CVE-2016-9456: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts in order to identify and fix other potential CSRF vulnerabilities. Over 20+ such issues were fixed.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2017-03-28T02:59Z
Repository: https://github.com/revive-adserver/revive-adserver
Language: PHP
Files changed: lib/OA/Admin/Template.php, lib/max/Admin/Inventory/TrackerAppend.php, lib/max/Admin/Inventory/themes/TrackerAppend.html, lib/max/other/html.php, lib/templates/admin/campaign-zone.html, www/admin/banner-modify.php, www/admin/campaign-modify.php, www/admin/campaign-zone-link.php, www/admin/channel-acl.php, www/admin/channel-modify.php, www/admin/lib-maintenance-priority.inc.php, www/admin/maintenance-acl-check.php, www/admin/maintenance-appendcode-check.php, www/admin/maintenance-banners-check.php, www/admin/maintenance-encoding.php, www/admin/maintenance-menus.php, www/admin/maintenance-plugins.php, www/admin/maintenance-priority-calculate.php, www/admin/maintenance-priority.php, www/admin/maintenance-storage-move.php, www/admin/maintenance-storage.php, www/admin/run-mpe.php, www/admin/tracker-append.php, www/admin/tracker-variables.php, www/admin/updates-history.php, www/admin/zone-modify.php
Commit date: 2016-03-01 16:23:10 +0100
Commit message: Fix other CSRF issues

Cross-Site Request Forgery (CSRF)
---------------------------------

Following a number of CSRF reports, the Revive Team has conducted a security
audit of the admin interface scripts in order to identify and fix other
potential CSRF vulnerabilities.

The effort led to fixing 20+ such issues: please see the commit for the full
list of files affected.

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-352
CVSSv2: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Diff: diff --git a/lib/OA/Admin/Template.php b/lib/OA/Admin/Template.php
index cd41beab89..0234b11b09 100644
--- a/lib/OA/Admin/Template.php
+++ b/lib/OA/Admin/Template.php
@@ -117,10 +117,12 @@ class OA_Admin_Template extends Smarty
          * be placed into GET method calls for CRUD operations in templates. See
          * OA_Permission::checkSessionToken() method for details.
          */
         $this->register_function('rv_add_session_token', array('OA_Admin_Template', '_add_session_token'));
 
+        // Also assign a template variable for other usages
+        $this->assign("csrfToken", phpAds_SessionGetToken());
     }
 
     /**
      * CVE-2013-5954
      *
diff --git a/lib/max/Admin/Inventory/TrackerAppend.php b/lib/max/Admin/Inventory/TrackerAppend.php
index 314b3ed66a..33948d90bb 100644
--- a/lib/max/Admin/Inventory/TrackerAppend.php
+++ b/lib/max/Admin/Inventory/TrackerAppend.php
@@ -44,10 +44,11 @@ class MAX_Admin_Inventory_TrackerAppend
      */
     function __construct()
     {
         $this->_useDefaultDal();
 
+        $this->csrf_token    = phpAds_SessionGetToken();
         $this->advertiser_id = MAX_getValue('clientid', 0);
         $this->tracker_id    = MAX_getValue('trackerid', 0);
         $this->assetPath 	 = OX::assetPath();
         $this->showReminder  = false;
     }
diff --git a/lib/max/Admin/Inventory/themes/TrackerAppend.html b/lib/max/Admin/Inventory/themes/TrackerAppend.html
index 332f5e9e88..3056792deb 100644
--- a/lib/max/Admin/Inventory/themes/TrackerAppend.html
+++ b/lib/max/Admin/Inventory/themes/TrackerAppend.html
@@ -11,11 +11,11 @@
 <!--
 
 function MMM_trackerAction(action, id)
 {
     var f = document.getElementById('trackerAppendForm');
-    
+
     f.t_action.value = action;
     f.t_id.value = id;
     f.submit();
     return false;
 }
@@ -24,10 +24,11 @@ function MMM_trackerAction(action, id)
 </script>
 <div flexy:if="showReminder" class="errormessage"><img class="errormessage" src="{assetPath}/images/warning.gif" align="absmiddle">
 <span class='tab-s'>You have unsaved changes on this page, make sure you press &quot;Save Changes&quot; when finished</span><br>
 </div>
 <form id="trackerAppendForm" class="section" method="post">
+    <input type="hidden" name="token" value="{csrf_token}" />
     <input type="hidden" name="clientid" value="{advertiser_id}" />
     <input type="hidden" name="trackerid" value="{tracker_id}" />
     <input type="hidden" name="t_action" />
     <input type="hidden" name="t_id"  />
     <input type="hidden" name="t_paused" value="{getPausedCodes()}" />
diff --git a/lib/max/other/html.php b/lib/max/other/html.php
index 87c69f1c0e..0e6bc05df3 100644
--- a/lib/max/other/html.php
+++ b/lib/max/other/html.php
@@ -1145,10 +1145,11 @@ function MAX_displayAcls($acls, $aParams)
     $tabindex =& $GLOBALS['tabindex'];
     $page = basename($_SERVER['SCRIPT_NAME']);
     $conf = $GLOBALS['_MAX']['CONF'];
 
     echo "<form action='{$page}' method='post'>";
+    echo "<input type='hidden' name='token' value='".urlencode(phpAds_SessionGetToken())."' />";
 
     echo "<label><img src='" . OX::assetPath() . "/images/icon-acl-add.gif' align='absmiddle'>&nbsp;". $GLOBALS['strACLAdd'] .": &nbsp;";
     echo "<select name='type' accesskey='{$GLOBALS['keyAddNew']}' tabindex='".($tabindex++)."'>";
 
     $deliveryLimitations = OX_Component::getComponents('deliveryLimitations', null, false);
@@ -1687,15 +1688,18 @@ function addAdvertiserPageToolsAndShortcuts($advertiserId)
 
 
 function addTrackerPageTools($advertiserId, $trackerId, $aOtherAdvertisers)
 {
     if (OA_Permission::isAccount(OA_ACCOUNT_ADMIN) || OA_Permission::isAccount(OA_ACCOUNT_MANAGER)) {
+        $token = phpAds_SessionGetToken();
+
         //duplicate
-        addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "tracker-modify.php?clientid=".$advertiserId."&trackerid=".$trackerId."&duplicate=true&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconTrackerDuplicate");
+        addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "tracker-modify.php?token=".urlencode($token)."&clientid=".$advertiserId."&trackerid=".$trackerId."&duplicate=true&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconTrackerDuplicate");
 
         //move to
         $form  = "<form action='" . MAX::constructUrl(MAX_URL_ADMIN, 'tracker-modify.php') . "'>
+            <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
             <input type='hidden' name='trackerid' value='$trackerId'
             <input type='hidden' name='clientid' value='$advertiserId'
             <input type='hidden' name='returnurl' value='tracker-edit.php'>
             <select name='moveto'>";
         foreach ($aOtherAdvertisers as $advertiser) {
@@ -1704,28 +1708,32 @@ function addTrackerPageTools($advertiserId, $trackerId, $aOtherAdvertisers)
         $form .= "</select><input type='image' class='submit' src='" . OX::assetPath() . "/images/".$GLOBALS['phpAds_TextDirection']."/go_blue.gif'></form>";
         addPageFormTool($GLOBALS['strMoveTo'], 'iconTrackerMove', $form);
 
         //delete
         $deleteConfirm = phpAds_DelConfirm($GLOBALS['strConfirmDeleteTracker']);
-        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "tracker-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&clientid=".$advertiserId."&trackerid=".$trackerId."&returnurl=advertiser-trackers.php"), "iconDelete", null, $deleteConfirm);
+        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "tracker-delete.php?token=".urlencode($token)."&clientid=".$advertiserId."&trackerid=".$trackerId."&returnurl=advertiser-trackers.php"), "iconDelete", null, $deleteConfirm);
         addPageShortcut($GLOBALS['strBackToTrackers'], MAX::constructUrl(MAX_URL_ADMIN, "advertiser-trackers.php?clientid=$advertiserId"), "iconBack");
     }
 }
 
 
 function addCampaignPageTools($clientid, $campaignid, $aOtherAdvertisers, $aEntities)
 {
     global $phpAds_TextDirection;
 
     if (!OA_Permission::isAccount(OA_ACCOUNT_ADVERTISER)) {
-        addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "campaign-modify.php?duplicate=1&clientid=$clientid&campaignid=$campaignid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconCampaignDuplicate");
+
+        $token = phpAds_SessionGetToken();
+
+        addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "campaign-modify.php?token=".urlencode($token)."&duplicate=1&clientid=$clientid&campaignid=$campaignid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconCampaignDuplicate");
 
         if (OA_Permission::hasAccessToObject('campaigns', $campaignid, OA_Permission::OPERATION_MOVE)) {
             $form = "<form action='" . MAX::constructUrl(MAX_URL_ADMIN, 'campaign-modify.php') . "'>
+            <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
             <input type='hidden' name='clientid' value='$clientid'>
             <input type='hidden' name='campaignid' value='$campaignid'>
-            <input type='hidden' name='returnurl' value='".htmlspecialchars(basename($_SERVER['SCRIPT_NAME']))."'>
+            <input type='hidden' name='returnurl' value='".htmlspecialchars(basename($_SERVER['SCRIPT_NAME'], ENT_QUOTES))."'>
             <select name='newclientid'>";
                 $aOtherAdvertisers = _multiSort($aOtherAdvertisers,'name','advertiser_id');
                 foreach ($aOtherAdvertisers as $aOtherAdvertiser) {
                     $otherAdvertiserId = $aOtherAdvertiser['advertiser_id'];
                     $otherAdvertiserName = MAX_buildName($otherAdvertiserId, $aOtherAdvertiser['name']);
@@ -1738,11 +1746,11 @@ function addCampaignPageTools($clientid, $campaignid, $aOtherAdvertisers, $aEnti
 
             addPageFormTool($GLOBALS['strMoveTo'], 'iconCampaignMove', $form);
         }
 
         $deleteConfirm = phpAds_DelConfirm($GLOBALS['strConfirmDeleteCampaign']);
-        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "campaign-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&clientid=$clientid&campaignid=$campaignid&returnurl=advertiser-campaigns.php"), "iconDelete", null, $deleteConfirm);
+        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "campaign-delete.php?token=".urlencode($token)."&clientid=$clientid&campaignid=$campaignid&returnurl=advertiser-campaigns.php"), "iconDelete", null, $deleteConfirm);
     }
 
     //shortcuts
     if (!empty($campaignid) && !OA_Permission::isAccount(OA_ACCOUNT_ADVERTISER)) {
         if (OA_Permission::hasAccessToObject('campaigns', $campaignid, OA_Permission::OPERATION_ADD_CHILD)) {
@@ -1759,20 +1767,24 @@ function addCampaignPageTools($clientid, $campaignid, $aOtherAdvertisers, $aEnti
     }
 }
 
 function addBannerPageTools($advertiserId, $campaignId, $bannerId, $aOtherCampaigns, $aOtherBanners, $aEntities)
 {
+    global $phpAds_TextDirection;
+
     if (empty($bannerId)) {
         return;
     }
 
-    global $phpAds_TextDirection;
+    $token = phpAds_SessionGetToken();
+
     //duplicate
-    addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "banner-modify.php?duplicate=true&clientid=$advertiserId&campaignid=$campaignId&bannerid=$bannerId&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconBannerDuplicate");
+    addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "banner-modify.php?token=".urlencode($token)."&duplicate=true&clientid=$advertiserId&campaignid=$campaignId&bannerid=$bannerId&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconBannerDuplicate");
 
     //move to
     $form = "<form action='" . MAX::constructUrl(MAX_URL_ADMIN, 'banner-modify.php') . "'>
+    <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
     <input type='hidden' name='clientid' value='$advertiserId'>
     <input type='hidden' name='campaignid' value='$campaignId'>
     <input type='hidden' name='bannerid' value='$bannerId'>
     <input type='hidden' name='returnurl' value='".htmlspecialchars(basename($_SERVER['SCRIPT_NAME']))."'>
     <select name='moveto'>";
@@ -1793,10 +1805,11 @@ function addBannerPageTools($advertiserId, $campaignId, $bannerId, $aOtherCampai
     addPageFormTool($GLOBALS['strMoveTo'], 'iconBannerMove', $form);
 
     //apply to
     if (basename($_SERVER['SCRIPT_NAME']) == 'banner-acl.php') {
         $form = "<form action='" . MAX::constructUrl(MAX_URL_ADMIN, 'banner-modify.php') . "'>
+        <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
         <input type='hidden' name='clientid' value='$advertiserId'>
         <input type='hidden' name='campaignid' value='$campaignId'>
         <input type='hidden' name='bannerid' value='$bannerId'>
         <input type='hidden' name='returnurl' value='".htmlspecialchars(basename($_SERVER['SCRIPT_NAME']))."'>
         <select name='applyto'>";
@@ -1813,11 +1826,11 @@ function addBannerPageTools($advertiserId, $campaignId, $bannerId, $aOtherCampai
     }
 
     //delete
     if (!OA_Permission::isAccount(OA_ACCOUNT_ADVERTISER)) {
         $deleteConfirm = phpAds_DelConfirm($GLOBALS['strConfirmDeleteBanner']);
-        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "banner-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&clientid=$advertiserId&campaignid=$campaignId&bannerid=$bannerId&returnurl=campaign-banners.php"), "iconDelete", null, $deleteConfirm);
+        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "banner-delete.php?token=".urlencode($token)."&clientid=$advertiserId&campaignid=$campaignId&bannerid=$bannerId&returnurl=campaign-banners.php"), "iconDelete", null, $deleteConfirm);
     }
 
     /* Shortcuts */
     addPageShortcut($GLOBALS['strBackToBanners'], MAX::constructUrl(MAX_URL_ADMIN, "campaign-banners.php?clientid=$advertiserId&campaignid=$campaignId"), "iconBack");
     $entityString = _getEntityString($aEntities);
@@ -1838,10 +1851,13 @@ function addWebsitePageTools($websiteId)
 
 
 function addZonePageTools($affiliateid, $zoneid, $aOtherPublishers, $aEntities)
 {
     global $phpAds_TextDirection;
+
+    $token = phpAds_SessionGetToken();
+
     //duplicate
     if (OA_Permission::isAccount(OA_ACCOUNT_ADMIN)
         || OA_Permission::isAccount(OA_ACCOUNT_MANAGER)
         || OA_Permission::hasPermission(OA_PERM_ZONE_ADD)) {
         addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "zone-modify.php?duplicate=true&affiliateid=$affiliateid&zoneid=$zoneid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconZoneDuplicate");
@@ -1849,10 +1865,11 @@ function addZonePageTools($affiliateid, $zoneid, $aOtherPublishers, $aEntities)
 
     //move to
     if (OA_Permission::isAccount(OA_ACCOUNT_ADMIN)
         || OA_Permission::isAccount(OA_ACCOUNT_MANAGER)) {
         $form = "<form action='" . MAX::constructUrl(MAX_URL_ADMIN, 'zone-modify.php') . "'>
+        <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
         <input type='hidden' name='affiliateid' value='$affiliateid'>
         <input type='hidden' name='zoneid' value='$zoneid'>
         <input type='hidden' name='returnurl' value='".htmlspecialchars(basename($_SERVER['SCRIPT_NAME']))."'>
         <select name='newaffiliateid'>";
         $aOtherPublishers = _multiSort($aOtherPublishers,'name','publisher_id');
@@ -1870,11 +1887,11 @@ function addZonePageTools($affiliateid, $zoneid, $aOtherPublishers, $aEntities)
     //delete
     if (OA_Permission::isAccount(OA_ACCOUNT_ADMIN)
        || OA_Permission::isAccount(OA_ACCOUNT_MANAGER)
        || OA_Permission::hasPermission(OA_PERM_ZONE_DELETE)) {
         $deleteConfirm = phpAds_DelConfirm($GLOBALS['strConfirmDeleteZone']);
-        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "zone-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&affiliateid=$affiliateid&zoneid=$zoneid&returnurl=affiliate-zones.php"), "iconDelete", null, $deleteConfirm);
+        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "zone-delete.php?token=".urlencode($token)."&affiliateid=$affiliateid&zoneid=$zoneid&returnurl=affiliate-zones.php"), "iconDelete", null, $deleteConfirm);
     }
 
     //shortcut
     addPageShortcut($GLOBALS['strBackToZones'], MAX::constructUrl(MAX_URL_ADMIN, "affiliate-zones.php?affiliateid=$affiliateid"), "iconBack");
     $entityString = _getEntityString($aEntities);
@@ -1888,16 +1905,18 @@ function addChannelPageTools($agencyid, $websiteId, $channelid, $channelType)
     }
     else {
         $deleteReturlUrl = MAX::constructUrl(MAX_URL_ADMIN, 'channel-index.php');
     }
 
+    $token = phpAds_SessionGetToken();
+
     //duplicate
-    addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "channel-modify.php?duplicate=true&agencyid=$agencyid&affiliateid=$websiteId&channelid=$channelid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconTargetingChannelDuplicate");
+    addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "channel-modify.php?token=".urlencode($token)."&duplicate=true&agencyid=$agencyid&affiliateid=$websiteId&channelid=$channelid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconTargetingChannelDuplicate");
 
     //delete
     $deleteConfirm = phpAds_DelConfirm($GLOBALS['strConfirmDeleteChannel']);
-    addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "channel-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&agencyid=$agencyid&affiliateid=$websiteId&channelid=$channelid&returnurl=$deleteReturlUrl"), "iconDelete", null, $deleteConfirm);
+    addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "channel-delete.php?token=".urlencode($token)."&agencyid=$agencyid&affiliateid=$websiteId&channelid=$channelid&returnurl=$deleteReturlUrl"), "iconDelete", null, $deleteConfirm);
 }
 
 
 /**
  * Builds Pear pager object, preconfigured with items per page. Pager links are
diff --git a/lib/templates/admin/campaign-zone.html b/lib/templates/admin/campaign-zone.html
index e24f913b1f..f635f1f72d 100644
--- a/lib/templates/admin/campaign-zone.html
+++ b/lib/templates/admin/campaign-zone.html
@@ -11,10 +11,11 @@
 -->*}
 {view_before_content}
 
 <form id="zoneLinkingForm">
 <div id="campaign-zone" class="new-form">
+  <input id="csrf-token" type="hidden" value="{$csrfToken|escape}" />
   <input id="advertiser-id" type="hidden" value="{$advertiserId}" />
   <input id="campaign-id" type="hidden" value="{$campaignId}" />
 
   <div id="filters">
     <div id="filters-available">
@@ -211,10 +212,11 @@
          $("#quick-search-available").val("");
       }
     }
 
     var postData = {
+      "token": $("#csrf-token").val(),
       "clientid": $("#advertiser-id").val(),
       "campaignid": $("#campaign-id").val(),
       "text-linked": quickSearchLinked,
       "text-available": quickSearchAvailable,
       "action": action,
@@ -236,10 +238,13 @@
       success: function(data) {
         if (!checkReload(data)) {
           updatePanel(data, "available");
           updatePanel(data, "linked");
 
+          // Refresh token
+          $("#csrf-token").val(extractPart(data, "value", "token"));
+
 	        $("#linking-status").html(extractPart(data, "info", "result")).stop().show().css("opacity", "1");
 	        if (window.linkingTimout) {
 	          window.linkingTimout.clearTimeout();
 	        }
 	        window.linkingTimeout = window.setTimeout(function() {
diff --git a/www/admin/banner-modify.php b/www/admin/banner-modify.php
index 421d79282c..67817fd156 100644
--- a/www/admin/banner-modify.php
+++ b/www/admin/banner-modify.php
@@ -29,17 +29,17 @@ phpAds_registerGlobal('bannerid', 'campaignid', 'clientid', 'returnurl', 'duplic
 
 
 // Security check
 OA_Permission::enforceAccount(OA_ACCOUNT_MANAGER);
 
-OA_Permission::checkSessionToken();
-
 /*-------------------------------------------------------*/
 /* Main code                                             */
 /*-------------------------------------------------------*/
 
 if (!empty($bannerid)) {
+    OA_Permission::checkSessionToken();
+
     OA_Permission::enforceAccessToObject('banners', $bannerid);
 
     if (!empty($moveto) && isset($moveto_x)) {
         if (OA_Permission::isAccount(OA_ACCOUNT_MANAGER)) {
             OA_Permission::enforceAccessToObject('campaigns', $moveto);
diff --git a/www/admin/campaign-modify.php b/www/admin/campaign-modify.php
index dbf4008a9a..d33170736d 100644
--- a/www/admin/campaign-modify.php
+++ b/www/admin/campaign-modify.php
@@ -41,10 +41,12 @@ else if (!empty($newclientid)) {
 /*-------------------------------------------------------*/
 /* Main code                                             */
 /*-------------------------------------------------------*/
 
 if (!empty($campaignid)) {
+    OA_Permission::checkSessionToken();
+
     if (!empty($duplicate)) {
     	// Duplicate the campaign
     	$doCampaigns = OA_Dal::factoryDO('campaigns');
     	$doCampaigns->get($campaignid);
         $oldName = $doCampaigns->campaignname;
diff --git a/www/admin/campaign-zone-link.php b/www/admin/campaign-zone-link.php
index 55df6d4530..e9c73a7a57 100644
--- a/www/admin/campaign-zone-link.php
+++ b/www/admin/campaign-zone-link.php
@@ -36,10 +36,12 @@ $action     = $GLOBALS["action"];
 $campaignId = $GLOBALS['campaignid'];
 
 OA_Permission::enforceAccount ( OA_ACCOUNT_MANAGER );
 OA_Permission::enforceAccessToObject ( 'campaigns', $campaignid );
 
+OA_Permission::checkSessionToken();
+
 $aZonesIds = array();
 $aZonesIdsHash = array();
 foreach ($_REQUEST['ids'] as $zone) {
     if (substr($zone, 0, 1) == 'z') {
         $aZonesIds[] = (int) substr($zone, 1);
@@ -101,6 +103,7 @@ switch ($action) {
             }
         break;
 };
 echo "<!--result-info-end-->";
 
-?>
+// CSRF Token
+echo "<!--token-value-start-->".phpAds_SessionGetToken()."<!--token-value-end-->";
diff --git a/www/admin/channel-acl.php b/www/admin/channel-acl.php
index 694a46c255..ec8744935f 100644
--- a/www/admin/channel-acl.php
+++ b/www/admin/channel-acl.php
@@ -57,10 +57,12 @@ if (!empty($affiliateid)) {
 if (!empty($action)) {
     if (empty($acl)) $acl = array();
     $acl = MAX_AclAdjust($acl, $action);
 }
 elseif (!empty($submit)) {
+    OA_Permission::checkSessionToken();
+
     $acl = (isset($acl)) ? $acl : array();
     // Only save when inputs are valid
     if (OX_AclCheckInputsFields($acl, $pageName) === true) {
         if (MAX_AclSave($acl, $aEntities)) {
 
diff --git a/www/admin/channel-modify.php b/www/admin/channel-modify.php
index 5fc81573cd..cde27af561 100644
--- a/www/admin/channel-modify.php
+++ b/www/admin/channel-modify.php
@@ -32,10 +32,12 @@ if (empty($returnurl)) {
     $returnurl = 'channel-edit.php';
 }
 
 // Security check
 if (isset($channelid) && $channelid != '') {
+    OA_Permission::checkSessionToken();
+
     if (isset($duplicate) && $duplicate == 'true') {
 
         //get channel old channel name
         $doChannel = OA_Dal::factoryDO('channel');
         if ($doChannel->get($channelid)) {
diff --git a/www/admin/lib-maintenance-priority.inc.php b/www/admin/lib-maintenance-priority.inc.php
index c0c2e242cd..8b48255b4e 100644
--- a/www/admin/lib-maintenance-priority.inc.php
+++ b/www/admin/lib-maintenance-priority.inc.php
@@ -11,11 +11,11 @@
 */
 
 function OA_runMPE()
 {
     $objResponse = new xajaxResponse();
-    $objResponse->addAssign("run-mpe", "innerHTML", "<img src='run-mpe.php' />");
+    $objResponse->addAssign("run-mpe", "innerHTML", "<img src='run-mpe.ph?token=".urlencode(phpAds_SessionGetToken())."' />");
     return $objResponse;
 }
 
 require_once MAX_PATH .'/lib/Max.php';
 require_once MAX_PATH .'/lib/xajax/xajax.inc.php';
diff --git a/www/admin/maintenance-acl-check.php b/www/admin/maintenance-acl-check.php
index 56e3404f12..d0aab95cac 100644
--- a/www/admin/maintenance-acl-check.php
+++ b/www/admin/maintenance-acl-check.php
@@ -36,10 +36,12 @@ phpAds_MaintenanceSelection("acls");
 /*-------------------------------------------------------*/
 /* Main code                                             */
 /*-------------------------------------------------------*/
 
 if (!empty($action) && ($action == 'Recompile')) {
+    OA_Permission::checkSessionToken();
+
     MAX_AclReCompileAll();
     echo "<strong>$strAllBannerChannelCompiled</strong><br />";
 }
 
 echo $strBannerChannelResult;
@@ -92,10 +94,11 @@ if ($allBannersValid) {
 if (!$allBannersValid || !$allChannelsValid) {
     phpAds_ShowBreak();
     echo "<br /><strong>". $strErrorsFound ."</strong><br /><br />";
     echo $strRepairCompiledLimitations;
     echo "<form action='' METHOD='GET'>";
+    echo "<input type='hidden' name='token' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."' />";
     echo "<input type='submit' name='action' value='$strRecompile' />";
     echo "</form>";
 }
 
 
diff --git a/www/admin/maintenance-appendcode-check.php b/www/admin/maintenance-appendcode-check.php
index 4b523282a2..9b5ff463f1 100644
--- a/www/admin/maintenance-appendcode-check.php
+++ b/www/admin/maintenance-appendcode-check.php
@@ -38,10 +38,12 @@ phpAds_MaintenanceSelection("appendcodes");
 
 // Init DAL
 $tr = new MAX_Dal_Inventory_Trackers();
 
 if (!empty($action) && ($action == 'Recompile')) {
+    OA_Permission::checkSessionToken();
+
     $tr->recompileAppendCodes();
     echo "<strong>$strAppendCodesRecompiled<br />";
 }
 
 echo $strAppendCodesResult;
@@ -66,10 +68,11 @@ phpAds_showBreak();
 if (!$allTrackersValid) {
     phpAds_ShowBreak();
     echo "<br /><strong>$strErrorsFound</strong><br /><br />";
     echo "$strRepairAppenedCodes<br />";
     echo "<form action='' METHOD='GET'>";
+    echo "<input type='hidden' name='token' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."' />";
     echo "<input type='submit' name='action' value='$strRecompile' />";
     echo "</form>";
 }
 
 
diff --git a/www/admin/maintenance-banners-check.php b/www/admin/maintenance-banners-check.php
index b91a947f4f..0be76615ca 100644
--- a/www/admin/maintenance-banners-check.php
+++ b/www/admin/maintenance-banners-check.php
@@ -30,10 +30,12 @@ phpAds_registerGlobal('action', 'returnurl');
 /*-------------------------------------------------------*/
 /* Main code                                             */
 /*-------------------------------------------------------*/
 
 if (!empty($action) && ($action == 'Rebuild')) {
+    OA_Permission::checkSessionToken();
+
     $result = processBanners(true);
     if (empty($result['errors'])) {
         if (empty($returnurl)) { $returnurl = 'maintenance-banners-check.php'; }
         OX_Admin_Redirect::redirect($returnurl);
     } else {
@@ -55,10 +57,11 @@ if (!empty($action) && ($action == 'Rebuild')) {
     $result = processBanners(false);
     if (!empty($result['errors']) || !empty($result['different'])) {
         _showPageHeader();
         echo $GLOBALS['strBannerCacheDifferencesFound'];
         echo "<form action='' METHOD='GET'>";
+        echo "<input type='hidden' name='token' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."' />";
         echo "<input type='submit' name='action' value='{$GLOBALS['strBannerCacheRebuildButton']}' />";
         echo "</form>";
     } else {
         _showPageHeader();
         echo $GLOBALS['strBannerCacheOK'];
diff --git a/www/admin/maintenance-encoding.php b/www/admin/maintenance-encoding.php
index fbc2157cfc..f98bdf45f3 100644
--- a/www/admin/maintenance-encoding.php
+++ b/www/admin/maintenance-encoding.php
@@ -103,10 +103,12 @@ $aTableFields = array(
         'idfields'  => array('zoneid'),
     ),
 );
 
 if (!empty($_POST['encConfirm'])) {
+    OA_Permission::checkSessionToken();
+
     _iterateTableFields($aTableFields, true);
     Header("Location: maintenance-maintenance.php");
 }
 
 /**
@@ -199,10 +201,11 @@ if (!empty($_POST['encTest'])) {
                         </tr>\n";
             }
         }
     }
     echo "</table><br />";
+    echo "<input type='hidden' name='token' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."' />";
     echo "<input type='submit' name='encConfirm' value='{$GLOBALS['strConvert']}' /> <input type='button' name='encCancel' value='{$GLOBALS['strCancel']}' onclick='javascript:document.location = \"" . $_SERVER['SCRIPT_NAME'] . "\";' />";
 }
 
 phpAds_ShowBreak();
 
diff --git a/www/admin/maintenance-menus.php b/www/admin/maintenance-menus.php
index e0e74b0f61..5cdb8981ba 100644
--- a/www/admin/maintenance-menus.php
+++ b/www/admin/maintenance-menus.php
@@ -38,10 +38,12 @@ echo "<br />";
 echo $strMenusPrecis;
 echo "<br /><br />";
 
 if (!empty($action))
 {
+    OA_Permission::checkSessionToken();
+
     switch ($action)
     {
         case 'build':
             require_once(LIB_PATH.'/Extension/admin.php');
             $oExtensionManager = new OX_Extension_admin();
@@ -51,11 +53,11 @@ if (!empty($action))
     }
     echo $strMenusCachedOk.'</br>';
 }
 
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-menus.php?action=build'>Rebuild Menu Cache</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-menus.php?action=build&amp;token=".urlencode(phpAds_SessionGetToken())."'>Rebuild Menu Cache</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
 
 
 /*-------------------------------------------------------*/
 /* HTML framework                                        */
diff --git a/www/admin/maintenance-plugins.php b/www/admin/maintenance-plugins.php
index 7f2869da77..c49e7392e3 100644
--- a/www/admin/maintenance-plugins.php
+++ b/www/admin/maintenance-plugins.php
@@ -38,10 +38,12 @@ echo "<br /><br />";
 
 phpAds_registerGlobal('action', 'returnurl');
 
 if (!empty($action))
 {
+    OA_Permission::checkSessionToken();
+
     switch ($action)
     {
         case 'rep':
             // generates brief display and detailed log
             // with debug info on plugin installations and status
@@ -114,23 +116,25 @@ if (!empty($action))
             break;*/
         default:
     }
 }
 
+$token = 'token='.urlencode(phpAds_SessionGetToken()).'&amp;';
+
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=hook'>Rebuild Component Hooks Cache</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=hook'>Rebuild Component Hooks Cache</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=pref'>Rebuild Preferences List</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=pref'>Rebuild Preferences List</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=reg'>Rebuild Delivery Hooks Cache</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=reg'>Rebuild Delivery Hooks Cache</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=rep'>Plugin Report</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=rep'>Plugin Report</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=exp'>Export All Plugins</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=exp'>Export All Plugins</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
 
-/*echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=dep'>Check Dependencies</a>&nbsp;&nbsp;";
+/*echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=dep'>Check Dependencies</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();*/
 if ($oTpl)
 {
     $oTpl->display();
 }
diff --git a/www/admin/maintenance-priority-calculate.php b/www/admin/maintenance-priority-calculate.php
index 2965c5a4cc..866537a584 100644
--- a/www/admin/maintenance-priority-calculate.php
+++ b/www/admin/maintenance-priority-calculate.php
@@ -18,10 +18,11 @@ require_once MAX_PATH . '/www/admin/config.php';
 require_once MAX_PATH . '/lib/OA/Maintenance/Priority.php';
 
 
 // Security check
 OA_Permission::enforceAccount(OA_ACCOUNT_ADMIN);
+OA_Permission::checkSessionToken();
 
 /*-------------------------------------------------------*/
 /* Main code                                             */
 /*-------------------------------------------------------*/
 
diff --git a/www/admin/maintenance-priority.php b/www/admin/maintenance-priority.php
index 1c3174984e..14ef5a86bf 100644
--- a/www/admin/maintenance-priority.php
+++ b/www/admin/maintenance-priority.php
@@ -115,11 +115,11 @@ function phpAds_showBanners()
 /*-------------------------------------------------------*/
 
 echo "<br />";
 
 // Show recalculate button
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-priority-calculate.php'>$strRecalculatePriority</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-priority-calculate.php?token=".urlencode(phpAds_SessionGetToken())."'>$strRecalculatePriority</a>&nbsp;&nbsp;";
 echo "<br /><br />";
 phpAds_ShowBreak();
 
 echo "<br /><br />";
 //echo 'This page needs to be re-written to show an agency-based list of ad/zone priority data...';
diff --git a/www/admin/maintenance-storage-move.php b/www/admin/maintenance-storage-move.php
index 8a45d2b7d5..d10221e7f6 100644
--- a/www/admin/maintenance-storage-move.php
+++ b/www/admin/maintenance-storage-move.php
@@ -19,10 +19,11 @@ require_once MAX_PATH . '/www/admin/config.php';
 require_once MAX_PATH . '/www/admin/lib-banner.inc.php';
 require_once MAX_PATH . '/www/admin/lib-storage.inc.php';
 
 // Security check
 OA_Permission::enforceAccount(OA_ACCOUNT_ADMIN);
+OA_Permission::checkSessionToken();
 
 /*-------------------------------------------------------*/
 /* Main code                                             */
 /*-------------------------------------------------------*/
 
diff --git a/www/admin/maintenance-storage.php b/www/admin/maintenance-storage.php
index ddd793e08d..13e72ba9a9 100644
--- a/www/admin/maintenance-storage.php
+++ b/www/admin/maintenance-storage.php
@@ -36,11 +36,11 @@ phpAds_MaintenanceSelection("storage");
 echo "<br />";
 echo $strStorageExplaination;
 echo "<br /><br />";
 
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-storage-move.php'>$strMoveToDirectory</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-storage-move.php?token=".urlencode(phpAds_SessionGetToken())."'>$strMoveToDirectory</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
 
 
 
 /*-------------------------------------------------------*/
diff --git a/www/admin/run-mpe.php b/www/admin/run-mpe.php
index 1b92e1d9fc..c75c885893 100644
--- a/www/admin/run-mpe.php
+++ b/www/admin/run-mpe.php
@@ -16,10 +16,11 @@ require_once '../../init.php';
 // Required files
 require_once MAX_PATH . '/www/admin/config.php';
 require_once MAX_PATH . '/lib/OA/Maintenance/Priority.php';
 
 OA_Permission::enforceAccount(OA_ACCOUNT_MANAGER, OA_ACCOUNT_ADVERTISER);
+OA_Permission::checkSessionToken();
 
 
 // Set longer time out, and ignore user abort
 if (!ini_get('safe_mode')) {
     @set_time_limit($conf['maintenance']['timeLimitScripts']);
diff --git a/www/admin/tracker-append.php b/www/admin/tracker-append.php
index 8a81ad0c5d..685c458aed 100644
--- a/www/admin/tracker-append.php
+++ b/www/admin/tracker-append.php
@@ -38,10 +38,12 @@ $trackerAppend = new Max_Admin_Inventory_TrackerAppend();
 /* Process submitted form                                */
 /*-------------------------------------------------------*/
 header("Content-Type: text/html; charset=ISO-8859-1");
 
 if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+    OA_Permission::checkSessionToken();
+
     $trackerAppend->handlePost($_POST);
 } else {
     $trackerAppend->handleGet();
 }
 
diff --git a/www/admin/tracker-variables.php b/www/admin/tracker-variables.php
index c99730eacd..6c4b392790 100644
--- a/www/admin/tracker-variables.php
+++ b/www/admin/tracker-variables.php
@@ -179,10 +179,12 @@ if (!empty($trackerid))
 
 
     // has user clicked on save changes?
     if (isset($action['save']))
     {
+        OA_Permission::checkSessionToken();
+
         // save variablemethod
         $doTrackers = OA_Dal::factoryDO('trackers');
         $doTrackers->get($trackerid);
         $doTrackers->variablemethod = $variablemethod;
         $doTrackers->update();
@@ -303,10 +305,11 @@ MAX_displayNavigationTracker($clientid, $trackerid, $aOtherAdvertisers);
 $tabindex = 0;
 
 if (isset($trackerid) && $trackerid != '')
 {
             echo "<form action='".$_SERVER['SCRIPT_NAME']."?clientid=$clientid&trackerid=$trackerid' method='post' onsubmit='return m3_hideShowSubmit()'>\n";
+                echo "<input type='token' name='submit' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."'>";
                 echo "<input type='hidden' name='submit' value='true'>";
                 echo "<input type='image' name='dummy' src='" . OX::assetPath() . "/images/spacer.gif' border='0' width='1' height='1'>\n";
                 echo "<br /><br />\n";
 
                 echo "<table border='0' width='100%' cellpadding='0' cellspacing='0'>"."\n";
diff --git a/www/admin/updates-history.php b/www/admin/updates-history.php
index 01d0d8a004..2b7a3526cf 100644
--- a/www/admin/updates-history.php
+++ b/www/admin/updates-history.php
@@ -97,10 +97,12 @@ function getDBAuditTable($aAudit)
 
 $oUpgrader->initDatabaseConnection();
 
 if (array_key_exists('btn_clean_audit', $_POST))
 {
+    OA_Permission::checkSessionToken();
+
     $upgrade_id = $_POST['upgrade_action_id'];
     $oUpgrader->oAuditor->cleanAuditArtifacts($upgrade_id);
 }
 
 $aAudit = $oUpgrader->oAuditor->queryAuditAllDescending();
@@ -293,10 +295,11 @@ if (count($aMessages)>0)
                             </td>
                         </tr>
                         </table>
                     </td>
                     <input type="hidden" name="upgrade_action_id" value="<?php echo $v['upgrade_action_id']; ?>" />
+                    <input type="hidden" name="token" value="<?php echo htmlspecialchars(phpAds_SessionGetToken()); ?>" />
                 </tr>
               </form>
                 <tr height='1'><td colspan='7' bgcolor='#888888'><img src='<?php echo OX::assetPath() ?>/images/break.gif' height='1' width='100%'></td></tr>
                 <?php
                     $i++;
diff --git a/www/admin/zone-modify.php b/www/admin/zone-modify.php
index 14807dbeb8..ea8fa75fc9 100644
--- a/www/admin/zone-modify.php
+++ b/www/admin/zone-modify.php
@@ -30,10 +30,11 @@ OA_Permission::enforceAccessToObject('zones', $zoneid);
 /*-------------------------------------------------------*/
 /* Main code                                             */
 /*-------------------------------------------------------*/
 
 if (isset($zoneid) && $zoneid != '') {
+    OA_Permission::checkSessionToken();
 
     if (isset($newaffiliateid) && $newaffiliateid != '') {
         // A publisher cannot move a zone to another publisher!
         OA_Permission::enforceAccount(OA_ACCOUNT_MANAGER);
         // Needs to ensure that the publisher the zone is being moved

Vulnerable code:     
        addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "tracker-modify.php?clientid=".$advertiserId."&trackerid=".$trackerId."&duplicate=true&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconTrackerDuplicate");
        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "tracker-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&clientid=".$advertiserId."&trackerid=".$trackerId."&returnurl=advertiser-trackers.php"), "iconDelete", null, $deleteConfirm);
        addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "campaign-modify.php?duplicate=1&clientid=$clientid&campaignid=$campaignid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconCampaignDuplicate");
            <input type='hidden' name='returnurl' value='".htmlspecialchars(basename($_SERVER['SCRIPT_NAME']))."'>
        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "campaign-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&clientid=$clientid&campaignid=$campaignid&returnurl=advertiser-campaigns.php"), "iconDelete", null, $deleteConfirm);
    global $phpAds_TextDirection;
    addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "banner-modify.php?duplicate=true&clientid=$advertiserId&campaignid=$campaignId&bannerid=$bannerId&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconBannerDuplicate");
        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "banner-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&clientid=$advertiserId&campaignid=$campaignId&bannerid=$bannerId&returnurl=campaign-banners.php"), "iconDelete", null, $deleteConfirm);
        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "zone-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&affiliateid=$affiliateid&zoneid=$zoneid&returnurl=affiliate-zones.php"), "iconDelete", null, $deleteConfirm);
    addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "channel-modify.php?duplicate=true&agencyid=$agencyid&affiliateid=$websiteId&channelid=$channelid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconTargetingChannelDuplicate");
    addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "channel-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&agencyid=$agencyid&affiliateid=$websiteId&channelid=$channelid&returnurl=$deleteReturlUrl"), "iconDelete", null, $deleteConfirm);
OA_Permission::checkSessionToken();

?>
    $objResponse->addAssign("run-mpe", "innerHTML", "<img src='run-mpe.php' />");
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-menus.php?action=build'>Rebuild Menu Cache</a>&nbsp;&nbsp;";
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=hook'>Rebuild Component Hooks Cache</a>&nbsp;&nbsp;";
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=pref'>Rebuild Preferences List</a>&nbsp;&nbsp;";
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=reg'>Rebuild Delivery Hooks Cache</a>&nbsp;&nbsp;";
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=rep'>Plugin Report</a>&nbsp;&nbsp;";
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=exp'>Export All Plugins</a>&nbsp;&nbsp;";
/*echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=dep'>Check Dependencies</a>&nbsp;&nbsp;";
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-priority-calculate.php'>$strRecalculatePriority</a>&nbsp;&nbsp;";
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-storage-move.php'>$strMoveToDirectory</a>&nbsp;&nbsp;";
Fixed code:         // Also assign a template variable for other usages
        $this->assign("csrfToken", phpAds_SessionGetToken());
        $this->csrf_token    = phpAds_SessionGetToken();

    <input type="hidden" name="token" value="{csrf_token}" />
    echo "<input type='hidden' name='token' value='".urlencode(phpAds_SessionGetToken())."' />";
        $token = phpAds_SessionGetToken();

        addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "tracker-modify.php?token=".urlencode($token)."&clientid=".$advertiserId."&trackerid=".$trackerId."&duplicate=true&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconTrackerDuplicate");
            <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "tracker-delete.php?token=".urlencode($token)."&clientid=".$advertiserId."&trackerid=".$trackerId."&returnurl=advertiser-trackers.php"), "iconDelete", null, $deleteConfirm);

        $token = phpAds_SessionGetToken();

        addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "campaign-modify.php?token=".urlencode($token)."&duplicate=1&clientid=$clientid&campaignid=$campaignid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconCampaignDuplicate");
            <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
            <input type='hidden' name='returnurl' value='".htmlspecialchars(basename($_SERVER['SCRIPT_NAME'], ENT_QUOTES))."'>
        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "campaign-delete.php?token=".urlencode($token)."&clientid=$clientid&campaignid=$campaignid&returnurl=advertiser-campaigns.php"), "iconDelete", null, $deleteConfirm);
    global $phpAds_TextDirection;

    $token = phpAds_SessionGetToken();

    addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "banner-modify.php?token=".urlencode($token)."&duplicate=true&clientid=$advertiserId&campaignid=$campaignId&bannerid=$bannerId&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconBannerDuplicate");
    <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
        <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "banner-delete.php?token=".urlencode($token)."&clientid=$advertiserId&campaignid=$campaignId&bannerid=$bannerId&returnurl=campaign-banners.php"), "iconDelete", null, $deleteConfirm);

    $token = phpAds_SessionGetToken();

        <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "zone-delete.php?token=".urlencode($token)."&affiliateid=$affiliateid&zoneid=$zoneid&returnurl=affiliate-zones.php"), "iconDelete", null, $deleteConfirm);
    $token = phpAds_SessionGetToken();

    addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "channel-modify.php?token=".urlencode($token)."&duplicate=true&agencyid=$agencyid&affiliateid=$websiteId&channelid=$channelid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconTargetingChannelDuplicate");
    addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "channel-delete.php?token=".urlencode($token)."&agencyid=$agencyid&affiliateid=$websiteId&channelid=$channelid&returnurl=$deleteReturlUrl"), "iconDelete", null, $deleteConfirm);
  <input id="csrf-token" type="hidden" value="{$csrfToken|escape}" />
      "token": $("#csrf-token").val(),
          // Refresh token
          $("#csrf-token").val(extractPart(data, "value", "token"));

    OA_Permission::checkSessionToken();

    OA_Permission::checkSessionToken();

OA_Permission::checkSessionToken();

// CSRF Token
echo "<!--token-value-start-->".phpAds_SessionGetToken()."<!--token-value-end-->";
    OA_Permission::checkSessionToken();

    OA_Permission::checkSessionToken();

    $objResponse->addAssign("run-mpe", "innerHTML", "<img src='run-mpe.ph?token=".urlencode(phpAds_SessionGetToken())."' />");
    OA_Permission::checkSessionToken();

    echo "<input type='hidden' name='token' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."' />";
    OA_Permission::checkSessionToken();

    echo "<input type='hidden' name='token' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."' />";
    OA_Permission::checkSessionToken();

        echo "<input type='hidden' name='token' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."' />";
    OA_Permission::checkSessionToken();

    echo "<input type='hidden' name='token' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."' />";
    OA_Permission::checkSessionToken();

echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-menus.php?action=build&amp;token=".urlencode(phpAds_SessionGetToken())."'>Rebuild Menu Cache</a>&nbsp;&nbsp;";
    OA_Permission::checkSessionToken();

$token = 'token='.urlencode(phpAds_SessionGetToken()).'&amp;';

echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=hook'>Rebuild Component Hooks Cache</a>&nbsp;&nbsp;";
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=pref'>Rebuild Preferences List</a>&nbsp;&nbsp;";
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=reg'>Rebuild Delivery Hooks Cache</a>&nbsp;&nbsp;";
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=rep'>Plugin Report</a>&nbsp;&nbsp;";
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=exp'>Export All Plugins</a>&nbsp;&nbsp;";
/*echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=dep'>Check Dependencies</a>&nbsp;&nbsp;";
OA_Permission::checkSessionToken();
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-priority-calculate.php?token=".urlencode(phpAds_SessionGetToken())."'>$strRecalculatePriority</a>&nbsp;&nbsp;";
OA_Permission::checkSessionToken();
echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-storage-move.php?token=".urlencode(phpAds_SessionGetToken())."'>$strMoveToDirectory</a>&nbsp;&nbsp;";
OA_Permission::checkSessionToken();
    OA_Permission::checkSessionToken();

        OA_Permission::checkSessionToken();

                echo "<input type='token' name='submit' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."'>";
    OA_Permission::checkSessionToken();

                    <input type="hidden" name="token" value="<?php echo htmlspecialchars(phpAds_SessionGetToken()); ?>" />
    OA_Permission::checkSessionToken();