Index: applications/panels/src/main/resources/Panels/AddClassProperty.xml
===================================================================
--- applications/panels/src/main/resources/Panels/AddClassProperty.xml	(revision 29535)
+++ applications/panels/src/main/resources/Panels/AddClassProperty.xml	(working copy)
@@ -103,6 +103,7 @@
 <content>#largepanelheader($msg.get("addproperty"))
 &lt;form id="propadd" method="post" action="$doc.getURL("propadd")" onsubmit="cancelCancelEdit()"&gt;
 &lt;div class="padded"&gt;
+&lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
 &lt;input type="hidden" name="xredirect" value="$doc.getURL("edit", "editor=class")"/&gt;
 &lt;label for="propname"&gt;$msg.get("propname"):&lt;/label&gt;&lt;br /&gt;
 &lt;input type="text" id="propname" name="propname" value="" size="20" /&gt;&lt;br /&gt;
Index: applications/panels/src/main/resources/Panels/PanelLayoutUpdate.xml
===================================================================
--- applications/panels/src/main/resources/Panels/PanelLayoutUpdate.xml	(revision 29535)
+++ applications/panels/src/main/resources/Panels/PanelLayoutUpdate.xml	(working copy)
@@ -34,7 +34,7 @@
 ##
 ## Check to see if the current user has admin rights on the current preferences document.
 ##
-#if(!$xwiki.hasAccessLevel("admin", $context.user, $prefsdocument))
+#if(!$xwiki.hasAccessLevel("admin", $context.user, $prefsdocument) || !${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")})
   #xwikimessageboxstart("$msg.get('panelwizard.placemanager')" "")
   $msg.get("panelwizard.notadmininplace", $place)
   #xwikimessageboxend()
Index: applications/panels/src/main/resources/Panels/RightsEditorWelcome.xml
===================================================================
--- applications/panels/src/main/resources/Panels/RightsEditorWelcome.xml	(revision 29535)
+++ applications/panels/src/main/resources/Panels/RightsEditorWelcome.xml	(working copy)
@@ -103,6 +103,7 @@
 #if($xwiki.rightsmanager.defaultUi == "stable")
 &lt;form id="objectadd" method="post" action="$doc.getURL("objectadd")" onsubmit="cancelCancelEdit()"&gt;
 &lt;div class="centered padded"&gt;
+&lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
 &lt;input type="hidden" name="xredirect" value="$doc.getURL("edit", "editor=rights")"/&gt;
 &lt;input type="hidden" name="classname" value="$class.name"/&gt;
 &lt;input type="submit" value="$msg.get("addrightentry")" class="button"/&gt;
Index: applications/panels/src/main/resources/Panels/CreatePanel.xml
===================================================================
--- applications/panels/src/main/resources/Panels/CreatePanel.xml	(revision 29535)
+++ applications/panels/src/main/resources/Panels/CreatePanel.xml	(working copy)
@@ -28,6 +28,7 @@
 {{html}}
   &lt;form method="post" action="$doc.getURL('view', 'xpage=plain')" onsubmit="cancelCancelEdit()"&gt;
     &lt;div&gt;
+      &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
       &lt;input type="hidden" name="create" value="1"/&gt;
       &lt;label for="panelTitle" class="hidden"&gt;$msg.get("xe.panels.create.title")&lt;/label&gt;
       &lt;input type="text" id="panelTitle" name="panelTitle" value="$msg.get("xe.panels.create.title")" class="panelinput" onfocus="if(this.value=='$msg.get("xe.panels.create.title")') this.value=''" onblur="if(this.value=='') this.value='$msg.get("xe.panels.create.title")'"/&gt;
Index: applications/panels/src/main/resources/Panels/DocumentInformation.xml
===================================================================
--- applications/panels/src/main/resources/Panels/DocumentInformation.xml	(revision 29535)
+++ applications/panels/src/main/resources/Panels/DocumentInformation.xml	(working copy)
@@ -177,7 +177,7 @@
         // Conversion in WYSIWYG mode does not yet support conversion of the current content
         if (XWiki.docisnew || confirm("Do you want to also convert the document's content and objects to the selected syntax? Choosing 'cancel' will reset the syntax to the previous one and do nothing. Note that if you choose 'ok' you will loose modifications and this will save the document automatically, you can cancel this modification by going to the document history interface and revert the last version.")) {
           this.disableEditingArea();
-          var url = '$doc.getURL('view', 'action=convertSyntax&amp;xpage=plain&amp;documentName=')' + encodeURIComponent(this.name) + '&amp;oldSyntaxId=' + encodeURIComponent(this.originalSyntax) + '&amp;newSyntaxId=' + encodeURIComponent(syntax);
+          var url = '$doc.getURL('view', 'action=convertSyntax&amp;xpage=plain&amp;form_token=$!{services.csrf.getToken()}&amp;documentName=')' + encodeURIComponent(this.name) + '&amp;oldSyntaxId=' + encodeURIComponent(this.originalSyntax) + '&amp;newSyntaxId=' + encodeURIComponent(syntax);
           new Ajax.Request(
             url,
             {
@@ -193,7 +193,7 @@
       } else if (!this.contentField.value.blank()) {
         if (confirm("Do you want to also convert the document's content and objects to the selected syntax? Choosing 'cancel' will only change the syntax identifier, without modifying the document's content. Note that if you choose 'ok' this will save the document automatically, you can cancel this modification by going to the document history interface and revert the last version.")) {
           this.disableEditingArea();
-          var url = '$doc.getURL('view', 'action=convertSyntax&amp;xpage=plain&amp;documentName=')' + encodeURIComponent(this.name) + '&amp;oldSyntaxId=' + encodeURIComponent(this.originalSyntax) + '&amp;newSyntaxId=' + encodeURIComponent(syntax);
+          var url = '$doc.getURL('view', 'action=convertSyntax&amp;xpage=plain&amp;form_token=$!{services.csrf.getToken()}&amp;documentName=')' + encodeURIComponent(this.name) + '&amp;oldSyntaxId=' + encodeURIComponent(this.originalSyntax) + '&amp;newSyntaxId=' + encodeURIComponent(syntax);
           new Ajax.Request(
             url,
             {
@@ -548,7 +548,7 @@
   #end
   ## Use the syntax and content received from the client, as the user might have made some changes that are not on saved yet.
   #set($void = $translatedDoc.setSyntaxId($oldSyntax))
-  #if (!$translatedDoc.convertSyntax($newSyntaxId))
+  #if (!$translatedDoc.convertSyntax($newSyntaxId) || !${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")})
     #set($error = true)
   #else
     #set($void = $translatedDoc.save("Document converted from syntax $oldSyntax to syntax $newSyntaxId"))
Index: applications/panels/src/main/resources/Panels/GlobalRightsEditorWelcome.xml
===================================================================
--- applications/panels/src/main/resources/Panels/GlobalRightsEditorWelcome.xml	(revision 29535)
+++ applications/panels/src/main/resources/Panels/GlobalRightsEditorWelcome.xml	(working copy)
@@ -103,6 +103,7 @@
 #if($xwiki.rightsmanager.defaultUi == "stable")
 &lt;form id="objectadd" method="post" action="$doc.getURL("objectadd")" onsubmit="cancelCancelEdit()"&gt;
 &lt;div class="centered padded"&gt;
+&lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
 &lt;input type="hidden" name="xredirect" value="$xwiki.requestURL"/&gt;
 &lt;input type="hidden" name="classname" value="XWiki.XWikiGlobalRights"/&gt;
 &lt;input type="submit" value="$msg.get("addrightentry")" class="button"/&gt;
Index: applications/panels/src/main/resources/Panels/AddObject.xml
===================================================================
--- applications/panels/src/main/resources/Panels/AddObject.xml	(revision 29535)
+++ applications/panels/src/main/resources/Panels/AddObject.xml	(working copy)
@@ -103,6 +103,7 @@
 <content>#largepanelheader($msg.get("addobject"))
 &lt;form id="objectadd" method="post" action="$doc.getURL("objectadd")" onsubmit="cancelCancelEdit()"&gt;
 &lt;p&gt;
+&lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
 &lt;input type="hidden" name="xredirect" value="$doc.getURL("edit", "editor=object")" /&gt;
 &lt;select name="classname" size="1"&gt;
 &lt;option value="---"&gt;$msg.get("selectclass")&lt;/option&gt;
Index: applications/blog/src/main/resources/Blog/Migration.xml
===================================================================
--- applications/blog/src/main/resources/Blog/Migration.xml	(revision 29535)
+++ applications/blog/src/main/resources/Blog/Migration.xml	(working copy)
@@ -24,7 +24,7 @@
 <syntaxId>xwiki/2.0</syntaxId>
 <hidden>true</hidden>
 <content>{{velocity filter="none"}}
-#if($request.migrate)
+#if($request.migrate &amp;&amp; $!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")})
   #set($newContent = '#includeForm("Blog.BlogPostSheet")')
   #set($query = ", BaseObject obj where obj.name = doc.fullName and obj.className = 'XWiki.ArticleClass'")
   #foreach($article in $xwiki.searchDocuments($query))
@@ -52,6 +52,7 @@
 
 {{html clean="false" wiki="true"}}
   &lt;form action="$doc.getURL()" method="post"&gt;
+    &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
     &lt;div&gt;&lt;input type="submit" name="migrate" value="$msg.get('xe.blog.migration.confirm')"/&gt;&lt;/div&gt;
   &lt;/form&gt;
 {{/html}}
Index: applications/blog/src/main/resources/Blog/ManageCategories.xml
===================================================================
--- applications/blog/src/main/resources/Blog/ManageCategories.xml	(revision 29535)
+++ applications/blog/src/main/resources/Blog/ManageCategories.xml	(working copy)
@@ -709,9 +709,9 @@
       #else
         #set($xredirect = ${doc.getURL('view', "xpage=plain&amp;display=list&amp;root=${newCategoryParent}")})
       #end
-      $response.sendRedirect($xwiki.getURL($name, 'save', "template=${blogCategoryTemplate}&amp;parent=${newCategoryParent}&amp;${blogCategoryClassname}_0_name=${title}&amp;${blogCategoryClassname}_0_description=&amp;xredirect=$util.encodeURI($xredirect)"))
+      $response.sendRedirect($xwiki.getURL($name, 'save', "template=${blogCategoryTemplate}&amp;parent=${newCategoryParent}&amp;${blogCategoryClassname}_0_name=${title}&amp;${blogCategoryClassname}_0_description=&amp;xredirect=$util.encodeURI($xredirect)&amp;form_token=$!{services.csrf.getToken()}"))
     #else ## request.ajax
-      $response.sendRedirect($xwiki.getURL($name, 'save', "template=${blogCategoryTemplate}&amp;parent=${newCategoryParent}&amp;${blogCategoryClassname}_0_name=${title}&amp;${blogCategoryClassname}_0_description=&amp;xredirect=${util.encodeURI(${doc.getURL()})}"))
+      $response.sendRedirect($xwiki.getURL($name, 'save', "template=${blogCategoryTemplate}&amp;parent=${newCategoryParent}&amp;${blogCategoryClassname}_0_name=${title}&amp;${blogCategoryClassname}_0_description=&amp;xredirect=${util.encodeURI(${doc.getURL()})}&amp;form_token=$!{services.csrf.getToken()}"))
     #end
   #end ## empty title
 #end
Index: applications/blog/src/main/resources/Blog/BlogCode.xml
===================================================================
--- applications/blog/src/main/resources/Blog/BlogCode.xml	(revision 29535)
+++ applications/blog/src/main/resources/Blog/BlogCode.xml	(working copy)
@@ -533,9 +533,9 @@
   ## Only published articles can be hidden. Unpublished articles are considered already hidden.
   #if($isPublished &amp;&amp; $entryDoc.creator == $context.user &amp;&amp; $xwiki.hasAccessLevel('edit', $context.user, $entryDoc.fullName))
     #if ($isHidden)
-      &lt;a class="blog-tool-show" href="$entryDoc.getURL('save', "${entryObj.getxWikiClass().getName()}_${entryObj.number}_hidden=0&amp;amp;comment=${escapetool.url($msg.get('xe.blog.code.madevisible'))}&amp;amp;xredirect=${escapetool.url($thisURL)}")" title="${escapetool.xml($msg.get('xe.blog.code.makevisible'))}"&gt;#toolImage('lock_open', 'show ')&lt;/a&gt;##
+      &lt;a class="blog-tool-show" href="$entryDoc.getURL('save', "${entryObj.getxWikiClass().getName()}_${entryObj.number}_hidden=0&amp;amp;comment=${escapetool.url($msg.get('xe.blog.code.madevisible'))}&amp;amp;xredirect=${escapetool.url($thisURL)}&amp;amp;form_token=$!{services.csrf.getToken()}")" title="${escapetool.xml($msg.get('xe.blog.code.makevisible'))}"&gt;#toolImage('lock_open', 'show ')&lt;/a&gt;##
     #else
-      &lt;a class="blog-tool-hide" href="$entryDoc.getURL('save', "${entryObj.getxWikiClass().getName()}_${entryObj.number}_hidden=1&amp;amp;comment=${escapetool.url($msg.get('xe.blog.code.hid'))}&amp;amp;xredirect=${escapetool.url($thisURL)}")" title="${escapetool.xml($msg.get('xe.blog.code.hide'))}"&gt;#toolImage('lock' 'hide ')&lt;/a&gt;##
+      &lt;a class="blog-tool-hide" href="$entryDoc.getURL('save', "${entryObj.getxWikiClass().getName()}_${entryObj.number}_hidden=1&amp;amp;comment=${escapetool.url($msg.get('xe.blog.code.hid'))}&amp;amp;xredirect=${escapetool.url($thisURL)}&amp;amp;form_token=$!{services.csrf.getToken()}")" title="${escapetool.xml($msg.get('xe.blog.code.hide'))}"&gt;#toolImage('lock' 'hide ')&lt;/a&gt;##
     #end
   #end
 #end
Index: applications/blog/src/main/resources/Blog/CategoriesCode.xml
===================================================================
--- applications/blog/src/main/resources/Blog/CategoriesCode.xml	(revision 29535)
+++ applications/blog/src/main/resources/Blog/CategoriesCode.xml	(working copy)
@@ -216,7 +216,7 @@
  * control for choosing the parent category among existing categories.
  *###
 ## DO NOT CHANGE INDENTATION
-#macro(addCategoryForm) &lt;form action="$doc.getURL()" method="post" class="category-add-form"&gt;&lt;div class='create-category'&gt; &lt;input type="hidden" name="xaction" value="create"/&gt; &lt;label&gt;$msg.get("xe.blog.categories.new")&lt;br/&gt; &lt;input type="text" name="newCategoryName" class="category-name-input"&gt;&lt;/input&gt;&lt;/label&gt;&lt;br/&gt;#if("$!{request.parentCategory}" == "")&lt;label&gt;#* $msg.get("xe.blog.categories.parent")*# Subcategory of:&lt;br/&gt; &lt;select name="newCategoryParent" id="blog_category_selectBox" class="category-add-input"&gt; &lt;option value="${defaultCategoryParent}" selected="selected"&gt;None&lt;/option&gt; $!processedCategories.clear() #displayCategoriesHierarchy($tree 'option') &lt;/select&gt; &lt;br/&gt;&lt;/label&gt;#else&lt;input type="hidden" name="newCategoryParent" value="${escapetool.xml($request.parentCategory)}"/&gt;#end&lt;span class="buttonwrapper"&gt;&lt;input class="button" type="submit" value="Add"&gt;&lt;/input&gt;&lt;/span&gt; &lt;a href="$doc.getURL()"&gt;Cancel&lt;/a&gt; &lt;/div&gt;&lt;/form&gt; #end
+#macro(addCategoryForm) &lt;form action="$doc.getURL()" method="post" class="category-add-form"&gt;&lt;div class='create-category'&gt; &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt; &lt;input type="hidden" name="xaction" value="create"/&gt; &lt;label&gt;$msg.get("xe.blog.categories.new")&lt;br/&gt; &lt;input type="text" name="newCategoryName" class="category-name-input"&gt;&lt;/input&gt;&lt;/label&gt;&lt;br/&gt;#if("$!{request.parentCategory}" == "")&lt;label&gt;#* $msg.get("xe.blog.categories.parent")*# Subcategory of:&lt;br/&gt; &lt;select name="newCategoryParent" id="blog_category_selectBox" class="category-add-input"&gt; &lt;option value="${defaultCategoryParent}" selected="selected"&gt;None&lt;/option&gt; $!processedCategories.clear() #displayCategoriesHierarchy($tree 'option') &lt;/select&gt; &lt;br/&gt;&lt;/label&gt;#else&lt;input type="hidden" name="newCategoryParent" value="${escapetool.xml($request.parentCategory)}"/&gt;#end&lt;span class="buttonwrapper"&gt;&lt;input class="button" type="submit" value="Add"&gt;&lt;/input&gt;&lt;/span&gt; &lt;a href="$doc.getURL()"&gt;Cancel&lt;/a&gt; &lt;/div&gt;&lt;/form&gt; #end
 ##
 ##
 ##
@@ -226,6 +226,7 @@
 ## DO NOT CHANGE INDENTATION
 #macro(renameCategoryForm)##
 &lt;form action="$doc.getURL()" method="post" class="category-rename-form"&gt;&lt;div class='rename-category'&gt;##
+&lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
 &lt;input type="hidden" name="xaction" value="rename"/&gt;##
 &lt;input type="hidden" name="category" value="${escapetool.xml($request.category)}"/&gt;##
 &lt;label&gt;$msg.get("xe.blog.categories.newName")&lt;br/&gt; &lt;input type="text" name="newCategoryName" class="category-name-input"&gt;&lt;/input&gt;&lt;/label&gt;&lt;br/&gt;##
@@ -254,7 +255,7 @@
 &lt;span class="blog-category-tools"&gt;##
 #if($xwiki.hasAccessLevel('delete', $context.user, $name) &amp;&amp; ("$!{request.xaction}" != 'showRenameCategory' || "$!{request.category}" != $name))&lt;a href="$xwiki.getURL('Blog.ManageCategories', 'view', "xaction=showRenameCategory&amp;amp;category=$nameUrl")" class="tool rename"&gt;#toolImage('pencil' 'Rename ')&lt;/a&gt;#end ##
 #if($xwiki.hasAccessLevel('edit', $context.user, $doc.fullName) &amp;&amp; ("$!{request.xaction}" != "showAddCategory" || "$!{request.parentCategory}" != $name))&lt;a href="$xwiki.getURL('Blog.ManageCategories', 'view', "xaction=showAddCategory&amp;amp;parentCategory=$nameUrl")" class="tool add-subcategory"&gt;#toolImage('chart_organisation_add' 'Add a subcategory ')&lt;/a&gt; #end ##
-#if($xwiki.hasAccessLevel('delete', $context.user, $name)) &lt;a href="$xwiki.getURL('Blog.ManageCategories', 'view', "xaction=delete&amp;amp;category=$nameUrl")" class="tool delete"&gt;#toolImage('cross' 'Delete ')&lt;/a&gt;#end ##
+#if($xwiki.hasAccessLevel('delete', $context.user, $name)) &lt;a href="$xwiki.getURL('Blog.ManageCategories', 'view', "xaction=delete&amp;amp;category=$nameUrl&amp;amp;form_token=$!{services.csrf.getToken()}")" class="tool delete"&gt;#toolImage('cross' 'Delete ')&lt;/a&gt;#end ##
 &lt;/span&gt;##
 #if($xwiki.hasAccessLevel('edit', $context.user, $doc.fullName) &amp;&amp; "$!{request.xaction}" == "showRenameCategory" &amp;&amp; "$!{request.category}" == $name) #renameCategoryForm() #end##
 #if($xwiki.hasAccessLevel('edit', $context.user, $doc.fullName) &amp;&amp; "$!{request.xaction}" == "showAddCategory" &amp;&amp; "$!{request.parentCategory}" == $name) #addCategoryForm() #end##
@@ -346,6 +347,7 @@
  *###
 #macro(showCreateCategoryBox $tree)
   &lt;div class='create-category'&gt;
+    &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
     &lt;input type="hidden" name="xaction" value="create"/&gt;
     &lt;label&gt;$msg.get("xe.blog.categories.new") &lt;input type="text" name="newCategoryName"&gt;&lt;/input&gt;&lt;/label&gt;
     &lt;label&gt;$msg.get("xe.blog.categories.parent")
@@ -395,7 +397,7 @@
   #end
   #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogCategoryClassname}' and doc.fullName &lt;&gt; 'Blog.CategoryTemplate' and doc.parent = ? order by doc.name")
   #foreach($item in $xwiki.searchDocuments($query, $parameterValues))
-    #if($xwiki.hasAccessLevel('edit', $context.user, $item))
+    #if($xwiki.hasAccessLevel('edit', $context.user, $item) &amp;&amp; $!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")})
       #set($subcategoryDoc = $xwiki.getDocument($item))
       $subcategoryDoc.setParent($categoryParent)
       $subcategoryDoc.save($msg.get('xe.blog.manageCategories.comment.updatedParent'), true)
@@ -407,7 +409,7 @@
   #end
   #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogPostClassname}' and doc.fullName &lt;&gt; 'Blog.BlogPostTemplate' and categories.id.id = obj.id and categories.id.name = 'category' and category = ? order by doc.name")
   #foreach($item in $xwiki.searchDocuments($query, $parameterValues))
-    #if($xwiki.hasAccessLevel('edit', $context.user, $item))
+    #if($xwiki.hasAccessLevel('edit', $context.user, $item) &amp;&amp; $!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")})
       #set($blogEntryDoc = $xwiki.getDocument($item))
       #set($discard = $blogEntryDoc.getObject(${blogPostClassname}).getProperty('category').value.remove($category))
       $blogEntryDoc.save($msg.get('xe.blog.manageCategories.comment.removedDeletedCategory'), true)
@@ -431,7 +433,7 @@
   #set($query = ', BaseObject obj where ')
   #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogCategoryClassname}' and doc.fullName &lt;&gt; 'Blog.CategoryTemplate' and doc.parent = ? order by doc.name")
   #foreach($item in $xwiki.searchDocuments($query, $parameterValues))
-    #if($xwiki.hasAccessLevel('edit', $context.user, $item))
+    #if($xwiki.hasAccessLevel('edit', $context.user, $item) &amp;&amp; $!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")})
       #set($subcategoryDoc = $xwiki.getDocument($item))
       $subcategoryDoc.setParent($newCategoryDoc.fullName)
       $subcategoryDoc.save($msg.get('xe.blog.manageCategories.comment.updatedParent'), true)
@@ -440,16 +442,18 @@
   #set($query = ', BaseObject obj, DBStringListProperty categories join categories.list as category where ')
   #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogPostClassname}' and doc.fullName &lt;&gt; 'Blog.BlogPostTemplate' and categories.id.id = obj.id and categories.id.name = 'category' and category = ? order by doc.name")
   #foreach($item in $xwiki.searchDocuments($query, $parameterValues))
-    #if($xwiki.hasAccessLevel('edit', $context.user, $item))
+    #if($xwiki.hasAccessLevel('edit', $context.user, $item) &amp;&amp; $!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")})
       #set($blogEntryDoc = $xwiki.getDocument($item))
       #set($discard = $blogEntryDoc.getObject(${blogPostClassname}).getProperty('category').value.remove($category))
       #set($discard = $blogEntryDoc.getObject(${blogPostClassname}).getProperty('category').value.add($newCategoryDoc.fullName))
       $blogEntryDoc.save($msg.get('xe.blog.manageCategories.comment.updatedRenamedCategory'), true)
     #end
   #end
-  $categoryDoc.getObject('Blog.CategoryClass').set('name', $newCategoryName)
-  $categoryDoc.save($msg.get('xe.blog.manageCategories.comment.updatedCategory'), true)
-  $categoryDoc.rename($newCategoryName)
+  #if ($!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")})
+    $categoryDoc.getObject('Blog.CategoryClass').set('name', $newCategoryName)
+    $categoryDoc.save($msg.get('xe.blog.manageCategories.comment.updatedCategory'), true)
+    $categoryDoc.rename($newCategoryName)
+  #end
 #end
 {{/velocity}}</content>
 </xwikidoc>
Index: applications/blog/src/main/resources/Blog/BlogScripts.xml
===================================================================
--- applications/blog/src/main/resources/Blog/BlogScripts.xml	(revision 29535)
+++ applications/blog/src/main/resources/Blog/BlogScripts.xml	(working copy)
@@ -244,7 +244,7 @@
     var parentCategory = this.newCategoryParent.value;
     var parentSpace = encodeURI(parentCategory.substring(0, parentCategory.indexOf(".")));
     var parent = encodeURI(parentCategory);
-    new Ajax.Request("${xwiki.getURL('__name__', 'save', "ajax=1&amp;template=${blogCategoryTemplate}")}".replace(/__name__/g, safeName) + "&amp;parent=" + parent + "&amp;title=" + title + "&amp;${blogCategoryClassname}_0_name=" + title, {
+    new Ajax.Request("${xwiki.getURL('__name__', 'save', "ajax=1&amp;template=${blogCategoryTemplate}&amp;form_token=$!{services.csrf.getToken()}")}".replace(/__name__/g, safeName) + "&amp;parent=" + parent + "&amp;title=" + title + "&amp;${blogCategoryClassname}_0_name=" + title, {
       method: "get",
       onSuccess: XWiki.Blog.updateCategoryTree.bindAsEventListener(this, name, parentCategory, parentSpace),
       on1223: function(response) {response.request.options.onSuccess(response)},
Index: applications/blog/src/main/resources/Blog/Publisher.xml
===================================================================
--- applications/blog/src/main/resources/Blog/Publisher.xml	(revision 29535)
+++ applications/blog/src/main/resources/Blog/Publisher.xml	(working copy)
@@ -32,7 +32,7 @@
 #end
 #set($entryName = "$!{request.entryName}")
 #if($entryName != '')
-  #if($xwiki.hasAccessLevel('edit', $context.user, $entryName))
+  #if($xwiki.hasAccessLevel('edit', $context.user, $entryName) &amp;&amp; $!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")})
     #set($entryDoc = $xwiki.getDocument($entryName))
     #if ($entryDoc)
       #getEntryObject($entryDoc $entryObj)
Index: applications/blog/src/main/resources/Blog/CreatePost.xml
===================================================================
--- applications/blog/src/main/resources/Blog/CreatePost.xml	(revision 29535)
+++ applications/blog/src/main/resources/Blog/CreatePost.xml	(working copy)
@@ -41,6 +41,7 @@
   #end
   &lt;form action="${xwiki.getURL('Blog.CreatePost', 'view', 'xpage=plain')}" id="newBlogPost" method="post"&gt;
   &lt;div&gt;
+    &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
     &lt;input type="hidden" name="entrySpace" value="$space"/&gt;
     #if($doc.getObject($blogCategoryClassname))
       &lt;input type="hidden" name="category" value="${escapetool.xml(${doc.fullName})}"/&gt;
@@ -63,7 +64,7 @@
   #if("$!request.category" != '')
     #set($category = "&amp;${blogPostClassname}_${blogPostObjectNumber}_category=${escapetool.url(${request.category})}")
   #end
-  $response.sendRedirect($xwiki.getURL($postDocName, 'inline', "template=${blogPostTemplate}&amp;parent=${parent}&amp;title=${title}&amp;${blogPostClassname}_0_title=${title}$!{category}"))
+  $response.sendRedirect($xwiki.getURL($postDocName, 'inline', "template=${blogPostTemplate}&amp;parent=${parent}&amp;title=${title}&amp;${blogPostClassname}_0_title=${title}$!{category}&amp;form_token=$!{request.getParameter('form_token')}"))
 #end## name == ''
 #elseif("$!request.entryTitle" != '')## !hasEdit &amp;&amp; form submitted
   #template('accessdenied.vm')
Index: applications/blog/src/main/resources/Blog/Management.xml
===================================================================
--- applications/blog/src/main/resources/Blog/Management.xml	(revision 29535)
+++ applications/blog/src/main/resources/Blog/Management.xml	(working copy)
@@ -65,13 +65,14 @@
     #end
     #set($title = $escapetool.url($title))
     #set($parent = 'Main.WebHome')
-    $response.sendRedirect($xwiki.getURL($blogDocName, 'save', "parent=${parent}&amp;title=${escapetool.url($title)}&amp;template=${blogTemplate}&amp;${blogClassname}_0_title=${escapetool.url($title)}"))
+    $response.sendRedirect($xwiki.getURL($blogDocName, 'save', "parent=${parent}&amp;title=${escapetool.url($title)}&amp;template=${blogTemplate}&amp;${blogClassname}_0_title=${escapetool.url($title)}&amp;form_token=$!{services.csrf.getToken()}"))
   #end
 #end
 ##
 ## Show the form
 &lt;form action="${xwiki.getURL('Blog.Management')}" id="newBlog" method="post"&gt;
 &lt;div&gt;
+  &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
 &lt;dl&gt;
   &lt;dt&gt;&lt;label for="blogSpace"&gt;$msg.get('xe.blog.manage.space')&lt;/label&gt;&lt;/dt&gt;
   &lt;dd&gt;&lt;input type="text" name="blogSpace" id="blogSpace" value=""/&gt;&lt;/dd&gt;
Index: applications/administration/src/main/resources/XWiki/AdminFieldsDisplaySheet.xml
===================================================================
--- applications/administration/src/main/resources/XWiki/AdminFieldsDisplaySheet.xml	(revision 29535)
+++ applications/administration/src/main/resources/XWiki/AdminFieldsDisplaySheet.xml	(working copy)
@@ -63,6 +63,7 @@
    &lt;/fieldset&gt;
   #end
   &lt;div class="hidden"&gt;
+    &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
     &lt;input type="hidden" name="xcontinue" value="$xwiki.getURL($currentDoc, 'admin', "editor=${editor}&amp;amp;section=${section}&amp;amp;space=${currentSpace}")" /&gt;
     &lt;input type="hidden" name="xredirect" value="$xwiki.getURL($currentDoc, "admin", "editor=${editor}&amp;amp;section=${section}&amp;amp;space=${currentSpace}")" /&gt;
     &lt;input type="hidden" name="classname" value="XWiki.XWikiPreferences" /&gt;
Index: applications/administration/src/main/resources/XWiki/AdminGroupsSheet.xml
===================================================================
--- applications/administration/src/main/resources/XWiki/AdminGroupsSheet.xml	(revision 29535)
+++ applications/administration/src/main/resources/XWiki/AdminGroupsSheet.xml	(working copy)
@@ -106,7 +106,8 @@
   //&lt;![CDATA[
     (function() {
       var startup = function() {
-        var ta = new XWiki.widgets.LiveTable("$url", "groupstable", displayGroups);
+        var callback = function(row, i, table) { return displayGroups(row, i, table, "$!{services.csrf.getToken()}"); };
+        var ta = new XWiki.widgets.LiveTable("$url", "groupstable", callback);
         Event.observe($('addNewGroup'), "click", makeAddHandler("$addnewurl", "$saveurl", "$redirecturl"));
       }
       if ((typeof(XWiki) != 'undefined') &amp;&amp; (typeof(XWiki.widgets) != 'undefined') &amp;&amp; (typeof(XWiki.widgets.LiveTable) != 'undefined')) {
Index: applications/administration/src/main/resources/XWiki/ConfigurableClass.xml
===================================================================
--- applications/administration/src/main/resources/XWiki/ConfigurableClass.xml	(revision 29535)
+++ applications/administration/src/main/resources/XWiki/ConfigurableClass.xml	(working copy)
@@ -571,6 +571,7 @@
                 #set($thisURL = "${thisURL}?$request.getQueryString()")
               #end
               &lt;input type="hidden" id="${escapedAppName}_redirect" name="$redirectParameter" value="$escapetool.html($thisURL)" /&gt;
+              &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
               &lt;/fieldset&gt;
               &lt;div class="bottombuttons"&gt;
                 &lt;p class="admin-buttons"&gt;
Index: applications/administration/src/main/resources/XWiki/ResetPasswordComplete.xml
===================================================================
--- applications/administration/src/main/resources/XWiki/ResetPasswordComplete.xml	(revision 29535)
+++ applications/administration/src/main/resources/XWiki/ResetPasswordComplete.xml	(working copy)
@@ -320,6 +320,7 @@
   #end
   &lt;form action="$doc.getURL()" method="post" onsubmit="if($('password').value == '') {alert('$msg.get("xe.admin.passwordreset.emptystring")'); return false;} else if($('password').value != $('password2').value) {alert('$msg.get("xe.admin.passwordreset.nomatch")'); return false; }"&gt;
     &lt;div class="hidden"&gt;
+      &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
       &lt;input type="hidden" name="u" value="$userName"/&gt;
       &lt;input type="hidden" name="v" value="$validationString"/&gt;
     &lt;/div&gt;
Index: applications/administration/src/main/resources/XWiki/XWikiGroupSheet.xml
===================================================================
--- applications/administration/src/main/resources/XWiki/XWikiGroupSheet.xml	(revision 29535)
+++ applications/administration/src/main/resources/XWiki/XWikiGroupSheet.xml	(working copy)
@@ -90,6 +90,7 @@
      if(name) 
      {
              var url = "$doc.getURL("view")" + "?xpage=adduorg" + "&amp;" + "uorg=" + uorg + "&amp;" + "name=" + name;
+             url += "&amp;form_token=$!{services.csrf.getToken()}";
              new Ajax.Request(url, 
              {
                method: 'get',
@@ -162,9 +163,9 @@
 #warning($msg.get("userdeletioncannotbecanceled"))
 #set($redirect = $xwiki.getRequestURL())
 {table}
-&lt;span class="floatleft"&gt;$msg.get("xe.admin.groups.members")&lt;/span&gt; &lt;a id="adduser" href="$doc.getURL("objectadd","classname=XWiki.XWikiGroups&amp;amp;xredirect=$redirect")" title="$msg.get("addusertogroup")"&gt;&lt;span class="hidden"&gt;($msg.get("add"))&lt;/span&gt;&lt;/a&gt; | 
+&lt;span class="floatleft"&gt;$msg.get("xe.admin.groups.members")&lt;/span&gt; &lt;a id="adduser" href="$doc.getURL("objectadd","classname=XWiki.XWikiGroups&amp;amp;xredirect=$redirect&amp;amp;form_token=$!{services.csrf.getToken()}")" title="$msg.get("addusertogroup")"&gt;&lt;span class="hidden"&gt;($msg.get("add"))&lt;/span&gt;&lt;/a&gt; | 
 #foreach($obj in $objects)
-$doc.display("member", $obj) | &lt;a class="deletelink" href="$doc.getURL("objectremove", "classname=XWiki.XWikiGroups&amp;amp;classid=${obj.number}&amp;amp;xredirect=${doc.getURL('inline')}")" title="$msg.get("removethisuserfromgroup")"&gt;$msg.get("delete")&lt;/a&gt;
+$doc.display("member", $obj) | &lt;a class="deletelink" href="$doc.getURL("objectremove", "classname=XWiki.XWikiGroups&amp;amp;classid=${obj.number}&amp;amp;xredirect=${doc.getURL('inline')}&amp;amp;form_token=$!{services.csrf.getToken()}")" title="$msg.get("removethisuserfromgroup")"&gt;$msg.get("delete")&lt;/a&gt;
 #end ##foreach
 {table}
 #else ## inline
Index: applications/administration/src/main/resources/XWiki/AdminUsersSheet.xml
===================================================================
--- applications/administration/src/main/resources/XWiki/AdminUsersSheet.xml	(revision 29535)
+++ applications/administration/src/main/resources/XWiki/AdminUsersSheet.xml	(working copy)
@@ -108,7 +108,8 @@
   //&lt;![CDATA[
     (function() {
       var startup = function() {
-       var ta = new XWiki.widgets.LiveTable("$url", "userstable", displayUsers); 
+       var callback = function(row, i, table) { return displayUsers(row, i, table, "$!{services.csrf.getToken()}"); };
+       var ta = new XWiki.widgets.LiveTable("$url", "userstable", callback); 
        #set($registerurl = $doc.getURL("view", "xpage=registerinline"))
        #set($saveurl = $doc.getURL("register", "xpage=registerinline"))
        #set($redirectuserurl = $xwiki.getDocument("XWiki.XWikiPreferences").getURL("admin", "editor=${editor}&amp;section=Users")) 
Index: applications/administration/src/main/resources/XWiki/ResetPassword.xml
===================================================================
--- applications/administration/src/main/resources/XWiki/ResetPassword.xml	(revision 29535)
+++ applications/administration/src/main/resources/XWiki/ResetPassword.xml	(working copy)
@@ -282,6 +282,7 @@
   $msg.get("xe.admin.passwordreset.startprocess")
 
   &lt;form method="post" action=""&gt;
+  &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
   &lt;div&gt;&lt;label for="u"&gt;$msg.get("xe.admin.passwordreset.username")&lt;/label&gt; &lt;input type="text" id="u" name="u"/&gt; &lt;span class="buttonwrapper"&gt;&lt;input type="submit" value="$msg.get("xe.admin.passwordreset.resetpassword")" class="button"/&gt;&lt;/span&gt;&lt;/div&gt;
   &lt;/form&gt;
 #else ## Second step, generate the verification string, store it, and send the email
Index: applications/administration/src/main/resources/XWiki/Registration.xml
===================================================================
--- applications/administration/src/main/resources/XWiki/Registration.xml	(revision 29535)
+++ applications/administration/src/main/resources/XWiki/Registration.xml	(working copy)
@@ -535,6 +535,7 @@
   {{html clean=false wiki=false}}
     &lt;form id="register" action="" method="post"&gt;
     &lt;div&gt;
+    &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
     #generateHtml($fields, $fieldMandatoryStar, $failureMessageParams)
     &lt;div class="wikimodel-emptyline"&gt;&lt;/div&gt;
     &lt;span class="buttonwrapper"&gt;
@@ -686,11 +687,16 @@
  * @param $doAfterRegistration code block to run after registration completes successfully.
  *###
 #macro(createUser, $fields, $request, $response, $doAfterRegistration)
-  ## See if email verification is required and register the user.
-  #if($xwiki.getXWikiPreferenceAsInt('use_email_verification', 0) == 1)
-    #set($reg = $xwiki.createUser(true))
+  ## CSRF check
+  #if(${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")})
+    ## See if email verification is required and register the user.
+    #if($xwiki.getXWikiPreferenceAsInt('use_email_verification', 0) == 1)
+      #set($reg = $xwiki.createUser(true))
+    #else
+      #set($reg = $xwiki.createUser(false))
+    #end
   #else
-    #set($reg = $xwiki.createUser(false))
+    $response.sendRedirect("$!{services.csrf.getResubmissionURL()}")
   #end
   ##
   ## Handle output from the registration.
@@ -742,6 +748,7 @@
       {{html clean=false wiki=false}}
         &lt;form id="loginForm" action="$loginURL" method="post"&gt;
           &lt;div&gt;
+          &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
           &lt;input id="j_username" name="j_username" type="hidden" value="$escapetool.html($!userName)" /&gt;
           &lt;input id="j_password" name="j_password" type="hidden" value="$escapetool.html($!password)" /&gt;
           &lt;input id="$redirectParam" name="$redirectParam" type="hidden" value="$escapetool.html($redirect)" /&gt;
Index: applications/watchlist/src/main/resources/XWiki/WatchListManager.xml
===================================================================
--- applications/watchlist/src/main/resources/XWiki/WatchListManager.xml	(revision 29535)
+++ applications/watchlist/src/main/resources/XWiki/WatchListManager.xml	(working copy)
@@ -195,6 +195,7 @@
           &lt;fieldset&gt;
           $msg.get("watchlist.staytuned.email.frequency"):
           $profileDoc.display("interval", "edit")
+          &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
           &lt;input type="hidden" name="xredirect" id="xredirect" value="$doc.getURL("view")" /&gt;
           &lt;span class="buttonwrapper"&gt;&lt;input type="submit" value="$msg.get('watchlist.staytuned.email.frequency.save')" class="button"/&gt;&lt;/span&gt;
           &lt;/fieldset&gt;
Index: applications/search/src/main/resources/XWiki/LuceneSearchAdmin.xml
===================================================================
--- applications/search/src/main/resources/XWiki/LuceneSearchAdmin.xml	(revision 29535)
+++ applications/search/src/main/resources/XWiki/LuceneSearchAdmin.xml	(working copy)
@@ -91,6 +91,7 @@
 {{html}}
 &lt;form action="$xwiki.requestURL" enctype="multipart/form-data" method="post"&gt;
 &lt;fieldset&gt;
+&lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
 
   ## Does not really make sense to reindex the whole farm from a subwiki
   #if ($context.isMainWiki())
Index: applications/search/src/main/resources/XWiki/SearchAdmin.xml
===================================================================
--- applications/search/src/main/resources/XWiki/SearchAdmin.xml	(revision 29535)
+++ applications/search/src/main/resources/XWiki/SearchAdmin.xml	(working copy)
@@ -188,6 +188,7 @@
 {{html wiki="true"}}
 &lt;form id="search_XWiki.SearchConfig" method="post" action="${searchConfigDoc.getURL('save')}" onsubmit="cancelCancelEdit()"&gt;
 &lt;fieldset&gt;
+&lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
 
 &lt;p&gt;
 &lt;label for="XWiki.SearchConfigClass_0_engine"&gt;$searchEnginePropertyClass.prettyName&lt;/label&gt;
Index: applications/calendar/src/main/resources/XWiki/CalendarSheet.xml
===================================================================
--- applications/calendar/src/main/resources/XWiki/CalendarSheet.xml	(revision 29535)
+++ applications/calendar/src/main/resources/XWiki/CalendarSheet.xml	(working copy)
@@ -43,7 +43,7 @@
 
 #foreach($event in $doc.getObjects("XWiki.CalendarEvent"))
 &lt;div class="vevent"&gt;
-1.1.1 &lt;span class="summary"&gt;$event.title.replaceAll('\n', "")&lt;/span&gt; #if($hasedit) (&lt;a href="$doc.getURL("edit", "editor=object&amp;amp;classname=XWiki.CalendarEvent&amp;amp;nb=$event.number")"&gt;$msg.get("edit")&lt;/a&gt;, &lt;a href="$doc.getURL("objectremove", "classname=XWiki.CalendarEvent&amp;amp;classid=${event.number}&amp;amp;xredirect=$doc.getURL('view')")"&gt;$msg.get("delete")&lt;/a&gt;)#end
+1.1.1 &lt;span class="summary"&gt;$event.title.replaceAll('\n', "")&lt;/span&gt; #if($hasedit) (&lt;a href="$doc.getURL("edit", "editor=object&amp;amp;classname=XWiki.CalendarEvent&amp;amp;nb=$event.number")"&gt;$msg.get("edit")&lt;/a&gt;, &lt;a href="$doc.getURL("objectremove", "classname=XWiki.CalendarEvent&amp;amp;classid=${event.number}&amp;amp;xredirect=$doc.getURL('view')&amp;amp;form_token=$!{services.csrf.getToken()}")"&gt;$msg.get("delete")&lt;/a&gt;)#end
 
 &lt;div class="eventinfo"&gt;
 #if($event.category != "" &amp;&amp; $event.getProperty('category').value != "Other")
@@ -68,6 +68,7 @@
 &lt;form action="$doc.getURL('objectadd')" method="get"&gt;
 &lt;div&gt;
 &lt;div class="hidden"&gt;
+&lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
 &lt;input type="hidden" name="classname" value="XWiki.CalendarEvent" /&gt;
 &lt;input type="hidden" name="xredirect" value="${doc.getURL('view')}" /&gt;
 &lt;/div&gt;
Index: applications/photoalbum/src/main/resources/Photos/WebHome.xml
===================================================================
--- applications/photoalbum/src/main/resources/Photos/WebHome.xml	(revision 29535)
+++ applications/photoalbum/src/main/resources/Photos/WebHome.xml	(working copy)
@@ -81,6 +81,7 @@
 
 &lt;form action="" id="newdoc"&gt;
 &lt;div&gt;
+&lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
 &lt;input type="hidden" name="parent" value="Photos.WebHome" /&gt;
 &lt;input type="hidden" name="template" value="XWiki.PhotoAlbumClassTemplate" /&gt;
 &lt;input type="hidden" name="sheet" value="1" /&gt;
Index: applications/application-manager/src/main/resources/XAppCode/ExportAppCode.xml
===================================================================
--- applications/application-manager/src/main/resources/XAppCode/ExportAppCode.xml	(revision 29535)
+++ applications/application-manager/src/main/resources/XAppCode/ExportAppCode.xml	(working copy)
@@ -77,6 +77,7 @@
   #else
     &lt;form id="exportForm" action="" method="get"&gt;
       #xwikimessageboxstart($msg.get("xapp.answer.exportapp.title", [$appname]) "")
+        &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
         &lt;input type="hidden" id="confirm" name="confirm" value="1" /&gt;
         &lt;input type="hidden" id="action" name="action" value="$action" /&gt;
         &lt;input type="hidden" id="appname" name="appname" value="$appname" /&gt;
Index: applications/application-manager/src/main/resources/XAppManager/CreateApplication.xml
===================================================================
--- applications/application-manager/src/main/resources/XAppManager/CreateApplication.xml	(revision 29535)
+++ applications/application-manager/src/main/resources/XAppManager/CreateApplication.xml	(working copy)
@@ -92,6 +92,7 @@
 &lt;form method="get" action=""&gt;
   &lt;fieldset&gt;
     &lt;legend&gt;$msg.get("xapp.legend.application")&lt;/legend&gt;
+    &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
     &lt;input type="hidden" name="action" value="create" /&gt;
     &lt;table width="100%"&gt;
       &lt;tr&gt;
Index: applications/tag/src/main/resources/Main/Tags.xml
===================================================================
--- applications/tag/src/main/resources/Main/Tags.xml	(revision 29535)
+++ applications/tag/src/main/resources/Main/Tags.xml	(working copy)
@@ -239,6 +239,7 @@
   #displayTagAppTitle($urlEscapedTag $htmlEscapedTag false)
   &lt;form id="renameForm" action="$doc.getURL()" method="post"&gt;
    &lt;div&gt;
+    &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
     &lt;input name="do" type="hidden" value="renameTag" /&gt;
     &lt;input name="tag" type="hidden" value="$htmlEscapedTag" /&gt;
     $msg.get('xe.tag.rename.renameto', [$htmlEscapedTag]) &lt;input type="text" name="renameTo" /&gt; &lt;span class="buttonwrapper"&gt;&lt;input type="submit" value="$msg.get('xe.tag.rename')" class="button"/&gt;&lt;/span&gt;
@@ -267,6 +268,7 @@
   #displayTagAppTitle($urlEscapedTag $htmlEscapedTag false)
   &lt;form id="deleteForm" action="$doc.getURL()" method="post"&gt;
    &lt;div&gt;
+    &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
     &lt;input name="do" type="hidden" value="deleteTag" /&gt;
     &lt;input name="tag" type="hidden" value="$htmlEscapedTag" /&gt;
     &lt;span class="buttonwrapper"&gt;&lt;input type="submit" value="$msg.get('xe.tag.delete', [$htmlEscapedTag])" class="button/&gt;&lt;/span&gt;
Index: applications/wiki-manager/src/main/resources/XWiki/XWikiServerClassSheet.xml
===================================================================
--- applications/wiki-manager/src/main/resources/XWiki/XWikiServerClassSheet.xml	(revision 29535)
+++ applications/wiki-manager/src/main/resources/XWiki/XWikiServerClassSheet.xml	(working copy)
@@ -69,7 +69,9 @@
   #set ($wiki = $WikiManager.getWikiFromDocumentName($doc.fullName))
   ##
   #if ($action &amp;&amp; ($action == "create") &amp;&amp; $domain &amp;&amp; ($domain.trim().length() &gt; 0))
-    #if (!$wiki.containsWikiAlias($domain))
+    #if (!${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")})
+      #error($msg.get("notallowed"))
+    #elseif (!$wiki.containsWikiAlias($domain))
       #set ($alias = $wiki.newObject("XWiki.XWikiServerClass"))
       $alias.set("server", $domain)
       $alias.set("homepage", "Main.WebHome")
@@ -80,7 +82,9 @@
   #end
   ##
   #if ($action &amp;&amp; ($action == "delete") &amp;&amp; $domain &amp;&amp; ($domain.trim().length() &gt; 0))
-    #if ($wiki.containsWikiAlias($domain))
+    #if (!${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")})
+      #error($msg.get("notallowed"))
+    #elseif ($wiki.containsWikiAlias($domain))
       #set ($alias = $wiki.getWikiAlias($domain))
       #set ($removed = $wiki.removeObject($alias.objectApi))
       $wiki.save()
@@ -172,6 +176,7 @@
       &lt;form method="get" action=""&gt;
         &lt;fieldset&gt;
           &lt;legend&gt;Create new alias&lt;/legend&gt;
+          &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
           &lt;input type="hidden" name="action" value="create"/&gt;
             $msg.get("wikimanager.prop.alias.server"): &lt;input type="text" name="domain" class="wikialiasinput"/&gt;
           &lt;input type="submit" class="button" value="$msg.get("create")"/&gt;
@@ -210,6 +215,7 @@
               &lt;/dl&gt;
         #if ($context.action == "view")
   	          &lt;br /&gt;
+              &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
               &lt;input type="hidden" name="action" value="delete"/&gt;
               &lt;input type="hidden" name="domain" value="$wikiAlias.server"/&gt;
               &lt;input type="submit" class="button" value="$msg.get("delete")"/&gt;
Index: applications/wiki-manager/src/main/resources/WikiManager/CreateNewWiki.xml
===================================================================
--- applications/wiki-manager/src/main/resources/WikiManager/CreateNewWiki.xml	(revision 29535)
+++ applications/wiki-manager/src/main/resources/WikiManager/CreateNewWiki.xml	(working copy)
@@ -345,6 +345,7 @@
      $('wikinamevalidation').innerHTML = "$MSG_ERROR_WIKINAMEEMPTY";
    
      var surl = "$ISWIKINAMEAVAILABLE" + "?xpage=plain&amp;ajax=1&amp;wikiname=" + escape(wikiname);
+     surl += "&amp;form_token=$!{services.csrf.getToken()}";
      new Ajax.Request(surl,
                {
                  method: 'get',
@@ -636,6 +637,7 @@
       &lt;br /&gt;
       #if ($request.stepbystep) &lt;input type="hidden" name="stepbystep" value="$request.stepbystep" /&gt; #end
       #if ($request.doc) &lt;input type="hidden" name="doc" value="$request.doc" /&gt; #end
+      &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
       &lt;input type="submit" id="actioncreatebutton" name="actioncreate" value="${msg.get("create")}" onclick="return validate();" /&gt;
     &lt;/div&gt;
   &lt;/div&gt;
Index: applications/scheduler/src/main/resources/Scheduler/WebHome.xml
===================================================================
--- applications/scheduler/src/main/resources/Scheduler/WebHome.xml	(revision 29535)
+++ applications/scheduler/src/main/resources/Scheduler/WebHome.xml	(working copy)
@@ -267,6 +267,7 @@
 {{html}}
 &lt;form action="" id="newdoc"&gt;
 &lt;div&gt;
+&lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
 &lt;input type="hidden" name="parent" value="Scheduler.WebHome" /&gt;
 &lt;input type="hidden" name="template" value="XWiki.SchedulerJobTemplate" /&gt;
 &lt;input type="hidden" name="sheet" value="1" /&gt;
