CVE-2015-6545: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-site request forgery (CSRF) vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a saveWorkerPeek action.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Published: 2015-09-03T17:59Z
Repository: https://github.com/wgm/cerb
Language: Other
Files changed: features/cerberusweb.core/api/uri/login.php, features/cerberusweb.core/templates/configuration/section/acl/edit_role.tpl, features/cerberusweb.core/templates/configuration/section/branding/index.tpl, features/cerberusweb.core/templates/configuration/section/cache/peek.tpl, features/cerberusweb.core/templates/configuration/section/license/index.tpl, features/cerberusweb.core/templates/configuration/section/localization/index.tpl, features/cerberusweb.core/templates/configuration/section/mail_failed/peek.tpl, features/cerberusweb.core/templates/configuration/section/mail_failed/view.tpl, features/cerberusweb.core/templates/configuration/section/mail_filtering/index.tpl, features/cerberusweb.core/templates/configuration/section/mail_from/index.tpl, features/cerberusweb.core/templates/configuration/section/mail_from/peek.tpl, features/cerberusweb.core/templates/configuration/section/mail_html/peek.tpl, features/cerberusweb.core/templates/configuration/section/mail_html/view.tpl, features/cerberusweb.core/templates/configuration/section/mail_import/index.tpl, features/cerberusweb.core/templates/configuration/section/mail_incoming/index.tpl, features/cerberusweb.core/templates/configuration/section/mail_relay/index.tpl, features/cerberusweb.core/templates/configuration/section/mail_routing/index.tpl, features/cerberusweb.core/templates/configuration/section/mail_routing/peek.tpl, features/cerberusweb.core/templates/configuration/section/plugin_library/download_popup.tpl, features/cerberusweb.core/templates/configuration/section/plugin_library/view.tpl, features/cerberusweb.core/templates/configuration/section/plugins/popup.tpl, features/cerberusweb.core/templates/configuration/section/plugins/view.tpl, features/cerberusweb.core/templates/configuration/section/portal/tabs/settings/index.tpl, features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/add.tpl, features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/bulk.tpl, features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/export.tpl, features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/import.tpl, features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/peek.tpl, features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/view.tpl, features/cerberusweb.core/templates/configuration/section/portals/add.tpl, features/cerberusweb.core/templates/configuration/section/portals/view.tpl, features/cerberusweb.core/templates/configuration/section/scheduler/job_edit.tpl, features/cerberusweb.core/templates/configuration/section/search/peek.tpl, features/cerberusweb.core/templates/configuration/section/security/index.tpl, features/cerberusweb.core/templates/configuration/section/sessions/bulk.tpl, features/cerberusweb.core/templates/configuration/section/sessions/view.tpl, features/cerberusweb.core/templates/configuration/section/storage_attachments/bulk.tpl, features/cerberusweb.core/templates/configuration/section/storage_attachments/view.tpl, features/cerberusweb.core/templates/configuration/section/storage_content/index.tpl, features/cerberusweb.core/templates/configuration/section/storage_content/peek.tpl, features/cerberusweb.core/templates/configuration/section/storage_profiles/peek.tpl, features/cerberusweb.core/templates/configuration/section/storage_profiles/view.tpl, features/cerberusweb.core/templates/configuration/section/workers/bulk.tpl, features/cerberusweb.core/templates/configuration/section/workers/peek.tpl, features/cerberusweb.core/templates/contacts/addresses/bulk.tpl, features/cerberusweb.core/templates/contacts/addresses/peek.tpl, features/cerberusweb.core/templates/contacts/addresses/view.tpl, features/cerberusweb.core/templates/contacts/orgs/bulk.tpl, features/cerberusweb.core/templates/contacts/orgs/org_merge_continue_peek.tpl, features/cerberusweb.core/templates/contacts/orgs/org_merge_peek.tpl, features/cerberusweb.core/templates/contacts/orgs/peek.tpl, features/cerberusweb.core/templates/contacts/orgs/view.tpl, features/cerberusweb.core/templates/contacts/people/bulk.tpl, features/cerberusweb.core/templates/contacts/people/peek.tpl, features/cerberusweb.core/templates/contacts/people/view.tpl, features/cerberusweb.core/templates/context_links/choosers/__file.tpl, features/cerberusweb.core/templates/context_links/choosers/__generic.tpl, features/cerberusweb.core/templates/display/modules/conversation/message.tpl, features/cerberusweb.core/templates/display/modules/history/index.tpl, features/cerberusweb.core/templates/display/rpc/add_note.tpl, features/cerberusweb.core/templates/display/rpc/merge_panel.tpl, features/cerberusweb.core/templates/display/rpc/relay_message.tpl, features/cerberusweb.core/templates/display/rpc/reply.tpl, features/cerberusweb.core/templates/display/rpc/requester_panel.tpl, features/cerberusweb.core/templates/groups/peek.tpl, features/cerberusweb.core/templates/groups/view.tpl, features/cerberusweb.core/templates/header.tpl, features/cerberusweb.core/templates/internal/activity_log/view.tpl, features/cerberusweb.core/templates/internal/bucket/peek.tpl, features/cerberusweb.core/templates/internal/bucket/view.tpl, features/cerberusweb.core/templates/internal/calendar/peek.tpl, features/cerberusweb.core/templates/internal/calendar/tab_availability.tpl, features/cerberusweb.core/templates/internal/calendar/view.tpl, features/cerberusweb.core/templates/internal/calendar_event/peek.tpl, features/cerberusweb.core/templates/internal/calendar_event/view.tpl, features/cerberusweb.core/templates/internal/calendar_recurring_profile/peek.tpl, features/cerberusweb.core/templates/internal/calendar_recurring_profile/view.tpl, features/cerberusweb.core/templates/internal/comments/peek.tpl, features/cerberusweb.core/templates/internal/comments/view.tpl, features/cerberusweb.core/templates/internal/custom_fieldsets/peek.tpl, features/cerberusweb.core/templates/internal/custom_fieldsets/view.tpl, features/cerberusweb.core/templates/internal/decisions/editors/_move.tpl, features/cerberusweb.core/templates/internal/decisions/editors/_reorder.tpl, features/cerberusweb.core/templates/internal/decisions/editors/action.tpl, features/cerberusweb.core/templates/internal/decisions/editors/outcome.tpl, features/cerberusweb.core/templates/internal/decisions/editors/simulate.tpl, features/cerberusweb.core/templates/internal/decisions/editors/switch.tpl, features/cerberusweb.core/templates/internal/decisions/editors/trigger.tpl, features/cerberusweb.core/templates/internal/file_bundle/peek.tpl, features/cerberusweb.core/templates/internal/file_bundle/view.tpl, features/cerberusweb.core/templates/internal/import/popup_mapping.tpl, features/cerberusweb.core/templates/internal/import/popup_upload.tpl, features/cerberusweb.core/templates/internal/macros/display/scheduler_popup.tpl, features/cerberusweb.core/templates/internal/macros/reply/run_popup.tpl, features/cerberusweb.core/templates/internal/mail_transport/peek.tpl, features/cerberusweb.core/templates/internal/mail_transport/view.tpl, features/cerberusweb.core/templates/internal/mailbox/peek.tpl, features/cerberusweb.core/templates/internal/mailbox/view.tpl, features/cerberusweb.core/templates/internal/messages/peek.tpl, features/cerberusweb.core/templates/internal/recommendations/context_recommend_peek.tpl, features/cerberusweb.core/templates/internal/responsibilities/peek_by_group_editable.tpl, features/cerberusweb.core/templates/internal/skills/peek.tpl, features/cerberusweb.core/templates/internal/skills/view.tpl, features/cerberusweb.core/templates/internal/skillsets/chooser_popup.tpl, features/cerberusweb.core/templates/internal/skillsets/peek.tpl, features/cerberusweb.core/templates/internal/skillsets/tab_editable.tpl, features/cerberusweb.core/templates/internal/skillsets/view.tpl, features/cerberusweb.core/templates/internal/snippets/bulk.tpl, features/cerberusweb.core/templates/internal/snippets/paste_placeholders.tpl, features/cerberusweb.core/templates/internal/snippets/peek.tpl, features/cerberusweb.core/templates/internal/snippets/views/default.tpl, features/cerberusweb.core/templates/internal/tour/banner.tpl, features/cerberusweb.core/templates/internal/va/peek.tpl, features/cerberusweb.core/templates/internal/va/scheduled_behavior/view.tpl, features/cerberusweb.core/templates/internal/va/view.tpl, features/cerberusweb.core/templates/internal/views/copy.tpl, features/cerberusweb.core/templates/internal/views/search_and_view.tpl, features/cerberusweb.core/templates/internal/views/view_export.tpl, features/cerberusweb.core/templates/internal/watchers/context_follow_peek.tpl, features/cerberusweb.core/templates/internal/workspaces/tabs/calendar/tab.tpl, features/cerberusweb.core/templates/internal/workspaces/tabs/worklists/tab.tpl, features/cerberusweb.core/templates/internal/workspaces/widgets/add.tpl, features/cerberusweb.core/templates/internal/workspaces/widgets/calendar/calendar.tpl, features/cerberusweb.core/templates/internal/workspaces/widgets/export.tpl, features/cerberusweb.core/templates/internal/workspaces/widgets/export_data.tpl, features/cerberusweb.core/templates/internal/workspaces/widgets/peek.tpl, features/cerberusweb.core/templates/mail/queue/bulk.tpl, features/cerberusweb.core/templates/mail/queue/peek.tpl, features/cerberusweb.core/templates/mail/queue/view.tpl, features/cerberusweb.core/templates/mail/section/compose/peek.tpl, features/cerberusweb.core/templates/messages/view.tpl, features/cerberusweb.core/templates/pages/add_tabs.tpl, features/cerberusweb.core/templates/pages/edit_workspace_page.tpl, features/cerberusweb.core/templates/pages/edit_workspace_tab.tpl, features/cerberusweb.core/templates/pages/page.tpl, features/cerberusweb.core/templates/pages/view.tpl, features/cerberusweb.core/templates/pages/wizard_popup.tpl, features/cerberusweb.core/templates/preferences/modules/general.tpl, features/cerberusweb.core/templates/preferences/modules/security.tpl, features/cerberusweb.core/templates/preferences/tabs/notifications/bulk.tpl, features/cerberusweb.core/templates/preferences/tabs/notifications/view.tpl, features/cerberusweb.core/templates/preferences/tabs/watcher/index.tpl, features/cerberusweb.core/templates/search/quick_search.tpl, features/cerberusweb.core/templates/tasks/rpc/bulk.tpl, features/cerberusweb.core/templates/tasks/rpc/peek.tpl, features/cerberusweb.core/templates/tasks/view.tpl, features/cerberusweb.core/templates/tickets/ajax/merge_confirm.tpl, features/cerberusweb.core/templates/tickets/peek.tpl, features/cerberusweb.core/templates/tickets/rpc/bulk.tpl, features/cerberusweb.core/templates/tickets/rpc/ticket_view_assist.tpl, features/cerberusweb.core/templates/tickets/rpc/ticket_view_assist_headers.tpl, features/cerberusweb.core/templates/tickets/view.tpl, features/cerberusweb.core/templates/workers/view.tpl, features/cerberusweb.crm/templates/crm/opps/bulk.tpl, features/cerberusweb.crm/templates/crm/opps/peek.tpl, features/cerberusweb.crm/templates/crm/opps/view.tpl, features/cerberusweb.feedback/templates/feedback/ajax/peek.tpl, features/cerberusweb.feedback/templates/feedback/bulk.tpl, features/cerberusweb.feedback/templates/feedback/view.tpl, features/cerberusweb.kb/templates/kb/ajax/category_edit_panel.tpl, features/cerberusweb.kb/templates/kb/bulk.tpl, features/cerberusweb.kb/templates/kb/peek_edit.tpl, features/cerberusweb.kb/templates/kb/peek_readonly.tpl, features/cerberusweb.kb/templates/kb/tabs/articles/index.tpl, features/cerberusweb.kb/templates/kb/view.tpl, features/cerberusweb.reports/templates/reports/custom_fields/usage/index.tpl, features/cerberusweb.reports/templates/reports/group/group_replies/index.tpl, features/cerberusweb.reports/templates/reports/snippets/snippet_popularity/index.tpl, features/cerberusweb.reports/templates/reports/ticket/closed_tickets/index.tpl, features/cerberusweb.reports/templates/reports/ticket/new_tickets/index.tpl, features/cerberusweb.reports/templates/reports/ticket/top_contacts_tickets/index.tpl, features/cerberusweb.reports/templates/reports/va/va_usage/index.tpl, features/cerberusweb.reports/templates/reports/worker/average_response_time/index.tpl, features/cerberusweb.reports/templates/reports/worker/worker_history/index.tpl, features/cerberusweb.restapi/templates/peek.tpl, features/cerberusweb.restapi/templates/view.tpl, features/cerberusweb.simulator/templates/setup/section.tpl, features/cerberusweb.timetracking/templates/config/activities/edit_activity.tpl, features/cerberusweb.timetracking/templates/config/activities/index.tpl, features/cerberusweb.timetracking/templates/reports/time_spent_activity/index.tpl, features/cerberusweb.timetracking/templates/reports/time_spent_org/index.tpl, features/cerberusweb.timetracking/templates/reports/time_spent_worker/index.tpl, features/cerberusweb.translators/templates/config/ajax/add_language_panel.tpl, features/cerberusweb.translators/templates/config/ajax/find_strings_panel.tpl, features/cerberusweb.translators/templates/config/ajax/import_strings_panel.tpl, features/cerberusweb.translators/templates/config/section/view.tpl, install/extras/sdk/devblocks-dao.php, install/extras/sdk/examples/example.object/templates/example_object/bulk.tpl, install/extras/sdk/examples/example.object/templates/example_object/peek.tpl, install/extras/sdk/examples/example.object/templates/example_object/view.tpl, install/extras/sdk/examples/example.report/templates/reports/example.tpl, libs/devblocks/api/Engine.php, libs/devblocks/api/Extension.php, libs/devblocks/api/services/template.php, libs/devblocks/framework.defaults.php, libs/devblocks/resources/js/devblocks.js
Commit date: 2015-08-13 03:59:32 -0700
Commit message: * [Security/CSRF] Fixed a medium risk CSRF (cross-site request forgery) vulnerability reported by High-Tech Bridge (HTB23269). We don't have any evidence of this having taken place in the wild, but we were able to reproduce the results with the proof-of-concept in the advisory. A logged in worker could be tricked into visiting a URL that could perform certain actions in their browser session. Cerb now uses the Synchronizer pattern: a session-based token included with every HTML FORM and Ajax request that is compared to the active session. This verifies that such requests are coming from an existing Cerb page rather than an external source. When a potential CSRF attack is detected, the event is now logged in the PHP log as a warning.

Diff: diff --git a/features/cerberusweb.core/api/uri/login.php b/features/cerberusweb.core/api/uri/login.php
index ef9a90ded..9a91b3921 100644
--- a/features/cerberusweb.core/api/uri/login.php
+++ b/features/cerberusweb.core/api/uri/login.php
@@ -302,10 +302,13 @@ class ChSignInPage extends CerberusPageExtension {
 		$visit = new CerberusVisit();
 		$visit->setWorker($worker);
 
 		$session->setVisit($visit);
 		
+		// Generate a CSRF token for the session
+		$_SESSION['csrf_token'] = CerberusApplication::generatePassword(256);
+		
 		if(isset($_SESSION['login_post_url'])) {
 			$redirect_path = explode('/', $_SESSION['login_post_url']);
 			
 			// Only valid pages
 			if(is_array($redirect_path) && !empty($redirect_path)) {
diff --git a/features/cerberusweb.core/templates/configuration/section/acl/edit_role.tpl b/features/cerberusweb.core/templates/configuration/section/acl/edit_role.tpl
index 13d84e0a2..2ba4e0b2d 100644
--- a/features/cerberusweb.core/templates/configuration/section/acl/edit_role.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/acl/edit_role.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="acl">
 <input type="hidden" name="action" value="saveRole">
 <input type="hidden" name="id" value="{if !empty($role->id)}{$role->id}{else}0{/if}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 {if $saved}
 <div class="ui-widget">
 	<div class="ui-state-highlight ui-corner-all" style="padding: 0.7em; margin: 0.2em; "> 
 	<strong>Saved!</strong>
diff --git a/features/cerberusweb.core/templates/configuration/section/branding/index.tpl b/features/cerberusweb.core/templates/configuration/section/branding/index.tpl
index 0445d6a65..1cf5a3e5b 100644
--- a/features/cerberusweb.core/templates/configuration/section/branding/index.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/branding/index.tpl
@@ -3,10 +3,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="post" id="frmSetupBranding" onsubmit="return false;">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="branding">
 <input type="hidden" name="action" value="saveJson">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>Settings</legend>
 	
 	<b>Logo URL:</b> (leave blank for default)<br>
diff --git a/features/cerberusweb.core/templates/configuration/section/cache/peek.tpl b/features/cerberusweb.core/templates/configuration/section/cache/peek.tpl
index 37e663264..89b9aaed5 100644
--- a/features/cerberusweb.core/templates/configuration/section/cache/peek.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/cache/peek.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="frmCachePeek" name="frmCachePeek" onsubmit="return false;">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="cache">
 <input type="hidden" name="action" value="saveCachePeek">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 {foreach from=$engines item=engine key=engine_id}
 <fieldset class="peek" style="margin-bottom:0;">
 	<legend><label><input type="radio" name="engine_extension_id" value="{$engine->id}" {if $current_cacher->id == $engine_id}checked="checked"{/if}> {$engine->manifest->name}</label></legend>
 	
diff --git a/features/cerberusweb.core/templates/configuration/section/license/index.tpl b/features/cerberusweb.core/templates/configuration/section/license/index.tpl
index 7d17685a1..f18927017 100644
--- a/features/cerberusweb.core/templates/configuration/section/license/index.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/license/index.tpl
@@ -26,10 +26,11 @@
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="license">
 <input type="hidden" name="action" value="saveJson">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 	
 <fieldset>
 	<legend>Update License</legend>
 	
 	<b>Enter your company name <u>exactly</u> as it appears on your order:</b><br>
diff --git a/features/cerberusweb.core/templates/configuration/section/localization/index.tpl b/features/cerberusweb.core/templates/configuration/section/localization/index.tpl
index 19b1b6101..4e3e0f035 100644
--- a/features/cerberusweb.core/templates/configuration/section/localization/index.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/localization/index.tpl
@@ -3,10 +3,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="post" id="frmSetupLocalization" onsubmit="return false;">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="localization">
 <input type="hidden" name="action" value="saveJson">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>Date &amp; Time</legend>
 	
 	{$setting_time_format = $settings->get('cerberusweb.core',CerberusSettings::TIME_FORMAT,CerberusSettingsDefaults::TIME_FORMAT)}
diff --git a/features/cerberusweb.core/templates/configuration/section/mail_failed/peek.tpl b/features/cerberusweb.core/templates/configuration/section/mail_failed/peek.tpl
index 0e8e0606a..1a80a473e 100644
--- a/features/cerberusweb.core/templates/configuration/section/mail_failed/peek.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/mail_failed/peek.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="mail_failed">
 <input type="hidden" name="action" value="savePeekPopup">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>storage/mail/fail/{$filename}:</b>
 <div>
 	<input type="hidden" name="file" value="{$filename}">
 	<iframe src="{devblocks_url}ajax.php?c=config&a=handleSectionAction&section=mail_failed&action=getRawMessageSource&file={$filename}{/devblocks_url}" style="width:100%;height:250px;margin:0;padding:0;border:1px solid rgb(150,150,150);"></iframe>
diff --git a/features/cerberusweb.core/templates/configuration/section/mail_failed/view.tpl b/features/cerberusweb.core/templates/configuration/section/mail_failed/view.tpl
index 039f36125..bbfc177ee 100644
--- a/features/cerberusweb.core/templates/configuration/section/mail_failed/view.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/mail_failed/view.tpl
@@ -26,10 +26,12 @@
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="mail_failed">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="5" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/configuration/section/mail_filtering/index.tpl b/features/cerberusweb.core/templates/configuration/section/mail_filtering/index.tpl
index 0a6c4bce9..1558ce7d1 100644
--- a/features/cerberusweb.core/templates/configuration/section/mail_filtering/index.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/mail_filtering/index.tpl
@@ -9,15 +9,17 @@
 	{include file="devblocks:cerberusweb.core::internal/decisions/assistant/tab.tpl" triggers_by_event=$va->behaviors}
 	</div>
 {/foreach}
 
 {if !$has_atleast_one}
-<form action="{devblocks_url}{/devblocks_url}">
+<form action="{devblocks_url}{/devblocks_url}" method="POST">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="mail_filtering">
 <input type="hidden" name="action" value="createDefaultVa">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <div class="help-box" style="padding:5px;border:0;">
 	<h1 style="margin-bottom:5px;text-align:left;">Create a global Virtual Attendant</h1>
 	
 	<p>
 		Only global Virtual Attendants are capable of filtering inbound mail.  You currently don't have one.
diff --git a/features/cerberusweb.core/templates/configuration/section/mail_from/index.tpl b/features/cerberusweb.core/templates/configuration/section/mail_from/index.tpl
index de51e903b..2d41b2b27 100644
--- a/features/cerberusweb.core/templates/configuration/section/mail_from/index.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/mail_from/index.tpl
@@ -3,10 +3,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="post" id="frmSetupMailFrom" onsubmit="return false;">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="mail_from">
 <input type="hidden" name="action" value="saveJson">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <div style="margin-bottom:10px;">
 	<button type="button" onclick="genericAjaxPopup('peek','c=config&a=handleSectionAction&section=mail_from&action=peek&id=0',null,false,'550');"><span class="glyphicons glyphicons-circle-plus" style="color:rgb(0,180,0);"></span> {'common.add'|devblocks_translate|capitalize}</button>
 </div>
 
diff --git a/features/cerberusweb.core/templates/configuration/section/mail_from/peek.tpl b/features/cerberusweb.core/templates/configuration/section/mail_from/peek.tpl
index f96fd123b..f47df6c9c 100644
--- a/features/cerberusweb.core/templates/configuration/section/mail_from/peek.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/mail_from/peek.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="mail_from">
 <input type="hidden" name="action" value="savePeek">
 <input type="hidden" name="id" value="{$address->address_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>Send worker replies as:</legend>
 	
 	<div style="margin-bottom:5px;">
diff --git a/features/cerberusweb.core/templates/configuration/section/mail_html/peek.tpl b/features/cerberusweb.core/templates/configuration/section/mail_html/peek.tpl
index c5e03f404..68952436f 100644
--- a/features/cerberusweb.core/templates/configuration/section/mail_html/peek.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/mail_html/peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="html_template">
 <input type="hidden" name="action" value="savePeek">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($model) && !empty($model->id)}<input type="hidden" name="id" value="{$model->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <div id="mailTemplateTabs">
 	<ul>
 		<li><a href="#htmlTemplateEditor">Editor</a></li>
 		<li><a href="#htmlTemplateCustomFields">{'common.custom_fields'|devblocks_translate|capitalize}</a></li>
diff --git a/features/cerberusweb.core/templates/configuration/section/mail_html/view.tpl b/features/cerberusweb.core/templates/configuration/section/mail_html/view.tpl
index 81ec39e3c..2f96aedbd 100644
--- a/features/cerberusweb.core/templates/configuration/section/mail_html/view.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/mail_html/view.tpl
@@ -31,10 +31,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="html_template">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="5" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/configuration/section/mail_import/index.tpl b/features/cerberusweb.core/templates/configuration/section/mail_import/index.tpl
index 2e0a5c819..d18ee736a 100644
--- a/features/cerberusweb.core/templates/configuration/section/mail_import/index.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/mail_import/index.tpl
@@ -3,10 +3,11 @@
 <form id="frmSetupMailImport" action="javascript:;" method="POST" onsubmit="return false;" enctype="multipart/form-data">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="mail_import">
 <input type="hidden" name="action" value="parseMessageJson">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Paste a message source:</b>
 <div>
 	<textarea name="message_source" style="width:98%;height:250px;">{$message_source}</textarea>
 </div>
diff --git a/features/cerberusweb.core/templates/configuration/section/mail_incoming/index.tpl b/features/cerberusweb.core/templates/configuration/section/mail_incoming/index.tpl
index 2a75b7bc2..3a2b297b8 100644
--- a/features/cerberusweb.core/templates/configuration/section/mail_incoming/index.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/mail_incoming/index.tpl
@@ -3,10 +3,11 @@
 <form id="frmSetupMailIncoming" action="{devblocks_url}{/devblocks_url}" method="post" onsubmit="return false;">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="mail_incoming">
 <input type="hidden" name="action" value="saveJson">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>{'common.settings'|devblocks_translate|capitalize}</legend>
 
 	<b>Reply to All:</b><br>
diff --git a/features/cerberusweb.core/templates/configuration/section/mail_relay/index.tpl b/features/cerberusweb.core/templates/configuration/section/mail_relay/index.tpl
index 139e6aa97..7e4f82d00 100644
--- a/features/cerberusweb.core/templates/configuration/section/mail_relay/index.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/mail_relay/index.tpl
@@ -3,10 +3,11 @@
 <form id="frmSetupMailRelay" action="{devblocks_url}{/devblocks_url}" method="post" onsubmit="return false;">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="mail_relay">
 <input type="hidden" name="action" value="saveJson">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <p>
 The email relay enables workers to respond to messages from external mail applications (e.g. Gmail, mobile phones, Outlook, etc) instead of always requiring them to use Cerb in the web browser.  
 Relayed responses are received from a worker's personal email address and rewritten so they appear to be from Cerb before being sent to a conversation's recipients.  
 This process protects the privacy of personal worker email addresses, while still providing the benefits of Cerb (e.g. shared history, assignments, etc).
diff --git a/features/cerberusweb.core/templates/configuration/section/mail_routing/index.tpl b/features/cerberusweb.core/templates/configuration/section/mail_routing/index.tpl
index 0cbd48c69..dd05e6fb1 100644
--- a/features/cerberusweb.core/templates/configuration/section/mail_routing/index.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/mail_routing/index.tpl
@@ -10,10 +10,11 @@
 	<form action="{devblocks_url}{/devblocks_url}" method="post">
 	<input type="hidden" name="c" value="config">
 	<input type="hidden" name="a" value="handleSectionAction">
 	<input type="hidden" name="section" value="mail_routing">
 	<input type="hidden" name="action" value="saveRouting">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 	<b>Which group should receive any unrouted new mail?</b><br> 
 	<select name="default_group_id">
 		<option value="0">-- None (Bounce) --
 	{if !empty($groups)}
diff --git a/features/cerberusweb.core/templates/configuration/section/mail_routing/peek.tpl b/features/cerberusweb.core/templates/configuration/section/mail_routing/peek.tpl
index 29ca26eb0..d0cb9bcdb 100644
--- a/features/cerberusweb.core/templates/configuration/section/mail_routing/peek.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/mail_routing/peek.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="mail_routing">
 <input type="hidden" name="action" value="saveMailRoutingRuleAdd">
 <input type="hidden" name="id" value="{$rule->id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Rule Name:</b> (e.g. ProductX Support)<br>
 <input type="text" name="name" value="{$rule->name}" size="45" style="width:95%;"><br>
 <label><input type="checkbox" name="is_sticky" value="1" {if $rule->is_sticky}checked="checked"{/if}> <span style="border-bottom:1px dotted;" title="Sticky rules are checked for matches first, are manually sortable, and can be stacked with subsequent rules.">Sticky</span></label>
 <br>
diff --git a/features/cerberusweb.core/templates/configuration/section/plugin_library/download_popup.tpl b/features/cerberusweb.core/templates/configuration/section/plugin_library/download_popup.tpl
index 21bcecb23..8fd5a1812 100644
--- a/features/cerberusweb.core/templates/configuration/section/plugin_library/download_popup.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/plugin_library/download_popup.tpl
@@ -1,14 +1,7 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="frmCerb6PluginDownload">
-{*
-<input type="hidden" name="c" value="config">
-<input type="hidden" name="a" value="handleSectionAction">
-<input type="hidden" name="section" value="plugin_library">
-<input type="hidden" name="action" value="saveDownloadPopup">
-<input type="hidden" name="plugin_id" value="{$plugin->id}">
-<input type="hidden" name="view_id" value="{$view_id}">
-*}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>{$plugin->name}</b><br>
 <br>
 
 {if !empty($requirements)}
diff --git a/features/cerberusweb.core/templates/configuration/section/plugin_library/view.tpl b/features/cerberusweb.core/templates/configuration/section/plugin_library/view.tpl
index 37757cc58..104e35ae4 100644
--- a/features/cerberusweb.core/templates/configuration/section/plugin_library/view.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/plugin_library/view.tpl
@@ -24,10 +24,12 @@
 <input type="hidden" name="a" value="">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="context_id" value="">
 <input type="hidden" name="id" value="{$view->id}">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/configuration/section/plugins/popup.tpl b/features/cerberusweb.core/templates/configuration/section/plugins/popup.tpl
index 2c3b8ea24..4dbb0b8db 100644
--- a/features/cerberusweb.core/templates/configuration/section/plugins/popup.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/plugins/popup.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="plugins">
 <input type="hidden" name="action" value="savePopup">
 <input type="hidden" name="plugin_id" value="{$plugin->id}">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if $is_uninstallable}<input type="hidden" name="uninstall" value="0">{/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <div>
 	<b>{'common.status'|devblocks_translate|capitalize}:</b> 
 	<label><input type="radio" name="enabled" value="1" onclick="$('#pluginConfigTabs').fadeIn();$('#divCerb6PluginOutput').show();" {if $plugin->enabled}checked="checked"{/if}>{'common.enabled'|devblocks_translate|capitalize}</label> 
 	<label><input type="radio" name="enabled" value="0" onclick="$('#pluginConfigTabs').fadeOut();$('#divCerb6PluginOutput').hide();" {if !$plugin->enabled}checked="checked"{/if}>{'common.disabled'|devblocks_translate|capitalize}</label> 
diff --git a/features/cerberusweb.core/templates/configuration/section/plugins/view.tpl b/features/cerberusweb.core/templates/configuration/section/plugins/view.tpl
index eff884353..eb82ac675 100644
--- a/features/cerberusweb.core/templates/configuration/section/plugins/view.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/plugins/view.tpl
@@ -24,10 +24,12 @@
 <input type="hidden" name="a" value="">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="context_id" value="">
 <input type="hidden" name="id" value="{$view->id}">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/configuration/section/portal/tabs/settings/index.tpl b/features/cerberusweb.core/templates/configuration/section/portal/tabs/settings/index.tpl
index 1ecf0c99f..280cd4033 100644
--- a/features/cerberusweb.core/templates/configuration/section/portal/tabs/settings/index.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/portal/tabs/settings/index.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="portal">
 <input type="hidden" name="action" value="saveTabSettings">
 <input type="hidden" name="portal" value="{$instance->code}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Portal Name:</b> ("Support Portal", "Contact Form", "ProductX FAQ")<br>
 <input type="text" name="portal_name" value="{if !empty($instance->name)}{$instance->name}{else}{$instance->manifest->name}{/if}" size="65"><br>
 <br> 
 
diff --git a/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/add.tpl b/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/add.tpl
index 7354a0483..a2290d905 100644
--- a/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/add.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/add.tpl
@@ -5,10 +5,11 @@
 		<input type="hidden" name="a" value="handleSectionAction">
 		<input type="hidden" name="section" value="portal">
 		<input type="hidden" name="action" value="saveAddTemplatePeek">
 		<input type="hidden" name="view_id" value="{$view_id}">
 		<input type="hidden" name="portal" value="{$portal}">
+		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 		
 		<b>Template:</b><br>
 		<select name="template">
 			{foreach from=$templates item=template}
 			<option value="{$template->plugin_id}:{$template->path}">[{$template->plugin_id}]{*({$template->set})*} {$template->path}</option>
diff --git a/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/bulk.tpl b/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/bulk.tpl
index 2f2ea6967..f85db132d 100644
--- a/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/bulk.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/bulk.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="portal">
 <input type="hidden" name="action" value="doTemplatesBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
  	{if !empty($ids)}
diff --git a/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/export.tpl b/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/export.tpl
index 8c12066bb..26019c93b 100644
--- a/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/export.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/export.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="portal">
 <input type="hidden" name="action" value="saveExportTemplatesPeek">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="portal" value="{$portal}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Filename:</b> (.xml)<br>
 <input type="text" name="filename" size="45" value="cerb_portal_templates_{$smarty.const.APP_BUILD}.xml"><br>
 <br>
 
diff --git a/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/import.tpl b/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/import.tpl
index 7d873238d..6bc87177f 100644
--- a/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/import.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/import.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="portal">
 <input type="hidden" name="action" value="saveImportTemplatesPeek">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="portal" value="{$portal}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Import File:</b> (.xml)<br>
 <input type="file" name="import_file" size="45"><br>
 <br>
 
diff --git a/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/peek.tpl b/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/peek.tpl
index 9d7dc4891..73fcfb228 100644
--- a/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/peek.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="portal">
 <input type="hidden" name="action" value="saveTemplatePeek">
 <input type="hidden" name="id" value="{$template->id}">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>{$template->path}:</b><br>
 <textarea name="content" wrap="off" style="height:300px;width:98%;">{$template->content}</textarea><br>
 <br>
 
diff --git a/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/view.tpl b/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/view.tpl
index 0d4780e79..daf1266fa 100644
--- a/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/view.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/portal/tabs/templates/view.tpl
@@ -18,10 +18,12 @@
 <form id="customize{$view->id}" name="customize{$view->id}" action="#" onsubmit="return false;" style="display:none;"></form>
 <form id="viewForm{$view->id}" name="viewForm{$view->id}" action="#">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/configuration/section/portals/add.tpl b/features/cerberusweb.core/templates/configuration/section/portals/add.tpl
index 450cf20da..f1e399381 100644
--- a/features/cerberusweb.core/templates/configuration/section/portals/add.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/portals/add.tpl
@@ -2,10 +2,11 @@
 	<form action="{devblocks_url}{/devblocks_url}" method="POST" id="frmAddPortal" name="frmAddPortal">
 	<input type="hidden" name="c" value="config">
 	<input type="hidden" name="a" value="handleSectionAction">
 	<input type="hidden" name="section" value="portals">
 	<input type="hidden" name="action" value="saveAddPortalPeek">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 	
 	<b>Portal Name:</b> ("Support Portal", "Contact Form", "ProductX FAQ")<br>
 	<input type="text" name="name" value="" style="width:98%;" autofocus="true"><br>
 	<br>
 	
diff --git a/features/cerberusweb.core/templates/configuration/section/portals/view.tpl b/features/cerberusweb.core/templates/configuration/section/portals/view.tpl
index c33161d71..b1955c885 100644
--- a/features/cerberusweb.core/templates/configuration/section/portals/view.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/portals/view.tpl
@@ -19,10 +19,12 @@
 <form id="customize{$view->id}" name="customize{$view->id}" action="#" onsubmit="return false;" style="display:none;"></form>
 <form id="viewForm{$view->id}" name="viewForm{$view->id}" action="#">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/configuration/section/scheduler/job_edit.tpl b/features/cerberusweb.core/templates/configuration/section/scheduler/job_edit.tpl
index a76cd4d95..b90871654 100644
--- a/features/cerberusweb.core/templates/configuration/section/scheduler/job_edit.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/scheduler/job_edit.tpl
@@ -12,10 +12,11 @@
 	<input type="hidden" name="c" value="config">
 	<input type="hidden" name="a" value="handleSectionAction">
 	<input type="hidden" name="section" value="scheduler">
 	<input type="hidden" name="action" value="saveJobJson">
 	<input type="hidden" name="id" value="{$job->manifest->id}">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 	
 	<label><input type="checkbox" name="enabled" value="1" {if $enabled}checked{/if}> <b>Enabled</b></label>
 	
 	{if $locked}
 	<label><input type="checkbox" name="locked" value="1" {if $locked}checked{/if}> <b>Locked</b></label>
diff --git a/features/cerberusweb.core/templates/configuration/section/search/peek.tpl b/features/cerberusweb.core/templates/configuration/section/search/peek.tpl
index ada10bc6f..c4d356c74 100644
--- a/features/cerberusweb.core/templates/configuration/section/search/peek.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/search/peek.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="search">
 <input type="hidden" name="action" value="saveSearchSchemaPeek">
 <input type="hidden" name="schema_extension_id" value="{$schema->id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 {foreach from=$search_engines item=engine key=engine_id}
 <fieldset class="peek">
 	<legend><label><input type="radio" name="engine_extension_id" value="{$engine->id}" {if $schema_engine->id==$engine_id}checked="checked"{/if}> {$engine->manifest->name}</label></legend>
 	
diff --git a/features/cerberusweb.core/templates/configuration/section/security/index.tpl b/features/cerberusweb.core/templates/configuration/section/security/index.tpl
index 15228ea15..296201c53 100644
--- a/features/cerberusweb.core/templates/configuration/section/security/index.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/security/index.tpl
@@ -3,10 +3,11 @@
 <form id="frmSetupSecurity" action="{devblocks_url}{/devblocks_url}" method="post" onsubmit="return false;">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="security">
 <input type="hidden" name="action" value="saveJson">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>Remote Administration</legend>
 	
 	<b>Allow remote administration tools (upgrade, cron) from these IPs:</b> (one IP per line)
diff --git a/features/cerberusweb.core/templates/configuration/section/sessions/bulk.tpl b/features/cerberusweb.core/templates/configuration/section/sessions/bulk.tpl
index 301cd298a..7d3b9d1d0 100644
--- a/features/cerberusweb.core/templates/configuration/section/sessions/bulk.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/sessions/bulk.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="sessions">
 <input type="hidden" name="action" value="doSessionsBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label>
 	
diff --git a/features/cerberusweb.core/templates/configuration/section/sessions/view.tpl b/features/cerberusweb.core/templates/configuration/section/sessions/view.tpl
index a3b3868c8..7dcedd57a 100644
--- a/features/cerberusweb.core/templates/configuration/section/sessions/view.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/sessions/view.tpl
@@ -19,10 +19,12 @@
 <form id="customize{$view->id}" name="customize{$view->id}" action="#" onsubmit="return false;" style="display:none;"></form>
 <form id="viewForm{$view->id}" name="viewForm{$view->id}" action="#">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="3" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/configuration/section/storage_attachments/bulk.tpl b/features/cerberusweb.core/templates/configuration/section/storage_attachments/bulk.tpl
index 9477921fe..9d87c2dbd 100644
--- a/features/cerberusweb.core/templates/configuration/section/storage_attachments/bulk.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/storage_attachments/bulk.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="storage_attachments">
 <input type="hidden" name="action" value="doAttachmentsBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label>
 	
diff --git a/features/cerberusweb.core/templates/configuration/section/storage_attachments/view.tpl b/features/cerberusweb.core/templates/configuration/section/storage_attachments/view.tpl
index 9e603b91b..92d50ab6a 100644
--- a/features/cerberusweb.core/templates/configuration/section/storage_attachments/view.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/storage_attachments/view.tpl
@@ -19,10 +19,12 @@
 <form id="customize{$view->id}" name="customize{$view->id}" action="#" onsubmit="return false;" style="display:none;"></form>
 <form id="viewForm{$view->id}" name="viewForm{$view->id}" action="#">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/configuration/section/storage_content/index.tpl b/features/cerberusweb.core/templates/configuration/section/storage_content/index.tpl
index 08b196378..269137e76 100644
--- a/features/cerberusweb.core/templates/configuration/section/storage_content/index.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/storage_content/index.tpl
@@ -1,10 +1,11 @@
 <h2>Storage Content</h2>
 
 <form action="{devblocks_url}{/devblocks_url}" method="POST" style="margin-bottom:5px;">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>Database</legend>
 	
 	Data: <b>{$total_db_data|devblocks_prettybytes:2}</b><br>
diff --git a/features/cerberusweb.core/templates/configuration/section/storage_content/peek.tpl b/features/cerberusweb.core/templates/configuration/section/storage_content/peek.tpl
index 288a883b8..1914ddc3e 100644
--- a/features/cerberusweb.core/templates/configuration/section/storage_content/peek.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/storage_content/peek.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="storage_content">
 <input type="hidden" name="action" value="saveStorageSchemaPeek">
 <input type="hidden" name="ext_id" value="{$schema->manifest->id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 {$schema->renderConfig()}
 
 <button type="button" onclick="genericAjaxPost('frmStorageSchemaPeek','schema_{$schema->manifest->id|md5}');genericAjaxPopupClose('peek');"><span class="glyphicons glyphicons-circle-ok" style="color:rgb(0,180,0);"></span> {'common.save_changes'|devblocks_translate}</button>
 
diff --git a/features/cerberusweb.core/templates/configuration/section/storage_profiles/peek.tpl b/features/cerberusweb.core/templates/configuration/section/storage_profiles/peek.tpl
index 140ed24c2..49d3e1ab3 100644
--- a/features/cerberusweb.core/templates/configuration/section/storage_profiles/peek.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/storage_profiles/peek.tpl
@@ -12,10 +12,11 @@
 <input type="hidden" name="section" value="storage_profiles">
 <input type="hidden" name="action" value="saveStorageProfilePeek">
 <input type="hidden" name="id" value="{$profile->id}">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>{'common.name'|devblocks_translate|capitalize}:</b><br>
 <input type="text" name="name" value="{$profile->name}" style="width:98%;" autofocus="true"><br>
 <br>
 
diff --git a/features/cerberusweb.core/templates/configuration/section/storage_profiles/view.tpl b/features/cerberusweb.core/templates/configuration/section/storage_profiles/view.tpl
index 4b5a211cb..9a73b417e 100644
--- a/features/cerberusweb.core/templates/configuration/section/storage_profiles/view.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/storage_profiles/view.tpl
@@ -17,10 +17,12 @@
 <form id="customize{$view->id}" name="customize{$view->id}" action="#" onsubmit="return false;" style="display:none;"></form>
 <form id="viewForm{$view->id}" name="viewForm{$view->id}" action="#">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/configuration/section/workers/bulk.tpl b/features/cerberusweb.core/templates/configuration/section/workers/bulk.tpl
index 478e8cc30..7f8d9f59c 100644
--- a/features/cerberusweb.core/templates/configuration/section/workers/bulk.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/workers/bulk.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="workers">
 <input type="hidden" name="action" value="doWorkersBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
diff --git a/features/cerberusweb.core/templates/configuration/section/workers/peek.tpl b/features/cerberusweb.core/templates/configuration/section/workers/peek.tpl
index a19d546e8..fef9871eb 100644
--- a/features/cerberusweb.core/templates/configuration/section/workers/peek.tpl
+++ b/features/cerberusweb.core/templates/configuration/section/workers/peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="workers">
 <input type="hidden" name="action" value="saveWorkerPeek">
 <input type="hidden" name="id" value="{$worker->id}">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate|capitalize}</legend>
 	
 	<table cellpadding="0" cellspacing="2" border="0" width="98%">
diff --git a/features/cerberusweb.core/templates/contacts/addresses/bulk.tpl b/features/cerberusweb.core/templates/contacts/addresses/bulk.tpl
index 7decd7209..2d0e48947 100644
--- a/features/cerberusweb.core/templates/contacts/addresses/bulk.tpl
+++ b/features/cerberusweb.core/templates/contacts/addresses/bulk.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="formBatchUpdate" name="formBatchUpdate" onsubmit="return false;">
 <input type="hidden" name="c" value="contacts">
 <input type="hidden" name="a" value="doAddressBatchUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
 	
diff --git a/features/cerberusweb.core/templates/contacts/addresses/peek.tpl b/features/cerberusweb.core/templates/contacts/addresses/peek.tpl
index 71329de90..12ca13ae3 100644
--- a/features/cerberusweb.core/templates/contacts/addresses/peek.tpl
+++ b/features/cerberusweb.core/templates/contacts/addresses/peek.tpl
@@ -5,10 +5,11 @@
 {if !empty($link_context)}
 <input type="hidden" name="link_context" value="{$link_context}">
 <input type="hidden" name="link_context_id" value="{$link_context_id}">
 {/if}
 <input type="hidden" name="view_id" value="{$view_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate}</legend>
 	
 	<table cellpadding="0" cellspacing="2" border="0" width="98%">
diff --git a/features/cerberusweb.core/templates/contacts/addresses/view.tpl b/features/cerberusweb.core/templates/contacts/addresses/view.tpl
index 40f49fabe..d80dd38f9 100644
--- a/features/cerberusweb.core/templates/contacts/addresses/view.tpl
+++ b/features/cerberusweb.core/templates/contacts/addresses/view.tpl
@@ -31,10 +31,12 @@
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="context_id" value="{$view_context}">
 <input type="hidden" name="c" value="contacts">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/contacts/orgs/bulk.tpl b/features/cerberusweb.core/templates/contacts/orgs/bulk.tpl
index 6393d631a..57a4694aa 100644
--- a/features/cerberusweb.core/templates/contacts/orgs/bulk.tpl
+++ b/features/cerberusweb.core/templates/contacts/orgs/bulk.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="formBatchUpdate" name="formBatchUpdate" onsubmit="return false;">
 <input type="hidden" name="c" value="contacts">
 <input type="hidden" name="a" value="doOrgBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="org_ids" value="{$org_ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($org_ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
  	{if !empty($org_ids)}
diff --git a/features/cerberusweb.core/templates/contacts/orgs/org_merge_continue_peek.tpl b/features/cerberusweb.core/templates/contacts/orgs/org_merge_continue_peek.tpl
index d9e2e9d34..1ecfb75e6 100644
--- a/features/cerberusweb.core/templates/contacts/orgs/org_merge_continue_peek.tpl
+++ b/features/cerberusweb.core/templates/contacts/orgs/org_merge_continue_peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="a" value="saveOrgMergePeek">
 <input type="hidden" name="view_id" value="{$view_id}">
 {foreach from=$orgs item=org key=org_id}
 <input type="hidden" name="org_id[]" value="{$org->id}">
 {/foreach}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <table cellpadding="3" cellspacing="0" border="0">
 	{foreach from=$combinations item=combo key=property}
 	{$label = $combo.label}
 	{$values = $combo.values}
diff --git a/features/cerberusweb.core/templates/contacts/orgs/org_merge_peek.tpl b/features/cerberusweb.core/templates/contacts/orgs/org_merge_peek.tpl
index 282a2bb6d..75c4e7353 100644
--- a/features/cerberusweb.core/templates/contacts/orgs/org_merge_peek.tpl
+++ b/features/cerberusweb.core/templates/contacts/orgs/org_merge_peek.tpl
@@ -1,10 +1,11 @@
 {$uniq_id = uniqid()}
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="frm{$uniq_id}" name="frm{$uniq_id}" onsubmit="return false;">
 <input type="hidden" name="c" value="contacts">
 <input type="hidden" name="a" value="showOrgMergeContinuePeek">
 <input type="hidden" name="view_id" value="{$view_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Select organizations to merge:</b><br>
 <button type="button" class="chooser_orgs"><span class="glyphicons glyphicons-search"></span></button>
 <ul class="chooser-container bubbles" style="display:block;">
 {if !empty($orgs)}
diff --git a/features/cerberusweb.core/templates/contacts/orgs/peek.tpl b/features/cerberusweb.core/templates/contacts/orgs/peek.tpl
index 3c5152526..bef5b5a88 100644
--- a/features/cerberusweb.core/templates/contacts/orgs/peek.tpl
+++ b/features/cerberusweb.core/templates/contacts/orgs/peek.tpl
@@ -17,10 +17,11 @@
 	{if !empty($link_context)}
 	<input type="hidden" name="link_context" value="{$link_context}">
 	<input type="hidden" name="link_context_id" value="{$link_context_id}">
 	{/if}
 	<input type="hidden" name="do_delete" value="0">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 	
 	<fieldset class="peek">
 		<legend>{'common.properties'|devblocks_translate}</legend>
 		
 		<table cellpadding="0" cellspacing="2" border="0" width="98%">
diff --git a/features/cerberusweb.core/templates/contacts/orgs/view.tpl b/features/cerberusweb.core/templates/contacts/orgs/view.tpl
index 6c0d1f3d8..1ab80f342 100644
--- a/features/cerberusweb.core/templates/contacts/orgs/view.tpl
+++ b/features/cerberusweb.core/templates/contacts/orgs/view.tpl
@@ -30,10 +30,12 @@
 <input type="hidden" name="context_id" value="{$view_context}">
 <input type="hidden" name="id" value="{$view->id}">
 <input type="hidden" name="c" value="contacts">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/contacts/people/bulk.tpl b/features/cerberusweb.core/templates/contacts/people/bulk.tpl
index df713820b..198641f50 100644
--- a/features/cerberusweb.core/templates/contacts/people/bulk.tpl
+++ b/features/cerberusweb.core/templates/contacts/people/bulk.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="formBatchUpdate" name="formBatchUpdate" onsubmit="return false;">
 <input type="hidden" name="c" value="contacts">
 <input type="hidden" name="a" value="doPeopleBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
  	{if !empty($ids)}
diff --git a/features/cerberusweb.core/templates/contacts/people/peek.tpl b/features/cerberusweb.core/templates/contacts/people/peek.tpl
index 2bfe164e4..48392bed4 100644
--- a/features/cerberusweb.core/templates/contacts/people/peek.tpl
+++ b/features/cerberusweb.core/templates/contacts/people/peek.tpl
@@ -6,10 +6,11 @@
 {if empty($contact->id) && !empty($context)}
 <input type="hidden" name="context" value="{$context}">
 <input type="hidden" name="context_id" value="{$context_id}">
 {/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate}</legend>
 	
 	<table cellpadding="0" cellspacing="2" border="0" width="98%">
diff --git a/features/cerberusweb.core/templates/contacts/people/view.tpl b/features/cerberusweb.core/templates/contacts/people/view.tpl
index 8780ec1a1..4c3b5c8f2 100644
--- a/features/cerberusweb.core/templates/contacts/people/view.tpl
+++ b/features/cerberusweb.core/templates/contacts/people/view.tpl
@@ -30,10 +30,12 @@
 <input type="hidden" name="context_id" value="{$view_context}">
 <input type="hidden" name="id" value="{$view->id}">
 <input type="hidden" name="c" value="contacts">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/context_links/choosers/__file.tpl b/features/cerberusweb.core/templates/context_links/choosers/__file.tpl
index 1fc16e364..c0117b430 100644
--- a/features/cerberusweb.core/templates/context_links/choosers/__file.tpl
+++ b/features/cerberusweb.core/templates/context_links/choosers/__file.tpl
@@ -1,8 +1,9 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" enctype="multipart/form-data" target="iframe_file_post" id="chooserFileUploadForm">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="chooserOpenFileUpload">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{if $single}{'common.upload.file'|devblocks_translate|capitalize}{else}{'common.upload.files'|devblocks_translate|capitalize}{/if}</legend>
 	<input type="file" name="file_data[]" {if !$single}multiple="multiple"{/if}>
 </fieldset>
diff --git a/features/cerberusweb.core/templates/context_links/choosers/__generic.tpl b/features/cerberusweb.core/templates/context_links/choosers/__generic.tpl
index 200ecca41..fc36c4791 100644
--- a/features/cerberusweb.core/templates/context_links/choosers/__generic.tpl
+++ b/features/cerberusweb.core/templates/context_links/choosers/__generic.tpl
@@ -5,10 +5,11 @@
 <div style="clear:both;"></div>
 
 {include file="devblocks:cerberusweb.core::internal/views/search_and_view.tpl" view=$view}
 
 <form action="#" method="POST" id="chooser{$view->id}" style="{if $single}display:none;{/if}}">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 	<b>Selected:</b>
 	<ul class="buffer bubbles"></ul>
 	<br>
 	<br>
 	<button type="button" class="submit"><span class="glyphicons glyphicons-circle-ok" style="color:rgb(0,180,0);"></span> {'common.save_changes'|devblocks_translate}</button>
diff --git a/features/cerberusweb.core/templates/display/modules/conversation/message.tpl b/features/cerberusweb.core/templates/display/modules/conversation/message.tpl
index 03d42705d..480cfc70e 100644
--- a/features/cerberusweb.core/templates/display/modules/conversation/message.tpl
+++ b/features/cerberusweb.core/templates/display/modules/conversation/message.tpl
@@ -146,10 +146,11 @@
 		  	
 		  	<form id="{$message->id}options" style="padding-top:10px;display:none;" method="post" action="{devblocks_url}{/devblocks_url}">
 		  		<input type="hidden" name="c" value="display">
 		  		<input type="hidden" name="a" value="">
 		  		<input type="hidden" name="id" value="{$message->id}">
+		  		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 		  		
 		  		<button type="button" onclick="document.frmPrint.action='{devblocks_url}c=print&a=message&id={$message->id}{/devblocks_url}';document.frmPrint.submit();"><span class="glyphicons glyphicons-print"></span> {'common.print'|devblocks_translate|capitalize}</button>
 		  		
 		  		{if $ticket->first_message_id != $message->id && $active_worker->hasPriv('core.display.actions.split')} {* Don't allow splitting of a single message *}
 		  		<button type="button" onclick="$frm=$(this).closest('form');$frm.find('input:hidden[name=a]').val('doSplitMessage');$frm.submit();" title="Split message into new ticket"><span class="glyphicons glyphicons-duplicate"></span> {'display.button.split_ticket'|devblocks_translate|capitalize}</button>
diff --git a/features/cerberusweb.core/templates/display/modules/history/index.tpl b/features/cerberusweb.core/templates/display/modules/history/index.tpl
index 1cf374650..b29b7356d 100644
--- a/features/cerberusweb.core/templates/display/modules/history/index.tpl
+++ b/features/cerberusweb.core/templates/display/modules/history/index.tpl
@@ -1,10 +1,12 @@
 <div align="left">
 	<form action="{devblocks_url}{/devblocks_url}" method="post" style="margin-bottom:5px;">
 	<input type="hidden" name="c" value="display">
 	<input type="hidden" name="a" value="">
 	<input type="hidden" name="id" value="{$ticket->id}">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+	
 		<b>History for:</b> 
 		<label><input type="radio" name="scope" value="email" onclick="this.form.a.value='doTicketHistoryScope';this.form.submit();" {if empty($scope) || 'email'==$scope}checked="checked"{/if}> {'ticket.requesters'|devblocks_translate|capitalize}</label>
 		{if !empty($ticket->org_id)}<label><input type="radio" name="scope" value="org" onclick="this.form.a.value='doTicketHistoryScope';this.form.submit();" {if 'org'==$scope}checked="checked"{/if}> {'contact_org.name'|devblocks_translate|capitalize}</label>{/if}
 		<label><input type="radio" name="scope" value="domain" onclick="this.form.a.value='doTicketHistoryScope';this.form.submit();" {if 'domain'==$scope}checked="checked"{/if}> Sender Domain</label>
 	</form>
diff --git a/features/cerberusweb.core/templates/display/rpc/add_note.tpl b/features/cerberusweb.core/templates/display/rpc/add_note.tpl
index 2fbeacda0..9cdc7e40c 100644
--- a/features/cerberusweb.core/templates/display/rpc/add_note.tpl
+++ b/features/cerberusweb.core/templates/display/rpc/add_note.tpl
@@ -1,10 +1,11 @@
 <form id="reply{$message->id}_form" action="{devblocks_url}{/devblocks_url}" method="POST" enctype="multipart/form-data">
 <input type="hidden" name="c" value="display">
 <input type="hidden" name="a" value="doAddNote">
 <input type="hidden" name="id" value="{$message->id}">
 <input type="hidden" name="ticket_id" value="{$message->ticket_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <div class="block" style="width:98%;margin:10px;">
 <table cellpadding="2" cellspacing="0" border="0" width="100%">
 	<tr>
 		<td><h2 style="color:rgb(50,50,50);">Add Sticky Note</h2></td>
diff --git a/features/cerberusweb.core/templates/display/rpc/merge_panel.tpl b/features/cerberusweb.core/templates/display/rpc/merge_panel.tpl
index a7348465b..2ac9f9bde 100644
--- a/features/cerberusweb.core/templates/display/rpc/merge_panel.tpl
+++ b/features/cerberusweb.core/templates/display/rpc/merge_panel.tpl
@@ -1,9 +1,10 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="frmDisplayMerge" name="frmDisplayMerge">
 <input type="hidden" name="c" value="display">
 <input type="hidden" name="a" value="saveMergePanel">
 <input type="hidden" name="src_ticket_id" value="{$ticket_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Merge with tickets:</b><br>
 <button type="button" class="chooser_ticket"><span class="glyphicons glyphicons-search"></span></button>
 <br>
 <br>
diff --git a/features/cerberusweb.core/templates/display/rpc/relay_message.tpl b/features/cerberusweb.core/templates/display/rpc/relay_message.tpl
index df6efb8d5..b290142e1 100644
--- a/features/cerberusweb.core/templates/display/rpc/relay_message.tpl
+++ b/features/cerberusweb.core/templates/display/rpc/relay_message.tpl
@@ -2,10 +2,11 @@
 
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="frmRelayMessage" name="frmRelayMessage">
 <input type="hidden" name="c" value="display">
 <input type="hidden" name="a" value="saveRelayMessagePopup">
 <input type="hidden" name="id" value="{$message->id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>Message contents</legend>
 	
 	{$sender_name = $sender->getName()}
diff --git a/features/cerberusweb.core/templates/display/rpc/reply.tpl b/features/cerberusweb.core/templates/display/rpc/reply.tpl
index 48c2cc75a..0a0556ec8 100644
--- a/features/cerberusweb.core/templates/display/rpc/reply.tpl
+++ b/features/cerberusweb.core/templates/display/rpc/reply.tpl
@@ -1,8 +1,9 @@
 <div class="block reply_frame" style="width:98%;margin:10px;">
 
 <form id="reply{$message->id}_part1" onsubmit="return false;">
+
 <table cellpadding="2" cellspacing="0" border="0" width="100%">
 	<tr>
 		<td><h2 style="color:rgb(50,50,50);">{if $is_forward}{'display.ui.forward'|devblocks_translate|capitalize}{else}{'display.ui.reply'|devblocks_translate|capitalize}{/if}</h2></td>
 	</tr>
 	<tr>
@@ -169,10 +170,11 @@
 <!-- {* Copy these dynamically so a plugin dev doesn't need to conflict with the reply <form> *} -->
 <input type="hidden" name="to" value="{$to}">
 <input type="hidden" name="cc" value="{$cc}">
 <input type="hidden" name="bcc" value="{$bcc}">
 <input type="hidden" name="subject" value="{$subject}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 {if $is_forward}
 <textarea name="content" id="reply_{$message->id}" class="reply" style="width:98%;height:{$mail_reply_textbox_size_px|default:300}px;border:1px solid rgb(180,180,180);padding:5px;">
 {if !empty($draft)}{$draft->body}{else}
 {if !empty($signature)}
diff --git a/features/cerberusweb.core/templates/display/rpc/requester_panel.tpl b/features/cerberusweb.core/templates/display/rpc/requester_panel.tpl
index 1cb30cd93..b7997b3b9 100644
--- a/features/cerberusweb.core/templates/display/rpc/requester_panel.tpl
+++ b/features/cerberusweb.core/templates/display/rpc/requester_panel.tpl
@@ -1,9 +1,10 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="formDisplayReq" name="formDisplayReq" onsubmit="return false;">
 <input type="hidden" name="c" value="display">
 <input type="hidden" name="a" value="saveRequestersPanel">
 <input type="hidden" name="ticket_id" value="{$ticket_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>{'display.ui.add_to_recipients'|devblocks_translate}:</b><br>
 <button type="button" class="chooser_address"><span class="glyphicons glyphicons-circle-plus" style="color:rgb(0,180,0);"></span></button>
 <ul class="chooser-container bubbles">
 {if !empty($requesters)}
diff --git a/features/cerberusweb.core/templates/groups/peek.tpl b/features/cerberusweb.core/templates/groups/peek.tpl
index d9f69cd07..181156996 100644
--- a/features/cerberusweb.core/templates/groups/peek.tpl
+++ b/features/cerberusweb.core/templates/groups/peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="group">
 <input type="hidden" name="action" value="savePeek">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($group) && !empty($group->id)}<input type="hidden" name="id" value="{$group->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <table cellpadding="2" cellspacing="0" border="0" width="98%">
 
 	<tr>
 		<td width="0%" nowrap="nowrap" align="right" valign="middle">{'common.name'|devblocks_translate|capitalize}: </td>
diff --git a/features/cerberusweb.core/templates/groups/view.tpl b/features/cerberusweb.core/templates/groups/view.tpl
index a6be29169..0ec3259dc 100644
--- a/features/cerberusweb.core/templates/groups/view.tpl
+++ b/features/cerberusweb.core/templates/groups/view.tpl
@@ -30,10 +30,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="group">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="5" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/header.tpl b/features/cerberusweb.core/templates/header.tpl
index b7e76ecaf..a1ee9cf84 100644
--- a/features/cerberusweb.core/templates/header.tpl
+++ b/features/cerberusweb.core/templates/header.tpl
@@ -3,10 +3,11 @@
 <head>
 	<meta http-equiv="Content-Type" content="text/html; charset={$smarty.const.LANG_CHARSET_CODE}">
 	<meta http-equiv="Cache-Control" content="no-cache">
 	<meta name="robots" content="noindex">
 	<meta name="googlebot" content="noindex">
+	<meta name="_csrf_token" content="{$session.csrf_token}">
 	<!--[if gte IE 9]>
 	<meta http-equiv="X-UA-Compatible" content="IE=Edge"/>
 	<![endif]-->
 	
 	<title>{$settings->get('cerberusweb.core','helpdesk_title')}</title>
diff --git a/features/cerberusweb.core/templates/internal/activity_log/view.tpl b/features/cerberusweb.core/templates/internal/activity_log/view.tpl
index cabe5c681..a04a010fe 100644
--- a/features/cerberusweb.core/templates/internal/activity_log/view.tpl
+++ b/features/cerberusweb.core/templates/internal/activity_log/view.tpl
@@ -25,10 +25,12 @@
 <form id="viewForm{$view->id}" name="viewForm{$view->id}" action="{devblocks_url}{/devblocks_url}" method="post">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="context_id" value="{$view_context}">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/bucket/peek.tpl b/features/cerberusweb.core/templates/internal/bucket/peek.tpl
index 54864f1f0..a04a7cd47 100644
--- a/features/cerberusweb.core/templates/internal/bucket/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/bucket/peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="bucket">
 <input type="hidden" name="action" value="savePeek">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($bucket) && !empty($bucket->id)}<input type="hidden" name="id" value="{$bucket->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <table cellpadding="2" cellspacing="0" border="0" width="98%">
 	<tr>
 		<td width="0%" nowrap="nowrap" align="middle">
 			<b>{'common.name'|devblocks_translate|capitalize}:</b> 
diff --git a/features/cerberusweb.core/templates/internal/bucket/view.tpl b/features/cerberusweb.core/templates/internal/bucket/view.tpl
index 9f71c03de..8ffd571ce 100644
--- a/features/cerberusweb.core/templates/internal/bucket/view.tpl
+++ b/features/cerberusweb.core/templates/internal/bucket/view.tpl
@@ -31,10 +31,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="bucket">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="5" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/calendar/peek.tpl b/features/cerberusweb.core/templates/internal/calendar/peek.tpl
index 8be3ef261..09b546cb6 100644
--- a/features/cerberusweb.core/templates/internal/calendar/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/calendar/peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="calendars">
 <input type="hidden" name="action" value="saveCalendarPeek">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($model) && !empty($model->id)}<input type="hidden" name="id" value="{$model->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <table cellspacing="0" cellpadding="2" border="0" width="98%" style="margin-bottom:10px;">
 	<tr>
 		<td width="1%" nowrap="nowrap"><b>{'common.name'|devblocks_translate}:</b></td>
 		<td width="99%">
diff --git a/features/cerberusweb.core/templates/internal/calendar/tab_availability.tpl b/features/cerberusweb.core/templates/internal/calendar/tab_availability.tpl
index ae7ec4819..de26d0998 100644
--- a/features/cerberusweb.core/templates/internal/calendar/tab_availability.tpl
+++ b/features/cerberusweb.core/templates/internal/calendar/tab_availability.tpl
@@ -1,13 +1,15 @@
 {$guid = uniqid()}
 
 {if empty($calendar) && $context == CerberusContexts::CONTEXT_WORKER && $context_id == $active_worker->id}
-<form action="{devblocks_url}{/devblocks_url}">
+<form action="{devblocks_url}{/devblocks_url}" method="post">
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="worker">
 <input type="hidden" name="action" value="setAvailabilityCalendar">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <div class="help-box" style="padding:5px;border:0;">
 	<h1 style="margin-bottom:5px;text-align:left;">Configure your availability calendar</h1>
 	
 	<p>
 		This calendar displays your availability.
diff --git a/features/cerberusweb.core/templates/internal/calendar/view.tpl b/features/cerberusweb.core/templates/internal/calendar/view.tpl
index 4d4a6dcf6..663f8f6fc 100644
--- a/features/cerberusweb.core/templates/internal/calendar/view.tpl
+++ b/features/cerberusweb.core/templates/internal/calendar/view.tpl
@@ -31,10 +31,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="calendar">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/calendar_event/peek.tpl b/features/cerberusweb.core/templates/internal/calendar_event/peek.tpl
index f5a633125..ef5f5bcad 100644
--- a/features/cerberusweb.core/templates/internal/calendar_event/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/calendar_event/peek.tpl
@@ -13,10 +13,11 @@
 {/if}
 {if !empty($link_context)}
 <input type="hidden" name="link_context" value="{$link_context}">
 <input type="hidden" name="link_context_id" value="{$link_context_id}">
 {/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <table cellpadding="0" cellspacing="2" border="0" width="98%">
 	<tr>
 		<td width="0%" nowrap="nowrap" valign="top" align="right">{'common.name'|devblocks_translate|capitalize}: </td>
 		<td width="100%">
diff --git a/features/cerberusweb.core/templates/internal/calendar_event/view.tpl b/features/cerberusweb.core/templates/internal/calendar_event/view.tpl
index f5cb362ed..3666c312e 100644
--- a/features/cerberusweb.core/templates/internal/calendar_event/view.tpl
+++ b/features/cerberusweb.core/templates/internal/calendar_event/view.tpl
@@ -28,10 +28,12 @@
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="context_id" value="cerberusweb.contexts.calendar_event">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/calendar_recurring_profile/peek.tpl b/features/cerberusweb.core/templates/internal/calendar_recurring_profile/peek.tpl
index 8b965e223..19cf21e94 100644
--- a/features/cerberusweb.core/templates/internal/calendar_recurring_profile/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/calendar_recurring_profile/peek.tpl
@@ -7,10 +7,11 @@
 {if !empty($model->calendar_id)}
 <input type="hidden" name="calendar_id" value="{$model->calendar_id}">
 {/if}
 {if !empty($model) && !empty($model->id)}<input type="hidden" name="id" value="{$model->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <table cellpadding="0" cellspacing="2" border="0" width="98%">
 	<tr>
 		<td width="0%" nowrap="nowrap" valign="top" align="right">{'common.name'|devblocks_translate|capitalize}: </td>
 		<td width="100%">
diff --git a/features/cerberusweb.core/templates/internal/calendar_recurring_profile/view.tpl b/features/cerberusweb.core/templates/internal/calendar_recurring_profile/view.tpl
index 2818fb42c..ac8d9618b 100644
--- a/features/cerberusweb.core/templates/internal/calendar_recurring_profile/view.tpl
+++ b/features/cerberusweb.core/templates/internal/calendar_recurring_profile/view.tpl
@@ -31,10 +31,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="calendar_recurring_profile">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/comments/peek.tpl b/features/cerberusweb.core/templates/internal/comments/peek.tpl
index f011aaf55..27514425a 100644
--- a/features/cerberusweb.core/templates/internal/comments/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/comments/peek.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="post" id="internalCommentPopup" onsubmit="return false;">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="commentSavePopup">
 <input type="hidden" name="context" value="{$context}">
 <input type="hidden" name="context_id" value="{$context_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Author:</b> {$active_worker->getName()}
 <div>
 	<textarea name="comment" rows="2" cols="60" style="width:98%;" placeholder="{'comment.notify.at_mention'|devblocks_translate}"></textarea>
 </div>
diff --git a/features/cerberusweb.core/templates/internal/comments/view.tpl b/features/cerberusweb.core/templates/internal/comments/view.tpl
index f75d6061c..0fc7ed8c2 100644
--- a/features/cerberusweb.core/templates/internal/comments/view.tpl
+++ b/features/cerberusweb.core/templates/internal/comments/view.tpl
@@ -29,10 +29,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="comment">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/custom_fieldsets/peek.tpl b/features/cerberusweb.core/templates/internal/custom_fieldsets/peek.tpl
index 293b28332..0bdb0683a 100644
--- a/features/cerberusweb.core/templates/internal/custom_fieldsets/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/custom_fieldsets/peek.tpl
@@ -12,10 +12,11 @@
 <input type="hidden" name="section" value="custom_fieldsets">
 <input type="hidden" name="action" value="saveCustomFieldsetPeek">
 <input type="hidden" name="id" value="{$custom_fieldset->id}">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek cfield-props">
 	<legend>{'common.properties'|devblocks_translate|capitalize}</legend>
 	
 	<table cellpadding="2" cellspacing="0" border="0" width="100%">
diff --git a/features/cerberusweb.core/templates/internal/custom_fieldsets/view.tpl b/features/cerberusweb.core/templates/internal/custom_fieldsets/view.tpl
index 4d3f7e92d..a079f2082 100644
--- a/features/cerberusweb.core/templates/internal/custom_fieldsets/view.tpl
+++ b/features/cerberusweb.core/templates/internal/custom_fieldsets/view.tpl
@@ -26,10 +26,12 @@
 <form id="viewForm{$view->id}" name="viewForm{$view->id}" action="{devblocks_url}{/devblocks_url}" method="post">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="context_id" value="cerberusweb.contexts.custom_fieldset">
 <input type="hidden" name="c" value="tickets">
 <input type="hidden" name="a" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="5" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/decisions/editors/_move.tpl b/features/cerberusweb.core/templates/internal/decisions/editors/_move.tpl
index c76eb426d..f1051c31f 100644
--- a/features/cerberusweb.core/templates/internal/decisions/editors/_move.tpl
+++ b/features/cerberusweb.core/templates/internal/decisions/editors/_move.tpl
@@ -1,10 +1,11 @@
 <form id="frmDecisionNodeMove" onsubmit="return false;">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="saveDecisionMovePopup">
 {if isset($node)}<input type="hidden" name="id" value="{$node->id}">{/if}
 {if isset($trigger)}<input type="hidden" name="trigger_id" value="{$trigger->id}">{/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>Move</legend>
 	<select name="dir">
 		<option value="-1">Before</option>
diff --git a/features/cerberusweb.core/templates/internal/decisions/editors/_reorder.tpl b/features/cerberusweb.core/templates/internal/decisions/editors/_reorder.tpl
index 9f3f55376..e6dc7c205 100644
--- a/features/cerberusweb.core/templates/internal/decisions/editors/_reorder.tpl
+++ b/features/cerberusweb.core/templates/internal/decisions/editors/_reorder.tpl
@@ -1,10 +1,11 @@
 <form id="frmDecisionNodeReorder" onsubmit="return false;">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="saveDecisionReorderPopup">
 {if isset($node)}<input type="hidden" name="id" value="{$node->id}">{/if}
 {if isset($trigger)}<input type="hidden" name="trigger_id" value="{$trigger->id}">{/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>{if !empty($node)}{$node->title}{elseif !empty($trigger)}{$trigger->event_point}{/if}</legend>
 	
 	{* [TODO] Show a tree excluding the current branch *}
diff --git a/features/cerberusweb.core/templates/internal/decisions/editors/action.tpl b/features/cerberusweb.core/templates/internal/decisions/editors/action.tpl
index bfc896acc..aeb89a054 100644
--- a/features/cerberusweb.core/templates/internal/decisions/editors/action.tpl
+++ b/features/cerberusweb.core/templates/internal/decisions/editors/action.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="">
 {if isset($id)}<input type="hidden" name="id" value="{$id}">{/if}
 {if isset($parent_id)}<input type="hidden" name="parent_id" value="{$parent_id}">{/if}
 {if isset($type)}<input type="hidden" name="type" value="{$type}">{/if}
 {if isset($trigger_id)}<input type="hidden" name="trigger_id" value="{$trigger_id}">{/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>{'common.title'|devblocks_translate|capitalize}:</b><br>
 <input type="text" name="title" value="{$model->title}" style="width:100%;"><br>
 <br>
 
@@ -67,10 +68,12 @@
 
 <form id="frmDecisionActionAdd{$id}" action="javascript:;" onsubmit="return false;">
 <input type="hidden" name="seq" value="{if !is_null($seq)}{$seq+1}{else}0{/if}">
 <input type="hidden" name="action" value="">
 {if isset($trigger_id)}<input type="hidden" name="trigger_id" value="{$trigger_id}">{/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <fieldset>
 	<legend>Add Action</legend>
 
 	<button type="button" class="action cerb-popupmenu-trigger">Add Action &#x25be;</button>
 
diff --git a/features/cerberusweb.core/templates/internal/decisions/editors/outcome.tpl b/features/cerberusweb.core/templates/internal/decisions/editors/outcome.tpl
index 6127f5d20..89538575e 100644
--- a/features/cerberusweb.core/templates/internal/decisions/editors/outcome.tpl
+++ b/features/cerberusweb.core/templates/internal/decisions/editors/outcome.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="">
 {if isset($id)}<input type="hidden" name="id" value="{$id}">{/if}
 {if isset($parent_id)}<input type="hidden" name="parent_id" value="{$parent_id}">{/if}
 {if isset($type)}<input type="hidden" name="type" value="{$type}">{/if}
 {if isset($trigger_id)}<input type="hidden" name="trigger_id" value="{$trigger_id}">{/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>{'common.title'|devblocks_translate|capitalize}:</b><br>
 <input type="text" name="title" value="{$model->title}" style="width:100%;"><br>
 <br>
 
@@ -78,10 +79,12 @@
 
 <form id="frmDecisionOutcomeAdd{$id}" action="javascript:;" onsubmit="return false;">
 <input type="hidden" name="seq" value="{$seq}">
 <input type="hidden" name="condition" value="">
 {if isset($trigger_id)}<input type="hidden" name="trigger_id" value="{$trigger_id}">{/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <fieldset>
 	<legend>Add Condition</legend>
 
 	<button type="button" class="condition cerb-popupmenu-trigger">Add Condition &#x25be;</button>
 	<button type="button" class="group">Add Group</button>
diff --git a/features/cerberusweb.core/templates/internal/decisions/editors/simulate.tpl b/features/cerberusweb.core/templates/internal/decisions/editors/simulate.tpl
index 008b49c56..59dd164ca 100644
--- a/features/cerberusweb.core/templates/internal/decisions/editors/simulate.tpl
+++ b/features/cerberusweb.core/templates/internal/decisions/editors/simulate.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="runBehaviorSimulator">
 {if isset($node)}<input type="hidden" name="id" value="{$node->id}">{/if}
 {if isset($trigger)}<input type="hidden" name="trigger_id" value="{$trigger->id}">{/if}
 <input type="hidden" name="event_params_json" value="{$event_params_json}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 {* Target *}
 
 {$ext_event->renderSimulatorTarget($trigger, $event_model)}
 
diff --git a/features/cerberusweb.core/templates/internal/decisions/editors/switch.tpl b/features/cerberusweb.core/templates/internal/decisions/editors/switch.tpl
index d7303a5aa..c9bfe7f1d 100644
--- a/features/cerberusweb.core/templates/internal/decisions/editors/switch.tpl
+++ b/features/cerberusweb.core/templates/internal/decisions/editors/switch.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="">
 {if isset($id)}<input type="hidden" name="id" value="{$id}">{/if}
 {if isset($parent_id)}<input type="hidden" name="parent_id" value="{$parent_id}">{/if}
 {if isset($type)}<input type="hidden" name="type" value="{$type}">{/if}
 {if isset($trigger_id)}<input type="hidden" name="trigger_id" value="{$trigger_id}">{/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>{'common.title'|devblocks_translate|capitalize}:</b><br>
 <input type="text" name="title" value="{$model->title}" style="width:100%;"><br>
 <br>
 
diff --git a/features/cerberusweb.core/templates/internal/decisions/editors/trigger.tpl b/features/cerberusweb.core/templates/internal/decisions/editors/trigger.tpl
index e11e24766..de5e5efc9 100644
--- a/features/cerberusweb.core/templates/internal/decisions/editors/trigger.tpl
+++ b/features/cerberusweb.core/templates/internal/decisions/editors/trigger.tpl
@@ -5,10 +5,11 @@
 <input type="hidden" name="a" value="">
 <input type="hidden" name="trigger_id" value="{if isset($trigger->id)}{$trigger->id}{else}0{/if}">
 {if empty($trigger->id)}
 <input type="hidden" name="va_id" value="{$va->id}">
 {/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <div>
 	<b>{'common.title'|devblocks_translate|capitalize}:</b><br>
 	<input type="text" name="title" value="{$trigger->title}" style="width:100%;"><br>
 </div>
@@ -114,10 +115,11 @@
 	<div id="tabBehavior{$trigger->id}Import">
 		<form action="{devblocks_url}{/devblocks_url}" method="post" id="frmBehaviorImport" onsubmit="return false;">
 		<input type="hidden" name="c" value="internal">
 		<input type="hidden" name="a" value="">
 		<input type="hidden" name="va_id" value="{$va->id}">
+		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 		<div class="import">
 			<b>Import:</b> (.json format)
 			<br>
 			<textarea name="import_json" style="width:100%;height:250px;white-space:pre;word-wrap:normal;" rows="10" cols="45" spellcheck="false"></textarea>
diff --git a/features/cerberusweb.core/templates/internal/file_bundle/peek.tpl b/features/cerberusweb.core/templates/internal/file_bundle/peek.tpl
index ff1f4aeab..80c73e030 100644
--- a/features/cerberusweb.core/templates/internal/file_bundle/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/file_bundle/peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="file_bundle">
 <input type="hidden" name="action" value="savePeek">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($model) && !empty($model->id)}<input type="hidden" name="id" value="{$model->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate}</legend>
 	
 	<table cellspacing="0" cellpadding="2" border="0" width="98%">
diff --git a/features/cerberusweb.core/templates/internal/file_bundle/view.tpl b/features/cerberusweb.core/templates/internal/file_bundle/view.tpl
index d38a35cbc..e50d09ad5 100644
--- a/features/cerberusweb.core/templates/internal/file_bundle/view.tpl
+++ b/features/cerberusweb.core/templates/internal/file_bundle/view.tpl
@@ -31,10 +31,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="file_bundle">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/import/popup_mapping.tpl b/features/cerberusweb.core/templates/internal/import/popup_mapping.tpl
index 6328705f1..d0babed1d 100644
--- a/features/cerberusweb.core/templates/internal/import/popup_mapping.tpl
+++ b/features/cerberusweb.core/templates/internal/import/popup_mapping.tpl
@@ -2,10 +2,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="frmImport">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="doImport">
 <input type="hidden" name="context" value="{$context}">
 <input type="hidden" name="view_id" value="{$view_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>Associate Fields with Import Columns</legend>
 
 	<table cellpadding="2" cellspacing="0" border="0">
diff --git a/features/cerberusweb.core/templates/internal/import/popup_upload.tpl b/features/cerberusweb.core/templates/internal/import/popup_upload.tpl
index fee5a873b..1d7fe2987 100644
--- a/features/cerberusweb.core/templates/internal/import/popup_upload.tpl
+++ b/features/cerberusweb.core/templates/internal/import/popup_upload.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" enctype="multipart/form-data" target="iframe_file_post" id="frmImportPopup">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="parseImportFile">
 <input type="hidden" name="context" value="{$context}">
 <input type="hidden" name="view_id" value="{$view_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>Upload File</legend>
 	<b>{'common.import.upload_csv'|devblocks_translate}:</b> {'common.import.upload_csv.tip'|devblocks_translate}<br>
 	<input type="file" name="csv_file">
diff --git a/features/cerberusweb.core/templates/internal/macros/display/scheduler_popup.tpl b/features/cerberusweb.core/templates/internal/macros/display/scheduler_popup.tpl
index 26ae21717..457c19594 100644
--- a/features/cerberusweb.core/templates/internal/macros/display/scheduler_popup.tpl
+++ b/features/cerberusweb.core/templates/internal/macros/display/scheduler_popup.tpl
@@ -10,10 +10,11 @@
 <form action="#" method="post" id="frmScheduledBehaviorPeek" onsubmit="return false;">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="saveMacroSchedulerPopup">
 <input type="hidden" name="job_id" value="{$job->id}">
 {/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Behavior:</b><br>
 {if !empty($macro->title)}
 	{$macro->title}
 {else}
diff --git a/features/cerberusweb.core/templates/internal/macros/reply/run_popup.tpl b/features/cerberusweb.core/templates/internal/macros/reply/run_popup.tpl
index e88a69063..a5facdc19 100644
--- a/features/cerberusweb.core/templates/internal/macros/reply/run_popup.tpl
+++ b/features/cerberusweb.core/templates/internal/macros/reply/run_popup.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="c" value="display">
 <input type="hidden" name="a" value="getMacroReply">
 <input type="hidden" name="macro" value="{$macro->id}">
 <input type="hidden" name="ticket_id" value="{$ticket_id}">
 <input type="hidden" name="message_id" value="{$message_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Behavior:</b><br>
 {if !empty($macro->title)}
 	{$macro->title}
 {else}
diff --git a/features/cerberusweb.core/templates/internal/mail_transport/peek.tpl b/features/cerberusweb.core/templates/internal/mail_transport/peek.tpl
index 2f1f0d9f8..9958d770c 100644
--- a/features/cerberusweb.core/templates/internal/mail_transport/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/mail_transport/peek.tpl
@@ -1,9 +1,10 @@
 <form action="javascript:;" method="post" class="peek-mail-transport" onsubmit="return false;">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($model) && !empty($model->id)}<input type="hidden" name="id" value="{$model->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek" style="margin-bottom:0px;">
 	<legend>{'common.properties'|devblocks_translate}</legend>
 	
 	<table cellspacing="0" cellpadding="2" border="0" width="98%">
diff --git a/features/cerberusweb.core/templates/internal/mail_transport/view.tpl b/features/cerberusweb.core/templates/internal/mail_transport/view.tpl
index 612172fb8..3d75ba81e 100644
--- a/features/cerberusweb.core/templates/internal/mail_transport/view.tpl
+++ b/features/cerberusweb.core/templates/internal/mail_transport/view.tpl
@@ -30,10 +30,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="mail_transport">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="5" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/mailbox/peek.tpl b/features/cerberusweb.core/templates/internal/mailbox/peek.tpl
index 9e08845d7..70a154eaa 100644
--- a/features/cerberusweb.core/templates/internal/mailbox/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/mailbox/peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="mailbox">
 <input type="hidden" name="action" value="savePeekJson">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($model) && !empty($model->id)}<input type="hidden" name="id" value="{$model->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate}</legend>
 	
 	<table cellpadding="2" cellspacing="0" border="0">
diff --git a/features/cerberusweb.core/templates/internal/mailbox/view.tpl b/features/cerberusweb.core/templates/internal/mailbox/view.tpl
index a8512eadf..aaaec1910 100644
--- a/features/cerberusweb.core/templates/internal/mailbox/view.tpl
+++ b/features/cerberusweb.core/templates/internal/mailbox/view.tpl
@@ -31,10 +31,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="mailbox">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/messages/peek.tpl b/features/cerberusweb.core/templates/internal/messages/peek.tpl
index 22bb6aa75..ee2a915f0 100644
--- a/features/cerberusweb.core/templates/internal/messages/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/messages/peek.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="c" value="display">
 <input type="hidden" name="a" value="saveMessagePeekPopup">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($model) && !empty($model->id)}<input type="hidden" name="id" value="{$model->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 {$ticket = $model->getTicket()}
 {$headers = $model->getHeaders()}
 
 {if $headers.from}
diff --git a/features/cerberusweb.core/templates/internal/recommendations/context_recommend_peek.tpl b/features/cerberusweb.core/templates/internal/recommendations/context_recommend_peek.tpl
index a033340e8..ac97799d8 100644
--- a/features/cerberusweb.core/templates/internal/recommendations/context_recommend_peek.tpl
+++ b/features/cerberusweb.core/templates/internal/recommendations/context_recommend_peek.tpl
@@ -11,10 +11,11 @@
 	<input type="hidden" name="action" value="saveContextRecommendationsPopupJson">
 	<input type="hidden" name="context" value="{$context}">
 	<input type="hidden" name="context_id" value="{$context_id}">
 	<input type="hidden" name="group_id" value="{$group_id}">
 	<input type="hidden" name="bucket_id" value="{$bucket_id}">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 	
 	<div style="margin-bottom:10px;">
 	{include file="devblocks:cerberusweb.core::internal/workers/worker_picker_container.tpl" context=$context context_id=$context_id}
 	</div>
 	
diff --git a/features/cerberusweb.core/templates/internal/responsibilities/peek_by_group_editable.tpl b/features/cerberusweb.core/templates/internal/responsibilities/peek_by_group_editable.tpl
index a558c5ac6..eedb889e2 100644
--- a/features/cerberusweb.core/templates/internal/responsibilities/peek_by_group_editable.tpl
+++ b/features/cerberusweb.core/templates/internal/responsibilities/peek_by_group_editable.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="responsibilities">
 <input type="hidden" name="action" value="saveResponsibilitiesPopup">
 <input type="hidden" name="context" value="{CerberusContexts::CONTEXT_GROUP}">
 <input type="hidden" name="context_id" value="{$group->id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 {foreach from=$buckets item=bucket}
 	<fieldset class="peek cerb-delta-slider-container" style="display:inline-block;">
 		<legend>{$bucket->name}</legend>
 	
diff --git a/features/cerberusweb.core/templates/internal/skills/peek.tpl b/features/cerberusweb.core/templates/internal/skills/peek.tpl
index f1d7df638..4000afad6 100644
--- a/features/cerberusweb.core/templates/internal/skills/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/skills/peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="skill">
 <input type="hidden" name="action" value="savePeek">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($model) && !empty($model->id)}<input type="hidden" name="id" value="{$model->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate}</legend>
 	
 	<table cellspacing="0" cellpadding="2" border="0" width="98%">
diff --git a/features/cerberusweb.core/templates/internal/skills/view.tpl b/features/cerberusweb.core/templates/internal/skills/view.tpl
index 7bc38b59a..f35327d5d 100644
--- a/features/cerberusweb.core/templates/internal/skills/view.tpl
+++ b/features/cerberusweb.core/templates/internal/skills/view.tpl
@@ -31,10 +31,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="skill">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="5" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/skillsets/chooser_popup.tpl b/features/cerberusweb.core/templates/internal/skillsets/chooser_popup.tpl
index 583f0e7aa..de41bb4c5 100644
--- a/features/cerberusweb.core/templates/internal/skillsets/chooser_popup.tpl
+++ b/features/cerberusweb.core/templates/internal/skillsets/chooser_popup.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="skills">
 <input type="hidden" name="action" value="saveSkillsForContext">
 <input type="hidden" name="context" value="{$context}">
 <input type="hidden" name="context_id" value="{$context_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 {include file="devblocks:cerberusweb.core::internal/skillsets/fieldsets_and_menu.tpl" skill_labels=$skill_labels skillsets_linked=$skillsets}
 
 <button type="button" class="submit"><span class="glyphicons glyphicons-circle-ok" style="color:rgb(0,180,0);"></span> {'common.save_changes'|devblocks_translate|capitalize}</button>
 
diff --git a/features/cerberusweb.core/templates/internal/skillsets/peek.tpl b/features/cerberusweb.core/templates/internal/skillsets/peek.tpl
index 1b1663c30..a251a0dd7 100644
--- a/features/cerberusweb.core/templates/internal/skillsets/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/skillsets/peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="skillset">
 <input type="hidden" name="action" value="savePeek">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($model) && !empty($model->id)}<input type="hidden" name="id" value="{$model->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate}</legend>
 	
 	<table cellspacing="0" cellpadding="2" border="0" width="98%">
diff --git a/features/cerberusweb.core/templates/internal/skillsets/tab_editable.tpl b/features/cerberusweb.core/templates/internal/skillsets/tab_editable.tpl
index 7b57b8083..18f7b9144 100644
--- a/features/cerberusweb.core/templates/internal/skillsets/tab_editable.tpl
+++ b/features/cerberusweb.core/templates/internal/skillsets/tab_editable.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="skills">
 <input type="hidden" name="action" value="saveSkillsForContext">
 <input type="hidden" name="context" value="{$context}">
 <input type="hidden" name="context_id" value="{$context_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 {include file="devblocks:cerberusweb.core::internal/skillsets/fieldsets_and_menu.tpl" skill_labels=$skill_labels skillsets_linked=$skillsets}
 
 <div style="margin-top:10px;">
 	<div class="status"></div>
diff --git a/features/cerberusweb.core/templates/internal/skillsets/view.tpl b/features/cerberusweb.core/templates/internal/skillsets/view.tpl
index 138c0fc02..b8a4bedaf 100644
--- a/features/cerberusweb.core/templates/internal/skillsets/view.tpl
+++ b/features/cerberusweb.core/templates/internal/skillsets/view.tpl
@@ -31,10 +31,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="skillset">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="5" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/snippets/bulk.tpl b/features/cerberusweb.core/templates/internal/snippets/bulk.tpl
index 26e61d9dd..92cdc7a2a 100644
--- a/features/cerberusweb.core/templates/internal/snippets/bulk.tpl
+++ b/features/cerberusweb.core/templates/internal/snippets/bulk.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="formBatchUpdate" name="formBatchUpdate" onsubmit="return false;">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="doSnippetBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
 	{if !empty($ids)}
diff --git a/features/cerberusweb.core/templates/internal/snippets/paste_placeholders.tpl b/features/cerberusweb.core/templates/internal/snippets/paste_placeholders.tpl
index 64bf96bd7..3470384eb 100644
--- a/features/cerberusweb.core/templates/internal/snippets/paste_placeholders.tpl
+++ b/features/cerberusweb.core/templates/internal/snippets/paste_placeholders.tpl
@@ -1,10 +1,11 @@
 <form action="#" method="POST" id="formSnippetsPaste" name="formSnippetsPaste" onsubmit="return false;">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="snippetPlaceholdersPreview">
 <input type="hidden" name="id" value="{$snippet->id}">
 <input type="hidden" name="context_id" value="{$context_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek" style="margin-bottom:5px;">
 	<legend>Fill in the blanks:</legend>
 	
 	{foreach from=$snippet->custom_placeholders item=placeholder key=placeholder_key}
diff --git a/features/cerberusweb.core/templates/internal/snippets/peek.tpl b/features/cerberusweb.core/templates/internal/snippets/peek.tpl
index 8cb92fa49..f3b253a5e 100644
--- a/features/cerberusweb.core/templates/internal/snippets/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/snippets/peek.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="saveSnippetsPeek">
 <input type="hidden" name="id" value="{$snippet->id}">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate|capitalize}</legend>
 	
 	<table cellpadding="2" cellspacing="0" border="0" width="100%">
diff --git a/features/cerberusweb.core/templates/internal/snippets/views/default.tpl b/features/cerberusweb.core/templates/internal/snippets/views/default.tpl
index a1931b9fa..bf92caec3 100644
--- a/features/cerberusweb.core/templates/internal/snippets/views/default.tpl
+++ b/features/cerberusweb.core/templates/internal/snippets/views/default.tpl
@@ -27,10 +27,12 @@
 <form id="viewForm{$view->id}" name="viewForm{$view->id}" action="{devblocks_url}{/devblocks_url}" method="post">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="context_id" value="cerberusweb.contexts.snippet">
 <input type="hidden" name="c" value="tickets">
 <input type="hidden" name="a" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="5" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/tour/banner.tpl b/features/cerberusweb.core/templates/internal/tour/banner.tpl
index 1c2057618..998d0cad7 100644
--- a/features/cerberusweb.core/templates/internal/tour/banner.tpl
+++ b/features/cerberusweb.core/templates/internal/tour/banner.tpl
@@ -9,10 +9,11 @@
 		<td align="center" width="80%"><h1>Tour: {$tour.title}</h1></td>
 		<td align="right" width="10%" nowrap="nowrap">
 			<form action="{devblocks_url}{/devblocks_url}" method="post" name="tourForm">
 				<input type="hidden" name="c" value="internal">
 				<input type="hidden" name="a" value="doStopTour">
+				<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 				<a href="javascript:;" onclick="$('#tourDiv').fadeOut();genericAjaxGet('','c=internal&a=doStopTour');">hide this</a>
 				&nbsp;
 			</form>
 		</td>
 	</tr>
diff --git a/features/cerberusweb.core/templates/internal/va/peek.tpl b/features/cerberusweb.core/templates/internal/va/peek.tpl
index ec49bedc9..3e736fc36 100644
--- a/features/cerberusweb.core/templates/internal/va/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/va/peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="virtual_attendant">
 <input type="hidden" name="action" value="savePeek">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($model) && !empty($model->id)}<input type="hidden" name="id" value="{$model->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate}</legend>
 	
 	<table cellspacing="0" cellpadding="2" border="0" width="98%">
diff --git a/features/cerberusweb.core/templates/internal/va/scheduled_behavior/view.tpl b/features/cerberusweb.core/templates/internal/va/scheduled_behavior/view.tpl
index 4f5c2e4b8..a432422ff 100644
--- a/features/cerberusweb.core/templates/internal/va/scheduled_behavior/view.tpl
+++ b/features/cerberusweb.core/templates/internal/va/scheduled_behavior/view.tpl
@@ -18,10 +18,12 @@
 <form id="viewForm{$view->id}" name="viewForm{$view->id}" action="#">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="context_id" value="cerberusweb.contexts.group">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="5" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/va/view.tpl b/features/cerberusweb.core/templates/internal/va/view.tpl
index ce5d33270..28d0ecf4e 100644
--- a/features/cerberusweb.core/templates/internal/va/view.tpl
+++ b/features/cerberusweb.core/templates/internal/va/view.tpl
@@ -31,10 +31,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="virtual_attendant">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/internal/views/copy.tpl b/features/cerberusweb.core/templates/internal/views/copy.tpl
index a28466312..c0cb590e0 100644
--- a/features/cerberusweb.core/templates/internal/views/copy.tpl
+++ b/features/cerberusweb.core/templates/internal/views/copy.tpl
@@ -1,7 +1,8 @@
 <form action="{devblocks_url}{/devblocks_url}" method="post" id="frmCopy{$view->id}" onsubmit="return false;">
 <input type="hidden" name="view_id" value="{$view_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <H2>Copy Worklist</H2>
 
 You can copy this worklist to other pages in order to build your ideal workspace.<br>
 <br>
diff --git a/features/cerberusweb.core/templates/internal/views/search_and_view.tpl b/features/cerberusweb.core/templates/internal/views/search_and_view.tpl
index 790f19a25..3a96066fe 100644
--- a/features/cerberusweb.core/templates/internal/views/search_and_view.tpl
+++ b/features/cerberusweb.core/templates/internal/views/search_and_view.tpl
@@ -1,10 +1,11 @@
 {if !empty($view)}
 <form action="#" method="POST" id="filter{$view->id}">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="id" value="{$view->id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <div id="viewCustomFilters{$view->id}">
 {include file="devblocks:cerberusweb.core::internal/views/customize_view_criteria.tpl"}
 </div>
 </form>
diff --git a/features/cerberusweb.core/templates/internal/views/view_export.tpl b/features/cerberusweb.core/templates/internal/views/view_export.tpl
index addb56358..8cadedbe0 100644
--- a/features/cerberusweb.core/templates/internal/views/view_export.tpl
+++ b/features/cerberusweb.core/templates/internal/views/view_export.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="post" target="_blank" id="frm{$view_id}_export">
 <input type="hidden" name="c" value="internal">
 <input type="hidden" name="a" value="viewDoExport">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="cursor_key" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <div class="export-settings">
 
 <h1>{'common.export'|devblocks_translate|capitalize}</h1>
 <br>
diff --git a/features/cerberusweb.core/templates/internal/watchers/context_follow_peek.tpl b/features/cerberusweb.core/templates/internal/watchers/context_follow_peek.tpl
index b2fdb49e9..b36118dc7 100644
--- a/features/cerberusweb.core/templates/internal/watchers/context_follow_peek.tpl
+++ b/features/cerberusweb.core/templates/internal/watchers/context_follow_peek.tpl
@@ -11,10 +11,11 @@
 	<input type="hidden" name="action" value="saveContextWatchersPopupJson">
 	<input type="hidden" name="context" value="{$context}">
 	<input type="hidden" name="context_id" value="{$context_id}">
 	<input type="hidden" name="group_id" value="{$group_id}">
 	<input type="hidden" name="bucket_id" value="{$bucket_id}">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 	
 	<div style="margin-bottom:10px;">
 	{include file="devblocks:cerberusweb.core::internal/workers/worker_picker_container.tpl" context=$context context_id=$context_id}
 	</div>
 	
diff --git a/features/cerberusweb.core/templates/internal/workspaces/tabs/calendar/tab.tpl b/features/cerberusweb.core/templates/internal/workspaces/tabs/calendar/tab.tpl
index 64ed58c4e..7ae55c7fb 100644
--- a/features/cerberusweb.core/templates/internal/workspaces/tabs/calendar/tab.tpl
+++ b/features/cerberusweb.core/templates/internal/workspaces/tabs/calendar/tab.tpl
@@ -11,10 +11,12 @@
 {else}
 
 {$guid = uniqid()}
 
 <form id="frm{$guid}" action="#" style="margin-bottom:5px;width:98%;">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+	
 	<div style="float:left;">
 		<span style="font-weight:bold;font-size:150%;">{$calendar_properties.calendar_date|devblocks_date:'F Y'}</span>
 		<span style="margin-left:10px;">
 			{if !empty($create_contexts)}
 			<div style="display:inline-block;margin-left:10px;">
diff --git a/features/cerberusweb.core/templates/internal/workspaces/tabs/worklists/tab.tpl b/features/cerberusweb.core/templates/internal/workspaces/tabs/worklists/tab.tpl
index c9c80f226..b0bed0117 100644
--- a/features/cerberusweb.core/templates/internal/workspaces/tabs/worklists/tab.tpl
+++ b/features/cerberusweb.core/templates/internal/workspaces/tabs/worklists/tab.tpl
@@ -1,7 +1,8 @@
 {if empty($worklists)}
 <form action="#" onsubmit="return false;">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 <div class="help-box" style="padding:5px;border:0;">
 	<h1 style="margin-bottom:5px;text-align:left;">Let's put this workspace to good use</h1>
 	
 	<p>
 		You now have a blank worklists tab.  You can click the  
diff --git a/features/cerberusweb.core/templates/internal/workspaces/widgets/add.tpl b/features/cerberusweb.core/templates/internal/workspaces/widgets/add.tpl
index 9df260e76..bc56104a0 100644
--- a/features/cerberusweb.core/templates/internal/workspaces/widgets/add.tpl
+++ b/features/cerberusweb.core/templates/internal/workspaces/widgets/add.tpl
@@ -9,10 +9,11 @@
 		<input type="hidden" name="c" value="internal">
 		<input type="hidden" name="a" value="handleSectionAction">
 		<input type="hidden" name="section" value="dashboards">
 		<input type="hidden" name="action" value="addWidgetPopupJson">
 		<input type="hidden" name="workspace_tab_id" value="{$workspace_tab_id}">
+		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 		
 		<b>Type:</b>
 		<select name="extension_id">
 			{foreach from=$widget_extensions item=widget_extension}
 			<option value="{$widget_extension->id}">{$widget_extension->name}</option>
@@ -30,10 +31,11 @@
 		<input type="hidden" name="c" value="internal">
 		<input type="hidden" name="a" value="handleSectionAction">
 		<input type="hidden" name="section" value="dashboards">
 		<input type="hidden" name="action" value="addWidgetImportJson">
 		<input type="hidden" name="workspace_tab_id" value="{$workspace_tab_id}">
+		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 		<div class="import">
 			<b>Import:</b> (.json format)
 			
 			<div>
diff --git a/features/cerberusweb.core/templates/internal/workspaces/widgets/calendar/calendar.tpl b/features/cerberusweb.core/templates/internal/workspaces/widgets/calendar/calendar.tpl
index 199cbe117..e4fe015b6 100644
--- a/features/cerberusweb.core/templates/internal/workspaces/widgets/calendar/calendar.tpl
+++ b/features/cerberusweb.core/templates/internal/workspaces/widgets/calendar/calendar.tpl
@@ -1,8 +1,10 @@
 {$guid = uniqid()}
 
 <form id="frm{$guid}" action="#" style="margin-bottom:5px;width:98%;">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+	
 	<div style="float:left;">
 		<span style="font-weight:bold;font-size:150%;">{$calendar_properties.calendar_date|devblocks_date:'F Y'}</span>
 	</div>
 
 	<div style="float:right;">
diff --git a/features/cerberusweb.core/templates/internal/workspaces/widgets/export.tpl b/features/cerberusweb.core/templates/internal/workspaces/widgets/export.tpl
index ee40013ae..ee9232e81 100644
--- a/features/cerberusweb.core/templates/internal/workspaces/widgets/export.tpl
+++ b/features/cerberusweb.core/templates/internal/workspaces/widgets/export.tpl
@@ -1,6 +1,7 @@
 <form action="javascript:;" method="post" id="frmWidgetExport" onsubmit="return false;">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Widget:</b>
 
 {$widget->label}
 
diff --git a/features/cerberusweb.core/templates/internal/workspaces/widgets/export_data.tpl b/features/cerberusweb.core/templates/internal/workspaces/widgets/export_data.tpl
index bb7853d56..6eaec155b 100644
--- a/features/cerberusweb.core/templates/internal/workspaces/widgets/export_data.tpl
+++ b/features/cerberusweb.core/templates/internal/workspaces/widgets/export_data.tpl
@@ -1,6 +1,7 @@
 <form action="javascript:;" method="post" id="frmWidgetExportData" onsubmit="return false;">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Widget:</b>
 
 {$widget->label}
 
diff --git a/features/cerberusweb.core/templates/internal/workspaces/widgets/peek.tpl b/features/cerberusweb.core/templates/internal/workspaces/widgets/peek.tpl
index a405407f2..bb92f0c26 100644
--- a/features/cerberusweb.core/templates/internal/workspaces/widgets/peek.tpl
+++ b/features/cerberusweb.core/templates/internal/workspaces/widgets/peek.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="dashboards">
 <input type="hidden" name="action" value="saveWidgetPopup">
 {if !empty($widget) && !empty($widget->id)}<input type="hidden" name="id" value="{$widget->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <table width="100%" cellpadding="0" cellspacing="2">
 	{if $extension instanceof Extension_WorkspaceWidget}
 	<tr>
 		<td width="1%" nowrap="nowrap" valign="top">
diff --git a/features/cerberusweb.core/templates/mail/queue/bulk.tpl b/features/cerberusweb.core/templates/mail/queue/bulk.tpl
index 6ecd0e694..91c8245b2 100644
--- a/features/cerberusweb.core/templates/mail/queue/bulk.tpl
+++ b/features/cerberusweb.core/templates/mail/queue/bulk.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="drafts">
 <input type="hidden" name="action" value="doDraftsBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
 	{if !empty($ids)}
diff --git a/features/cerberusweb.core/templates/mail/queue/peek.tpl b/features/cerberusweb.core/templates/mail/queue/peek.tpl
index cde1cbfc2..f24986f7c 100644
--- a/features/cerberusweb.core/templates/mail/queue/peek.tpl
+++ b/features/cerberusweb.core/templates/mail/queue/peek.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="section" value="drafts">
 <input type="hidden" name="action" value="saveDraftsPeek">
 <input type="hidden" name="id" value="{$draft->id}">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <table cellpadding="0" cellspacing="2" border="0" width="98%">
 	{if is_null($workers)}{$workers = DAO_Worker::getAll()}{/if}
 	{$worker = $workers.{$draft->worker_id}}
 	{if !empty($worker)}
diff --git a/features/cerberusweb.core/templates/mail/queue/view.tpl b/features/cerberusweb.core/templates/mail/queue/view.tpl
index a5d3b6892..a9cd5e687 100644
--- a/features/cerberusweb.core/templates/mail/queue/view.tpl
+++ b/features/cerberusweb.core/templates/mail/queue/view.tpl
@@ -23,10 +23,12 @@
 <input type="hidden" name="c" value="mail">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="drafts">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/mail/section/compose/peek.tpl b/features/cerberusweb.core/templates/mail/section/compose/peek.tpl
index 889466ca1..af0cd6376 100644
--- a/features/cerberusweb.core/templates/mail/section/compose/peek.tpl
+++ b/features/cerberusweb.core/templates/mail/section/compose/peek.tpl
@@ -12,10 +12,11 @@
 {elseif !empty($draft->params.link_context)}
 <input type="hidden" name="link_context" value="{$draft->params.link_context}">
 <input type="hidden" name="link_context_id" value="{$draft->params.link_context_id}">
 {/if}
 <input type="hidden" name="format" value="{if ($draft && $draft->params.format == 'parsedown') || $mail_reply_html}parsedown{/if}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.message'|devblocks_translate|capitalize}</legend>
 	
 	<table cellpadding="0" cellspacing="2" border="0" width="98%">
diff --git a/features/cerberusweb.core/templates/messages/view.tpl b/features/cerberusweb.core/templates/messages/view.tpl
index c0d79d755..a1c2d6d56 100644
--- a/features/cerberusweb.core/templates/messages/view.tpl
+++ b/features/cerberusweb.core/templates/messages/view.tpl
@@ -24,10 +24,12 @@
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="context_id" value="{$view_context}">
 <input type="hidden" name="c" value="tickets">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/pages/add_tabs.tpl b/features/cerberusweb.core/templates/pages/add_tabs.tpl
index ef675465b..d0ca20c10 100644
--- a/features/cerberusweb.core/templates/pages/add_tabs.tpl
+++ b/features/cerberusweb.core/templates/pages/add_tabs.tpl
@@ -26,10 +26,12 @@
 <form id="{$uniq_id}" action="{devblocks_url}{/devblocks_url}" method="post" onsubmit="return false;">
 <input type="hidden" name="c" value="pages">
 <input type="hidden" name="a" value="doAddCustomTabJson">
 <input type="hidden" name="page_id" value="{$page->id}">
 <input type="hidden" name="len" value="99">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <fieldset class="peek">
 	<legend>Add a new tab:</legend>
 
 	<label><input type="radio" name="mode" value="build" checked="checked"> Build</label>
 	<label><input type="radio" name="mode" value="import"> Import</label>
diff --git a/features/cerberusweb.core/templates/pages/edit_workspace_page.tpl b/features/cerberusweb.core/templates/pages/edit_workspace_page.tpl
index 385c8109b..c57860aa1 100644
--- a/features/cerberusweb.core/templates/pages/edit_workspace_page.tpl
+++ b/features/cerberusweb.core/templates/pages/edit_workspace_page.tpl
@@ -4,10 +4,11 @@
 <input type="hidden" name="c" value="pages">
 <input type="hidden" name="a" value="doEditWorkspacePage">
 <input type="hidden" name="id" value="{$workspace_page->id|default:0}">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($workspace_page)}<input type="hidden" name="do_delete" value="0">{/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <table cellpadding="2" cellspacing="0" border="0" width="100%" style="margin-bottom:5px;">
 	<tr>
 		<td width="1%" nowrap="nowrap" align="right" valign="top">
 			<b>{'common.name'|devblocks_translate|capitalize}:</b>
@@ -116,10 +117,11 @@
 	<div id="tabWorkspacePage{$workspace_page->id}Import">
 		<form action="{devblocks_url}{/devblocks_url}" method="post" id="frmWorkspacePageImport" onsubmit="return false;">
 		<input type="hidden" name="c" value="pages">
 		<input type="hidden" name="a" value="importWorkspacePageJson">
 		<input type="hidden" name="view_id" value="{$view_id}">
+		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 		<div class="import">
 			<b>Import:</b> (.json format)
 			<br>
 			<textarea name="import_json" style="width:100%;height:250px;white-space:pre;word-wrap:normal;" rows="10" cols="45" spellcheck="false"></textarea>
diff --git a/features/cerberusweb.core/templates/pages/edit_workspace_tab.tpl b/features/cerberusweb.core/templates/pages/edit_workspace_tab.tpl
index dbd6e3623..67430740f 100644
--- a/features/cerberusweb.core/templates/pages/edit_workspace_tab.tpl
+++ b/features/cerberusweb.core/templates/pages/edit_workspace_tab.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="c" value="pages">
 <input type="hidden" name="a" value="doEditWorkspaceTabJson">
 <input type="hidden" name="id" value="{$workspace_tab->id}">
 <input type="hidden" name="workspace_page_id" value="{$workspace_tab->workspace_page_id}">
 {if !empty($workspace_tab)}<input type="hidden" name="do_delete" value="0">{/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <table cellpadding="2" cellspacing="0" border="0" width="100%" style="margin-bottom:5px;">
 	<tr>
 		<td width="1%" nowrap="nowrap" align="right" valign="top">
 			<b>{'common.name'|devblocks_translate|capitalize}:</b>
diff --git a/features/cerberusweb.core/templates/pages/page.tpl b/features/cerberusweb.core/templates/pages/page.tpl
index 1a68a29b4..d464afa02 100644
--- a/features/cerberusweb.core/templates/pages/page.tpl
+++ b/features/cerberusweb.core/templates/pages/page.tpl
@@ -1,8 +1,9 @@
 <form action="{devblocks_url}{/devblocks_url}" id="frmWorkspacePage{$page->id}" method="POST" style="margin-top:5px;">
 	<input type="hidden" name="c" value="internal">
 	<input type="hidden" name="a" value="">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 	{$menu_json = DAO_WorkerPref::get($active_worker->id, 'menu_json', json_encode(array()))}
 	{$menu = json_decode($menu_json, true)}
 	{$in_menu = in_array($page->id, $menu)}
 	
diff --git a/features/cerberusweb.core/templates/pages/view.tpl b/features/cerberusweb.core/templates/pages/view.tpl
index 86575afbc..d23df8dd4 100644
--- a/features/cerberusweb.core/templates/pages/view.tpl
+++ b/features/cerberusweb.core/templates/pages/view.tpl
@@ -24,10 +24,12 @@
 <form id="viewForm{$view->id}" name="viewForm{$view->id}" action="{devblocks_url}{/devblocks_url}" method="post">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="context_id" value="">
 <input type="hidden" name="c" value="pages">
 <input type="hidden" name="a" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/pages/wizard_popup.tpl b/features/cerberusweb.core/templates/pages/wizard_popup.tpl
index 54d58a431..da079a8a6 100644
--- a/features/cerberusweb.core/templates/pages/wizard_popup.tpl
+++ b/features/cerberusweb.core/templates/pages/wizard_popup.tpl
@@ -1,9 +1,10 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="frmPageWizard" name="frmPageWizard" onsubmit="return false;">
 <input type="hidden" name="c" value="pages">
 <input type="hidden" name="a" value="savePageWizardPopup">
 <input type="hidden" name="view_id" value="{$view_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend style="color:rgb(80,80,80);">What kind of page would you like to create?</legend>
 	
 	<div style="margin-bottom:10px;">
diff --git a/features/cerberusweb.core/templates/preferences/modules/general.tpl b/features/cerberusweb.core/templates/preferences/modules/general.tpl
index 92c177c20..0c3642394 100644
--- a/features/cerberusweb.core/templates/preferences/modules/general.tpl
+++ b/features/cerberusweb.core/templates/preferences/modules/general.tpl
@@ -1,8 +1,9 @@
 <form action="{devblocks_url}{/devblocks_url}" method="post">
 <input type="hidden" name="c" value="preferences">
 <input type="hidden" name="a" value="saveDefaults">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'preferences.account.settings'|devblocks_translate|capitalize}</legend>
 
 	<b>{'preferences.account.timezone'|devblocks_translate|capitalize}</b> {if !empty($server_timezone)}({'preferences.account.current'|devblocks_translate} {$server_timezone}){/if}<br>
@@ -146,6 +147,7 @@
 
 <form action="{devblocks_url}{/devblocks_url}" name="resendConfirmationForm" method="post">
 <input type="hidden" name="c" value="preferences">
 <input type="hidden" name="a" value="resendConfirmation">
 <input type="hidden" name="email" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 </form>
diff --git a/features/cerberusweb.core/templates/preferences/modules/security.tpl b/features/cerberusweb.core/templates/preferences/modules/security.tpl
index 0f404280c..e83a122cb 100644
--- a/features/cerberusweb.core/templates/preferences/modules/security.tpl
+++ b/features/cerberusweb.core/templates/preferences/modules/security.tpl
@@ -1,8 +1,9 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" autocomplete="off">
 <input type="hidden" name="c" value="preferences">
 <input type="hidden" name="a" value="saveSecurityTab">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <div class="help-box">
 	<h1>Set up your secret questions</h1>
 	
 	<p>
diff --git a/features/cerberusweb.core/templates/preferences/tabs/notifications/bulk.tpl b/features/cerberusweb.core/templates/preferences/tabs/notifications/bulk.tpl
index 3cf4ad3cc..4e9e4fb70 100644
--- a/features/cerberusweb.core/templates/preferences/tabs/notifications/bulk.tpl
+++ b/features/cerberusweb.core/templates/preferences/tabs/notifications/bulk.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="formBatchUpdate" name="formBatchUpdate" onsubmit="return false;">
 <input type="hidden" name="c" value="preferences">
 <input type="hidden" name="a" value="doNotificationsBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label>
 	{if !empty($ids)}
diff --git a/features/cerberusweb.core/templates/preferences/tabs/notifications/view.tpl b/features/cerberusweb.core/templates/preferences/tabs/notifications/view.tpl
index d95d24d60..2ce6f2335 100644
--- a/features/cerberusweb.core/templates/preferences/tabs/notifications/view.tpl
+++ b/features/cerberusweb.core/templates/preferences/tabs/notifications/view.tpl
@@ -23,10 +23,12 @@
 <form id="viewForm{$view->id}" name="viewForm{$view->id}" action="{devblocks_url}{/devblocks_url}" method="post">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="c" value="preferences">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="5" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/preferences/tabs/watcher/index.tpl b/features/cerberusweb.core/templates/preferences/tabs/watcher/index.tpl
index 064d257cc..e069595f8 100644
--- a/features/cerberusweb.core/templates/preferences/tabs/watcher/index.tpl
+++ b/features/cerberusweb.core/templates/preferences/tabs/watcher/index.tpl
@@ -1,8 +1,9 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="frmWatcherPrefs">
 <input type="hidden" name="c" value="preferences">
 <input type="hidden" name="a" value="saveWatcherTab">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 <legend>If I'm watching something, send me a notification when these events happen:</legend>
 Select: 
 <a href="javascript:;" onclick="checkAll('frmWatcherPrefs',true);">{'common.all'|devblocks_translate|lower}</a>
diff --git a/features/cerberusweb.core/templates/search/quick_search.tpl b/features/cerberusweb.core/templates/search/quick_search.tpl
index e9b396145..d2f80f8b3 100644
--- a/features/cerberusweb.core/templates/search/quick_search.tpl
+++ b/features/cerberusweb.core/templates/search/quick_search.tpl
@@ -4,10 +4,11 @@
 
 <form action="javascript:;" method="post" id="{$uniqid}" class="quick-search">
 	<input type="hidden" name="c" value="search">
 	<input type="hidden" name="a" value="ajaxQuickSearch">
 	<input type="hidden" name="view_id" value="{$view->id}">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 	<div style="border:1px solid rgb(200,200,200);border-radius:10px;display:inline-block;">
 		<input type="text" name="query" class="input_search cerb-input-quicksearch" style="border:0;" size="50" value="{$quick_search_query}" autocomplete="off" spellcheck="false">
 		<a href="javascript:;" class="cerb-quick-search-menu-trigger" style="position:relative;top:5px;padding:0px 10px;"><span class="glyphicons glyphicons-chevron-down" style="margin:2px 0px 0px 2px;"></span></a>
 	</div>
diff --git a/features/cerberusweb.core/templates/tasks/rpc/bulk.tpl b/features/cerberusweb.core/templates/tasks/rpc/bulk.tpl
index 5f9c94297..604966060 100644
--- a/features/cerberusweb.core/templates/tasks/rpc/bulk.tpl
+++ b/features/cerberusweb.core/templates/tasks/rpc/bulk.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="formBatchUpdate" name="formBatchUpdate" onsubmit="return false;">
 <input type="hidden" name="c" value="tasks">
 <input type="hidden" name="a" value="doTaskBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
 	{if !empty($ids)}
diff --git a/features/cerberusweb.core/templates/tasks/rpc/peek.tpl b/features/cerberusweb.core/templates/tasks/rpc/peek.tpl
index 5693b3004..96e1b642f 100644
--- a/features/cerberusweb.core/templates/tasks/rpc/peek.tpl
+++ b/features/cerberusweb.core/templates/tasks/rpc/peek.tpl
@@ -6,10 +6,11 @@
 {if !empty($link_context)}
 <input type="hidden" name="link_context" value="{$link_context}">
 <input type="hidden" name="link_context_id" value="{$link_context_id}">
 {/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate}</legend>
 	
 	<table cellpadding="0" cellspacing="2" border="0" width="98%">
diff --git a/features/cerberusweb.core/templates/tasks/view.tpl b/features/cerberusweb.core/templates/tasks/view.tpl
index a52981e23..374ee2dee 100644
--- a/features/cerberusweb.core/templates/tasks/view.tpl
+++ b/features/cerberusweb.core/templates/tasks/view.tpl
@@ -29,10 +29,12 @@
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="context_id" value="{$view_context}">
 <input type="hidden" name="c" value="tasks">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.core/templates/tickets/ajax/merge_confirm.tpl b/features/cerberusweb.core/templates/tickets/ajax/merge_confirm.tpl
index a75d58e1c..8966beae8 100644
--- a/features/cerberusweb.core/templates/tickets/ajax/merge_confirm.tpl
+++ b/features/cerberusweb.core/templates/tickets/ajax/merge_confirm.tpl
@@ -1,9 +1,10 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST">
 <input type="hidden" name="c" value="tickets">
 <input type="hidden" name="a" value="viewMergeTickets">
 <input type="hidden" name="view_id" value="{$view_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>Are you sure you want to merge these tickets?</legend>
 	
 	The selected tickets will be merged into a single ticket. 
diff --git a/features/cerberusweb.core/templates/tickets/peek.tpl b/features/cerberusweb.core/templates/tickets/peek.tpl
index 96b67ea9c..fa8e53cab 100644
--- a/features/cerberusweb.core/templates/tickets/peek.tpl
+++ b/features/cerberusweb.core/templates/tickets/peek.tpl
@@ -7,10 +7,11 @@
 <input type="hidden" name="id" value="{$ticket->id}">
 {if !empty($link_context)}
 <input type="hidden" name="link_context" value="{$link_context}">
 <input type="hidden" name="link_context_id" value="{$link_context_id}">
 {/if}
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 {if !$edit_mode && !empty($message)}
 <div id="ticketPeekMessage" style="margin-bottom:10px;">
 		{assign var=headers value=$message->getHeaders()}
 		{if !empty($headers.to)}<b>{'message.header.to'|devblocks_translate|capitalize}:</b> {$headers.to|truncate:255}<br>{/if}
diff --git a/features/cerberusweb.core/templates/tickets/rpc/bulk.tpl b/features/cerberusweb.core/templates/tickets/rpc/bulk.tpl
index 9249f5dc4..110bba2a4 100644
--- a/features/cerberusweb.core/templates/tickets/rpc/bulk.tpl
+++ b/features/cerberusweb.core/templates/tickets/rpc/bulk.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="formBatchUpdate" name="formBatchUpdate" onsubmit="return false;">
 <input type="hidden" name="c" value="tickets">
 <input type="hidden" name="a" value="doBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" onclick="toggleDiv('categoryFilterPanelSender','none');toggleDiv('categoryFilterPanelSubject','none');" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
 	{if !empty($ids)}
diff --git a/features/cerberusweb.core/templates/tickets/rpc/ticket_view_assist.tpl b/features/cerberusweb.core/templates/tickets/rpc/ticket_view_assist.tpl
index 8d446edba..8eb47e18a 100644
--- a/features/cerberusweb.core/templates/tickets/rpc/ticket_view_assist.tpl
+++ b/features/cerberusweb.core/templates/tickets/rpc/ticket_view_assist.tpl
@@ -1,9 +1,10 @@
 <form action="{devblocks_url}{/devblocks_url}" method="post" id="viewAssist{$view_id}">
 <input type="hidden" name="c" value="tickets">
 <input type="hidden" name="a" value="viewAutoAssist">
 <input type="hidden" name="view_id" value="{$view_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 Sort biggest piles by: 
 <label><input type="radio" name="mode" value="subjects" {if $mode!="subjects"}onclick="genericAjaxGet('{$view_id}_tips','c=tickets&a=showViewAutoAssist&view_id={$view_id}&mode=subjects');"{/if} {if $mode=="subjects"}checked{/if}>Subject Similarity</label>
 <label><input type="radio" name="mode" value="senders" {if $mode!="senders"}onclick="genericAjaxGet('{$view_id}_tips','c=tickets&a=showViewAutoAssist&view_id={$view_id}&mode=senders');"{/if} {if $mode=="senders"}checked{/if}>Senders</label>
 <label><input type="radio" name="mode" value="headers" onclick="genericAjaxGet('{$view_id}_tips','c=tickets&a=showViewAutoAssist&view_id={$view_id}&mode=headers');" {if $mode=="headers"}checked{/if}>Headers</label>
diff --git a/features/cerberusweb.core/templates/tickets/rpc/ticket_view_assist_headers.tpl b/features/cerberusweb.core/templates/tickets/rpc/ticket_view_assist_headers.tpl
index 673abf7a9..fc228a438 100644
--- a/features/cerberusweb.core/templates/tickets/rpc/ticket_view_assist_headers.tpl
+++ b/features/cerberusweb.core/templates/tickets/rpc/ticket_view_assist_headers.tpl
@@ -1,9 +1,10 @@
 <form action="{devblocks_url}{/devblocks_url}" method="post">
 <input type="hidden" name="c" value="tickets">
 <input type="hidden" name="a" value="viewAutoAssist">
 <input type="hidden" name="view_id" value="{$view_id}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 Sort biggest piles by: 
 <label><input type="radio" name="mode" value="subjects" {if $mode!="subjects"}onclick="genericAjaxGet('{$view_id}_tips','c=tickets&a=showViewAutoAssist&view_id={$view_id}&mode=subjects');"{/if} {if $mode=="subjects"}checked{/if}>Subject Similarity</label>
 <label><input type="radio" name="mode" value="senders" {if $mode!="senders"}onclick="genericAjaxGet('{$view_id}_tips','c=tickets&a=showViewAutoAssist&view_id={$view_id}&mode=senders');"{/if} {if $mode=="senders"}checked{/if}>Senders</label>
 <label><input type="radio" name="mode" value="headers" {if $mode!="headers"}onclick="genericAjaxGet('{$view_id}_tips','c=tickets&a=showViewAutoAssist&view_id={$view_id}&mode=headers');"{/if} {if $mode=="headers"}checked{/if}>Headers</label>
diff --git a/features/cerberusweb.core/templates/tickets/view.tpl b/features/cerberusweb.core/templates/tickets/view.tpl
index 118899b88..b3f0562bf 100644
--- a/features/cerberusweb.core/templates/tickets/view.tpl
+++ b/features/cerberusweb.core/templates/tickets/view.tpl
@@ -33,10 +33,12 @@
 <input type="hidden" name="context_id" value="{$view_context}">
 <input type="hidden" name="c" value="tickets">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="id" value="{$view->id}">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 	{* Column Headers *}
 	<thead>
 	<tr>
 		{if !$view->options.disable_recommendations}
diff --git a/features/cerberusweb.core/templates/workers/view.tpl b/features/cerberusweb.core/templates/workers/view.tpl
index 586d5305b..b4b03e14f 100644
--- a/features/cerberusweb.core/templates/workers/view.tpl
+++ b/features/cerberusweb.core/templates/workers/view.tpl
@@ -30,10 +30,12 @@
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="worker">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="2" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.crm/templates/crm/opps/bulk.tpl b/features/cerberusweb.crm/templates/crm/opps/bulk.tpl
index 24485981e..3c2cccf26 100644
--- a/features/cerberusweb.crm/templates/crm/opps/bulk.tpl
+++ b/features/cerberusweb.crm/templates/crm/opps/bulk.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="formBatchUpdate" name="formBatchUpdate" onsubmit="return false;">
 <input type="hidden" name="c" value="crm">
 <input type="hidden" name="a" value="doOppBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="opp_ids" value="{$opp_ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($opp_ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
 	{if !empty($opp_ids)}
diff --git a/features/cerberusweb.crm/templates/crm/opps/peek.tpl b/features/cerberusweb.crm/templates/crm/opps/peek.tpl
index d2c704ee3..e399e5f1f 100644
--- a/features/cerberusweb.crm/templates/crm/opps/peek.tpl
+++ b/features/cerberusweb.crm/templates/crm/opps/peek.tpl
@@ -6,10 +6,11 @@
 {if !empty($link_context)}
 <input type="hidden" name="link_context" value="{$link_context}">
 <input type="hidden" name="link_context_id" value="{$link_context_id}">
 {/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate}</legend>
 	
 	<table cellpadding="0" cellspacing="2" border="0" width="98%">
diff --git a/features/cerberusweb.crm/templates/crm/opps/view.tpl b/features/cerberusweb.crm/templates/crm/opps/view.tpl
index f4bc9837a..92afd26db 100644
--- a/features/cerberusweb.crm/templates/crm/opps/view.tpl
+++ b/features/cerberusweb.crm/templates/crm/opps/view.tpl
@@ -30,10 +30,12 @@
 <input type="hidden" name="context_id" value="{$view_context}">
 <input type="hidden" name="id" value="{$view->id}">
 <input type="hidden" name="c" value="crm">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.feedback/templates/feedback/ajax/peek.tpl b/features/cerberusweb.feedback/templates/feedback/ajax/peek.tpl
index aea7f43f7..c35ab6176 100644
--- a/features/cerberusweb.feedback/templates/feedback/ajax/peek.tpl
+++ b/features/cerberusweb.feedback/templates/feedback/ajax/peek.tpl
@@ -5,10 +5,11 @@
 {if !empty($link_context)}
 <input type="hidden" name="link_context" value="{$link_context}">
 <input type="hidden" name="link_context_id" value="{$link_context_id}">
 {/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>Properties</legend>
 	
 	<b>{'feedback_entry.quote_address'|devblocks_translate|capitalize}:</b> ({'feedback.peek.quote.tooltip'|devblocks_translate})<br>
diff --git a/features/cerberusweb.feedback/templates/feedback/bulk.tpl b/features/cerberusweb.feedback/templates/feedback/bulk.tpl
index 3110405c3..68a036696 100644
--- a/features/cerberusweb.feedback/templates/feedback/bulk.tpl
+++ b/features/cerberusweb.feedback/templates/feedback/bulk.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="formBatchUpdate" name="formBatchUpdate" onsubmit="return false;">
 <input type="hidden" name="c" value="feedback">
 <input type="hidden" name="a" value="doBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
 	{if !empty($ids)}
diff --git a/features/cerberusweb.feedback/templates/feedback/view.tpl b/features/cerberusweb.feedback/templates/feedback/view.tpl
index e08c1bf02..cff69c7bf 100644
--- a/features/cerberusweb.feedback/templates/feedback/view.tpl
+++ b/features/cerberusweb.feedback/templates/feedback/view.tpl
@@ -23,10 +23,11 @@
 <form id="customize{$view->id}" name="customize{$view->id}" action="#" onsubmit="return false;" style="display:none;"></form>
 <form id="viewForm{$view->id}" name="viewForm{$view->id}" action="#">
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="c" value="feedback">
 <input type="hidden" name="a" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
diff --git a/features/cerberusweb.kb/templates/kb/ajax/category_edit_panel.tpl b/features/cerberusweb.kb/templates/kb/ajax/category_edit_panel.tpl
index 86a3e20e5..f0ad2dd79 100644
--- a/features/cerberusweb.kb/templates/kb/ajax/category_edit_panel.tpl
+++ b/features/cerberusweb.kb/templates/kb/ajax/category_edit_panel.tpl
@@ -1,10 +1,11 @@
 <form action="javascript:;" method="POST" id="frmKbCategoryEdit" onsubmit="return false;">
 <input type="hidden" name="c" value="kb.ajax">
 <input type="hidden" name="a" value="saveKbCategoryEditPanelJson">
 <input type="hidden" name="id" value="{$category->id}">
 <input type="hidden" name="delete_box" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Name:</b><br>
 <input type="text" name="name" value="{$category->name}" style="width:99%;border:solid 1px rgb(180,180,180);"><br>
 <br>
 
diff --git a/features/cerberusweb.kb/templates/kb/bulk.tpl b/features/cerberusweb.kb/templates/kb/bulk.tpl
index a17890349..d9f21b6f9 100644
--- a/features/cerberusweb.kb/templates/kb/bulk.tpl
+++ b/features/cerberusweb.kb/templates/kb/bulk.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="formBatchUpdate" name="formBatchUpdate" onsubmit="return false;">
 <input type="hidden" name="c" value="kb.ajax">
 <input type="hidden" name="a" value="doArticlesBulkUpdate">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
  	{if !empty($ids)}
diff --git a/features/cerberusweb.kb/templates/kb/peek_edit.tpl b/features/cerberusweb.kb/templates/kb/peek_edit.tpl
index 3b9b40567..6fca13fec 100644
--- a/features/cerberusweb.kb/templates/kb/peek_edit.tpl
+++ b/features/cerberusweb.kb/templates/kb/peek_edit.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="c" value="kb.ajax">
 <input type="hidden" name="a" value="saveArticleEditPanel">
 <input type="hidden" name="id" value="{$article->id}">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <div id="kbArticleTabs">
 	<ul>
 		<li><a href="#kbArticleEditor">Editor</a></li>
 		<li><a href="#kbArticleProperties">{'common.properties'|devblocks_translate|capitalize}</a></li>
diff --git a/features/cerberusweb.kb/templates/kb/peek_readonly.tpl b/features/cerberusweb.kb/templates/kb/peek_readonly.tpl
index 24bd6bdbd..efaadb93a 100644
--- a/features/cerberusweb.kb/templates/kb/peek_readonly.tpl
+++ b/features/cerberusweb.kb/templates/kb/peek_readonly.tpl
@@ -1,6 +1,7 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <iframe src="{$smarty.const.DEVBLOCKS_WEBPATH}ajax.php?c=kb.ajax&a=getArticleContent&id={$article->id}" style="margin:5px 0px 5px 5px;height:400px;width:98%;border:1px solid rgb(200,200,200);" frameborder="0"></iframe>
 <br>
 {include file="devblocks:cerberusweb.core::internal/attachments/list.tpl" context={CerberusContexts::CONTEXT_KB_ARTICLE} context_id={$article->id}}
 
diff --git a/features/cerberusweb.kb/templates/kb/tabs/articles/index.tpl b/features/cerberusweb.kb/templates/kb/tabs/articles/index.tpl
index a71a0ed85..2577906ee 100644
--- a/features/cerberusweb.kb/templates/kb/tabs/articles/index.tpl
+++ b/features/cerberusweb.kb/templates/kb/tabs/articles/index.tpl
@@ -1,10 +1,11 @@
 <div style="margin-top:5px;" id="divKbTab{$tab->id}">
 
 <form id="frmKbBrowseTab{$tab->id}" enctype="multipart/form-data" method="post" action="{devblocks_url}{/devblocks_url}">
 	<input type="hidden" name="c" value="kb.ajax">
 	<input type="hidden" name="a" value="">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 	{if $active_worker->hasPriv('core.kb.categories.modify')}
 		{$parent_id = 0}
 		{if $root_id}
 			{assign var=parent_id value=$categories.$root_id->parent_id}
diff --git a/features/cerberusweb.kb/templates/kb/view.tpl b/features/cerberusweb.kb/templates/kb/view.tpl
index 3364dc06d..8423a5737 100644
--- a/features/cerberusweb.kb/templates/kb/view.tpl
+++ b/features/cerberusweb.kb/templates/kb/view.tpl
@@ -29,10 +29,12 @@
 <input type="hidden" name="context_id" value="{$view_context}">
 <input type="hidden" name="c" value="kb">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="return" value="{$response_uri}">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.reports/templates/reports/custom_fields/usage/index.tpl b/features/cerberusweb.reports/templates/reports/custom_fields/usage/index.tpl
index 1d19623a9..85266d183 100644
--- a/features/cerberusweb.reports/templates/reports/custom_fields/usage/index.tpl
+++ b/features/cerberusweb.reports/templates/reports/custom_fields/usage/index.tpl
@@ -1,9 +1,10 @@
 <fieldset class="peek" style="margin-bottom:0;">
 <legend>{'reports.ui.custom_fields.usage'|devblocks_translate}</legend>
 
 <form action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=report.custom_fields.usage{/devblocks_url}" method="POST" id="frmRange" name="frmRange">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Custom Field:</b>
 
 <select name="field_id" onchange="this.form.btnSubmit.click();">
 	{foreach from=$context_manifests item=mft}
diff --git a/features/cerberusweb.reports/templates/reports/group/group_replies/index.tpl b/features/cerberusweb.reports/templates/reports/group/group_replies/index.tpl
index 1c76d3a1c..755ee4e0a 100644
--- a/features/cerberusweb.reports/templates/reports/group/group_replies/index.tpl
+++ b/features/cerberusweb.reports/templates/reports/group/group_replies/index.tpl
@@ -1,10 +1,11 @@
 <fieldset class="peek">
 <legend>{'reports.ui.group.replies'|devblocks_translate}</legend>
 
 <form action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=report.groups.group_replies{/devblocks_url}" method="POST" id="frmRange" name="frmRange">
 <input type="hidden" name="c" value="reports">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 <b>{'reports.ui.date_from'|devblocks_translate}</b> <input type="text" name="start" id="start" size="24" value="{$start}"><button type="button" onclick="devblocksAjaxDateChooser('#start','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>{'reports.ui.date_to'|devblocks_translate}</b> <input type="text" name="end" id="end" size="24" value="{$end}"><button type="button" onclick="devblocksAjaxDateChooser('#end','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>Grouping:</b> <select name="report_date_grouping">
 	<option value="">-auto-</option>
 	<option value="year" {if 'year'==$report_date_grouping}selected="selected"{/if}>Years</option>
diff --git a/features/cerberusweb.reports/templates/reports/snippets/snippet_popularity/index.tpl b/features/cerberusweb.reports/templates/reports/snippets/snippet_popularity/index.tpl
index 4e760502c..718b5c0f4 100644
--- a/features/cerberusweb.reports/templates/reports/snippets/snippet_popularity/index.tpl
+++ b/features/cerberusweb.reports/templates/reports/snippets/snippet_popularity/index.tpl
@@ -1,10 +1,11 @@
 <fieldset class="peek">
 <legend>{'reports.ui.snippets.popularity'|devblocks_translate}</legend>
 
 <form action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=report.snippets.popularity{/devblocks_url}" method="POST" id="frmRange">
 <input type="hidden" name="c" value="reports">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 <b>{'reports.ui.date_from'|devblocks_translate}</b> <input type="text" name="start" id="start" size="24" value="{$start}"><button type="button" onclick="devblocksAjaxDateChooser('#start','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>{'reports.ui.date_to'|devblocks_translate}</b> <input type="text" name="end" id="end" size="24" value="{$end}"><button type="button" onclick="devblocksAjaxDateChooser('#end','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 
 {$limits = [25,50,100,250,500,1000]}
 <b>Limit:</b> 
diff --git a/features/cerberusweb.reports/templates/reports/ticket/closed_tickets/index.tpl b/features/cerberusweb.reports/templates/reports/ticket/closed_tickets/index.tpl
index 4f4eb73da..c4875c305 100644
--- a/features/cerberusweb.reports/templates/reports/ticket/closed_tickets/index.tpl
+++ b/features/cerberusweb.reports/templates/reports/ticket/closed_tickets/index.tpl
@@ -1,10 +1,11 @@
 <fieldset class="peek">
 <legend>{'reports.ui.ticket.closed'|devblocks_translate}</legend>
 
 <form action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=report.tickets.closed_tickets{/devblocks_url}" method="POST" id="frmRange" name="frmRange">
 <input type="hidden" name="c" value="reports">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 <b>{'reports.ui.date_from'|devblocks_translate}</b> <input type="text" name="start" id="start" size="24" value="{$start}"><button type="button" onclick="devblocksAjaxDateChooser('#start','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>{'reports.ui.date_to'|devblocks_translate}</b> <input type="text" name="end" id="end" size="24" value="{$end}"><button type="button" onclick="devblocksAjaxDateChooser('#end','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>Grouping:</b> <select name="report_date_grouping">
 	<option value="">-auto-</option>
 	<option value="year" {if 'year'==$report_date_grouping}selected="selected"{/if}>Years</option>
diff --git a/features/cerberusweb.reports/templates/reports/ticket/new_tickets/index.tpl b/features/cerberusweb.reports/templates/reports/ticket/new_tickets/index.tpl
index b10104d97..31b3bd3cc 100644
--- a/features/cerberusweb.reports/templates/reports/ticket/new_tickets/index.tpl
+++ b/features/cerberusweb.reports/templates/reports/ticket/new_tickets/index.tpl
@@ -1,10 +1,11 @@
 <fieldset class="peek">
 <legend>{'reports.ui.ticket.new_tickets'|devblocks_translate}</legend>
 
 <form action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=report.tickets.new_tickets{/devblocks_url}" method="POST" id="frmRange">
 <input type="hidden" name="c" value="reports">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 <b>{'reports.ui.date_from'|devblocks_translate}</b> <input type="text" name="start" id="start" size="24" value="{$start}"><button type="button" onclick="devblocksAjaxDateChooser('#start','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>{'reports.ui.date_to'|devblocks_translate}</b> <input type="text" name="end" id="end" size="24" value="{$end}"><button type="button" onclick="devblocksAjaxDateChooser('#end','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>Grouping:</b> <select name="report_date_grouping">
 	<option value="">-auto-</option>
 	<option value="year" {if 'year'==$report_date_grouping}selected="selected"{/if}>Years</option>
diff --git a/features/cerberusweb.reports/templates/reports/ticket/top_contacts_tickets/index.tpl b/features/cerberusweb.reports/templates/reports/ticket/top_contacts_tickets/index.tpl
index e29e60273..05af9d479 100644
--- a/features/cerberusweb.reports/templates/reports/ticket/top_contacts_tickets/index.tpl
+++ b/features/cerberusweb.reports/templates/reports/ticket/top_contacts_tickets/index.tpl
@@ -1,9 +1,10 @@
 <fieldset class="peek">
 <legend>{'reports.ui.ticket.top_contacts'|devblocks_translate}</legend>
 
 <form action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=report.tickets.top_contacts{/devblocks_url}" method="POST" id="frmRange" name="frmRange">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 {'reports.ui.date_from'|devblocks_translate} <input type="text" name="start" id="start" size="24" value="{$start}"><button type="button" onclick="devblocksAjaxDateChooser('#start','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 {'reports.ui.date_to'|devblocks_translate} <input type="text" name="end" id="end" size="24" value="{$end}"><button type="button" onclick="devblocksAjaxDateChooser('#end','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <div id="divCal"></div>
 
 {'reports.ui.date_past'|devblocks_translate} <a href="javascript:;" onclick="$('#start').val('-1 year');$('#end').val('now');$('#btnSubmit').click();">{'reports.ui.filters.1_year'|devblocks_translate|lower}</a>
diff --git a/features/cerberusweb.reports/templates/reports/va/va_usage/index.tpl b/features/cerberusweb.reports/templates/reports/va/va_usage/index.tpl
index d93d3f4f3..1ab09f183 100644
--- a/features/cerberusweb.reports/templates/reports/va/va_usage/index.tpl
+++ b/features/cerberusweb.reports/templates/reports/va/va_usage/index.tpl
@@ -1,10 +1,11 @@
 <fieldset class="peek">
 <legend>{'reports.ui.virtual_attendant.usage'|devblocks_translate}</legend>
 
 <form action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=report.virtual_attendants.usage{/devblocks_url}" method="POST" id="frmRange">
 <input type="hidden" name="c" value="reports">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 <b>{'reports.ui.date_from'|devblocks_translate}</b> <input type="text" name="start" id="start" size="24" value="{$start}"><button type="button" onclick="devblocksAjaxDateChooser('#start','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>{'reports.ui.date_to'|devblocks_translate}</b> <input type="text" name="end" id="end" size="24" value="{$end}"><button type="button" onclick="devblocksAjaxDateChooser('#end','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 
 <b>Sort by:</b> 
 <select name="sort_by">
diff --git a/features/cerberusweb.reports/templates/reports/worker/average_response_time/index.tpl b/features/cerberusweb.reports/templates/reports/worker/average_response_time/index.tpl
index c8c64a68d..604a5a9a6 100644
--- a/features/cerberusweb.reports/templates/reports/worker/average_response_time/index.tpl
+++ b/features/cerberusweb.reports/templates/reports/worker/average_response_time/index.tpl
@@ -3,10 +3,11 @@
 
 <b>{'reports.ui.worker.response_time.date_range'|devblocks_translate}</b>
 {if $invalidDate}<font color="red"><b>{'reports.ui.invalid_date'|devblocks_translate}</b></font>{/if}
 
 <form action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=report.workers.averageresponsetime{/devblocks_url}" method="POST" id="frmRange" name="frmRange">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 <input type="text" name="start" id="start" size="24" value="{$start}"><button type="button" onclick="devblocksAjaxDateChooser('#start','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <input type="text" name="end" id="end" size="24" value="{$end}"><button type="button" onclick="devblocksAjaxDateChooser('#end','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 
 <div id="divCal"></div>
 
diff --git a/features/cerberusweb.reports/templates/reports/worker/worker_history/index.tpl b/features/cerberusweb.reports/templates/reports/worker/worker_history/index.tpl
index b3b2bb076..edeb2c33f 100644
--- a/features/cerberusweb.reports/templates/reports/worker/worker_history/index.tpl
+++ b/features/cerberusweb.reports/templates/reports/worker/worker_history/index.tpl
@@ -1,9 +1,10 @@
 <fieldset class="peek">
 <legend>{'reports.ui.worker.worker_history'|devblocks_translate}</legend>
 
 <form action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=report.workers.worker_history{/devblocks_url}" method="POST" id="frmRange" name="frmRange">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 <b>{'reports.ui.date_from'|devblocks_translate}</b> <input type="text" name="start" id="start" size="24" value="{$start}"><button type="button" onclick="devblocksAjaxDateChooser('#start','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>{'reports.ui.date_to'|devblocks_translate}</b> <input type="text" name="end" id="end" size="24" value="{$end}"><button type="button" onclick="devblocksAjaxDateChooser('#end','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>Grouping:</b> <select name="report_date_grouping">
 	<option value="">-auto-</option>
 	<option value="year" {if 'year'==$report_date_grouping}selected="selected"{/if}>Years</option>
diff --git a/features/cerberusweb.restapi/templates/peek.tpl b/features/cerberusweb.restapi/templates/peek.tpl
index aa8e57a9c..039953ed3 100644
--- a/features/cerberusweb.restapi/templates/peek.tpl
+++ b/features/cerberusweb.restapi/templates/peek.tpl
@@ -3,10 +3,11 @@
 <input type="hidden" name="a" value="handleTabAction">
 <input type="hidden" name="tab" value="rest.preferences.tab.api">
 <input type="hidden" name="action" value="savePeekPopup">
 <input type="hidden" name="id" value="{$model->id|default:'0'}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate}</legend>
 	
 	<table cellpadding="0" cellspacing="5" border="0" width="98%">
diff --git a/features/cerberusweb.restapi/templates/view.tpl b/features/cerberusweb.restapi/templates/view.tpl
index 657f21872..8e87ec24b 100644
--- a/features/cerberusweb.restapi/templates/view.tpl
+++ b/features/cerberusweb.restapi/templates/view.tpl
@@ -24,10 +24,12 @@
 <input type="hidden" name="context_id" value="{$view_context}">
 <input type="hidden" name="id" value="{$view->id}">
 <input type="hidden" name="c" value="rest">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="5" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/features/cerberusweb.simulator/templates/setup/section.tpl b/features/cerberusweb.simulator/templates/setup/section.tpl
index d5c5ee0d6..75c9ee180 100644
--- a/features/cerberusweb.simulator/templates/setup/section.tpl
+++ b/features/cerberusweb.simulator/templates/setup/section.tpl
@@ -6,10 +6,11 @@
 	<form method="post" action="{devblocks_url}{/devblocks_url}" id="simulatorMailForm">
 	<input type="hidden" name="c" value="config">
 	<input type="hidden" name="a" value="handleSectionAction">
 	<input type="hidden" name="section" value="simulator">
 	<input type="hidden" name="action" value="generateTicketsJson">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 	
 	<table cellpadding="5" cellspacing="0" border="0">
 		<tr>
 			<td>
 				<b>{'simulator.ui.cfg.to_address'|devblocks_translate}</b><br>
@@ -59,10 +60,11 @@
 	<form method="post" action="{devblocks_url}{/devblocks_url}" id="simulatorTaskForm">
 	<input type="hidden" name="c" value="config">
 	<input type="hidden" name="a" value="handleSectionAction">
 	<input type="hidden" name="section" value="simulator">
 	<input type="hidden" name="action" value="generateTasksJson">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 	
 	<table cellpadding="5" cellspacing="0" border="0">
 		<tr>
 			{*
 			<td>
@@ -114,10 +116,11 @@
 	<form method="post" action="{devblocks_url}{/devblocks_url}" id="simulatorOrgForm">
 	<input type="hidden" name="c" value="config">
 	<input type="hidden" name="a" value="handleSectionAction">
 	<input type="hidden" name="section" value="simulator">
 	<input type="hidden" name="action" value="generateOrgsJson">
+	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 	
 	<table cellpadding="5" cellspacing="0" border="0">
 		<tr>
 			{*
 			<td>
diff --git a/features/cerberusweb.timetracking/templates/config/activities/edit_activity.tpl b/features/cerberusweb.timetracking/templates/config/activities/edit_activity.tpl
index e916ee546..a493ecc56 100644
--- a/features/cerberusweb.timetracking/templates/config/activities/edit_activity.tpl
+++ b/features/cerberusweb.timetracking/templates/config/activities/edit_activity.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="timetracking">
 <input type="hidden" name="action" value="save">
 <input type="hidden" name="id" value="{if !empty($activity->id)}{$activity->id}{else}0{/if}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>
 		{if empty($activity->id)}
 		{'timetracking.ui.cfg.add_activity'|devblocks_translate}
diff --git a/features/cerberusweb.timetracking/templates/config/activities/index.tpl b/features/cerberusweb.timetracking/templates/config/activities/index.tpl
index b8ffe953f..e8bcbd3e5 100644
--- a/features/cerberusweb.timetracking/templates/config/activities/index.tpl
+++ b/features/cerberusweb.timetracking/templates/config/activities/index.tpl
@@ -24,10 +24,11 @@
 			
 		</td>
 		
 		<td width="100%" valign="top">
 			<form action="{devblocks_url}{/devblocks_url}" method="post" id="configActivity">
+				<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 				{include file="devblocks:cerberusweb.timetracking::config/activities/edit_activity.tpl" activity=null}
 			</form>
 		</td>
 		
 	</tr>
diff --git a/features/cerberusweb.timetracking/templates/reports/time_spent_activity/index.tpl b/features/cerberusweb.timetracking/templates/reports/time_spent_activity/index.tpl
index 52369b5c5..92bf6551f 100644
--- a/features/cerberusweb.timetracking/templates/reports/time_spent_activity/index.tpl
+++ b/features/cerberusweb.timetracking/templates/reports/time_spent_activity/index.tpl
@@ -1,9 +1,10 @@
 <fieldset class="peek">
 <legend>{'timetracking.ui.reports.time_spent_activity'|devblocks_translate}</legend>
 
 <form action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=report.timetracking.timespentactivity{/devblocks_url}" method="POST" id="frmRange" name="frmRange">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 <b>{'timetracking.ui.reports.from'|devblocks_translate}</b> <input type="text" name="start" id="start" size="24" value="{$start}"><button type="button" onclick="devblocksAjaxDateChooser('#start','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>{'timetracking.ui.reports.to'|devblocks_translate}</b> <input type="text" name="end" id="end" size="24" value="{$end}"><button type="button" onclick="devblocksAjaxDateChooser('#end','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>Grouping:</b> <select name="report_date_grouping">
 	<option value="">-auto-</option>
 	<option value="year" {if 'year'==$report_date_grouping}selected="selected"{/if}>Years</option>
diff --git a/features/cerberusweb.timetracking/templates/reports/time_spent_org/index.tpl b/features/cerberusweb.timetracking/templates/reports/time_spent_org/index.tpl
index 181b0ebba..792be1e9b 100644
--- a/features/cerberusweb.timetracking/templates/reports/time_spent_org/index.tpl
+++ b/features/cerberusweb.timetracking/templates/reports/time_spent_org/index.tpl
@@ -1,9 +1,10 @@
 <fieldset class="peek">
 <legend>{'timetracking.ui.reports.time_spent_org'|devblocks_translate}</legend>
 
 <form action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=report.timetracking.timespentorg{/devblocks_url}" method="POST" id="frmRange" name="frmRange">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 <b>{'timetracking.ui.reports.from'|devblocks_translate}</b> <input type="text" name="start" id="start" size="24" value="{$start}"><button type="button" onclick="devblocksAjaxDateChooser('#start','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>{'timetracking.ui.reports.to'|devblocks_translate}</b> <input type="text" name="end" id="end" size="24" value="{$end}"><button type="button" onclick="devblocksAjaxDateChooser('#end','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>Grouping:</b> <select name="report_date_grouping">
 	<option value="">-auto-</option>
 	<option value="year" {if 'year'==$report_date_grouping}selected="selected"{/if}>Years</option>
diff --git a/features/cerberusweb.timetracking/templates/reports/time_spent_worker/index.tpl b/features/cerberusweb.timetracking/templates/reports/time_spent_worker/index.tpl
index a6edaf07a..0feb97314 100644
--- a/features/cerberusweb.timetracking/templates/reports/time_spent_worker/index.tpl
+++ b/features/cerberusweb.timetracking/templates/reports/time_spent_worker/index.tpl
@@ -1,9 +1,10 @@
 <fieldset class="peek">
 <legend>{'timetracking.ui.reports.time_spent_worker'|devblocks_translate}</legend>
 
 <form action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=report.timetracking.timespentworker{/devblocks_url}" method="POST" id="frmRange" name="frmRange">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 <b>{'timetracking.ui.reports.from'|devblocks_translate}</b> <input type="text" name="start" id="start" size="24" value="{$start}"><button type="button" onclick="devblocksAjaxDateChooser('#start','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>{'timetracking.ui.reports.to'|devblocks_translate}</b> <input type="text" name="end" id="end" size="24" value="{$end}"><button type="button" onclick="devblocksAjaxDateChooser('#end','#divCal');"><span class="glyphicons glyphicons-calendar"></span></button>
 <b>Grouping:</b> <select name="report_date_grouping">
 	<option value="">-auto-</option>
 	<option value="year" {if 'year'==$report_date_grouping}selected="selected"{/if}>Years</option>
diff --git a/features/cerberusweb.translators/templates/config/ajax/add_language_panel.tpl b/features/cerberusweb.translators/templates/config/ajax/add_language_panel.tpl
index 3c35449b5..4170fdfd5 100644
--- a/features/cerberusweb.translators/templates/config/ajax/add_language_panel.tpl
+++ b/features/cerberusweb.translators/templates/config/ajax/add_language_panel.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="post" id="frmAddLanguage">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="translations">
 <input type="hidden" name="action" value="saveAddLanguagePanel">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 {if is_array($codes) && count($codes) > 1}
 <table cellspacing="0" cellpadding="2" border="0">
 <tr>
 	<td><b>{'translators.language'|devblocks_translate|capitalize}</b></td>
diff --git a/features/cerberusweb.translators/templates/config/ajax/find_strings_panel.tpl b/features/cerberusweb.translators/templates/config/ajax/find_strings_panel.tpl
index 86d66c661..45766f3cc 100644
--- a/features/cerberusweb.translators/templates/config/ajax/find_strings_panel.tpl
+++ b/features/cerberusweb.translators/templates/config/ajax/find_strings_panel.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="post" id="frmFindStringsEntry">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="translations">
 <input type="hidden" name="action" value="saveFindStringsPanel">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 This will find text defined in U.S. English and not yet translated to other languages.  
 Leaving new text blank allows you to easily find translation work with a search.
 <br>
 <br>
diff --git a/features/cerberusweb.translators/templates/config/ajax/import_strings_panel.tpl b/features/cerberusweb.translators/templates/config/ajax/import_strings_panel.tpl
index 322a12f7d..cdd0304a8 100644
--- a/features/cerberusweb.translators/templates/config/ajax/import_strings_panel.tpl
+++ b/features/cerberusweb.translators/templates/config/ajax/import_strings_panel.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="post" id="frmFindStringsEntry" enctype="multipart/form-data">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="translations">
 <input type="hidden" name="action" value="saveImportStringsPanel">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <b>Language File:</b> (.xml; TMX)<br>
 <input type="file" name="import_file" size="45"><br>
 <br>
 
diff --git a/features/cerberusweb.translators/templates/config/section/view.tpl b/features/cerberusweb.translators/templates/config/section/view.tpl
index 1af5ec759..4a668f1af 100644
--- a/features/cerberusweb.translators/templates/config/section/view.tpl
+++ b/features/cerberusweb.translators/templates/config/section/view.tpl
@@ -21,10 +21,11 @@
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="c" value="config">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="translations">
 <input type="hidden" name="action" value="">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
diff --git a/install/extras/sdk/devblocks-dao.php b/install/extras/sdk/devblocks-dao.php
index ae1059868..6478c4f79 100644
--- a/install/extras/sdk/devblocks-dao.php
+++ b/install/extras/sdk/devblocks-dao.php
@@ -1273,10 +1273,11 @@ class Context_<?php echo $class_name;?> extends Extension_DevblocksContext imple
 <input type="hidden" name="section" value="<?php echo $table_name; ?>">
 <input type="hidden" name="action" value="savePeek">
 <input type="hidden" name="view_id" value="{$view_id}">
 {if !empty($model) && !empty($model->id)}<input type="hidden" name="id" value="{$model->id}">{/if}
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate}</legend>
 	
 	<table cellspacing="0" cellpadding="2" border="0" width="98%">
@@ -1426,10 +1427,12 @@ $field_prefix = strtolower(substr($table_name,0,1));
 <input type="hidden" name="c" value="profiles">
 <input type="hidden" name="a" value="handleSectionAction">
 <input type="hidden" name="section" value="<?php echo $table_name; ?>">
 <input type="hidden" name="action" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/install/extras/sdk/examples/example.object/templates/example_object/bulk.tpl b/install/extras/sdk/examples/example.object/templates/example_object/bulk.tpl
index 8781a1474..e4abebac3 100644
--- a/install/extras/sdk/examples/example.object/templates/example_object/bulk.tpl
+++ b/install/extras/sdk/examples/example.object/templates/example_object/bulk.tpl
@@ -1,10 +1,11 @@
 <form action="{devblocks_url}{/devblocks_url}" method="POST" id="formBatchUpdate" name="formBatchUpdate" onsubmit="return false;">
 <input type="hidden" name="c" value="example.objects">
 <input type="hidden" name="a" value="saveBulkUpdatePopup">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="ids" value="{$ids}">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset>
 	<legend>{'common.bulk_update.with'|devblocks_translate|capitalize}</legend>
 	<label><input type="radio" name="filter" value="" {if empty($ids)}checked{/if}> {'common.bulk_update.filter.all'|devblocks_translate}</label> 
  	{if !empty($ids)}
diff --git a/install/extras/sdk/examples/example.object/templates/example_object/peek.tpl b/install/extras/sdk/examples/example.object/templates/example_object/peek.tpl
index 37d66d7e0..57ca383a0 100644
--- a/install/extras/sdk/examples/example.object/templates/example_object/peek.tpl
+++ b/install/extras/sdk/examples/example.object/templates/example_object/peek.tpl
@@ -2,10 +2,11 @@
 <input type="hidden" name="c" value="example.objects">
 <input type="hidden" name="a" value="saveEntryPopup">
 <input type="hidden" name="id" value="{$model->id}">
 <input type="hidden" name="view_id" value="{$view_id}">
 <input type="hidden" name="do_delete" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 
 <fieldset class="peek">
 	<legend>{'common.properties'|devblocks_translate|capitalize}</legend>
 	
 	<table cellspacing="0" cellpadding="2" border="0" width="98%">
diff --git a/install/extras/sdk/examples/example.object/templates/example_object/view.tpl b/install/extras/sdk/examples/example.object/templates/example_object/view.tpl
index 5676c91d8..fc50eab47 100644
--- a/install/extras/sdk/examples/example.object/templates/example_object/view.tpl
+++ b/install/extras/sdk/examples/example.object/templates/example_object/view.tpl
@@ -26,10 +26,12 @@
 <input type="hidden" name="view_id" value="{$view->id}">
 <input type="hidden" name="context_id" value="{$view_context}">
 <input type="hidden" name="c" value="example.objects">
 <input type="hidden" name="a" value="">
 <input type="hidden" name="explore_from" value="0">
+<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
+
 <table cellpadding="1" cellspacing="0" border="0" width="100%" class="worklistBody">
 
 	{* Column Headers *}
 	<thead>
 	<tr>
diff --git a/install/extras/sdk/examples/example.report/templates/reports/example.tpl b/install/extras/sdk/examples/example.report/templates/reports/example.tpl
index 605d3413c..7de2bc4f7 100644
--- a/install/extras/sdk/examples/example.report/templates/reports/example.tpl
+++ b/install/extras/sdk/examples/example.report/templates/reports/example.tpl
@@ -1,9 +1,10 @@
 <fieldset class="peek" style="background:none;">
 	<legend>{'example.report'|devblocks_translate|capitalize}</legend>
 
 	<form id="frmExampleReport" action="{devblocks_url}c=pages&page={$page->id}-{$page->name|devblocks_permalink}&report=example.report{/devblocks_url}" method="POST">
+		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
 		&nbsp; 
 		Tickets created between: 
 		<input type="text" name="date_from" size="24" value="{$date_from}">
 		 and 
 		<input type="text" name="date_to" size="24" value="{$date_to}">
diff --git a/libs/devblocks/api/Engine.php b/libs/devblocks/api/Engine.php
index 6eb095b6b..9dd8bcf57 100644
--- a/libs/devblocks/api/Engine.php
+++ b/libs/devblocks/api/Engine.php
@@ -572,11 +572,15 @@ abstract class DevblocksEngine {
 
 			default:
 				break;
 		}
 
-		$request = new DevblocksHttpRequest($parts,$queryArgs);
+		$method = strtoupper(@$_SERVER['REQUEST_METHOD']);
+		
+		$request = new DevblocksHttpRequest($parts,$queryArgs,$method);
+		$request->csrf_token = isset($_SERVER['HTTP_X_CSRF_TOKEN']) ? $_SERVER['HTTP_X_CSRF_TOKEN'] : @$_REQUEST['_csrf_token'];
+		
 		DevblocksPlatform::setHttpRequest($request);
 
 		return $request;
 	}
 
@@ -586,10 +590,32 @@ abstract class DevblocksEngine {
 	 * @param DevblocksHttpRequest $request
 	 * @param boolean $is_ajax
 	 */
 	static function processRequest(DevblocksHttpRequest $request, $is_ajax=false) {
 		$path = $request->path;
+		
+		// Security: CSRF
+		
+		// If we are running a controller action...
+		if(isset($_REQUEST['c']) || isset($_REQUEST['a'])) {
+			
+			// ...and we're not in DEVELOPMENT_MODE
+			if(!DEVELOPMENT_MODE_ALLOW_CSRF) {
+			
+				// ...and the CSRF token is invalid for this session, freak out
+				if(!isset($_SESSION['csrf_token']) || $_SESSION['csrf_token'] != $request->csrf_token) {
+					header("Status: 403");
+					@$referer = $_SERVER['HTTP_REFERER'];
+					@$remote_addr = $_SERVER['REMOTE_ADDR'];
+					
+					error_log(sprintf("[Cerb/Security] Possible CSRF attack from IP %s using referrer %s", $remote_addr, $referer), E_USER_WARNING);
+					die("Access denied");
+				}
+			}
+		}
+
+		// Controllers
 
 		$controller_uri = array_shift($path);
 
 		// [JAS]: Offer the platform a chance to intercept.
 		switch($controller_uri) {
diff --git a/libs/devblocks/api/Extension.php b/libs/devblocks/api/Extension.php
index c91fdef58..0cde81728 100644
--- a/libs/devblocks/api/Extension.php
+++ b/libs/devblocks/api/Extension.php
@@ -2032,15 +2032,19 @@ interface DevblocksHttpRequestHandler {
 	public function handleRequest(DevblocksHttpRequest $request);
 	public function writeResponse(DevblocksHttpResponse $response);
 };
 
 class DevblocksHttpRequest extends DevblocksHttpIO {
+	public $method = null;
+	public $csrf_token = null;
+	
 	/**
 	 * @param array $path
 	 */
-	function __construct($path, $query=array()) {
+	function __construct($path, $query=array(), $method=null) {
 		parent::__construct($path, $query);
+		$this->method = $method;
 	}
 };
 
 class DevblocksHttpResponse extends DevblocksHttpIO {
 	/**
diff --git a/libs/devblocks/api/services/template.php b/libs/devblocks/api/services/template.php
index 155efff96..dc34c2956 100644
--- a/libs/devblocks/api/services/template.php
+++ b/libs/devblocks/api/services/template.php
@@ -85,10 +85,15 @@ class _DevblocksTemplateManager {
 		
 		$url = DevblocksPlatform::getUrlService();
 		
 		$contents = $url->write($content, !empty($params['full']) ? true : false);
 		
+		$is_ajax = substr($content, 0, 9) == 'ajax.php?';
+		
+		if($is_ajax)
+			$contents .= '&_csrf_token=' . $_SESSION['csrf_token'];
+		
 		if (!empty($params['assign'])) {
 			$smarty->assign($params['assign'], $contents);
 		} else {
 			return $contents;
 		}
diff --git a/libs/devblocks/framework.defaults.php b/libs/devblocks/framework.defaults.php
index 5a9054314..ee09ae1f1 100644
--- a/libs/devblocks/framework.defaults.php
+++ b/libs/devblocks/framework.defaults.php
@@ -66,10 +66,13 @@ if(!defined('DEVELOPMENT_MODE'))
 	define('DEVELOPMENT_MODE', false);
 
 if(!defined('DEVELOPMENT_MODE_QUERIES'))
 	define('DEVELOPMENT_MODE_QUERIES', false);
 
+if(!defined('DEVELOPMENT_MODE_ALLOW_CSRF'))
+	define('DEVELOPMENT_MODE_ALLOW_CSRF', false);
+
 // ----
 
 @ini_set('session.gc_maxlifetime','86400');
 @ini_set('session.save_path',APP_TEMP_PATH);
 @date_default_timezone_set(date_default_timezone_get());
diff --git a/libs/devblocks/resources/js/devblocks.js b/libs/devblocks/resources/js/devblocks.js
index d99ba55c3..abffd3a68 100644
--- a/libs/devblocks/resources/js/devblocks.js
+++ b/libs/devblocks/resources/js/devblocks.js
@@ -238,13 +238,13 @@ function hideLoadingPanel() {
 	loadingPanel.dialog('destroy');
 	loadingPanel = null;
 }
 
 function genericAjaxPopupFind($sel) {
-	$devblocksPopups = $('#devblocksPopups');
-	$data = $devblocksPopups.data();
-	$element = $($sel).closest('DIV.devblocks-popup');
+	var $devblocksPopups = $('#devblocksPopups');
+	var $data = $devblocksPopups.data();
+	var $element = $($sel).closest('DIV.devblocks-popup');
 	for($key in $data) {
 		if($element.attr('id') == $data[$key].attr('id'))
 			return $data[$key];
 	}
 	
@@ -254,11 +254,11 @@ function genericAjaxPopupFind($sel) {
 function genericAjaxPopupFetch($layer) {
 	return $('#devblocksPopups').data($layer);
 }
 
 function genericAjaxPopupClose($layer, $event) {
-	$popup = genericAjaxPopupFetch($layer);
+	var $popup = genericAjaxPopupFetch($layer);
 	if(null != $popup) {
 		try {
 			if(null != $event)
 				$popup.trigger($event);
 		} catch(e) { if(window.console) console.log(e);  }
@@ -271,11 +271,11 @@ function genericAjaxPopupClose($layer, $event) {
 	}
 	return false;
 }
 
 function genericAjaxPopupDestroy($layer) {
-	$popup = genericAjaxPopupFetch($layer);
+	var $popup = genericAjaxPopupFetch($layer);
 	if(null != $popup) {
 		genericAjaxPopupClose($layer);
 		try {
 			$popup.dialog('destroy');
 			$popup.unbind();
@@ -474,10 +474,15 @@ function genericAjaxGet(divRef,args,cb,options) {
 	options.type = 'GET';
 	options.url = DevblocksAppPath+'ajax.php?'+args;
 	options.cache = false;
 	options.success = cb;
 	
+	if(null == options.headers)
+		options.headers = {};
+		
+	options.headers['X-CSRF-Token'] = $('meta[name="_csrf_token"]').attr('content');
+	
 	$.ajax(options);
 }
 
 function genericAjaxPost(formRef,divRef,args,cb,options) {
 	var frm = null;
@@ -521,10 +526,15 @@ function genericAjaxPost(formRef,divRef,args,cb,options) {
 	options.data = $(frm).serialize();
 	options.url = DevblocksAppPath+'ajax.php'+(null!=args?('?'+args):''),
 	options.cache = false;
 	options.success = cb;
 	
+	if(null == options.headers)
+		options.headers = {};
+		
+	options.headers['X-CSRF-Token'] = $('meta[name="_csrf_token"]').attr('content');
+	
 	$.ajax(options);
 }
 
 function devblocksAjaxDateChooser(field, div, options) {
 	if(typeof field == 'object') {

Vulnerable code: <form action="{devblocks_url}{/devblocks_url}">
{*
<input type="hidden" name="c" value="config">
<input type="hidden" name="a" value="handleSectionAction">
<input type="hidden" name="section" value="plugin_library">
<input type="hidden" name="action" value="saveDownloadPopup">
<input type="hidden" name="plugin_id" value="{$plugin->id}">
<input type="hidden" name="view_id" value="{$view_id}">
*}
<form action="{devblocks_url}{/devblocks_url}">
		$request = new DevblocksHttpRequest($parts,$queryArgs);
	function __construct($path, $query=array()) {
	$devblocksPopups = $('#devblocksPopups');
	$data = $devblocksPopups.data();
	$element = $($sel).closest('DIV.devblocks-popup');
	$popup = genericAjaxPopupFetch($layer);
	$popup = genericAjaxPopupFetch($layer);
Fixed code: 		// Generate a CSRF token for the session
		$_SESSION['csrf_token'] = CerberusApplication::generatePassword(256);
		
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<form action="{devblocks_url}{/devblocks_url}" method="POST">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
		  		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

	<meta name="_csrf_token" content="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<form action="{devblocks_url}{/devblocks_url}" method="post">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

				<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
	<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
				<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">

		<input type="hidden" name="_csrf_token" value="{$session.csrf_token}">
		$method = strtoupper(@$_SERVER['REQUEST_METHOD']);
		
		$request = new DevblocksHttpRequest($parts,$queryArgs,$method);
		$request->csrf_token = isset($_SERVER['HTTP_X_CSRF_TOKEN']) ? $_SERVER['HTTP_X_CSRF_TOKEN'] : @$_REQUEST['_csrf_token'];
		
		
		// Security: CSRF
		
		// If we are running a controller action...
		if(isset($_REQUEST['c']) || isset($_REQUEST['a'])) {
			
			// ...and we're not in DEVELOPMENT_MODE
			if(!DEVELOPMENT_MODE_ALLOW_CSRF) {
			
				// ...and the CSRF token is invalid for this session, freak out
				if(!isset($_SESSION['csrf_token']) || $_SESSION['csrf_token'] != $request->csrf_token) {
					header("Status: 403");
					@$referer = $_SERVER['HTTP_REFERER'];
					@$remote_addr = $_SERVER['REMOTE_ADDR'];
					
					error_log(sprintf("[Cerb/Security] Possible CSRF attack from IP %s using referrer %s", $remote_addr, $referer), E_USER_WARNING);
					die("Access denied");
				}
			}
		}

		// Controllers
	public $method = null;
	public $csrf_token = null;
	
	function __construct($path, $query=array(), $method=null) {
		$this->method = $method;
		$is_ajax = substr($content, 0, 9) == 'ajax.php?';
		
		if($is_ajax)
			$contents .= '&_csrf_token=' . $_SESSION['csrf_token'];
		
if(!defined('DEVELOPMENT_MODE_ALLOW_CSRF'))
	define('DEVELOPMENT_MODE_ALLOW_CSRF', false);

	var $devblocksPopups = $('#devblocksPopups');
	var $data = $devblocksPopups.data();
	var $element = $($sel).closest('DIV.devblocks-popup');
	var $popup = genericAjaxPopupFetch($layer);
	var $popup = genericAjaxPopupFetch($layer);
	if(null == options.headers)
		options.headers = {};
		
	options.headers['X-CSRF-Token'] = $('meta[name="_csrf_token"]').attr('content');
	
	if(null == options.headers)
		options.headers = {};
		
	options.headers['X-CSRF-Token'] = $('meta[name="_csrf_token"]').attr('content');