From 5e8ea082e6708226f7aae6ad4df6e14a6ee2bc99 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 6 Jun 2017 16:41:37 -0300
Subject: [PATCH] Bug 18740: (bug 16992 follow-up) Add CSRF token to the
 template

Bug 16992 is in
  commit 9e74db7b51085f62919e34ab4e5ccdf9da2066a1
    Bug 18124: Restrict CSRF token to user's session

but template change is missing

Test plan:
Modify a patron from member-password.pl
Without this patch you got
  Wrong CSRF token at /home/vagrant/kohaclone/members/member-password.pl line 68.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Patch fixes the bug. Passes the qa script.
Signed-off-by: Mason James <mtj@kohaaloha.com>
---
 .../prog/en/modules/members/member-password.tt              | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
index 5d55ef5cdb..786125e7d4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
@@ -114,7 +114,11 @@
 	</li>
 	</ol>
 </fieldset>
-	<fieldset class="action"><input type="submit" value="Save" /> <a class="cancel" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]">Cancel</a></fieldset>
+    <fieldset class="action">
+        <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+        <input type="submit" value="Save" />
+        <a class="cancel" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]">Cancel</a>
+    </fieldset>
 </form>[% END %]
 
 </div>
-- 
2.39.5