                         </div>
                                         <div class="modal-footer">
                                             <form method="post" action="/cgi-bin/koha/circ/returns.pl" autocomplete="off">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="barcode" value="[% item.barcode | html %]" />
                                                 <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" />
                                                 <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" />
@@ -444,6 +445,7 @@
                             <div class="modal-dialog modal-wide">
                                 <div class="modal-content">
                                     <form method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <div class="modal-header">
                                             <h3>Please confirm bundle contents for [% item.barcode | html %]</h3>
                                         </div>
@@ -530,6 +532,7 @@
                                 <div class="modal-dialog">
                                     <div class="modal-content">
                                         <form method="post" action="returns.pl" name="mainform" id="mainform">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <div class="modal-header">
                                                 <h3>
                                                     Cannot check in
@@ -574,6 +577,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="returns.pl" name="wrongtransferform" id="wrongtransferform">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" />
                                                 <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" />
                                                 <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />
@@ -619,6 +623,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="returns.pl" class="confirm">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <div class="modal-header">
                                                     <h3>
                                                         Hold found (item is already waiting):
@@ -733,6 +738,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="returns.pl" name="mainform" id="mainform">
+                                                [% INCLUDE 'csrf-token.inc' %]
 
                                                 <input type="hidden" name="print_slip" value="0" />
 
@@ -791,6 +797,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="returns.pl" class="confirm">
+                                                [% INCLUDE 'csrf-token.inc' %]
 
                                                 <input type="hidden" name="print_slip" value="0" />
 
@@ -907,6 +914,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="/cgi-bin/koha/circ/returns.pl" class="confirm">
+                                                [% INCLUDE 'csrf-token.inc' %]
 
                                                 <div class="modal-header">
                                                     <h3>
@@ -1008,6 +1016,7 @@
                                     <div class="modal-dialog">
                                         <div class="modal-content">
                                             <form method="post" action="/cgi-bin/koha/circ/returns.pl" class="confirm">
+                                                [% INCLUDE 'csrf-token.inc' %]
 
                                                 <div class="modal-header">
                                                     <h3>
@@ -1100,6 +1109,7 @@
                         </div>
 
                         <form id="checkin-form" method="post" action="/cgi-bin/koha/circ/returns.pl" autocomplete="off" >
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset id="circ_returns_checkin">
                                 <div class="show_checkin_dialog" style="float:right;display:none"><button type="button" class="btn btn-default btn-sm" data-toggle="tooltip" title="Show the last checkin message"><i class="fa fa-info"></i></button></div>
                                 <h1>Check in</h1>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt
index 7bff51ab4f..0345210e15 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt
@@ -72,6 +72,7 @@ Updated:<ul>
     [% END %]
     </ul>
 <form method="post" action="[% referer or "/cgi-bin/koha/circ/circulation.pl" %]">
+    [% INCLUDE 'csrf-token.inc' %]
     <div class="noshow">
         [% FOREACH recycle_loo IN recycle_loop %]
         <input type="text" name="[% recycle_loo.param | html %]" value="[% recycle_loo.value | html %]" />
@@ -83,6 +84,7 @@ Updated:<ul>
 [% ELSE %]
 
 <form method="post" action="set-library.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 [% IF ( CAN_user_superlibrarian || CAN_user_loggedinlibrary ) %]
 <fieldset class="rows">
     <legend>Set library</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt
index 75f50f1f64..8d83be76d2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt
@@ -70,6 +70,7 @@
                                         Please retain this item and check it in to process the hold.
                                         </p>
                                         <form name="cancelReservewithtransfert" action="waitingreserves.pl#[% tab | html %]" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
                                         </form>
                                     </div>
@@ -81,6 +82,7 @@
                                         Please retain this item and check it in to process the hold.
                                         </p>
                                         <form name="cancelReservewithwaiting" action="waitingreserves.pl#[% tab | html %]" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
                                         </form>
                                     </div>
@@ -125,6 +127,7 @@
                                                 <button class="btn cancel_selected_holds" data-bulk="true"></button>
                                                 <div class="btn-group">
                                                     <form name="cancelAllReserve" action="waitingreserves.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="cancelall" value="1" />
                                                         <input type="hidden" name="allbranches" value="[% allbranches | html %]" />
                                                         <input type="hidden" name="tab" value="holdsover">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt
index da5d8769bb..f8e37273af 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt
@@ -48,6 +48,7 @@
             [% INCLUDE 'messages.inc' %]
 
             <form method="post" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="id" value="[% club.id | html %]" />
                 <input type="hidden" name="club_template_id" value="[% club_template.id | html %]" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt
index 3d9010ac8c..3369753ef7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt
@@ -53,6 +53,7 @@
             [% INCLUDE 'messages.inc' %]
 
             <form method="post" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="id" value="[% club_template.id | html %]" />
 
                 <h1>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt
index 0eec76dc0b..26f183c30c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt
@@ -47,6 +47,7 @@
         [% END %]
 
         <form method="post" action="/cgi-bin/koha/course_reserves/add_items.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="course_id" value="[% course.course_id | html %]" />
             <input type="hidden" name="action" value="lookup" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt
index 18b1b9c3be..cfbf43b31a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt
@@ -60,6 +60,7 @@
         [% END %]
 
         <form method="post" action="/cgi-bin/koha/course_reserves/add_items.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="course_id" value="[% course.course_id | html %]" />
             <input type="hidden" name="return" value="[% return | html %]" />
             <input type="hidden" name="action" value="add" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt
index 0ecc016d2e..b4821f9ab5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt
@@ -45,6 +45,7 @@
 
         [% IF action == 'display_form' %]
             <form method="post" action="/cgi-bin/koha/course_reserves/batch_add_items.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="course_id" value="[% course.course_id | html %]" />
                 <input type="hidden" name="action" value="add" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt
index a9d0ae5bc4..35b6b02eb0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt
@@ -34,6 +34,7 @@
             <h1>Batch remove reserves</h1>
         [% IF action == 'display_form' %]
             <form method="post" action="/cgi-bin/koha/course_reserves/batch_rm_items.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="action" value="batch_rm" />
                 <fieldset class="rows">
                     <legend>Remove items: scan barcodes</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
index aafe826931..b7971c4957 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
@@ -59,6 +59,7 @@
                 </h1>
 
             <form method="post" action="/cgi-bin/koha/course_reserves/mod_course.pl" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
                 [% IF course_id %]<input type="hidden" name="course_id" value="[% course_id | html %]" />[% END %]
                 <fieldset class="rows">
                     <legend>[% IF course_id %]Edit course[% ELSE %]Create course[% END %]</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
index 864bdcf8b3..a8d20f5e71 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
@@ -181,6 +181,7 @@
                         [% END %]
                         [% IF request.biblio_id && request.biblio_id.length > 0  && !whole.value.check_out_errors.error.STATS %]
                             <form method="POST" action="/cgi-bin/koha/ill/ill-requests.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="rows">
                                     <legend>Check out details</legend>
                                     [% items = whole.value.biblio.items.unblessed %]
@@ -321,6 +322,7 @@
                     [% IF whole.value.partners %]
                        [% ill_url = "/cgi-bin/koha/ill/ill-requests.pl?method=illview&illrequest_id=" _ request.illrequest_id %]
                         <form method="POST" action="/cgi-bin/koha/ill/ill-requests.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 <legend>Interlibrary loan request details</legend>
                                 <ol>
@@ -399,6 +401,7 @@
 
                 [% ELSIF query_type == 'edit_action' %]
                     <form method="POST" action="/cgi-bin/koha/ill/ill-requests.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <legend>Request details</legend>
                             <ol>
@@ -501,6 +504,7 @@
                     <div class="dialog alert">
                         <h3>Are you sure you wish to delete this request?</h3>
                         <form action="/cgi-bin/koha/ill/ill-requests.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="method" value="delete" />
                             <input type="hidden" name="confirmed" value="1" />
                             <input type="hidden" name="illrequest_id" value="[% request.id | html %]" />
@@ -824,6 +828,7 @@
                     <div id="results" class="page-section">
                         <h3>Displaying availability results</h3>
                         <form method="POST" action="/cgi-bin/koha/ill/ill-requests.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             [% FOREACH key IN whole.keys %]
                                 [% value = whole.$key %]
                                 [% IF key != 'method' && key != 'custom_key' && key != 'custom_value' %]
@@ -857,6 +862,7 @@
                     <h1>Request type disclaimer</h1>
                     <div id="results" class="page-section">
                         <form method="post" id="typedisclaimer-form">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 [% disclaimer.text | $raw %]
                                 [% SET disc_av_category_code = AuthorisedValues.GetAuthValueDropbox(disclaimer.av_cat) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt
index 863c17e542..6a30ec6d81 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt
@@ -52,6 +52,7 @@
                     <p>Before we begin, please verify you have the correct credentials to continue. Please log in with the username and password given to you by your systems administrator and located in your <code>koha-conf.xml</code> configuration file.</p>
 
                     <form action="[% url | html %]" method="post" id="mainform">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% FOREACH INPUT IN INPUTS %]
                             <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
                         [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt
index f9fe7293dc..2481e4a861 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt
@@ -45,6 +45,7 @@
                     <p>Please pick your language from the following list. If your language is not listed, please inform your system administrator.</p>
 
                     <form name="language" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="form-group">
                             <label for="language">Select a language: </label>
                             <select id="language" name="language">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt
index 0bca0ed0b6..5a17faf0ac 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt
@@ -41,6 +41,7 @@
 
                 [% IF ( dbconnection ) %]
                     <form name="checkdbparameters" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF ( checkdatabaseaccess ) %]
                             <div class="alert alert-success" role="alert"><p>Connection established.</p></div>
                             [% IF ( checkdatabasecreated ) %]
@@ -87,6 +88,7 @@
                     </form>
                 [% ELSE %]
                     <form name="checkinformation" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="step" value="2" />
                         <input type="hidden" name="checkdb" value="1" />
                         <p><input value="Continue to the next step" class="btn btn-primary" type="submit" /> </p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt
index 1e84e53796..55eef916d3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt
@@ -84,6 +84,7 @@
                     </div>
 
                     <form name="frameworkselection" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="selectframeworks" />
 
@@ -123,6 +124,7 @@
                     </div>
 
                     <form name="frameworkselection" method="post" action="install.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="addframeworks" />
                         [% IF ( frameworksloop ) %]
@@ -252,6 +254,7 @@
                     <p>In the next steps you will be guided through some basic requirements like defining Koha user with all administrative privileges (superlibrarian).</p>
 
                     <form action="/cgi-bin/koha/installer/install.pl" method="post" name="finish">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <h4>
                             You can help the Koha community by sharing your statistics with us.
                         </h4>
@@ -289,6 +292,7 @@
                         </div>
 
                         <form action="install.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="step" value="3" />
                             <p><input value="Continue to the next step" class="btn btn-primary" type="submit" /></p>
                         </form>
@@ -311,6 +315,7 @@
 
                     <p>Now we're ready to create the database tables and fill them with some default data.</p>
                     <form action="install.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="importdatastructure" />
                         <p><input value="Continue to the next step" class="btn btn-primary" type="submit" /></p>
@@ -338,6 +343,7 @@
 
                         <p>We are ready to do some basic configuration.</p>
                         <form action="install.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="step" value="3" />
                             <input type="hidden" name="op" value="choosemarc" />
                             <p><input value="Continue to the next step" class="btn btn-primary" type="submit" /></p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt
index 3f3b09bbad..74c3597778 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt
@@ -69,6 +69,7 @@
                 <h2>Barcode image generator</h2>
 
                 <form action="/cgi-bin/koha/svc/barcode" method="post" id="barcodegen">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="brief">
                         <div class="row">
                             <div class="col-sm-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt
index f054c2e058..dc23dfaec4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt
@@ -6,6 +6,7 @@
 <h1>Search</h1>
 
 <form name="f" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 	<input type="hidden" name="op" value="do_search" />
 	<input type="hidden" name="type" value="intranet" />
 	<div class="details">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
index 835858514d..6b899f0862 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
@@ -90,6 +90,7 @@
 
                         <div id="manage-label-batches">
                             <form name="add_by_number" action="/cgi-bin/koha/labels/label-edit-batch.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <div>
                                     <fieldset class="rows" style="border-bottom: 0px; border: 0px;">
                                     <ol><li id="description">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt
index bd16857412..95df164c89 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt
@@ -38,6 +38,7 @@
                     [% INCLUDE 'labels-toolbar.inc' %]
                     <h1>Print barcode range</h1>
                     <form name="add_by_number" action="/cgi-bin/koha/labels/label-edit-batch.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add" />
                         <fieldset class="rows">
                             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
index 6380ddd94d..a05adc09b5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
@@ -72,6 +72,7 @@
                 [% END %]
             </h3>
             <form name="exporting" method="post" action="/cgi-bin/koha/labels/label-print.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="export" />
                 <input type="hidden" name="referer" value="[% referer | html %]" />
                 [% FOREACH batch_id IN batch_ids %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt
index 3e0e7cea2a..3bcbe4083d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt
@@ -20,6 +20,7 @@
         </h1>
 
         <form name="f" method="post" action="/cgi-bin/koha/labels/label-item-search.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="do_search" />
             <input type="hidden" name="batch_id" value="[% batch_id | html %]" />
             <input type="hidden" name="type" value="[% type | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt
index 2382d512ad..7d5bef0656 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt
@@ -35,6 +35,7 @@
 
 <h1>Quick spine label creator</h1>
                 <form action="/cgi-bin/koha/labels/spinelabel-print.pl" method="post" id="spinelabelprint">
+                    [% INCLUDE 'csrf-token.inc' %]
 				<fieldset class="brief">
 				<ol>
 					<li><label for="barcode">Barcode: </label>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/alert-subscriptions.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/alert-subscriptions.tt
index d149cc66ee..bff2d38674 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/alert-subscriptions.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/alert-subscriptions.tt
@@ -70,6 +70,7 @@
                                         </td>
                                         <td class="actions">
                                             <form action="/cgi-bin/koha/members/alert-subscriptions.pl" method="post" class="unsubscribe" data-title="[% sub.biblio.title | html %] [% sub.biblio.subtitle | html %]"data-patron="[% INCLUDE 'patron-title.inc' no_html = 1 %]">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="subscription_id" value="[% sub.subscriptionid | html %]">
                                                 <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]">
                                                 <button type="submit" class="btn btn-default btn-sm"><i class="fa fa-times"></i> Unsubscribe from email alerts</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
index 7c8868b240..303a34237f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
@@ -59,6 +59,7 @@
     [% END %]
     <div class="btn-toolbar">
         <form method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="submit" name="discharge" class="btn btn-primary" value="Generate discharge" />
             <input type="hidden" value="[% patron.borrowernumber | html %]" name="borrowernumber" />
         </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
index a9bd956498..7cbaab0771 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
@@ -83,6 +83,7 @@
                 [% END %]
 
                 <form method="post" action="/cgi-bin/koha/members/files.pl" enctype="multipart/form-data">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <legend>Upload new file</legend>
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
index 9e056fde12..8c5b46b050 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
@@ -113,6 +113,7 @@
             <!-- Create or edit housebound_profile -->
             [% IF ( method == 'update_or_create' ) %]
               <form id="editform" method="post" name="editform"
+                  [% INCLUDE 'csrf-token.inc' %]
                     action="/cgi-bin/koha/members/housebound.pl">
                 <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                 [% IF ( housebound_profile ) %]
@@ -250,6 +251,7 @@
             [% ELSIF ( method == 'visit_update_or_create' ) %]
               <h4>Manage housebound deliveries</h4>
               <form name="form" id="instance_form" method="post"
+                  [% INCLUDE 'csrf-token.inc' %]
                     action="/cgi-bin/koha/members/housebound.pl">
                 [% IF ( visit ) %]
                   <input type="hidden" name="method" value="editvisitconfirm" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
index 6b2c11d17b..92250de220 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
@@ -114,6 +114,7 @@
           </div>
         [% IF CAN_user_tools_edit_patrons %]
             <form id="patron_batchmod_form" method="post" action="/cgi-bin/koha/tools/modborrowers.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="show" />
                 <textarea style="display:none" id="borrowernumberlist" name="borrowernumberlist"></textarea>
             </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt
index 9ea7874ba6..95c6a481c2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt
@@ -115,6 +115,7 @@
             <h1>Update patron records</h1>
             [% IF PendingModifications %]
                 <form method="post" action="members-update-do.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <div id="pending_updates" class="panel-group" role="tablist" aria-multiselectable="true">
                         [% FOREACH pm IN PendingModifications %]
                             [% SET borrowernumber = pm.borrowernumber %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt
index bc369c9f21..47f08d4c15 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt
@@ -89,6 +89,7 @@
                                                 [% IF ( QUEUED_MESSAGE.status != 'pending' ) %]
                                                     <div class="notice">
                                                         <form id="resend_notice[% QUEUED_MESSAGE.message_id | html %]" action="/cgi-bin/koha/members/notices.pl?borrowernumber=[% borrowernumber | html %]" method="POST">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="resend_notice" />
                                                             <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
                                                             <input type="hidden" name="message_id" value="[% QUEUED_MESSAGE.message_id | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt
index 9e6d1f98cb..0081027f31 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt
@@ -20,6 +20,7 @@
 
     [% IF patron_categories %]
         <form method="post" action="update-child.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset>
                 <table id="catst">
                     <thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt
index dbd9e4400c..de45fcdc7d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt
@@ -71,6 +71,7 @@
 
    <div id="fileuploadform">
      <form method="post" action="/cgi-bin/koha/offline_circ/process_koc.pl" enctype="multipart/form-data" class="validated">
+         [% INCLUDE 'csrf-token.inc' %]
 		<fieldset class="brief">
        <ol><li><label for="fileToUpload">Choose .koc file: </label>
             <input class="required" required="required" type="file" id="fileToUpload" size="50" name="fileToUpload" />
@@ -86,12 +87,14 @@
    </div>
 
    <form action="enqueue_koc.pl" id="processfile" method="post" enctype="multipart/form-data">
+       [% INCLUDE 'csrf-token.inc' %]
      <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
      <input type="hidden" name="action" value="add_to_queue" />
      <input type="submit" value="Add to offline circulation queue" id="queueformsubmit" />
    </form>
 
    <form action="process_koc.pl" id="enqueuefile" method="post" enctype="multipart/form-data">
+       [% INCLUDE 'csrf-token.inc' %]
      <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
      <!-- <input type="submit" value="Apply directly" id="mainformsubmit" /> -->
    </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep1.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep1.tt
index e1cf606bf7..22bba760ff 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep1.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep1.tt
@@ -35,6 +35,7 @@
                 </div>
 
                 <form name="LibraryCreation" method="post" action="onboarding.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows" >
                         <input type="hidden" name="step" value="1"/>
                         <input type="hidden" name="op" value="add_validate_library"/>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt
index 07e58dae05..b86f5d35dd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt
@@ -47,6 +47,7 @@
                 <p> The patron category you create will be used by the <span class="bg-info">administrator account</span>.</p>
 
                 <form id="category_form" method="post" action="onboarding.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <input type="hidden" name="step" value="2" />
                         <input type="hidden" name="op" value="add_validate_category" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt
index bc8c777f58..40dfd307ed 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt
@@ -39,6 +39,7 @@
                 Now we will create a patron with superlibrarian permissions. Log in with this to access Koha as a staff member with all permissions.
                 </p>
                 <form name="createpatron" id="createpatron" method="post" action="onboarding.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="add_validate_patron" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt
index 8bdde97a7b..c4169b9d81 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt
@@ -40,6 +40,7 @@
                     <p> Important: Item types are what you apply circulation rules to. Circulation rules govern how your institution will lend its items: Checkout length, renewal policy, hold policy, etc. For example a circulation rule applied to the DVD item type may enforce a payment of $1.00 for checking out any DVD.</p>
 
                     <form id="createitemform" method="post" action="onboarding.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <input type="hidden" name="step" value="4" />
                         <input type="hidden" name="op" value="add_validate_itemtype" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt
index 4105d079db..37a7285c11 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt
@@ -56,6 +56,7 @@
                     </div>
 
                     <form name="createcirculationrule" method="post" action="onboarding.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <input type="hidden" name="step" value="5"/>
                             <input type="hidden" name="op" value="add_validate_circ_rule" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt
index a3a69b6c4a..64a31d6133 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt
@@ -52,6 +52,7 @@
         </h1>
 
         <form method="post" action="/cgi-bin/koha/patron_lists/add-modify.pl" class="validated">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
 
                 <legend class="sr-only">Patron list details</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
index c59de1a4e0..3ca8e7d39d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
@@ -102,6 +102,7 @@
         [% END %]
 
         <form action="list.pl" id="add_patrons" method="post" class="clearfix">
+            [% INCLUDE 'csrf-token.inc' %]
             <fieldset class="rows">
                 <legend>Add patrons</legend>
                 <ol>
@@ -153,6 +154,7 @@
         </form>
 
         <form action="list.pl" id="remove_patrons" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
 
             <div class="searchheader" id="searchheader">
                 <span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> |
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
index 779f220211..e9d5321d23 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
@@ -67,6 +67,7 @@
                     [% INCLUDE 'patroncards-errors.inc' %]
                     <div id="manage-patroncard-batches">
                             <form name="add_by_bor_num" action="/cgi-bin/koha/patroncards/edit-batch.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <div>
                                     <fieldset class="rows" style="border-bottom: 0px; border: 0px;">
                                     <ol><li id="description">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt
index fc2108d0f1..1d017c922a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt
@@ -60,6 +60,7 @@
 
                 <!-- NOTE: The order of the elements on this form is crictical to correct processing. You've been warned...  -->
                 <form name="input" action="/cgi-bin/koha/patroncards/edit-layout.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                 <div class="row">
                 <div class="col-sm-6">
                         <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt
index 4b9e37d93e..278883253b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt
@@ -58,6 +58,7 @@
                                 [% END%]
                             </h1>
                                     <form name="input" action="/cgi-bin/koha/patroncards/edit-profile.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="rows"><legend>Profile settings</legend>
                                         <ol>
                                             <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt
index 087940e7f1..a973f65db4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt
@@ -59,6 +59,7 @@
                         [% IF (template_id) %] ([% template_id | html %])[% END %]
                     </h1>
                     <form name="input" action="/cgi-bin/koha/patroncards/edit-template.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="row">
                         <div class="col-sm-6">
                             <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt
index 94e41589c2..005f57773e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt
@@ -45,6 +45,7 @@
                         <h2>Upload additional images for patron cards</h2>
                         <p>Manage additional images to use as logo, decoration or background on a patron card layout.</p>
                         <form name="upload_images" method="post" action="/cgi-bin/koha/patroncards/image-manage.pl" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="brief">
                                 <div class="hint">Only PNG, GIF, JPEG, XPM formats are supported. Maximum image size is 2MB.</div>
                                 <ol>
@@ -83,6 +84,7 @@
                     <h2>Delete images</h2>
                         [% IF ( TABLE ) %]
                         <form name="delete_images" method="post" action="/cgi-bin/koha/patroncards/image-manage.pl" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="brief">
                                 <div class="hint">
                                     Select one or more images to delete.
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
index 6bcd9993e2..71451ab4b8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
@@ -62,6 +62,7 @@
                     [% END %]
             </h3>
             <form id="exportingf" name="exporting" method="post" action="/cgi-bin/koha/patroncards/print.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="export" />
                 <input type="hidden" name="referer" value="[% referer | html %]" />
                 [% FOREACH batch_id IN batch_ids %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt
index 228d6eecd3..ac6efc434d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt
@@ -45,6 +45,7 @@
                 </div>
                 [% END %]
                 <form method="post" action="/cgi-bin/koha/plugins/plugins-upload.pl" enctype="multipart/form-data">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="brief">
                         <div class="hint"><strong>NOTE:</strong> Only KPZ file format is supported.</div>
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt
index 3978cbed53..05ad8acead 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt
@@ -44,6 +44,7 @@
                 </p>
                 [% IF ( CAN_user_parameters_manage_cash_registers ) %]
                     <form action="/cgi-bin/koha/admin/cash_registers.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="add_form" />
                         <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button>
                     </form>
@@ -63,6 +64,7 @@
         [% END %]
 
         <form name="payForm" id="payForm" method="post" action="/cgi-bin/koha/pos/pay.pl">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="row">
 
                 <div class="col-md-6">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt
index 3ff6f0ed31..91c14519a8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt
@@ -41,6 +41,7 @@
                     </p>
                     [% IF ( CAN_user_parameters_manage_cash_registers ) %]
                         <form action="/cgi-bin/koha/admin/cash_registers.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="add_form" />
                             <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button>
                         </form>
@@ -309,6 +310,7 @@
     <!-- Issue refund modal -->
     <div class="modal" id="issueRefundModal" tabindex="-1" role="dialog" aria-labelledby="issueRefundLabel">
         <form id="refund_form" method="post" enctype="multipart/form-data" class="validated">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="accountline" value="" id="refundline">
             <div class="modal-dialog" role="document">
                 <div class="modal-content">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt
index d0b7cec62c..5b2f64e372 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt
@@ -38,6 +38,7 @@
                             </p>
                             [% IF ( CAN_user_parameters_manage_cash_registers ) %]
                                 <form action="/cgi-bin/koha/admin/cash_registers.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="add_form" />
                                     <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button>
                                 </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_overdue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_overdue.tt
index 54e5820321..f29328acc0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_overdue.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_overdue.tt
@@ -43,6 +43,7 @@
             [% IF recalls.count %]
                 <div class="page-section">
                     <form method="post" action="/cgi-bin/koha/recalls/recalls_overdue.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="cancel_multiple_recalls">
                         <input type="checkbox" id="select_all"> <span id="select_all_text">Select all</span>
                         [% INCLUDE 'recalls.inc' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_queue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_queue.tt
index d159d8b735..16b427b4e8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_queue.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_queue.tt
@@ -43,6 +43,7 @@
             [% IF recalls.count %]
                 <div class="page-section">
                     <form method="post" action="/cgi-bin/koha/recalls/recalls_queue.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="cancel_multiple_recalls">
                         <input type="checkbox" id="select_all"> <span id="select_all_text">Select all</span>
                         [% INCLUDE 'recalls.inc' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt
index f27eccfcc5..498f95700c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt
@@ -125,6 +125,7 @@
                                 </td>
                                 <td class="recall-action">
                                     <form action="/cgi-bin/koha/recalls/recalls_to_pull.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="recall_id" value="[% recall.first_recall.id | html %]">
                                         <input type="hidden" name="op" value="cancel">
                                         [% IF recall.first_recall.in_transit %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt
index 52aaebb8ff..d6aea43f45 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt
@@ -79,6 +79,7 @@
                                                 <td class="recall-library">[% recall.library.branchname | html %]</td>
                                                 <td class="recall-action actions">
                                                     <form action="/cgi-bin/koha/recalls/recalls_waiting.pl" method="post">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="recall_id" value="[% recall.id | html %]">
                                                         <input type="hidden" name="op" value="modify">
                                                         <fieldset class="action">
@@ -123,6 +124,7 @@
                                                     <td class="recall-library">[% recall.library.branchname | html %]</td>
                                                     <td class="recall-action actions">
                                                         <form action="/cgi-bin/koha/recalls/recalls_waiting.pl" method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="recall_id" value="[% recall.id | html %]">
                                                             <input type="hidden" name="op" value="modify">
                                                             <fieldset class="action">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/request.tt
index 6a552334cf..195e76bdea 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/request.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/request.tt
@@ -43,6 +43,7 @@
         [% IF recalls.count %]
             <div class="page-section">
                 <form method="post" action="/cgi-bin/koha/recalls/request.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="cancel_multiple_recalls">
                     <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]">
                     <input type="checkbox" id="select_all"> <span id="select_all_text">Select all</span>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt
index c4a8816e9a..e24e015df5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt
@@ -107,6 +107,7 @@
 	[% END %]
 [% ELSE %]
 	<form method="post" action="/cgi-bin/koha/reports/acquisitions_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
 	<legend>Acquisitions statistics</legend>
 	<table>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt
index f8c9b49e8a..638aef9970 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt
@@ -117,6 +117,7 @@
 [% ELSE %]
     <h1>Patrons with the most checkouts</h1>
 	<form method="post" action="/cgi-bin/koha/reports/bor_issues_top.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
         <ol>
             <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt
index 142414e1bf..4002da8d2a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt
@@ -72,6 +72,7 @@
 [% ELSE %]
     <h1>Patrons with no checkouts</h1>
     <form method="post" action="/cgi-bin/koha/reports/borrowers_out.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
 		<ol>
             <li><label for="patroncategory">Patron category: </label> <select name="Filter" id="patroncategory"><option value="" > Any category code</option>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt
index 6f5adf7bfb..2b77193607 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt
@@ -95,6 +95,7 @@
 [% ELSE %]
 
 	<form method="post" action="/cgi-bin/koha/reports/borrowers_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows"><legend>Patrons statistics</legend>
 	<table>
 		<thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt
index 8fffadaa06..6a3b402ddd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt
@@ -64,6 +64,7 @@
 
     <h1>Cash register statistics</h1>
     <form method="post" action="/cgi-bin/koha/reports/cash_register_stats.pl" id="frmCashRegister">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <legend>Cash register statistics [% beginDate | $KohaDates %] to [% endDate | $KohaDates %]</legend>
             <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
index f8c421ab15..bafe621a3e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
@@ -91,6 +91,7 @@
 [% ELSE %]
     <h1>Most-circulated items</h1>
 	<form method="post" action="/cgi-bin/koha/reports/cat_issues_top.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
 	<ol>
         <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt
index deb5f37331..1f86e2dea1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt
@@ -164,6 +164,7 @@
                     <h1>Items with no checkouts</h1>
 
                     <form method="post" action="/cgi-bin/koha/reports/catalogue_out.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <ol>
                                 <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt
index 486ad778d7..ba997b8a52 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt
@@ -99,6 +99,7 @@
 [% ELSE %]
 
 	<form method="post" action="/cgi-bin/koha/reports/catalogue_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
 	<legend>Catalog statistics</legend>
 	<table>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
index ba65178303..8d7e759e18 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
@@ -88,6 +88,7 @@
             <div class="page-section">
                 <h2>Current terms</h2>
                 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="phase" value="View Dictionary" />
                     [% IF ( areas ) %]
                         Filter by area
@@ -136,6 +137,7 @@
 [% IF ( new_dictionary ) %]
 <h3>Add new definition</h3>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows"><legend>Step 1 of 5: Name the new definition</legend><ol>
 <li>
 <label for="definition_name">Definition name:</label>
@@ -155,6 +157,7 @@
 [%- IF ( step_2 ) -%]
 <h3>Add new definition</h3>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
   <fieldset class="rows">
     <legend>Step 2 of 5: Choose the area</legend>
     <ol>
@@ -177,6 +180,7 @@
 [% IF ( step_3 ) %]
 <h3>Add new definition</h3>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">      
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows">
 <legend>Step 3 of 5: Choose a column</legend>
 <input type="hidden" name="area" value="[% area | html %]" />
@@ -213,6 +217,7 @@
 [% IF ( step_4 ) %]
 <h3>Add new definition</h3>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows">
 <legend>Step 4 of 5: Specify a value</legend>
 <input type="hidden" name="area" value="[% area | html %]" />
@@ -262,6 +267,7 @@
 
 [% IF ( step_5 ) %]
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="area" value="[% area | html %]" />
 <input type="hidden" name="definition_name" value="[% definition_name | html %]" />
 <input type="hidden" name="definition_description" value="[% definition_description | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
index 1b639d26c6..a1a6e06635 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
@@ -267,6 +267,7 @@
                                     [% END %]
 
                                     <form action="/cgi-bin/koha/reports/guided_reports.pl" id="reports_form" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="phase" value="Delete Multiple" />
                                         <table id="table_reports">
                                             <thead>
@@ -515,6 +516,7 @@
                 [% IF ( build2 ) %]
                     <h1>Build a report</h1>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="public" value="[% public | html %]" />
                         <input type="hidden" name="cache_expiry" value="[% cache_expiry | html %]" />
@@ -546,6 +548,7 @@
                     <p>Note: Be careful selecting when selecting columns. If your choice is too broad it could result in a very large report that will either not complete, or slow your system down.</p>
 
                     <form id="column_submit" action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="public" value="[% public | html %]" />
@@ -598,6 +601,7 @@
                 [% IF ( build4 ) %]
                     <h1>Build a report</h1>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" >
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="column" value="[% column | html %]" />
@@ -686,6 +690,7 @@
                     <h1>Build a report</h1>
                     <h3>Step 5 of 6: Pick which columns to total</h3>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="column" value="[% column | html %]" />
@@ -724,6 +729,7 @@
                     <h1>Build a report</h1>
                     <h3>Step 6 of 6: Choose how you want the report ordered</h3>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="area" value="[% area | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="column" value="[% column | html %]" />
@@ -766,6 +772,7 @@
                     </p>
 
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="sql" value="[% sql | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="public" value="[% public | html %]" />
@@ -779,6 +786,7 @@
 
                 [% IF ( save ) %]
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" id="sql_report_form">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="sql" value="[% sql | html %]" />
                         <input type="hidden" name="type" value="[% type | html %]" />
                         <input type="hidden" name="area" value="[% area | html %]" />
@@ -936,6 +944,7 @@
                         [% IF ( execute ) %]
                             [% UNLESS ( errors ) %]
                                 <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/batch_record_modification.pl" id="batch_record_modification" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="recordtype" value="biblio" />
                                     <input type="hidden" name="op" value="list" />
                                     [% # Preserve the whitespace of the following textarea in order to format the values correctly %]
@@ -945,6 +954,7 @@
                                 </form>
 
                                 <form method="POST" action="/cgi-bin/koha/tools/batch_delete_records.pl" id="batch_record_deletion" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="recordtype" value="biblio" />
                                     <input type="hidden" name="op" value="list" />
                                     [% # Preserve the whitespace of the following textarea in order to format the values correctly %]
@@ -954,6 +964,7 @@
                                 </form>
 
                                 <form method="POST" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_modification" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="show" />
                                     [% FOREACH result IN results %]
                                         [% FOREACH cells IN result.cells %]
@@ -969,6 +980,7 @@
                                 </form>
 
                                 <form method="POST" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_deletion" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="show" />
                                     <input type="hidden" name="del" value="1" />
                                     [% FOREACH result IN results %]
@@ -999,6 +1011,7 @@
                                 </form>
 
                                 <form method="POST" action="/cgi-bin/koha/tools/modborrowers.pl" id="batch_patron_modification" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="show" />
                                     [% # Preserve the whitespace of the following textarea in order to format the values correctly %]
                                     <textarea style="display:none" name="cardnumberlist" id="cardnumberlist">
@@ -1007,6 +1020,7 @@
                                 </form>
 
                                 <form action="/cgi-bin/koha/patroncards/edit-batch.pl" id="patron_card_creator" method="post" target="_blank">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="add" />
                                     <input type="hidden" name="batch_id" value="0" />
                                     [% # Preserve the whitespace of the following textarea in order to format the values correctly %]
@@ -1230,6 +1244,7 @@
                 [% IF ( create ) %]
                     <h1>Create from SQL</h1>
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" id="sql_report_form">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <legend>Create report from SQL</legend>
                             <ol>
@@ -1348,6 +1363,7 @@
 
                 [% IF ( editsql ) %]
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" id="sql_report_form">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="id" value="[% id | html %]"/>
                         <fieldset class="rows">
                             <legend><h1>Edit SQL report</h1></legend>
@@ -1414,6 +1430,7 @@
 
                 [% IF ( errors ) %]
                     <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <div class="dialog alert">
                             <strong>The following error was encountered:</strong><br />
                             [% FOREACH error IN errors %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt
index efe2023c40..3dc48db489 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt
@@ -88,6 +88,7 @@
 [% ELSE %]
 
 	<form method="post" action="/cgi-bin/koha/reports/issues_avg_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
 	<legend>Average checkout period statistics</legend>
 	<table>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt
index 0cce6b7829..2b60400740 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt
@@ -114,6 +114,7 @@
 [% ELSE %]
 
     <form method="post" action="/cgi-bin/koha/reports/issues_stats.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
 	<legend>Circulation statistics</legend><table>
         <thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt
index c2b4cf36e6..3ea84c170b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt
@@ -143,6 +143,7 @@
 	[% ELSE %]
 	
 	<form name="f" action="/cgi-bin/koha/reports/itemslost.pl" method="post">
+	    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
         <ol>
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
index f8e8396c6c..46a9170967 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
@@ -76,6 +76,7 @@
 [% ELSE %]
         <h1>View a count of items held at your library grouped by item type</h1>
         <form method="post" action="/cgi-bin/koha/reports/manager.pl?report_name=itemtypes">
+            [% INCLUDE 'csrf-token.inc' %]
           <fieldset class="rows">
             <ol>
               <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt
index 90c8f90cab..aca486a081 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt
@@ -103,6 +103,7 @@
     [% END %]
 [% ELSE %]
         <form name="f" action="/cgi-bin/koha/reports/orders_by_fund.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
         <legend>Filters</legend>
         <ol><li><label for="budgetfilter">Fund: </label>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt
index f969c88100..09597b82f6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt
@@ -113,6 +113,7 @@
 [% ELSE %]
 
     <form method="post" action="/cgi-bin/koha/reports/reserves_stats.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
 	<legend>Holds statistics</legend><table>
         <thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt
index 83507f2895..42a40aefd4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt
@@ -87,6 +87,7 @@
 
 [% ELSE %]
 	<form method="post" action="/cgi-bin/koha/reports/serials_stats.pl">
+	    [% INCLUDE 'csrf-token.inc' %]
 
 	<fieldset class="rows">
 		<ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
index d15e16743c..eabc15d0ad 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
@@ -224,6 +224,7 @@
                             [% IF clubcount %]
                                 [% WRAPPER tab_panel tabname="holds_clubsearch_pane" %]
                                     <form id="holds_clubsearch" action="request.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <div class="hint">Enter club ID or partial name:</div>
                                         <input type="text" size="40" id="club" class="focus" name="findclub" autocomplete="off" />
                                         <input type="submit" class="btn btn-primary" value="Search" />
@@ -246,6 +247,7 @@
                 <fieldset class="rows">
                     <legend>Hold details</legend>
                     <form action="/api/v1/clubs/[% club.id | html %]/holds" method="post" name="form" id="club-request-form">
+                        [% INCLUDE 'csrf-token.inc' %]
 
                         [% IF ( multi_hold ) %]
                             <input type="hidden" name="request" value="any"/>
@@ -491,6 +493,7 @@
                 <fieldset class="rows">
                     <legend>Hold details</legend>
                     <form action="placerequest.pl" method="post" name="form" id="hold-request-form">
+                        [% INCLUDE 'csrf-token.inc' %]
 
                         <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                         [% FOREACH biblionumber IN biblionumbers %]
@@ -1046,6 +1049,7 @@
                 [% END %]
                 [% IF ( reserveloop ) %]
                     <form id="existing_holds" name="T[% time | html %]" action="modrequest.pl" method="post" style="display:block">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF ( multi_hold ) %]
                             [% FOREACH biblionumber IN biblionumbers %]
                             <input type="hidden" name="biblionumber" value="[% biblionumber | html %]"/>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
index 9d48ea0383..c3d0b043f1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
@@ -91,6 +91,7 @@
 
               <div>
                 <form action="addItems.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="brief">
                         <legend>Add or remove items</legend>
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt
index 0ef926b352..46168d9df2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt
@@ -124,6 +124,7 @@
                     [% END %]
 
                     <form action="editCollections.pl" method="post" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF ( previousActionEdit ) %]
                             <input type="hidden" name="action" value="update" />
                             <input type="hidden" name="colId" value="[% editColId | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt
index 157fa1afc2..846fc70887 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt
@@ -72,6 +72,7 @@
                 [% ELSE %]
                     <div>
                         <form action="transferCollection.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="colId" value="[% colId | html %]" />
                             <fieldset class="rows">
                                 <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search.tt
index 37ae608d42..3835e31c6d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search.tt
@@ -9,6 +9,7 @@
 
 <h1>Serial subscription: search for vendor </h1>
     <form action="/cgi-bin/koha/serials/acqui-search-result.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <label for="text">Vendor name: </label>
         <input id="text" type="text"  size="25" name="supplier" autofocus="autofocus" />
         <input type="submit" class="btn btn-primary" value="OK" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt
index caf31d85db..c9c6de9e6b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt
@@ -78,6 +78,7 @@
                 [% END %]
 
                 <form id="claims" name="claims" action="claims.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset>
                         <label for="supplierid">Vendor: </label>
                         <select id="supplierid" name="supplierid">
@@ -117,6 +118,7 @@
 
                     <fieldset>
                         <form action="claims.pl" method="post" id="claims_form">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <table id="claimst">
                                 <thead>
                                     <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt
index 56bc219937..62fbd984ed 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt
@@ -33,6 +33,7 @@
 <h1>Preview routing list for <em>[% title | html %]</em></h1>
 
 <form method="post" action="routing-preview.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" id="subscriptionid" name="subscriptionid" value="[% subscriptionid | html %]" />
     <input type="hidden" id="issue_escaped" name="issue_escaped" value="[% issue_escaped | html %]" />
 <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt
index 0887b890fb..797b2aa618 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt
@@ -43,6 +43,7 @@
 [% END %]
 
 <form method="post" action="routing.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="op" value="save" />
 <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
 <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt
index fe4d9dba50..27a292bba1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt
@@ -144,6 +144,7 @@
 
                 [% IF ( years ) %]
                     <form name="edition" action="/cgi-bin/koha/serials/serials-edit.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% WRAPPER tabs id= "subscription_years" %]
                             [% WRAPPER tabs_nav %]
                                 [% FOREACH year IN years %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt
index f67b643344..636ff5966c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt
@@ -110,6 +110,7 @@ $(document).ready(function() {
 
 [% IF internalnotes %]<p>Nonpublic note: [% internalnotes | html | html_line_break %]</p>[% END %]
 <form method="post" name="f" class="noEnterSubmit" action="serials-edit.pl" id="serials_edit">
+    [% INCLUDE 'csrf-token.inc' %]
 
 [% IF ( Errors ) %]
 <div class="dialog alert">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
index e4f4f7cfdc..49df5180e1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
@@ -46,6 +46,7 @@
 
     [% BLOCK subscriptions_table %]
         <form method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             [% IF closed %]
                 [% SET tab = 'closed' %]
             [% ELSE %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
index ae38d7b641..bfddf9ce6d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
@@ -54,6 +54,7 @@ fieldset.rows table { clear: none; margin: 0; }
         </div>
     </div>
     <form method="post" id="subscription_add_form" name="f" action="/cgi-bin/koha/serials/subscription-add.pl" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
                 <div class="row" id="page_1">
                     <div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
                         [% IF ( modify ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt
index ee1a6c7ff0..b8bbc7278d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt
@@ -77,6 +77,7 @@
                     </div>
 
                     <form method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% FOREACH subscription IN subscriptions %]
                             <input type="hidden" name="subscriptionid" value="[% subscription.subscriptionid | html %]"/>
                         [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
index 59130e7141..a79dea1b0c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
@@ -63,6 +63,7 @@
                         </ul>
 
                         <form method="post" action="/cgi-bin/koha/serials/subscription-detail.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
                             <input type="hidden" name="issueconfirmed" value="1" />
                             <input type="hidden" name="op" value="del" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
index d386f51d6f..ca22b6a859 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
@@ -43,6 +43,7 @@
           <h1>Edit frequency: [% description | html %]</h1>
         [% END %]
         <form action="/cgi-bin/koha/serials/subscription-frequencies.pl" id="add_frequency_form" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
           [% IF (modify) %]
             <input type="hidden" name="id" value="[% id | html %]" />
             <input type="hidden" name="op" value="savemod" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt
index a2e161443b..f30f43832a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt
@@ -35,6 +35,7 @@
 
         <div id="subscription_form_history">
           <form method="post" action="/cgi-bin/koha/serials/subscription-history.pl">
+              [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="mod" />
             <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
             <p>Hint : you can update the serial history manually. This can be useful for an old subscription or to clean the existing history. Modify those fields with care, as future serial receive will continue to update them automatically.</p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt
index c3cac67cbb..5d9bd8341f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt
@@ -61,6 +61,7 @@
           [% END %]
 
           <form action="/cgi-bin/koha/serials/subscription-numberpatterns.pl" method="post" class="validated">
+              [% INCLUDE 'csrf-token.inc' %]
             [% IF (new) %]
               <input type="hidden" name="op" value="savenew" />
             [% ELSE %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt
index 1ad3540a20..da6a1f09f1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt
@@ -30,6 +30,7 @@
 [% ELSE %]
 
 <form name="f" action="/cgi-bin/koha/serials/subscription-renew.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 		<input type="hidden" name="op" value="renew" />
 		<input type="hidden" name="subscriptionid" value="[% subscription.subscriptionid | html %]" />
 		<fieldset class="rows"><legend>Subscription renewal for [% subscription.bibliotitle | html %]</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt
index fef5a7499c..89cef4835e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt
@@ -71,6 +71,7 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
                 [% INCLUDE 'messages.inc' %]
 <h1>Tags</h1>
 <form method="post" action="/cgi-bin/koha/tags/review.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     <h4>
     [% IF ( filter_approved_all ) %]<span>Displaying all terms</span>[% END %]
     [% IF ( filter_approved_ok ) %]<span>Displaying approved terms</span>[% END %]
@@ -212,6 +213,7 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
    <h4>Check lists</h4>
    <div class="description">Enter a word or phrase to check against approved/rejected lists: </div>
    <form method="post" action="/cgi-bin/koha/tags/review.pl">
+       [% INCLUDE 'csrf-token.inc' %]
    <input type="text" size="14" name="test" id="test" />
    <fieldset class="action"><button type="submit" value="Test" class="approval_btn btn btn-default btn-sm" id="test_button" name="op-test"><i class="fas fa-check-square" aria-hidden="true"></i> Test</button></fieldset>
    <div id="verdict">
@@ -232,6 +234,7 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
 <div class="col-sm-2 col-sm-pull-10">
     <aside>
 <form method="post" action="/cgi-bin/koha/tags/review.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="brief">
   <h4>Filters</h4>
 	<ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt
index f58691382a..6c159fa17a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt
@@ -48,6 +48,7 @@
 
         [% IF ( op == 'edit_form' ) %]
           <form method="post" id="rules_form" action="/cgi-bin/koha/tools/automatic_item_modification_by_age.pl">
+              [% INCLUDE 'csrf-token.inc' %]
             <h1>Rules for automatic item modifications by age</h1>
             <div id="toolbar" class="btn-toolbar">
                 <div class="btn-group">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
index 71b997226f..ffa1addbb9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
@@ -132,6 +132,7 @@
 
 
 <form name="f" action="batchMod.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
      <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber | html %]" />
      <input type="hidden" name="op" value="[% op | html %]" />
      <input type="hidden" name="searchid" value="[% searchid | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
index b773f0d445..1b442b5fcf 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
@@ -157,6 +157,7 @@
 
 
         <form name="f" action="batchMod.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="op" value="[% op | html %]" />
             <input type="hidden" name="searchid" value="[% searchid | html %]" />
             <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt
index 5ed55b0349..ecce87d44f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt
@@ -45,6 +45,7 @@
 
                 <h1>Batch item [% IF ( del ) %]deletion[% ELSE %]modification[% END %]</h1>
                         <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/batchMod.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 <legend>Use a file</legend>
                                   <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
index 27d03a8ba1..770020cdc4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
@@ -83,6 +83,7 @@
   [% END %]
   [% IF op == 'form' %]
     <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/batch_delete_records.pl" id="record_ids_selection">
+        [% INCLUDE 'csrf-token.inc' %]
       <fieldset class="rows">
         <legend>Record type</legend>
         <ol>
@@ -194,6 +195,7 @@
           | <a id="clearlinkedtobiblio" href="#">Clear used authorities</a>
         </div>
         <form action="/cgi-bin/koha/tools/batch_delete_records.pl" method="post" id="selectauths">
+            [% INCLUDE 'csrf-token.inc' %]
           <table id="authorities" class="records">
             <thead>
               <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt
index 9b90f72ebb..f430594de5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt
@@ -83,6 +83,7 @@
 
                     [% IF view == 'form' %]
                         <form method="post" action="/cgi-bin/koha/tools/batch_extend_due_dates.pl" id="extend_due_dates_form">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 <legend>Checkout criteria:</legend>
                                 <ol>
@@ -157,6 +158,7 @@
                     [% ELSIF view == 'list' %]
                         [% IF checkouts.count %]
                             <form action="/cgi-bin/koha/tools/batch_extend_due_dates.pl" method="post" id="process">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <div class="page-section">
                                     <div class="btn-toolbar selections-toolbar">
                                         <a id="selectall" href="#"><i class="fa fa-check"></i> Select all</a>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt
index 26defb4f22..68151f05a0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt
@@ -86,6 +86,7 @@
 
                     [% IF view == 'form' %]
                         <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/batch_record_modification.pl" id="record_ids_selection">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 <legend>Record type</legend>
                                 <ol class="radio">
@@ -168,6 +169,7 @@
                     [% ELSIF view == 'list' %]
                         [% IF records %]
                             <form action="/cgi-bin/koha/tools/batch_record_modification.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <label for="marc_modification_template_id" class="required">Modify record using the following template: </label>
                                 <select name="marc_modification_template_id" id="marc_modification_template_id" required="required">
                                     <option value="">Select a template</option>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt
index 532575931a..cf78a2e5b6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt
@@ -101,6 +101,7 @@
 </div>
 <div id="step1">
     <form name="f1" id="delete_patrons_form" action="/cgi-bin/koha/tools/cleanborrowers.pl" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
     <fieldset>
     <legend>Delete patrons</legend>
         <h3><input id="checkborrower" type="checkbox" name="checkbox" value="borrower" /><label for="checkborrower"> Verify you want to delete patrons</label></h3>
@@ -178,6 +179,7 @@
 <!-- STEP 2 START -->
 <div id="step2">
         <form name="f2" action="/cgi-bin/koha/tools/cleanborrowers.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
 
         <div class="dialog alert">
             <h3>Warning</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
index 0caded1edd..cff4a1c1d4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
@@ -151,6 +151,7 @@
     [% END %]
 
     <form action="/cgi-bin/koha/tools/csv-profiles.pl" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id | html %]" />
         <fieldset class="rows">
@@ -279,6 +280,7 @@
         [% IF csv_profile %]
             <h1>[% tx("Delete CSV profile '{csv_profile_name}'?", {csv_profile_name = csv_profile.profile }) | html %]</h1>
             <form action="/cgi-bin/koha/tools/csv-profiles.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id | html %]" />
                 <button type="submit" class="approve"><i class="fa fa-check" aria-hidden="true"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt
index a766bed264..6e2b8e74d6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt
@@ -69,6 +69,7 @@
             </p>
 
             <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/export.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <fieldset class="rows">
                     <legend> Select records to export </legend>
                     <ol>
@@ -199,6 +200,7 @@
 
         [% WRAPPER tab_panel tabname="auths" %]
             <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/export.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <fieldset class="rows">
                     <legend> Select records to export </legend>
                     <ol>
@@ -274,6 +276,7 @@
         [% IF ( allow_db_export ) %]
             [% WRAPPER tab_panel tabname="db" %]
                 <form method="post" class="clearfix" action="/cgi-bin/koha/tools/export.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <p><strong>Note : This export file will be very large, and is generated nightly.</strong></p>
                     <fieldset class="rows">
                         <legend> Choose a file </legend>
@@ -300,6 +303,7 @@
         [% IF ( allow_conf_export ) %]
             [% WRAPPER tab_panel tabname="conf" %]
                 <form method="post" class="clearfix" action="/cgi-bin/koha/tools/export.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <p><strong>Note : This export file will be very large, and is generated nightly.</strong></p>
                     <fieldset class="rows">
                         <legend> Choose a file </legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt
index d4df1ea17b..b65c657e32 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt
@@ -47,6 +47,7 @@
 
                             <div class="panel" id="showHoliday">
                                 <form action="/cgi-bin/koha/tools/exceptionHolidays.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" id="showHolidayType" name="showHolidayType" value="" />
                                     <fieldset class="brief">
                                         <h3>Edit this holiday</h3>
@@ -143,6 +144,7 @@
                             <!-- Panel to deal with new holidays -->
                             <div class="panel" id="newHoliday">
                                 <form action="/cgi-bin/koha/tools/newHolidays.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="brief">
                                         <h3>Add new holiday</h3>
                                         <ol>
@@ -234,6 +236,7 @@
                             </div>
                             <div style="margin-top: 2em;">
                                 <form action="copy-holidays.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="from_branchcode" value="[% branch | html %]" />
                                     <label for="branchcode">Copy holidays to:</label>
                                     <select id="branchcode" name="branchcode">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt
index 712d9f234c..6634c6ce2a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt
@@ -69,6 +69,7 @@
        [% UNLESS op %]
 
     <form method="post" id="inventory_form" action="/cgi-bin/koha/tools/inventory.pl" enctype="multipart/form-data">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
           <legend>Use a barcode file</legend>
           <ol>
@@ -245,6 +246,7 @@
     [% END %]
     [% IF (op) %]
     <form method="post" action="/cgi-bin/koha/tools/inventory.pl">
+        [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="minlocation" value="[% minlocation | html %]" />
     <input type="hidden" name="maxlocation" value="[% maxlocation | html %]" />
     <input type="hidden" name="location" value="[% location | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
index 3dea27a8a5..6ba4a1955f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
@@ -244,6 +244,7 @@
                                             <td class="actions">
                                                 [% IF !independant_branch || !lette.branchcode %]
                                                     <form method="post" action="/cgi-bin/koha/tools/letter.pl">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="op" value="copy_form" />
                                                         <input type="hidden" name="oldbranchcode" value="[% lette.branchcode | html %]" />
                                                         <input type="hidden" name="module" value="[% lette.module | html %]" />
@@ -304,6 +305,7 @@
                     </div> <!-- /#toolbar -->
 
                     <form id="add_notice" name="Aform" method="post" enctype="multipart/form-data" class="validate">
+                        [% INCLUDE 'csrf-token.inc' %]
                         [% IF add_form %]
                             <input type="hidden" name="op" id="op" value="add_validate" />
                         [% ELSE %]
@@ -503,6 +505,7 @@
                 [% IF ( add_validate or copy_validate) %]
                     Data recorded
                     <form action="[% action | html %]" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="submit" class="btn btn-primary" value="OK" />
                     </form>
                 [% END %]
@@ -527,6 +530,7 @@
                             </tr>
                         </table>
                         <form action="[% action | html %]" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_confirmed">
                             <input type="hidden" name="branchcode" value="[% letter.branchcode | html %]" />
                             <input type="hidden" name="code" value="[% letter.code | html %]" />
@@ -543,6 +547,7 @@
                 [% IF ( delete_confirmed ) %]
                     <span>Data deleted</span>
                     <form action="[% action | html %]" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                     <input type="submit" class="btn btn-primary" value="OK" />
                     </form>
                 [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt
index ade8c88ca5..6aec448af4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt
@@ -121,6 +121,7 @@
                     [% IF ( batch_info ) %]
                         [% IF ( can_commit ) %]
                             <form method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="op" value="redo-matching" />
                                 <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
                                 <input type="hidden" name="current_matcher_id" value="[% current_matcher_id | html %]" />
@@ -269,6 +270,7 @@
                         <div>
                             [% IF ( can_commit ) %]
                                 <form method="post" id="import_batch_form">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="commit-batch" />
                                     <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
                                     [% IF ( record_type != 'auth' ) %]
@@ -305,6 +307,7 @@
                             [% END # /IF can_commit %]
                             [% IF ( can_revert ) %]
                                 <form method="post" id="revert_batch_form">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="revert-batch" />
                                     <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
                                     <fieldset class="action"><input type="submit" class="button" name="mainformsubmit" value="Undo import into catalog" /></fieldset>
@@ -372,12 +375,14 @@
                                             <td class="actions">
                                                 [% IF ( batch_lis.can_clean ) %]
                                                     <form method="post" name="clean_batch_[% batch_lis.import_batch_id | html %]" id="clean_batch_[% batch_lis.import_batch_id | html %]" class="batch_form batch_clean">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="import_batch_id" value="[% batch_lis.import_batch_id | html %]" />
                                                         <input type="hidden" name="op" value="clean-batch" />
                                                         <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-eraser"></i> Clean</button>
                                                     </form>
                                                 [% ELSIF ( batch_lis.import_status == 'cleaned' ) %]
                                                     <form method="post" action="/cgi-bin/koha/tools/manage-marc-import.pl" name="delete_batch_[% batch_lis.import_batch_id | html %]" id="delete_batch_[% batch_lis.import_batch_id | html %]" class="batch_form batch_delete">
+                                                        [% INCLUDE 'csrf-token.inc' %]
                                                         <input type="hidden" name="import_batch_id" value="[% batch_lis.import_batch_id | html %]" />
                                                         <input type="hidden" name="op" value="delete-batch" />
                                                         <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-trash-can"></i> Delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt
index d433ae37a9..c2d706ec72 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt
@@ -214,6 +214,7 @@
                     [% END # /IF ActionsLoop %]
 
                     <form method="post" action="/cgi-bin/koha/tools/marc_modification_templates.pl" id="add_action" >
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset>
                             <legend id="modaction_legend">Add a new action</legend>
                             <div id="warning_multivalued" style="color:red; display:none;">You have chosen a condition on the same field as the original field. If your records contain multivalued fields it is highly recommended not to do that.</div>
@@ -323,6 +324,7 @@
                     <h2 id="LabelcreateTemplate">Create a new template</h2>
                 </div>
                 <form method="post" action="/cgi-bin/koha/tools/marc_modification_templates.pl" id="add_template" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <div class="modal-body">
                         <fieldset>
                             <p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt
index 4b316e921e..43b5ca4100 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt
@@ -63,6 +63,7 @@
                 [% IF ( op == 'show_form' ) %]
                     <h1>Batch patron modification</h1>
                     <form id="patron_batchmod_form" method="post" enctype="multipart/form-data" action="/cgi-bin/koha/tools/modborrowers.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="show" />
 
                         [% WRAPPER tabs id= "batch_patron_options" %]
@@ -221,6 +222,7 @@
 
                     [% IF ( op == 'show' ) %]
                     <form name="f" action="modborrowers.pl" method="post" id="batchmod-borrowers-form">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="do" />
                         [% IF ( borrowers ) %]
                             <div class="btn-toolbar selections-toolbar"><a id="selectallbutton" href="#"><i class="fa fa-check"></i> Select all</a> | <a id="clearallbutton" href="#"><i class="fa fa-times"></i> Clear all</a></div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt
index 4b37c8908d..3fe96f9c86 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt
@@ -42,6 +42,7 @@
             <p>Columns must be filled left to right: if the first column is blank, other columns will be ignored. </p>
         </div>
             <form method="post" action="/cgi-bin/koha/tools/overduerules.pl" id="selectlibrary">
+                [% INCLUDE 'csrf-token.inc' %]
             <label for="branch">Select a library:</label>
                 <select id="branch" name="branch">
                     <option value="">Default</option>
@@ -68,6 +69,7 @@
             [% END %]
             [% IF ( table ) %]
                 <form method="post" action="/cgi-bin/koha/tools/overduerules.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="save" />
                     <input type="hidden" name="branch" value="[% branch | html %]" />
                     <h3>Rules for overdue actions: [% IF ( branch ) %][% Branches.GetName( branch ) | html %][% ELSE %] default library [% END %]</h3>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt
index 12834054bc..0bb60dc9fb 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt
@@ -56,6 +56,7 @@
 
             [% IF ( problem_reports.count ) %]
                 <form id="mark_selected" method="post" action="/cgi-bin/koha/tools/problem-reports.pl">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <div id="toolbar" class="btn-toolbar">
                         <button type="submit" class="btn btn-default markviewed" name="mark_selected-viewed" value="viewed" disabled="disabled"><i class="fa-solid fa-eye"></i> Mark viewed</button>
                         <button type="submit" class="btn btn-default markclosed" name="mark_selected-closed" value="closed" disabled="disabled"><i class="fa fa-times-circle"></i> Mark closed</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt
index df9f09392e..d3386866cd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt
@@ -83,6 +83,7 @@
 [% IF op == 'add_form' %]
     <h1>[% IF quote %]Modify quote[% ELSE %]New quote[% END %]</h1>
     <form action="/cgi-bin/koha/tools/quotes.pl" id="Aform" name="Aform" class="validated" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <input type="hidden" name="op" value="add_validate" />
             <ol>
@@ -109,6 +110,7 @@
 [% IF op == 'delete_confirm' %]
     <div class="dialog alert">
         <form action="/cgi-bin/koha/tools/quotes.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <h1>Are you sure you want to delete the following quote?</h1>
             [% quote.source | html %] - [% quote.text | html %]
             <input type="hidden" name="op" value="delete_confirmed" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt
index 1561117f34..36c589f062 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt
@@ -40,6 +40,7 @@
 [% END %]
 
 <form name="form1" action="scheduler.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="mode" value="job_add" />
 
 <fieldset class="rows">
@@ -89,6 +90,7 @@
 </tr>
 [% FOREACH JOB IN JOBS %]
 <form action="scheduler.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 <input type="hidden" name="mode" value="job_change" />
 
 <tr>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt
index abe3406778..98910230c9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt
@@ -89,6 +89,7 @@
     <li>You can enter a name for this import. It may be useful, when creating a record, to remember where the suggested MARC data comes from!</li>
 </ul>
 <form method="post" id="uploadfile" enctype="multipart/form-data">
+    [% INCLUDE 'csrf-token.inc' %]
 <fieldset class="rows" id="uploadform">
 <legend>Upload a file to stage</legend>
 <ol>
@@ -129,6 +130,7 @@
 </fieldset>
 
     <form method="post" id="processfile" enctype="multipart/form-data">
+        [% INCLUDE 'csrf-token.inc' %]
 [% IF basketno && booksellerid %]
     <input type="hidden" name="basketno" id="basketno" value="[% basketno | html %]" />
     <input type="hidden" name="booksellerid" id="booksellerid" value="[% booksellerid | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt
index 0dab2527bd..30787674d6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt
@@ -182,6 +182,7 @@
                     [% END %]
 
                     <form id="rota_form" method="post" enctype="multipart/form-data" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <ol>
                                 <li>
@@ -243,6 +244,7 @@
                     <!-- Add stage modal -->
                     <div class="modal" id="addStageModal" tabindex="-1" role="dialog" aria-labelledby="addStageLabel">
                         <form id="stage_form" method="post" enctype="multipart/form-data" class="validated">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <div class="modal-dialog" role="document">
                                 <div class="modal-content">
                                     <div class="modal-header">
@@ -342,6 +344,7 @@
                     [% END %]
 
                     <form id="stage_form" method="post" enctype="multipart/form-data" class="validated">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <fieldset class="rows">
                             <ol>
                                 <li>
@@ -433,6 +436,7 @@
                     <!-- Add items modal -->
                     <div class="modal" id="addItemsModal" tabindex="-1" role="dialog" aria-labelledby="addItemsLabel">
                         <form id="add_rota_item_form" method="post" enctype="multipart/form-data" class="validated">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <div class="modal-dialog" role="document">
                                 <div class="modal-content">
                                     <div class="modal-header">
@@ -599,6 +603,7 @@
 
                     [% IF barcode_status.on_other.size > 0 %]
                         <form id="add_rota_item_form" method="post" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset>
                                 <legend>Select items to move to this rota:</legend>
                                 [% FOREACH item_on_other IN barcode_status.on_other %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt
index f468a37c8a..7b4fe321bc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt
@@ -184,6 +184,7 @@
                     [% END %]
 
                         <form method="post" action="/cgi-bin/koha/tools/upload-cover-image.pl" id="uploadfile" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows" >
                                 <div id="fileuploadform">
                                     <label for="fileToUpload">Select the file to upload: </label>
@@ -207,6 +208,7 @@
                         </form> <!-- /#uploadfile -->
 
                         <form method="post" id="processfile" action="/cgi-bin/koha/tools/upload-cover-image.pl" enctype="multipart/form-data">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
 
                             [% IF itemnumber %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt
index 5a7b5f9cdd..c4e522fe92 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt
@@ -31,6 +31,7 @@
 
 [% BLOCK form_new %]
     <form method="post" action="/cgi-bin/koha/tools/upload.pl" id="uploadfile" enctype="multipart/form-data">
+        [% INCLUDE 'csrf-token.inc' %]
         [% PROCESS plugin_pars %]
         <fieldset class="rows" id="uploadform">
         <legend>Upload new files</legend>
@@ -99,6 +100,7 @@
 [% BLOCK form_browse %]
     [% IF uploadcategories %]
     <form method="post" id="browsefile" action="/cgi-bin/koha/tools/upload.pl">
+        [% INCLUDE 'csrf-token.inc' %]
         [% PROCESS plugin_pars %]
         <input type="hidden" name="op" value="browse"/>
         <fieldset class="brief">
@@ -128,6 +130,7 @@
 
 [% BLOCK form_search %]
     <form method="post" id="searchfile" action="/cgi-bin/koha/tools/upload.pl">
+        [% INCLUDE 'csrf-token.inc' %]
         [% PROCESS plugin_pars %]
         <input type="hidden" name="op" value="search"/>
         <fieldset class="brief">
@@ -147,6 +150,7 @@
 
 [% BLOCK submitter %]
     <form id="submitter" style="display:none;" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         [% PROCESS plugin_pars %]
         <input type="hidden" name="op" id="op" value=""/>
         <input type="hidden" name="id" id="id" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
index 2544109ca1..e4c003b9e2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
@@ -199,6 +199,7 @@
 
                 <h1>Log viewer</h1>
 				<form method="post" action="/cgi-bin/koha/tools/viewlog.pl">
+				    [% INCLUDE 'csrf-token.inc' %]
 					[% IF ( do_it ) %]
 						<input type="hidden" name="do_it" value="[% do_it | html %]" />
 					[% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
index ca1da22b03..85ef902adc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
@@ -35,6 +35,7 @@
                 </ul>
 
         <form name="f1" action="/cgi-bin/koha/virtualshelves/addbybiblionumber.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
                         [% FOREACH biblio IN biblios %] <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]" />[% END %]
             <input type="hidden" name="confirmed" value="1" />
             [% IF ( shelfnumber ) %]<input type="hidden" name="shelfnumber" value="[% shelfnumber | html %]" />[% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt
index 61fdbd824c..1c0e0f942b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt
@@ -30,6 +30,7 @@
 [% ELSE %]
 <div id="export" class="detailtagcell">    <form method="post" action="/cgi-bin/koha/virtualshelves/downloadshelf.pl">
 <form method="post" action="/cgi-bin/koha/virtualshelves/downloadshelf.pl">
+    [% INCLUDE 'csrf-token.inc' %]
 	<fieldset class="rows">
         <legend><h1>Download list</h1></legend>
 	<ol><li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
index 0989c28a9d..4bb9518896 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
@@ -31,6 +31,7 @@
 [% ELSE %]
 
 <form action="/cgi-bin/koha/virtualshelves/sendshelf.pl" method="post">
+    [% INCLUDE 'csrf-token.inc' %]
 
 <h1>Sending your list</h1>
 <fieldset class="rows">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/account-table.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/account-table.inc
index 70a1508e87..a2c60d5bc5 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/account-table.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/account-table.inc
@@ -1,5 +1,6 @@
 [% PROCESS 'accounts.inc' %]
 <form method="post" action="opac-account-pay.pl" class="form-horizontal">
+    [% INCLUDE 'csrf-token.inc' %]
     [% IF ( ACCOUNT_LINES ) %]
         <table class="table table-bordered table-striped finestable" id="finestable">
             <caption class="sr-only">Your charges</caption>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/holds-table.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/holds-table.inc
index 0a35aa715d..2b415055ce 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/holds-table.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/holds-table.inc
@@ -91,6 +91,7 @@
                             <div class="modal" id="changePickup[% HOLD.reserve_id | html %]" tabindex="-1" aria-labelledby="changePickup[% HOLD.reserve_id | html %]Label" aria-hidden="true">
                                 <div class="modal-dialog">
                                     <form id="change_branch_form[% HOLD.reserve_id | html %]" action="/cgi-bin/koha/opac-modrequest.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <div class="modal-content">
                                             <div class="modal-header">
                                                 <h5 class="modal-title" id="changePickup[% HOLD.reserve_id | html %]Label">Change pickup location for <em>[% INCLUDE 'biblio-title.inc' biblio=HOLD.biblio %]</em></h5>
@@ -166,6 +167,7 @@
                         [% IF ( HOLD.is_cancelable_from_opac ) %]
                             [% IF HOLD.suspend %]
                                 <form class="form-inline" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="reserve_id" value="[% HOLD.reserve_id | html %]" />
                                     <button class="btn btn-link" type="submit" name="submit"><i class="fa fa-play" aria-hidden="true"></i> Resume</button>
                                 </form>
@@ -174,6 +176,7 @@
                                     <a class="btn btn-link suspend_hold js-show" href="#" role="button" data-title="[% HOLD.biblio.title | html %] [% FOREACH subtitle IN HOLD.biblio.subtitle.split(' \| ') %][% IF Koha.Preference('marcflavour')=='UNIMARC' %],[% END %][% subtitle | html %][% END %]" data-reserve_id="[% HOLD.reserve_id | html %]"><i class="fa fa-pause" aria-hidden="true"></i> Suspend</a>
                                 [% ELSE %]
                                     <form class="form-inline" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" name="reserve_id" value="[% HOLD.reserve_id | html %]" />
                                         <button class="btn btn-link" type="submit" name="submit"><i class="fa fa-pause" aria-hidden="true"></i> Suspend</button>
                                     </form>
@@ -186,12 +189,14 @@
                     <td class="modify">
                         [% IF ( HOLD.is_cancelable_from_opac ) %]
                             <form id="delete_hold_[% HOLD.reserve_id | html %]" action="/cgi-bin/koha/opac-modrequest.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="biblionumber" value="[% HOLD.biblionumber | html %]" />
                                 <input type="hidden" name="reserve_id" value="[% HOLD.reserve_id | html %]" />
                                 <button data-title="[% INCLUDE 'biblio-title-head.inc' biblio=HOLD.biblio %]" data-reserve_id="[% HOLD.reserve_id | html %]" type="submit" class="btn btn-sm btn-danger btn-delete-hold"><i class="fa fa-times" aria-hidden="true"></i> [% tp('Cancel hold button', 'Cancel') | html %]</button>
                             </form>
                         [% ELSIF HOLD.is_waiting && HOLD.cancellation_requestable_from_opac %]
                             <form id="req_cancel_hold_[% HOLD.reserve_id | html %]" action="/cgi-bin/koha/opac-modrequest.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="biblionumber" value="[% HOLD.biblionumber | html %]" />
                                 <input type="hidden" name="reserve_id" value="[% HOLD.reserve_id | html %]" />
                                 <input type="hidden" name="cancellation_request" value="1" />
@@ -210,6 +215,7 @@
     [% UNLESS ( all_holds_waiting ) %]
         <div>
             <form class="form-inline" id="suspend_all_holds" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <button type="submit" id="suspend_all_submit" class="btn btn-primary"><i class="fa fa-pause" aria-hidden="true"></i> Suspend all holds</button>
                 <input type="hidden" name="suspend" value="1" />
 
@@ -223,6 +229,7 @@
         <br/>
         <div>
             <form id="resume_all_holds" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <button type="submit" id="resume_all_submit" class="btn btn-primary"><i class="fa fa-play" aria-hidden="true"></i> Resume all suspended holds</button>
                 <input type="hidden" name="suspend" value="0" />
             </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
index 670c15fc50..2a1e4f1a71 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
@@ -389,6 +389,7 @@
                     </button>
                 </div>
                 <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="modalAuth">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="has-search-query" id="has-search-query" value="" />
                     <div class="modal-body">
                         [% IF ( Koha.Preference('GoogleOpenIDConnect') == 1 ) %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc
index a91aa47569..5e17ee2000 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc
@@ -119,6 +119,7 @@
                 <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">&times;</button>
             </div>
             <form method="post" action="/cgi-bin/koha/opac-export.pl">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                     <fieldset id="dc_fieldset">
                         <input id="input-simple" type="radio" name="format" value="rdfdc">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc
index 6ed5e724f2..9e12aeed28 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc
@@ -8,6 +8,7 @@
                     &nbsp;&nbsp;&nbsp;<em>Written on [% message.message_date | $KohaDates %] by [% Branches.GetName(message.branchcode) | html %]</em>
                 </li>
                 <form id="dismiss-message-form" action="/cgi-bin/koha/opac-dismiss-message.pl" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="message_id" value="[% message.message_id | html %]">
                     <input type="hidden" name="patron_id" value="[% message.borrowernumber | html %]">
                     <button type="submit" class="dismiss-message-button btn btn-primary"><i class="fa fa-trash" aria-hidden="true"></i> Dismiss</button>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-checkout.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-checkout.inc
index 17f734d10d..7f1c76adba 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-checkout.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-checkout.inc
@@ -8,6 +8,7 @@
                 </button>
             </div>
             <form action="#" method="post" id="overdrive-checkout-form">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                     <input type="hidden" name="id" value="" />
                     <div id="overdrive-format-list">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc
index 10e862d41f..80f0bbfc8d 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc
@@ -8,6 +8,7 @@
                 </button>
             </div>
             <form action="#" method="post" id="overdrive-login-form">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-body">
                         <fieldset class="brief">
                             <label for="ODpassword">Password:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt
index 25b997f3ec..fe6b54c9d7 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt
@@ -25,6 +25,7 @@
                                 </ul>
                                 [% IF private_shelves.count or public_shelves.count or private_shelves_shared_with_me.count %]
                                     <form name="f1" action="/cgi-bin/koha/opac-addbybiblionumber.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <fieldset>
                                             <legend>Select a list</legend>
                                             <label for="shelfnumber">Add to list:</label> <select name="shelfnumber" id="shelfnumber">
@@ -58,6 +59,7 @@
                                 [% ELSE %]
                                     [% IF ( singleshelf ) %]
                                         <form name="f1" action="/cgi-bin/koha/opac-addbybiblionumber.pl" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             [% FOREACH biblio IN biblios %]
                                                 <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]">
                                             [% END %]
@@ -74,6 +76,7 @@
 
                             [% UNLESS ( singleshelf ) %]
                                 <form name="f2" method="post" action="/cgi-bin/koha/opac-addbybiblionumber.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset>
                                         <legend>Add to a new list:</legend>
                                             <label for="newvirtualshelf">List name:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt
index 7ab3b0a25c..1b404ea8da 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt
@@ -30,6 +30,7 @@
                         [% IF ( typeissue ) %]
                             <h2>Subscribe to a subscription alert</h2>
                             <form action="opac-alert-subscribe.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p>Do you want to receive an email when a new issue for this subscription arrives?</p>
                                 <h3>[% bibliotitle | html %]</h3>
                                 [% IF ( notes ) %]<p>[% notes | html %]</p>[% END %]
@@ -44,6 +45,7 @@
                         [% IF ( typeissuecancel ) %]
                             <h2>Unsubscribe from a subscription alert</h2>
                             <form action="opac-alert-subscribe.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <p>Please confirm that you do not want to receive email when a new issue arrives for this subscription.</p>
                                 <h3>[% bibliotitle | html %]</h3>
                                 [% IF ( notes ) %]<p>[% notes | html %]</p>[% END %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscriptions.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscriptions.tt
index abcdb9319a..2df421cb93 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscriptions.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscriptions.tt
@@ -71,6 +71,7 @@
                                         </td>
                                         <td class="actions">
                                             <form action="/cgi-bin/koha/opac-alert-subscribe.pl" method="post" class="unsubscribe" data-title="[% sub.biblio.title | html %] [% sub.biblio.subtitle | html %]" data-patron="[% INCLUDE 'patron-title.inc' no_html=1 patron=logged_in_user%]">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="subscriptionid" value="[% sub.subscriptionid | html %]">
                                                 <input type="hidden" name="referer" value="[% referer | html %]">
                                                 <input type="hidden" name="biblionumber" value="[% sub.biblionumber | html %]">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
index f76ded9c5f..dd5f790f9f 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
@@ -208,6 +208,7 @@
                                 <form action="/cgi-bin/koha/sci/sci-main.pl" name="auth" id="auth" method="post" autocomplete="off">
                             [% ELSE %]
                                 <form action="[% script_name | html %]" name="auth" id="auth" method="post" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                             [% END %]
                                 <input type="hidden" name="koha_login_context" value="opac" />
 
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt
index 3603b8fe51..e79d1a1b23 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt
@@ -32,6 +32,7 @@
                 [% END %]
                     <div id="userauthhome" class="maincontent">
                         <form name="f" action="/cgi-bin/koha/opac-authorities-home.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="do_search" />
                             <input type="hidden" name="type" value="opac" />
                             <fieldset class="rows">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt
index 7ba7bb4513..affb89c4a2 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt
@@ -350,6 +350,7 @@
                                 <input type="hidden" name="records" id="records" />
                             </form>
                             <form method="post" id="download_cart" action="/cgi-bin/koha/opac-downloadcart.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="format" id="download_format" value="" />
                                 <input type="hidden" name="bib_list" value="[% bib_list | html %]" />
                             </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt
index 127fa4bdd0..582df83ade 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt
@@ -184,6 +184,7 @@
                                                     <td>[% p.notes | html %]</td>
                                                     <td>
                                                         <form method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="arrival-alert" />
                                                             <input type="hidden" name="pickup_id" value="[% p.id | html %]" />
                                                             [% IF ! p.staged_datetime || p.arrival_datetime %]
@@ -196,6 +197,7 @@
                                                         </form>
                                                         <p>
                                                         <form method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="cancel-pickup" />
                                                             <input type="hidden" name="pickup_id" value="[% p.id | html %]" />
                                                             [% IF p.delivered_datetime %]
@@ -223,6 +225,7 @@
                                 <div role="tabpanel" class="tab-pane active" id="user-schedule-pickup" aria-labelledby="tab-user-schedule-pickup">
                                 [% END %]
                                     <form id="create-pickup" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <fieldset class="rows">
                                             <ol>
                                                 <li>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
index 789244f9d3..fb7cd51139 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
@@ -233,6 +233,7 @@
                     [% IF ( TagsInputEnabled ) %]
                         [% IF ( loggedinusername ) %]
                             <form id="tagform[% biblio.biblionumber | html %]" method="post" action="/cgi-bin/koha/opac-tags.pl" style="display:none;">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Tags</legend>
                                 <div class="form-row">
                                     <div class="col-3">
@@ -295,6 +296,7 @@
 
                     [% IF ( OpacStarRatings != 'disable' ) %]
                         <form method="post" action="/cgi-bin/koha/opac-ratings.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Star ratings</legend>
                             <div class="results_summary ratings" id="rating-[% biblio.biblionumber | html %]">
 
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt
index 090936c72a..f618893d1d 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt
@@ -11,6 +11,7 @@
                     <div id="userdownloadcart" class="maincontent">
                         <h1>Download cart</h1>
                         <form method="post" action="/cgi-bin/koha/opac-downloadcart.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <select name="format" id="format">
                                 <option value="">-- Choose format --</option>
                                 <option value="ris">RIS (Zotero, EndNote, others)</option>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt
index 81768b0049..c8ce1f482b 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt
@@ -57,6 +57,7 @@
                                 </div>
                             [% ELSE %]
                                 <form method="post" action="/cgi-bin/koha/opac-downloadshelf.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset>
                                         <select name="format" id="dlformat" required="required">
                                             <legend>Choose format</legend>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt
index e5a96e3c35..4b7af4d7e6 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt
@@ -90,6 +90,7 @@
                                 [% INCLUDE messages %]
                                 [% IF backends %]
                                     <form method="post" id="illrequestcreate-form" novalidate="novalidate">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <legend class="sr-only">Backends</legend>
                                         <fieldset class="rows">
                                             <label for="backend">Provider:</label>
@@ -177,6 +178,7 @@
                             [% INCLUDE messages %]
                             [% status = request.status %]
                             <form method="post" action="?method=update" id="illrequestupdate-form" novalidate="novalidate">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="rows">
                                     <legend id="library_legend">Details from library</legend>
                                     <ol>
@@ -252,6 +254,7 @@
                             <h1>Interlibrary loan item availability</h1>
                             <div id="results">
                                 <form method="POST" action="/cgi-bin/koha/opac-illrequests.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend><h2>Displaying availability results</h2></legend>
                                     [% FOREACH key IN whole.keys %]
                                         [% value = whole.$key %]
@@ -284,6 +287,7 @@
                             <div id="results" class="page-section">
                                 [% INCLUDE messages %]
                                 <form method="post" id="typedisclaimer-form">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="rows">
                                         [% disclaimer.text | $raw %]
                                         [% SET disc_av_category_code = AuthorisedValues.GetAuthValueDropbox(disclaimer.av_cat) %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt
index b19286a4b1..4c2526f0a2 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt
@@ -42,6 +42,7 @@
                             Checkout notes have not been enabled. Please contact the library.
                         [% ELSE %]
                             <form id="issue-note" action="/cgi-bin/koha/opac-issue-note.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Edit checkout note</legend>
                                 <fieldset>
                                     <label for="note" class="required">Note:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
index 8d2a88e3ae..5452c660ae 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
@@ -172,6 +172,7 @@
                         [% UNLESS ( casAuthentication || shibbolethAuthentication || Koha.Preference('opacShibOnly') ) %]
                             <div id="login">
                                 <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="auth" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="koha_login_context" value="opac" />
                                     <fieldset class="brief">
                                         <legend>Log in to your account:</legend>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
index 9a28c12aa3..019483191b 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
@@ -69,6 +69,7 @@
                     [% IF logged_in_user.category.effective_change_password %]
                         [% IF ( Ask_data ) %]
                             <form action="/cgi-bin/koha/opac-passwd.pl" name="mainform" id="mainform" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Change your password</legend>
                                 <fieldset>
                                     [% IF ( logged_in_user.category.effective_require_strong_password ) %]
@@ -106,6 +107,7 @@
                             Your password has been changed
                         </div>
                         <form action="/cgi-bin/koha/opac-user.pl" method="post" autocomplete="off">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
                             <p><input type="submit" class="btn btn-primary" value="Return to my account" /></p>
                         </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
index 8be44f786e..1163ccf916 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
@@ -116,6 +116,7 @@
                         <div class="alert alert-info">You can't reset your password.</div>
                     [% ELSIF (password_recovery) %]
                         <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Password recovery</legend>
                             <input type="hidden" name="koha_login_context" value="opac" />
                             <p>To reset your password, enter your login or your email address.</p>
@@ -138,6 +139,7 @@
                     [% ELSIF (new_password) %]
                         [% UNLESS ( errLinkNotValid ) %]
                             <form id="mainform" name="mainform" action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Password not valid</legend>
                                 <input type="hidden" name="koha_login_context" value="opac" />
                                 <fieldset class="brief">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt
index d27d88d4ab..b5385db843 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt
@@ -33,6 +33,7 @@
             <div class="col-lg-10 order-first order-md-first order-lg-2">
                 <div id="patronconsents" class="maincontent">
                     <form action="/cgi-bin/koha/opac-patron-consent.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="save"/>
                         <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]"/>
                         <h1>Your consents</h1>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt
index 4290975b8c..7ed5163952 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt
@@ -70,6 +70,7 @@
                         <p id="note1">Please note that information on any book still checked-out must be kept by the library no matter which privacy option you choose.</p>
                         <p id="note2">Please also note that the library staff can't update these values for you: it's your privacy!</p>
                         <form action="/cgi-bin/koha/opac-privacy.pl" method="post" id="opac-privacy-update-form">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Privacy rule</legend>
                             <input type="hidden" name="op" value="update_privacy" />
                             <fieldset>
@@ -153,16 +154,19 @@
                         <p>You can delete all your checkout and hold history immediately by clicking here. <strong>BE CAREFUL</strong>. Once you've confirmed the deletion, no one can retrieve the list!</p>
 
                         <form action="/cgi-bin/koha/opac-privacy.pl" method="post" id="opac-privacy-delete-checkouts">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_record" />
                             <input type="hidden" name="checkouts" value="1" />
                         </form>
 
                         <form action="/cgi-bin/koha/opac-privacy.pl" method="post" id="opac-privacy-delete-holds">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_record" />
                             <input type="hidden" name="holds" value="1" />
                         </form>
 
                         <form action="/cgi-bin/koha/opac-privacy.pl" method="post" id="opac-privacy-delete-all">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="op" value="delete_record" />
                             <input type="hidden" name="all" value="1" />
                         </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt
index c9d11fb9dc..26c8514c21 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt
@@ -62,6 +62,7 @@
                                 <div class="dialog">
 
                                     <form id="recallform" action="/cgi-bin/koha/opac-recall.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <fieldset class="rows" id="options">
                                             <legend>Place a recall on <b>[% biblio.title | html %]</b> ([% biblio.author | html %])?</legend>
                                             <ul>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt
index 3e2522658d..bdf5c7f261 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt
@@ -113,6 +113,7 @@
                                                     <td class="cancelrecall">
                                                         [% IF ( RECALL.requested or RECALL.overdue ) %]
                                                             <form action="/cgi-bin/koha/opac-recall.pl" method="post">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <input type="hidden" name="op" value="cancel">
                                                                 <input type="hidden" name="recall_id" value="[% RECALL.id | html %]">
                                                                 <input type="hidden" name="biblionumber" value="[% RECALL.biblio_id | html %]">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
index 5a20e52350..68aa2d0c1c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
@@ -51,6 +51,7 @@
                         <h1>Registration pending</h1>
                         <p id="confirm-instruction" class="registration-line">Click the button below to confirm registration.</p>
                         <form action="/cgi-bin/koha/opac-registration-verify.pl" method="post" name="confirm_registration" id="confirm_registration">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="token" value="[% token | html %]">
                             <input type="hidden" name="op" value="confirmed">
                             <input type="submit" value="Confirm" class="btn btn-primary">
@@ -103,6 +104,7 @@
                         [% UNLESS ( casAuthentication ) %]
                             <div id="login">
                                 <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="auth" autocomplete="off">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="koha_login_context" value="opac" />
                                     <fieldset class="brief">
                                         <legend>Log in to your account:</legend>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt
index 773f824aa7..bdfbab0c2b 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt
@@ -63,6 +63,7 @@
 
                     <div id="reportproblem" class="maincontent toptabs">
                         <form name="reportlibform" action="/cgi-bin/koha/opac-reportproblem.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Report a problem</legend>
                             <input type="hidden" name="op" value="addreport" />
                             <fieldset class="rows">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt
index 1b6ef84443..42f5e9f1bd 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt
@@ -61,6 +61,7 @@
                     [% END %]
 
                         <form id="place-article-request" method="post" action="/cgi-bin/koha/opac-request-article.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Place article request</legend>
                             <input type="hidden" name="action" value="create" />
                             <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblio.biblionumber | html %]" />
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt
index 7b1e9d3708..900b8f5a4c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt
@@ -144,6 +144,7 @@
                 [% END %]
 
             <form action="/cgi-bin/koha/opac-reserve.pl" method="post" id="hold-request-form">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Hold requests</legend>
                 <input type="hidden" name="place_reserve" value="1"/>
                 <!-- These values are set dynamically by js -->
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt
index 54eface998..a1e4af027b 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt
@@ -70,6 +70,7 @@
                             </div>
                         [% ELSE %]
                         <form action="/cgi-bin/koha/opac-reset-password.pl" name="mainform" id="mainform" method="post" autocomplete="off">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Reset your password</legend>
 
                             <fieldset class="brief">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt
index ba7c3a89f9..698acf4c28 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt
@@ -40,6 +40,7 @@
                         <h2>Comments on <em>[% INCLUDE 'biblio-title.inc' %]</em></h2>
                         [% IF ( biblio.author ) %]<h3>[% biblio.author | html %]</h3>[% END %]
                         <form id="reviewf" action="/cgi-bin/koha/opac-review.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <legend class="sr-only">Comments</legend>
                             <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]" />
                             [% IF ( reviewid ) %]<input type="hidden" name="reviewid" value="[% reviewid | html %]" />[% END %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt
index 01543bc29a..229e3294d2 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt
@@ -82,6 +82,7 @@
         [% IF ( current_biblio_searches ) %]
             <h2>Current session</h2>
             <form action="/cgi-bin/koha/opac-search-history.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Toolbar control</legend>
 
                 [% INCLUDE 'toolbar_controls' %]
@@ -129,6 +130,7 @@
         [% IF ( previous_biblio_searches ) %]
             <h2>Previous sessions</h2>
             <form action="/cgi-bin/koha/opac-search-history.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Toolbar control</legend>
                 [% INCLUDE 'toolbar_controls' %]
 
@@ -184,6 +186,7 @@
         [% IF ( current_authority_searches ) %]
             <h2>Current session</h2>
             <form action="/cgi-bin/koha/opac-search-history.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Toolbar control</legend>
                 [% INCLUDE 'toolbar_controls' %]
                 <input type="hidden" name="action" value="delete" />
@@ -225,6 +228,7 @@
         [% IF ( previous_authority_searches ) %]
             <h2>Previous sessions</h2>
             <form action="/cgi-bin/koha/opac-search-history.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <legend class="sr-only">Toolbar control</legend>
                 [% INCLUDE 'toolbar_controls' %]
                 <input type="hidden" name="action" value="delete" />
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt
index a446e8b5a9..71d6a2b1b2 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt
@@ -31,6 +31,7 @@
                                 <p><a class="button close" href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelfid | html %]">Back to lists</a></p>
                             [% ELSE %]
                                 <form action="/cgi-bin/koha/opac-sendshelf.pl" method="post" id="sendshelfform">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset class="brief">
                                         <legend><h1>Sending your list</h1></legend>
                                         <label for="email">Email address:</label>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt
index 834214a08f..bb3490e2cc 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt
@@ -51,6 +51,7 @@
                             <span class="view"><a id="Fullhistory" href="opac-serial-issues.pl?selectview=full&amp;biblionumber=[% biblionumber | html %]" class="button">Full history</a></span>
                         </div>
                         <form method="post" name="f">
+                            [% INCLUDE 'csrf-token.inc' %]
                             [% FOREACH subscription_LOO IN subscription_LOOP %]
                                 <div id="subscriptionline[% subscription_LOO.subscriptionid | html %]" class="subscriptionline">
                                     <caption><h2>Subscription information for [% subscription_LOO.bibliotitle | html %]</h2><caption>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
index 4166f62b35..306794bc0c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
@@ -10,6 +10,7 @@
 
 [% BLOCK delete_shelf %]
     <form action="/cgi-bin/koha/opac-shelves.pl" method="post" id="deleteshelf[% shelf.shelfnumber | html %]" class="d-inline">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="delete" />
         <input type="hidden" name="referer" value="list" />
         <input type='hidden' name='public' value='[% public | html %]' />
@@ -245,6 +246,7 @@
                                         [% IF can_manage_shelf %]
                                             <span class="sep">|</span>
                                             <form method="post" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="op" value="edit_form" />
                                                 <input type="hidden" name="referer" value="view" />
                                                 <input type='hidden' name='public' value='[% shelf.public | html %]' />
@@ -259,6 +261,7 @@
                                             [% END %]
                                         [% ELSIF !public # not manageshelf and private means shared %]
                                             <form action="/cgi-bin/koha/opac-shelves.pl" method="post" id="unshare[% shelf.shelfnumber | html %]" class="d-inline">
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="op" value="remove_share" />
                                                 <input type="hidden" name="referer" value="list" />
                                                 <input type='hidden' name='public' value='[% public | html %]' />
@@ -388,6 +391,7 @@
                             </div> <!-- /#floating -->
 
                             <form action="/cgi-bin/koha/opac-shelves.pl" method="post" id="myform" name="bookbag_form">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 [% IF can_manage_shelf %]
                                     <input type="hidden" name="op" value="remove_biblios" />
                                     <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
@@ -551,6 +555,7 @@
                                     [% IF can_manage_shelf %]
                                         <span class="sep">|</span>
                                         <form method="post" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <input type="hidden" name="op" value="edit_form" />
                                             <input type="hidden" name="referer" value="view" />
                                             <input type="hidden" name="public" value="[% shelf.public | html %]" />
@@ -576,6 +581,7 @@
 
                     [% IF op == 'add_form' OR op == 'edit_form' %]
                         <form method="post" action="/cgi-bin/koha/opac-shelves.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <fieldset class="rows">
                                 [% IF op == 'add_form' %]
                                     <div id="addshelf">
@@ -664,6 +670,7 @@
                         <h1>Transfer ownership of shared list '[% shelf.shelfname | html %]'</h1>
                         <br/>
                         <form action="/cgi-bin/koha/opac-shelves.pl" id="transferform" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
                         <fieldset>
                             <input type="hidden" name="op" value="transfer" />
                             <input type="hidden" name="public" value="0" />
@@ -760,6 +767,7 @@
                                                     <td>
                                                         [% IF s.can_be_managed( loggedinusernumber ) %]
                                                             <form action="/cgi-bin/koha/opac-shelves.pl" method="post" class="d-inline">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <input type="hidden" name="shelfnumber" value="[% s.shelfnumber | html %]" />
                                                                 <input type="hidden" name="public" value="[% s.public | html %]" />
                                                                 <input type="hidden" name="op" value="edit_form" />
@@ -775,6 +783,7 @@
                                                         [% END %]
                                                         [% IF s.is_shared AND s.can_be_managed( loggedinusernumber ) %]
                                                             <form action="/cgi-bin/koha/opac-shelves.pl" method="post" class="d-inline">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <input type="hidden" name="shelfnumber" value="[% s.shelfnumber | html %]" />
                                                                 <input type="hidden" name="public" value="0" />
                                                                 <input type="hidden" name="op" value="transfer" />
@@ -784,6 +793,7 @@
                                                         [% END %]
                                                         [% IF s.is_shared_with( loggedinusernumber ) %]
                                                             <form action="opac-shelves.pl" method="post" id="unshare[% s.shelfnumber | html %]" class="d-inline">
+                                                                [% INCLUDE 'csrf-token.inc' %]
                                                                 <input type="hidden" name="op" value="remove_share" />
                                                                 <input type="hidden" name="referer" value="list" />
                                                                 <input type='hidden' name='public' value='[% public | html %]' />
@@ -819,6 +829,7 @@
 </div> <!-- / .main -->
 
 <form method="post" id="download_list" action="/cgi-bin/koha/opac-downloadshelf.pl">
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
     <input type="hidden" name="format" id="download_format" value="" />
 </form>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt
index 2997f20583..e81d91e200 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt
@@ -79,6 +79,7 @@
                             [% END %]
 
                             <form action="/cgi-bin/koha/opac-suggestions.pl" method="post" id="add_suggestion_form">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <fieldset class="rows">
                                     <ol>
                                         [% IF Koha.Preference( 'OPACSuggestionAutoFill' ) %]
@@ -372,6 +373,7 @@
                             [% IF suggestions.size > 0 %]
                                 [% SET can_delete_suggestion = 0 %]
                                 <form action="/cgi-bin/koha/opac-suggestions.pl" method="post" id="delete_suggestions">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <input type="hidden" name="op" value="delete_confirm" />
                                     [% IF ( loggedinusername || ( Koha.Preference( 'AnonSuggestions' ) == 1 ) ) %]
                                         <div id="toolbar" class="toolbar clearfix">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt
index adaf29861e..3130733f19 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt
@@ -128,6 +128,7 @@
 
                         [% IF ( MY_TAGS ) %]
                         <form id="deletetags" method="post" action="opac-tags.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
                             <table id="mytagst" class="table table-bordered table-striped">
                             <caption>Your tags</caption>
                                 <thead>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt
index d241fdb3b1..89bbe3a2b7 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt
@@ -39,6 +39,7 @@
                                     <fieldset>
                                         <legend>Show</legend>
                                         <form class="form-inline" action="/cgi-bin/koha/opac-tags_subject.pl" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <p>up to <input type="text" name="number" value="[% number | html %]" size="4" maxlength="4" /> subjects <input type="submit" class="btn btn-primary" value="OK" /></p>
                                         </form>
                                     </fieldset>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
index 88e72888fe..dca48f11d1 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
@@ -315,6 +315,7 @@
                             [% WRAPPER tab_panel tabname="opac-user-checkouts" %]
                                 [% IF ( issues_count ) %]
                                     <form id="renewselected" action="/cgi-bin/koha/opac-renew.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <legend class="sr-only">Renew selected</legend>
                                         <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]">
                                         <input type="hidden" name="from" value="opac_user" />
@@ -549,6 +550,7 @@
 
                                     [% IF ( canrenew && !userdebarred && OpacRenewalAllowed && !( logged_in_user.is_expired && logged_in_user.category.effective_BlockExpiredPatronOpacActions ) ) %]
                                         <form id="renewall" class="js-hide" action="/cgi-bin/koha/opac-renew.pl" method="post">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <legend class="sr-only">Renew</legend>
                                             <input type="hidden" name="from" value="opac_user" />
                                             <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
@@ -893,6 +895,7 @@
                                                 <td class="cancelrecall">
                                                     [% IF ( RECALL.requested or RECALL.overdue ) %]
                                                         <form action="/cgi-bin/koha/opac-recall.pl" method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <input type="hidden" name="op" value="cancel">
                                                             <input type="hidden" name="recall_id" value="[% RECALL.id | html %]">
                                                             <input type="hidden" name="biblionumber" value="[% RECALL.biblio_id | html %]">
@@ -1033,6 +1036,7 @@
     <div class="modal-dialog">
         <div class="modal-content">
             <form action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-header">
                     [% IF HOLD.suspend %]
                         <h5 class="modal-title" id="suspendModalLabel">Resume hold</h5>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
index af596568f2..298906818a 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
@@ -110,6 +110,7 @@
                                     </table>
                                     <div>
                                         <form method="post" action="#" id="finish_form">
+                                            [% INCLUDE 'csrf-token.inc' %]
                                             <legend class="sr-only">Finish</legend>
                                             <button id="sci_finish_button" type="submit" class="btn btn-primary"><i class="fa fa-check" aria-hidden="true"></i> Finish</button>
                                         </form>
@@ -124,6 +125,7 @@
                         [%# Prompt for barcodes %]
                         <div id="new_checkins" class="sci_entry">
                             <form id="scan_form" name="scan_form" method="post" action="/cgi-bin/koha/sci/sci-main.pl">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Scan</legend>
                                 <div class="row">
                                     <div class="col-auto">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
index 5f8e8eee3e..f3b1f42ee0 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
@@ -104,6 +104,7 @@
 
                             [% IF ( returnitem && Koha.Preference('SCOAllowCheckin') ) %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="errorForm" class="inline" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend class="sr-only">Return</legend>
                                     <input type="hidden" name="op" value="returnbook" />
                                     <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -115,6 +116,7 @@
                             [% END %]
 
                             <form action="/cgi-bin/koha/sco/sco-main.pl" name="errorForm" class="inline" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Error</legend>
                                 <input type="hidden" name="op" value="" />
                                 <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -135,6 +137,7 @@
 
                             [% IF ( renew && Koha.Preference('SCOAllowCheckin') ) %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend class="sr-only">Return</legend>
                                     <input type="hidden" name="op" value="returnbook" />
                                     <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -148,6 +151,7 @@
 
                             [% UNLESS ( renew ) %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend class="sr-only">Renew</legend>
                                     <input type="hidden" name="op" value="renew" />
                                     <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -159,6 +163,7 @@
                                   </form>
                             [% ELSE %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend class="sr-only">Renew</legend>
                                     <input type="hidden" name="op" value="renew" />
                                     <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -171,6 +176,7 @@
                             [% END %]
 
                             <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <legend class="sr-only">Cancel</legend>
                                 <input type="hidden" name="op" value="" />
                                 <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -258,6 +264,7 @@
                         [% IF ( validuser ) %]
                             <div id="newcheckout" class="sco_entry">
                                 <form id="scan_form" name="scan_form" method="post" action="/cgi-bin/koha/sco/sco-main.pl">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <legend><h2>
                                         [% IF ( Koha.Preference('SCOAllowCheckin') ) %]
                                             <span>Check out, return, or renew an item:</span>
@@ -377,6 +384,7 @@
                                                     [% END %]
                                                     <td>
                                                         <form action="/cgi-bin/koha/sco/sco-main.pl" method="post">
+                                                            [% INCLUDE 'csrf-token.inc' %]
                                                             <legend class="sr-only">Issue renews</legend>
                                                             <input type="hidden" name="patronid" value="[% patronid | html %]" />
                                                             <input type="hidden" name="load_checkouts" value="[% load_checkouts | html %]" />
@@ -445,6 +453,7 @@
                         [% ELSE # IF validuser %]
                             <div class="sco_entry" >
                                 <form id="mainform" action="/cgi-bin/koha/sco/sco-main.pl" name="mainform" method="post">
+                                    [% INCLUDE 'csrf-token.inc' %]
                                     <fieldset>
                                         [% IF ( Koha.Preference('SelfCheckoutByLogin') ) %]
                                             <legend>Log in to your account</legend>