CVE-2022-4766: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability was found in dolibarr_project_timesheet up to 4.5.5. It has been declared as problematic. This vulnerability affects unknown code of the component Form Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. Upgrading to version 4.5.6.a is able to address this issue. The name of the patch is 082282e9dab43963e6c8f03cfaddd7921de377f4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216880.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2022-12-27T13:15Z
Repository: https://github.com/delcroip/dolibarr_project_timesheet
Language: PHP
Files changed: htdocs/timesheet/AttendanceEventAdmin.php, htdocs/timesheet/ChangeLog.md, htdocs/timesheet/TimesheetProjectInvoice.php, htdocs/timesheet/TimesheetReportProject.php, htdocs/timesheet/TimesheetReportUser.php, htdocs/timesheet/TimesheetTeamApproval.php, htdocs/timesheet/TimesheetUserTasksAdmin.php, htdocs/timesheet/admin/timesheetsetup.php, htdocs/timesheet/class/AttendanceEvent.class.php, htdocs/timesheet/class/TimesheetUserTasks.class.php, htdocs/timesheet/core/modules/modtimesheet.class.php
Commit date: 2022-08-04 00:07:14 +0200
Commit message: csrf token in all form

Diff: diff --git a/htdocs/timesheet/AttendanceEventAdmin.php b/htdocs/timesheet/AttendanceEventAdmin.php
index a0c3e32..9baaed5 100644
--- a/htdocs/timesheet/AttendanceEventAdmin.php
+++ b/htdocs/timesheet/AttendanceEventAdmin.php
@@ -513,10 +513,12 @@ if (empty($conf->global->MAIN_DISABLE_FULL_SCANLIST)) {
     } else {
         $error++;
         dol_print_error($db);
     }
     print '</table>'."\n";
+    print '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
+
     print '</form>'."\n";
     // new button
    // print '<a href = "attendanceeventCard.php?action=create" class="butAction"role="button">'.$langs->trans('New');
     print ' '.$langs->trans('Attendanceevent')."</a>\n";
 // End of page
diff --git a/htdocs/timesheet/ChangeLog.md b/htdocs/timesheet/ChangeLog.md
index bc2e189..1788425 100644
--- a/htdocs/timesheet/ChangeLog.md
+++ b/htdocs/timesheet/ChangeLog.md
@@ -1,6 +1,10 @@
 # dolibarr_project_timesheet changelog
+4.5.6
+- fix csrf issue in other pages
+- fix box issue
+
 4.5.5
 - fix: pdf header with small pictures
 - misc: white logo
 
 
diff --git a/htdocs/timesheet/TimesheetProjectInvoice.php b/htdocs/timesheet/TimesheetProjectInvoice.php
index 0f3e41f..764f769 100644
--- a/htdocs/timesheet/TimesheetProjectInvoice.php
+++ b/htdocs/timesheet/TimesheetProjectInvoice.php
@@ -23,10 +23,11 @@ define('$conf->global->TIMESHEET_INVOICE_SHOW_USER', '1');
 */
 //load class
 include 'core/lib/includeMain.lib.php';
 include 'core/lib/generic.lib.php';
 include 'core/lib/timesheet.lib.php';
+$token = getToken();
 require_once DOL_DOCUMENT_ROOT .'/core/lib/functions.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.form.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/project.lib.php';
 //get param
@@ -103,10 +104,12 @@ $langs->load('timesheet@timesheet');
             $Form .= '<input type = "hidden" name = "dateStart" value = "'.dol_print_date($dateStart, 'dayxcard').'">';
             $Form .= '<input type = "hidden" name = "dateEnd" value = "'.dol_print_date($dateEnd, 'dayxcard').'">';
             $Form .= '<input type = "hidden" name = "socid" value = "'.$socid.'">';
             $Form .= '<input type = "hidden" name = "invoicingMethod" value = "'.$mode.'">';
             $Form .= '<input type = "hidden" name = "ts2Invoice" value = "'.$ts2Invoice.'">';
+            $Form .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
+
             $resql = $db->query($sql);
             $num = 0;
             $resArray = array();
             if ($resql) {
                 $num = $db->num_rows($resql);
@@ -490,10 +493,11 @@ $langs->load('timesheet@timesheet');
             //    $sqlTailJoin .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_type_contact as ctc ON ctc.rowid = ec.fk_c_type_contact';
             //    $sqlTailWhere = ' ((ctc.element in (\'project_task\') AND ctc.code LIKE \'%EXECUTIVE%\')OR (ctc.element in (\'project\') AND ctc.code LIKE \'%LEADER%\')) AND ctc.active = \'1\'  ';
             //    $sqlTailWhere .= ' AND fk_socpeople = \''.$userid.'\' and t.fk_statut = \'1\'';
             //}
             $Form = '<form name = "settings" action="?step=2" method = "POST" >'."\n\t";
+            $Form .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
             $Form .= '<table class = "noborder" width = "100%">'."\n\t\t";
             $Form .= '<tr class = "liste_titre" width = "100%" ><th colspan = "2">'
                 .$langs->trans('generalInvoiceProjectParam').'</th></tr>';
             $invoicingMethod = $conf->global->TIMESHEET_INVOICE_METHOD;
             //$Form .= '<tr class = "oddeven"><th align = "left" width = "80%">'.$langs->trans('Project').'</th><th align = "left" width = "80%" >';
diff --git a/htdocs/timesheet/TimesheetReportProject.php b/htdocs/timesheet/TimesheetReportProject.php
index ca1fde1..a7a4297 100644
--- a/htdocs/timesheet/TimesheetReportProject.php
+++ b/htdocs/timesheet/TimesheetReportProject.php
@@ -226,10 +226,13 @@ $form_output .= '<form action="?action=reportproject'.(($optioncss != '')?'&amp;
         <td>'.$langs->trans('Mode').'</td>
         <td>'.$langs->trans('Options').'</td>
         <td></td>
         </tr>
         <tr >';
+$token = getToken();
+$form_output .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
+
 
 if($hidetab == 1){
         $form_output .='<td><select  name = "projectSelected">';
 // select project
     foreach ($projectList as $pjt) {
@@ -293,23 +296,23 @@ if (!empty($querryRes) && ($user->rights->facture->creer
 if (!empty($querryRes))$form_output .=
     '<a class = "butAction" href="?action=getpdf&dateStart='
     .dol_print_date($dateStart, 'dayxcard').'&dateEnd='
     .dol_print_date($dateEnd, 'dayxcard').'&projectSelected='
     .$projectSelectedId.'&mode='.$mode.'&invoicabletaskOnly='.$invoicabletaskOnly
-    ."&hidetab=".$hidetab.'&ungroup='.$ungroup.'" >'.$langs->trans('TimesheetPDF').'</a>';
+    ."&hidetab=".$hidetab.'&ungroup='.$ungroup.'&token='.$token.'" >'.$langs->trans('TimesheetPDF').'</a>';
 if (!empty($querryRes) && $conf->global->MAIN_MODULE_EXPORT)$form_output .=
     '<a class = "butAction" href="?action=getExport&dateStart='
     .dol_print_date($dateStart, 'dayxcard').'&dateEnd='
     .dol_print_date($dateEnd, 'dayxcard').'&projectSelected='.$projectSelectedId
     .'&mode='.$mode.'&model='.$model.'&invoicabletaskOnly='.$invoicabletaskOnly
-    ."&hidetab=".$hidetab.'&ungroup='.$ungroup.'" >'.$langs->trans('Export').'</a>';
+    ."&hidetab=".$hidetab.'&ungroup='.$ungroup.'&token='.$token.'" >'.$langs->trans('Export').'</a>';
 if (!empty($querryRes))$form_output .=
     '<a class = "butAction" href="?action=reportproject&dateStart='
     .dol_print_date($dateStart, 'dayxcard').'&dateEnd='
     .dol_print_date($dateEnd, 'dayxcard').'&projectSelected='.$projectSelectedId
     .'&mode='.$mode.'&invoicabletaskOnly='.$invoicabletaskOnly
-    ."&hidetab=".$hidetab.'&ungroup='.$ungroup.'" >'.$langs->trans('Refresh').'</a>';
+    ."&hidetab=".$hidetab.'&ungroup='.$ungroup.'&token='.$token.'" >'.$langs->trans('Refresh').'</a>';
 $form_output .= '</form>';
 if (!($optioncss != '' && !empty($_POST['userSelected']))) echo $form_output;
 echo $querryRes;
 /*
 // List of available export formats
diff --git a/htdocs/timesheet/TimesheetReportUser.php b/htdocs/timesheet/TimesheetReportUser.php
index e916981..7e8a073 100644
--- a/htdocs/timesheet/TimesheetReportUser.php
+++ b/htdocs/timesheet/TimesheetReportUser.php
@@ -161,10 +161,13 @@ $form_output .= '<form action="?action=reportUser'.(($optioncss != '')?'&amp;opt
         <td>'.$langs->trans('Options').'</td>
         </tr>
         <tr >
         <td>
         ';
+$token = getToken();
+$form_output .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
+
 if($admin){
     $form_output .= $form->select_dolusers($userIdSelected, 'userSelected');
 
 } else {
     $form_output .= $form->select_dolusers($userIdSelected, 'userSelected', 0, null, 0, $userIdlistfull);
@@ -235,22 +238,22 @@ if ( ! empty( $querryRes ) && $conf->global->MAIN_MODULE_EXPORT ) {
         .'&userSelected=' . $userIdSelected 
         .'&mode='.$mode.'&model=' . $model 
         .'&invoicabletaskOnly=' . $invoicabletaskOnly 
         .'&ungroup=' . $ungroup 
         .'&showAll=' . $show_all 
-        . '" >' . $langs->trans( 'Export' ) . '</a>';
+        . '&token='.$token.'" >' . $langs->trans( 'Export' ) . '</a>';
 }
 if ( ! empty( $querryRes ) ) {
 	$form_output .= '<a class = "butAction" href="?action=getpdf&dateStart=' 
     . dol_print_date( $dateStart, 'dayxcard' ) 
     . '&dateEnd=' . dol_print_date( $dateEnd, 'dayxcard' ) 
     . '&userSelected=' . $userIdSelected 
     . '&mode='.$mode.'&model=' . $model 
     . '&invoicabletaskOnly='  . $invoicabletaskOnly 
     . '&ungroup=' . $ungroup 
     . '&showAll=' . $show_all 
-    . '" >' . $langs->trans( 'PDF' ) . '</a>';
+    . '&token='.$token.'" >' . $langs->trans( 'PDF' ) . '</a>';
 }
 $form_output .= '</div></div></form>';
 
 if ( ! ( $optioncss != '' && ! empty( $userIdSelected ) ) ) {
 	echo $form_output;
diff --git a/htdocs/timesheet/TimesheetTeamApproval.php b/htdocs/timesheet/TimesheetTeamApproval.php
index 2bb0146..d23475f 100644
--- a/htdocs/timesheet/TimesheetTeamApproval.php
+++ b/htdocs/timesheet/TimesheetTeamApproval.php
@@ -363,10 +363,12 @@ function getHTMLNavigation($optioncss, $selectList, $current = 0)
         if ($optioncss != '')$Nav .= '&amp;optioncss='.$optioncss;
         $Nav .= '">  &lt;&lt;'.$langs->trans("Previous").' </a>'."\n\t\t";
     }
     $Nav .= "</th>\n\t\t<th>\n\t\t\t";
     $Nav .= '<form name = "goTo" action="?action=goTo" method = "POST" >'."\n\t\t\t";
+    $Nav .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
+
     $Nav .= $langs->trans("GoTo").': '.$htmlSelect."\n\t\t\t";;
     $Nav .= '<input type = "submit" value = "Go" /></form>'."\n\t\t</th>\n\t\t<th>\n\t\t\t";
     if ($current<count($selectList)) {
         $Nav .= '<a href="?action=goTo&target='.($current+1);
         if ($optioncss != '') $Nav .= '&amp;optioncss='.$optioncss;
diff --git a/htdocs/timesheet/TimesheetUserTasksAdmin.php b/htdocs/timesheet/TimesheetUserTasksAdmin.php
index 5cccbf1..93cacab 100644
--- a/htdocs/timesheet/TimesheetUserTasksAdmin.php
+++ b/htdocs/timesheet/TimesheetUserTasksAdmin.php
@@ -554,10 +554,11 @@ switch($action) {
             if ($filter && $filter != -1) $param .= '&filtre='.urlencode($filter);
             $num = $db->num_rows($resql);
             //print_barre_liste function defined in /core/lib/function.lib.php, possible to add a picto
             print_barre_liste($langs->trans("Timesheetuser"), $page, $PHP_SELF, $param, $sortfield, $sortorder, '', $num, $nbtotalofrecords);
             print '<form method = "POST" action = "'.$_SERVER["PHP_SELF"].'">';
+            print '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
             print '<table class = "liste" style = "border-collapse:separate;" width = "100%">'."\n";
             //TITLE
             print '<tr class = "liste_titre">';
             print_liste_field_titre('User', $PHP_SELF, 't.fk_userid', '', $param, '', $sortfield, $sortorder);
             print "\n";
diff --git a/htdocs/timesheet/admin/timesheetsetup.php b/htdocs/timesheet/admin/timesheetsetup.php
index 21a2ab0..317242e 100644
--- a/htdocs/timesheet/admin/timesheetsetup.php
+++ b/htdocs/timesheet/admin/timesheetsetup.php
@@ -358,10 +358,12 @@ echo '</div>';
 echo '<div id="general" class="tabBar">';
 print '<span class="opacitymedium">'.$langs->trans("GeneralTabDesc").'</span>';
 print load_fiche_titre( $langs->trans( "GeneralOption" ), '', '' );
 
 echo '<form name="settings" action="?action=save" method="POST">';
+$token = getToken();
+echo '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
 echo '<table class="noborder" width = "100%">';
 echo '<tr class="liste_titre" width = "100%" ><th width = "200px">'.$langs->trans("Name").'</th><th>';
 echo $langs->trans("Description").'</th><th>'.$langs->trans("Value")."</th></tr>";
 // activate attendance
 echo  '<tr class="oddeven"><td align="left">'.$langs->trans("Attendance");
diff --git a/htdocs/timesheet/class/AttendanceEvent.class.php b/htdocs/timesheet/class/AttendanceEvent.class.php
index a719b7d..4ecc7d3 100644
--- a/htdocs/timesheet/class/AttendanceEvent.class.php
+++ b/htdocs/timesheet/class/AttendanceEvent.class.php
@@ -756,10 +756,13 @@ public function getHTMLGetOtherUserTs($idsList, $selected, $admin)
         $HTML .= $form->select_dolusers($selected, 'userid', 0, null, 0, $idsList);
     } else{
          $HTML .= $form->select_dolusers($selected, 'userid');
     }
     $HTML .= '<input type = "submit" value = "'.$langs->trans('Submit').'"/></form> ';
+    //FIXME should take token as input
+    $token = getToken();
+    $HTML .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
 
     return $HTML;
 }
 
 public function createTimeSpend($user, $token = '')
diff --git a/htdocs/timesheet/class/TimesheetUserTasks.class.php b/htdocs/timesheet/class/TimesheetUserTasks.class.php
index f87e765..263b92f 100644
--- a/htdocs/timesheet/class/TimesheetUserTasks.class.php
+++ b/htdocs/timesheet/class/TimesheetUserTasks.class.php
@@ -1059,37 +1059,29 @@ public function getHTMLPublicHolidayLines($ajax = false)
 public function getHTMLNavigation($optioncss, $ajax = false)
 {
     global $langs, $conf;
     $form = new Form($this->db);
     $tail = '';
-    //$tail = '&wlm='.$this->whitelistmode;
     if (isset($conf->global->TIMESHEET_ADD_FOR_OTHER) 
         && $conf->global->TIMESHEET_ADD_FOR_OTHER == 1){
         $tail = '&userid='.$this->userId;
     }
     $Nav = '<table class = "noborder" width = "50%">'."\n\t".'<tr>'."\n\t\t".'<th>'."\n\t\t\t";
     if ($ajax) {
-//     $Nav .= '<a id = "navPrev" onClick = "loadXMLTimesheet(\''.getStartDate($this->date_start, -1).'\', 0);';
     } else{
         $Nav .= '<a href="?dateStart='.getStartDate($this->date_start, -1).$tail;
     }
     if ($optioncss != '')$Nav .= '&amp;optioncss='.$optioncss;
     $Nav .= '">  &lt;&lt;'.$langs->trans("Previous").' </a>'."\n\t\t</th>\n\t\t<th>\n\t\t\t";
-//  if ($ajax)
-//  {
-    //    $Nav .= '<form name = "goToDate" onsubmit = "return toDateHandler();" action="?action=goToDate&wlm='.$this->whitelistmode.'" method = "POST">'."\n\t\t\t";
-    //} else{
-        $Nav .= '<form name = "goToDate" action="?action=goToDate'.$tail.'" method = "POST" >'."\n\t\t\t";
-    //}
+    $Nav .= '<form name = "goToDate" action="?action=goToDate'.$tail.'" method = "POST" >'."\n\t\t\t";
+    //FIXME should take token as input
+    $token = getToken();
+    $Nav .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
+
     $Nav .= $langs->trans("GoTo").': '.$form->select_date(-1, 'toDate', 0, 0, 0, "", 1, 1, 1)."\n\t\t\t";;
     $Nav .= '<input type = "submit" value = "Go" /></form>'."\n\t\t</th>\n\t\t<th>\n\t\t\t";
-    //if ($ajax)
-//    {
-    //    $Nav .= '<a id = "navNext" onClick = "loadXMLTimesheet(\''.getStartDate($this->date_start, 1).'\', 0);';
-    //} else{
-        $Nav .= '<a href="?dateStart='.getStartDate($this->date_start, 1).$tail;
-    //}
+    $Nav .= '<a href="?dateStart='.getStartDate($this->date_start, 1).$tail;
     if ($optioncss != '') $Nav .= '&amp;optioncss='.$optioncss;
     $Nav .= '">'.$langs->trans("Next").' &gt;&gt;</a>'."\n\t\t</th>\n\t</tr>\n </table>\n";
     return $Nav;
 }
      /**
@@ -1153,11 +1145,16 @@ public function getHTMLNavigation($optioncss, $ajax = false)
         if (!$admin) {
             $HTML .= $form->select_dolusers($selected, 'userid', 0, null, 0, $idsList);
         } else{
             $HTML .= $form->select_dolusers($selected, 'userid');
         }
+        //FIXME should take token as input
+        $token = getToken();
+        $HTML .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
+
         $HTML .= '<input type = "submit" value = "'.$langs->trans('Submit').'"/></form> ';
+        
         return $HTML;
     }
     /**
      *        Initialise object with example values
      *        Id must be 0 if object instance is a specimen
diff --git a/htdocs/timesheet/core/modules/modtimesheet.class.php b/htdocs/timesheet/core/modules/modtimesheet.class.php
index 3d79c35..3ff7f25 100644
--- a/htdocs/timesheet/core/modules/modtimesheet.class.php
+++ b/htdocs/timesheet/core/modules/modtimesheet.class.php
@@ -52,11 +52,11 @@ class modTimesheet extends DolibarrModules
                 // Module description, used if translation string 'ModuleXXXDesc' not found(where XXX is value of numeric property 'numero' of module)
                 $this->description = "TimesheetView";
 		        $this->editor_name = 'Patrick Delcroix';
 		        $this->editor_url = 'https://github.com/delcroip';
                 // Possible values for version are: 'development', 'experimental', 'dolibarr' or version
-                $this->version = '4.5.4';
+                $this->version = '4.5.6';
                 // Key used in llx_cons table to save module status enabled/disabled(where timesheet is value of property name of module in uppercase)
                 $this->const_name = 'MAIN_MODULE_'.strtoupper($this->name);
                 // Where to store the module in setup page(0=common, 1=interface, 2=others, 3=very specific)
                 $this->special = 0;
                 // Name of image file used for this module.

Vulnerable code:     ."&hidetab=".$hidetab.'&ungroup='.$ungroup.'" >'.$langs->trans('TimesheetPDF').'</a>';
    ."&hidetab=".$hidetab.'&ungroup='.$ungroup.'" >'.$langs->trans('Export').'</a>';
    ."&hidetab=".$hidetab.'&ungroup='.$ungroup.'" >'.$langs->trans('Refresh').'</a>';
        . '" >' . $langs->trans( 'Export' ) . '</a>';
    . '" >' . $langs->trans( 'PDF' ) . '</a>';
    //$tail = '&wlm='.$this->whitelistmode;
//     $Nav .= '<a id = "navPrev" onClick = "loadXMLTimesheet(\''.getStartDate($this->date_start, -1).'\', 0);';
//  if ($ajax)
//  {
    //    $Nav .= '<form name = "goToDate" onsubmit = "return toDateHandler();" action="?action=goToDate&wlm='.$this->whitelistmode.'" method = "POST">'."\n\t\t\t";
    //} else{
        $Nav .= '<form name = "goToDate" action="?action=goToDate'.$tail.'" method = "POST" >'."\n\t\t\t";
    //}
    //if ($ajax)
//    {
    //    $Nav .= '<a id = "navNext" onClick = "loadXMLTimesheet(\''.getStartDate($this->date_start, 1).'\', 0);';
    //} else{
        $Nav .= '<a href="?dateStart='.getStartDate($this->date_start, 1).$tail;
    //}
                $this->version = '4.5.4';
Fixed code:     print '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';

4.5.6
- fix csrf issue in other pages
- fix box issue

$token = getToken();
            $Form .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';

            $Form .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
$token = getToken();
$form_output .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';

    ."&hidetab=".$hidetab.'&ungroup='.$ungroup.'&token='.$token.'" >'.$langs->trans('TimesheetPDF').'</a>';
    ."&hidetab=".$hidetab.'&ungroup='.$ungroup.'&token='.$token.'" >'.$langs->trans('Export').'</a>';
    ."&hidetab=".$hidetab.'&ungroup='.$ungroup.'&token='.$token.'" >'.$langs->trans('Refresh').'</a>';
$token = getToken();
$form_output .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';

        . '&token='.$token.'" >' . $langs->trans( 'Export' ) . '</a>';
    . '&token='.$token.'" >' . $langs->trans( 'PDF' ) . '</a>';
    $Nav .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';

            print '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
$token = getToken();
echo '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
    //FIXME should take token as input
    $token = getToken();
    $HTML .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
    $Nav .= '<form name = "goToDate" action="?action=goToDate'.$tail.'" method = "POST" >'."\n\t\t\t";
    //FIXME should take token as input
    $token = getToken();
    $Nav .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';

    $Nav .= '<a href="?dateStart='.getStartDate($this->date_start, 1).$tail;
        //FIXME should take token as input
        $token = getToken();
        $HTML .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';

        
                $this->version = '4.5.6';