From 159b6c8c3cb82db638570d43da668708604cc744 Mon Sep 17 00:00:00 2001
From: tursunboyevjavohir951-cmd <tursunboyevjavohir951@gmail.com>
Date: Mon, 20 Jul 2026 14:05:41 +0500
Subject: [PATCH] fix(csrf): add @csrf to all 92 Blade POST forms safely

V3 script: correctly handles Blade {{ }} expressions inside form
attributes by skipping over {{ }} blocks when finding the closing >.
No Blade expressions were broken. No forms left unprotected.

Forms now properly include @csrf directive after the opening form
tag, inside the form body.

VerifyCsrfToken middleware enabled in HttpKernel.php.
Routes api/*, cron/*, webhook/*, install/* remain CSRF-exempt.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 app/Core/Http/HttpKernel.php                                | 5 ++---
 app/Domain/Api/Templates/apiKey.blade.php                   | 1 +
 app/Domain/Api/Templates/delKey.blade.php                   | 1 +
 app/Domain/Api/Templates/newAPIKey.blade.php                | 1 +
 app/Domain/Auth/Templates/requestPwLink.blade.php           | 1 +
 app/Domain/Auth/Templates/resetPw.blade.php                 | 1 +
 app/Domain/Auth/Templates/userInvite.blade.php              | 1 +
 app/Domain/Auth/Templates/userInvite2.blade.php             | 1 +
 app/Domain/Auth/Templates/userInvite3.blade.php             | 1 +
 app/Domain/Auth/Templates/userInvite4.blade.php             | 1 +
 app/Domain/Auth/Templates/userInvite5.blade.php             | 1 +
 app/Domain/Blueprints/Templates/boardDialog.blade.php       | 1 +
 app/Domain/Blueprints/Templates/canvasDialog.blade.php      | 1 +
 app/Domain/Blueprints/Templates/delCanvas.blade.php         | 1 +
 app/Domain/Blueprints/Templates/delCanvasItem.blade.php     | 1 +
 app/Domain/Calendar/Templates/delEvent.blade.php            | 1 +
 app/Domain/Calendar/Templates/delExternalCal.blade.php      | 1 +
 app/Domain/Calendar/Templates/editEvent.blade.php           | 1 +
 .../Calendar/Templates/editExternalCalendar.blade.php       | 1 +
 app/Domain/Calendar/Templates/export.blade.php              | 1 +
 app/Domain/Calendar/Templates/importGCal.blade.php          | 1 +
 app/Domain/Calendar/Templates/showAllGCals.blade.php        | 1 +
 app/Domain/Canvas/Templates/boardDialog.blade.php           | 1 +
 app/Domain/Canvas/Templates/canvasDialog.blade.php          | 1 +
 app/Domain/Canvas/Templates/delCanvas.blade.php             | 1 +
 app/Domain/Canvas/Templates/delCanvasItem.blade.php         | 1 +
 app/Domain/Clients/Templates/delClient.blade.php            | 1 +
 app/Domain/Clients/Templates/editClient.blade.php           | 1 +
 app/Domain/Clients/Templates/newClient.blade.php            | 1 +
 app/Domain/Comments/Templates/showAll.blade.php             | 1 +
 .../Comments/Templates/submodules/generalComment.blade.php  | 1 +
 app/Domain/Connector/Templates/integrationEntity.blade.php  | 1 +
 app/Domain/Connector/Templates/integrationFields.blade.php  | 1 +
 app/Domain/Dashboard/Templates/show.blade.php               | 1 +
 app/Domain/Goalcanvas/Templates/bigRockDialog.blade.php     | 1 +
 app/Domain/Goalcanvas/Templates/canvasDialog.blade.php      | 1 +
 app/Domain/Goalcanvas/Templates/delCanvasItem.blade.php     | 1 +
 app/Domain/Help/Templates/firstTaskStep.blade.php           | 1 +
 app/Domain/Help/Templates/inviteTeamStep.blade.php          | 1 +
 app/Domain/Help/Templates/projectDefinitionStep.blade.php   | 1 +
 app/Domain/Help/Templates/projectIntroStep.blade.php        | 1 +
 app/Domain/Ideas/Templates/advancedBoards.blade.php         | 2 ++
 app/Domain/Ideas/Templates/delCanvas.blade.php              | 1 +
 app/Domain/Ideas/Templates/delCanvasItem.blade.php          | 1 +
 app/Domain/Ideas/Templates/ideaDialog.blade.php             | 1 +
 app/Domain/Ideas/Templates/showBoards.blade.php             | 2 ++
 app/Domain/Install/Templates/new.blade.php                  | 1 +
 app/Domain/Install/Templates/update.blade.php               | 1 +
 .../Logicmodelcanvas/Templates/canvasDialog.blade.php       | 1 +
 app/Domain/Projects/Templates/delProject.blade.php          | 1 +
 app/Domain/Projects/Templates/duplicateProject.blade.php    | 1 +
 app/Domain/Projects/Templates/newProject.blade.php          | 1 +
 app/Domain/Projects/Templates/showAll.blade.php             | 1 +
 app/Domain/Projects/Templates/showProject.blade.php         | 6 ++++++
 .../Projects/Templates/submodules/projectDetails.blade.php  | 1 +
 app/Domain/Setting/Templates/editBoxDialog.blade.php        | 1 +
 app/Domain/Setting/Templates/editCompanySettings.blade.php  | 2 ++
 app/Domain/Sprints/Templates/delSprint.blade.php            | 1 +
 app/Domain/Sprints/Templates/sprintdialog.blade.php         | 1 +
 app/Domain/Tickets/Templates/delMilestone.blade.php         | 1 +
 app/Domain/Tickets/Templates/delTicket.blade.php            | 1 +
 app/Domain/Tickets/Templates/milestoneDialog.blade.php      | 1 +
 app/Domain/Tickets/Templates/moveTicket.blade.php           | 1 +
 app/Domain/Tickets/Templates/newTicket.blade.php            | 1 +
 app/Domain/Tickets/Templates/newTicketModal.blade.php       | 1 +
 .../Tickets/Templates/partials/quickadd-form.blade.php      | 1 +
 app/Domain/Tickets/Templates/partials/subtasks.blade.php    | 1 +
 app/Domain/Tickets/Templates/showAll.blade.php              | 1 +
 app/Domain/Tickets/Templates/showList.blade.php             | 1 +
 app/Domain/Tickets/Templates/showTicket.blade.php           | 3 +++
 app/Domain/Tickets/Templates/showTicketModal.blade.php      | 1 +
 app/Domain/Tickets/Templates/submodules/subTasks.blade.php  | 1 +
 .../Tickets/Templates/submodules/ticketDetails.blade.php    | 1 +
 app/Domain/Tickets/Templates/submodules/timesheet.blade.php | 1 +
 app/Domain/Timesheets/Templates/addTime.blade.php           | 2 ++
 app/Domain/Timesheets/Templates/delTime.blade.php           | 1 +
 app/Domain/Timesheets/Templates/editTime.blade.php          | 1 +
 app/Domain/Timesheets/Templates/showAll.blade.php           | 1 +
 app/Domain/Timesheets/Templates/showMy.blade.php            | 1 +
 app/Domain/Timesheets/Templates/showMyList.blade.php        | 1 +
 app/Domain/TwoFA/Templates/edit.blade.php                   | 2 ++
 app/Domain/TwoFA/Templates/verify.blade.php                 | 1 +
 app/Domain/Users/Templates/delUser.blade.php                | 1 +
 app/Domain/Users/Templates/editOwn.blade.php                | 5 +++++
 app/Domain/Users/Templates/editUser.blade.php               | 1 +
 app/Domain/Users/Templates/importLdapDialog.blade.php       | 2 ++
 app/Domain/Users/Templates/newUser.blade.php                | 1 +
 app/Domain/Widgets/Templates/partials/myToDos.blade.php     | 2 ++
 app/Domain/Wiki/Templates/articleDialog.blade.php           | 1 +
 app/Domain/Wiki/Templates/delArticle.blade.php              | 1 +
 app/Domain/Wiki/Templates/delWiki.blade.php                 | 1 +
 app/Domain/Wiki/Templates/show.blade.php                    | 1 +
 app/Domain/Wiki/Templates/wikiDialog.blade.php              | 1 +
 93 files changed, 112 insertions(+), 3 deletions(-)

diff --git a/app/Core/Http/HttpKernel.php b/app/Core/Http/HttpKernel.php
index 5f8b95562d..927420b48e 100644
--- a/app/Core/Http/HttpKernel.php
+++ b/app/Core/Http/HttpKernel.php
@@ -59,9 +59,8 @@ class HttpKernel extends Kernel
         \Leantime\Core\Middleware\InitialHeaders::class,
         // \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
 
-        // CSRF verification is NOT yet global — ~82 legacy .tpl.php forms lack @csrf tokens.
-        // Enable globally only after all forms are tokenized. Until then, apply per-route.
-        // \Leantime\Core\Middleware\VerifyCsrfToken::class,
+        // CSRF protection enabled globally — all Blade forms now include @csrf.
+        \Leantime\Core\Middleware\VerifyCsrfToken::class,
 
         \Leantime\Core\Middleware\AuthCheck::class,
         \Leantime\Core\Middleware\AuthenticateSession::class,
diff --git a/app/Domain/Api/Templates/apiKey.blade.php b/app/Domain/Api/Templates/apiKey.blade.php
index 3e7cb44f65..b41e6ed3da 100644
--- a/app/Domain/Api/Templates/apiKey.blade.php
+++ b/app/Domain/Api/Templates/apiKey.blade.php
@@ -9,6 +9,7 @@
 {!! $tpl->displayNotification() !!}
 
 <form action="{{ BASE_URL }}/api/apiKey/{{ (int) $_GET['id'] }}" method="post" class="stdform formModal" >
+@csrf
         <input type="hidden" name="{{ session('formTokenName') }}" value="{{ session('formTokenValue') }}" />
         <input type="hidden" name="save" value="1" />
 
diff --git a/app/Domain/Api/Templates/delKey.blade.php b/app/Domain/Api/Templates/delKey.blade.php
index 8f8a2e1e24..73dacb32e4 100644
--- a/app/Domain/Api/Templates/delKey.blade.php
+++ b/app/Domain/Api/Templates/delKey.blade.php
@@ -18,6 +18,7 @@
         <h5 class="subtitle">{!! __('subtitles.delete_key') !!}</h5>
 
             <form method="post">
+            @csrf
                 <input type="hidden" name="{{ session('formTokenName') }}" value="{{ session('formTokenValue') }}" />
                 <p>{!! __('text.confirm_key_deletion') !!}</p><br />
                 <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
diff --git a/app/Domain/Api/Templates/newAPIKey.blade.php b/app/Domain/Api/Templates/newAPIKey.blade.php
index 833f516e19..c7c669019a 100644
--- a/app/Domain/Api/Templates/newAPIKey.blade.php
+++ b/app/Domain/Api/Templates/newAPIKey.blade.php
@@ -17,6 +17,7 @@
         <x-global::forms.button contentRole="primary" onclick="leantime.snippets.copyUrl('apiKey');">{!! __('links.copy_key') !!}</x-global::forms.button>
     @else
     <form action="{{ BASE_URL }}/api/newApiKey" method="post" class="stdform formModal" >
+    @csrf
 
         <input type="hidden" name="save" value="1" />
 
diff --git a/app/Domain/Auth/Templates/requestPwLink.blade.php b/app/Domain/Auth/Templates/requestPwLink.blade.php
index 0300bd7171..0b16d9029a 100644
--- a/app/Domain/Auth/Templates/requestPwLink.blade.php
+++ b/app/Domain/Auth/Templates/requestPwLink.blade.php
@@ -11,6 +11,7 @@
 <div class="regcontent">
     @dispatchEvent('afterRegcontentOpen')
     <form id="resetPassword" action="" method="post">
+    @csrf
         @dispatchEvent('afterFormOpen')
         {!! $tpl->displayInlineNotification() !!}
         <p>{!! __('text.enter_email_address_to_reset') !!}<br /><br /></p>
diff --git a/app/Domain/Auth/Templates/resetPw.blade.php b/app/Domain/Auth/Templates/resetPw.blade.php
index c649f3be4d..79b6fd0ed2 100644
--- a/app/Domain/Auth/Templates/resetPw.blade.php
+++ b/app/Domain/Auth/Templates/resetPw.blade.php
@@ -13,6 +13,7 @@
 <div class="regcontent">
     @dispatchEvent('afterRegcontentOpen')
     <form id="resetPassword" action="" method="post">
+    @csrf
         @dispatchEvent('afterFormOpen')
 
         {!! $tpl->displayInlineNotification() !!}
diff --git a/app/Domain/Auth/Templates/userInvite.blade.php b/app/Domain/Auth/Templates/userInvite.blade.php
index 870a22f119..eb3ff851ce 100644
--- a/app/Domain/Auth/Templates/userInvite.blade.php
+++ b/app/Domain/Auth/Templates/userInvite.blade.php
@@ -11,6 +11,7 @@
     <?php $tpl->dispatchTplEvent('afterRegcontentOpen'); ?>
 
     <form id="resetPassword" action="" method="post">
+    @csrf
         <?php $tpl->dispatchTplEvent('afterFormOpen'); ?>
 
         <?php echo $tpl->displayInlineNotification(); ?>
diff --git a/app/Domain/Auth/Templates/userInvite2.blade.php b/app/Domain/Auth/Templates/userInvite2.blade.php
index e1d500753c..c8d9850bf2 100644
--- a/app/Domain/Auth/Templates/userInvite2.blade.php
+++ b/app/Domain/Auth/Templates/userInvite2.blade.php
@@ -10,6 +10,7 @@
 <div class="regcontent">
 
     <form id="resetPassword" action="" method="post">
+    @csrf
         <input type="hidden" name="step" value="2" />
 
         {{  $tpl->displayInlineNotification() }}
diff --git a/app/Domain/Auth/Templates/userInvite3.blade.php b/app/Domain/Auth/Templates/userInvite3.blade.php
index 128696900c..4156d5001b 100644
--- a/app/Domain/Auth/Templates/userInvite3.blade.php
+++ b/app/Domain/Auth/Templates/userInvite3.blade.php
@@ -10,6 +10,7 @@
 <div class="regcontent">
 
     <form id="resetPassword" action="" method="post">
+    @csrf
         <input type="hidden" name="step" value="3" />
 
         {{  $tpl->displayInlineNotification() }}
diff --git a/app/Domain/Auth/Templates/userInvite4.blade.php b/app/Domain/Auth/Templates/userInvite4.blade.php
index 082aa05e21..a723a9a2f3 100644
--- a/app/Domain/Auth/Templates/userInvite4.blade.php
+++ b/app/Domain/Auth/Templates/userInvite4.blade.php
@@ -12,6 +12,7 @@
 <div class="regcontent">
 
     <form id="resetPassword" action="" method="post">
+    @csrf
 
         <input type="hidden" name="step" value="4"/>
 
diff --git a/app/Domain/Auth/Templates/userInvite5.blade.php b/app/Domain/Auth/Templates/userInvite5.blade.php
index ceb80e81f8..298e6096e0 100644
--- a/app/Domain/Auth/Templates/userInvite5.blade.php
+++ b/app/Domain/Auth/Templates/userInvite5.blade.php
@@ -9,6 +9,7 @@
 <div class="regcontent">
 
     <form id="resetPassword" action="" method="post">
+    @csrf
 
         <input type="hidden" name="step" value="5"/>
         <input type="hidden" name="complete" value="1"/>
diff --git a/app/Domain/Blueprints/Templates/boardDialog.blade.php b/app/Domain/Blueprints/Templates/boardDialog.blade.php
index ca6067a9cb..ab3ade83f2 100644
--- a/app/Domain/Blueprints/Templates/boardDialog.blade.php
+++ b/app/Domain/Blueprints/Templates/boardDialog.blade.php
@@ -4,6 +4,7 @@
 @endphp
 
 <form action="{{ BASE_URL }}/blueprints/{{ $canvasSlug }}/boardDialog{{ isset($_GET['id']) ? '/' . (int) $_GET['id'] : '' }}" method="post" class="formModal">
+@csrf
     <div class="modal-header">
         <h4 class="modal-title"><i class='fa fa-plus'></i> {!! __('subtitles.create_new_board') !!}</h4>
     </div>
diff --git a/app/Domain/Blueprints/Templates/canvasDialog.blade.php b/app/Domain/Blueprints/Templates/canvasDialog.blade.php
index bc90535b06..09eb67743c 100644
--- a/app/Domain/Blueprints/Templates/canvasDialog.blade.php
+++ b/app/Domain/Blueprints/Templates/canvasDialog.blade.php
@@ -36,6 +36,7 @@
     {!! $tpl->displayNotification() !!}
 
     <form class="formModal" method="post" action="{{ BASE_URL }}/blueprints/{{ $canvasSlug }}/editCanvasItem/{{ $id }}">
+    @csrf
 
         <input type="hidden" value="{{ $currentCanvas }}" name="canvasId" />
         <input type="hidden" value="{{ $canvasItem['box'] }}" name="box" id="box"/>
diff --git a/app/Domain/Blueprints/Templates/delCanvas.blade.php b/app/Domain/Blueprints/Templates/delCanvas.blade.php
index b594e3bb93..9b3eb6a518 100644
--- a/app/Domain/Blueprints/Templates/delCanvas.blade.php
+++ b/app/Domain/Blueprints/Templates/delCanvas.blade.php
@@ -5,6 +5,7 @@
 <h4 class="widgettitle title-light">{!! __('subtitles.delete') !!}</h4>
 
 <form method="post" action="{{ BASE_URL }}/blueprints/{{ $canvasSlug }}/delCanvas/{{ $id }}">
+@csrf
     <p>{!! __('text.confirm_board_deletion') !!}</p><br />
     <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
     <x-global::forms.button tag="a" contentRole="tertiary"
diff --git a/app/Domain/Blueprints/Templates/delCanvasItem.blade.php b/app/Domain/Blueprints/Templates/delCanvasItem.blade.php
index 85bccdd4ad..8a48bc2751 100644
--- a/app/Domain/Blueprints/Templates/delCanvasItem.blade.php
+++ b/app/Domain/Blueprints/Templates/delCanvasItem.blade.php
@@ -6,6 +6,7 @@
 <hr style="margin-top: 5px; margin-bottom: 15px;">
 
 <form method="post" action="{{ BASE_URL }}/blueprints/{{ $canvasSlug }}/delCanvasItem/{{ $id }}">
+@csrf
     <p>{!! __('text.confirm_board_item_deletion') !!}</p><br />
     <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
     <x-global::forms.button tag="a" contentRole="tertiary" link="{{ BASE_URL }}/blueprints/{{ $canvasSlug }}/showCanvas">{!! __('buttons.back') !!}</x-global::forms.button>
diff --git a/app/Domain/Calendar/Templates/delEvent.blade.php b/app/Domain/Calendar/Templates/delEvent.blade.php
index 445bb11016..f0137bf792 100644
--- a/app/Domain/Calendar/Templates/delEvent.blade.php
+++ b/app/Domain/Calendar/Templates/delEvent.blade.php
@@ -9,6 +9,7 @@
 <h4 class="widgettitle title-light">{!! __('subtitles.delete') !!}</h4>
 
 <form method="post" class="formModal" action="{{ BASE_URL }}/calendar/delEvent/{{ $id }}">
+@csrf
     @dispatchEvent('afterFormOpen')
     <p>{!! __('text.confirm_event_deletion') !!}</p><br />
     @dispatchEvent('beforeSubmitButton')
diff --git a/app/Domain/Calendar/Templates/delExternalCal.blade.php b/app/Domain/Calendar/Templates/delExternalCal.blade.php
index 651c850549..b5e50f6e48 100644
--- a/app/Domain/Calendar/Templates/delExternalCal.blade.php
+++ b/app/Domain/Calendar/Templates/delExternalCal.blade.php
@@ -9,6 +9,7 @@
 <h4 class="widgettitle title-light">{!! __('subtitles.delete') !!}</h4>
 
 <form method="post" class="formModal" action="{{ BASE_URL }}/calendar/delExternalCalendar/{{ $id }}">
+@csrf
     @dispatchEvent('afterFormOpen')
     <p>{!! __('text.confirm_calendar_deletion') !!}</p><br />
     @dispatchEvent('beforeSubmitButton')
diff --git a/app/Domain/Calendar/Templates/editEvent.blade.php b/app/Domain/Calendar/Templates/editEvent.blade.php
index 7fb597d381..d93a5d35a0 100644
--- a/app/Domain/Calendar/Templates/editEvent.blade.php
+++ b/app/Domain/Calendar/Templates/editEvent.blade.php
@@ -11,6 +11,7 @@
 <h4 class="widgettitle title-light">{!! __('subtitles.event') !!}</h4>
 
 <form action="{{ BASE_URL }}/calendar/editEvent/{{ $values['id'] }}" method="post" class="formModal">
+@csrf
 
     @dispatchEvent('afterFormOpen')
 
diff --git a/app/Domain/Calendar/Templates/editExternalCalendar.blade.php b/app/Domain/Calendar/Templates/editExternalCalendar.blade.php
index 71c11287c5..e548f1e4aa 100644
--- a/app/Domain/Calendar/Templates/editExternalCalendar.blade.php
+++ b/app/Domain/Calendar/Templates/editExternalCalendar.blade.php
@@ -5,6 +5,7 @@
 
 
 <form action="{{ BASE_URL }}/calendar/editExternal/{{ $values['id'] }}" method="post" class="formModal">
+@csrf
 
     <input type="hidden" name="save" value="1" />
     <label for="name">{{ $tpl->__('label.calendar_name') }}:</label>
diff --git a/app/Domain/Calendar/Templates/export.blade.php b/app/Domain/Calendar/Templates/export.blade.php
index f4dd150a93..983e3736bd 100644
--- a/app/Domain/Calendar/Templates/export.blade.php
+++ b/app/Domain/Calendar/Templates/export.blade.php
@@ -11,6 +11,7 @@
 {!! $tpl->displayNotification() !!}
 
 <form class="formModal" method="post" action="{{ BASE_URL }}/calendar/export">
+@csrf
 
     @dispatchEvent('afterFormOpen')
 
diff --git a/app/Domain/Calendar/Templates/importGCal.blade.php b/app/Domain/Calendar/Templates/importGCal.blade.php
index eb6c234c30..f7ca08aa50 100644
--- a/app/Domain/Calendar/Templates/importGCal.blade.php
+++ b/app/Domain/Calendar/Templates/importGCal.blade.php
@@ -5,6 +5,7 @@
 
 
 <form action="{{ BASE_URL }}/calendar/importGCal" method="post" class="formModal">
+@csrf
 
     <label for="name">{{ $tpl->__('label.calendar_name') }}:</label>
     <x-global::forms.text-input id="name" name="name" autocomplete="off" value="{{ $values['name'] }}" /><br />
diff --git a/app/Domain/Calendar/Templates/showAllGCals.blade.php b/app/Domain/Calendar/Templates/showAllGCals.blade.php
index 1e9899c6b6..b94141c09c 100644
--- a/app/Domain/Calendar/Templates/showAllGCals.blade.php
+++ b/app/Domain/Calendar/Templates/showAllGCals.blade.php
@@ -6,6 +6,7 @@
 <div class="pageheader">
     @dispatchEvent('afterPageHeaderOpen')
     <form action="{{ BASE_URL }}/index.php?act=tickets.showAll" method="post" class="searchbar">
+    @csrf
         <x-global::forms.text-input name="term" placeholder="To search type and hit enter..." />
     </form>
 
diff --git a/app/Domain/Canvas/Templates/boardDialog.blade.php b/app/Domain/Canvas/Templates/boardDialog.blade.php
index 3e0aa1d776..ce46f6ee48 100644
--- a/app/Domain/Canvas/Templates/boardDialog.blade.php
+++ b/app/Domain/Canvas/Templates/boardDialog.blade.php
@@ -4,6 +4,7 @@
 @endphp
 
 <form action="{{ BASE_URL }}/{{ $canvasName }}canvas/boardDialog{{ isset($_GET['id']) ? '/' . (int) $_GET['id'] : '' }}" method="post" class="formModal">
+@csrf
     <div class="modal-header">
         <h4 class="modal-title"><i class='fa fa-plus'></i> {!! __('subtitles.create_new_board') !!}</h4>
     </div>
diff --git a/app/Domain/Canvas/Templates/canvasDialog.blade.php b/app/Domain/Canvas/Templates/canvasDialog.blade.php
index 66757a0f7b..f08c4ef88a 100644
--- a/app/Domain/Canvas/Templates/canvasDialog.blade.php
+++ b/app/Domain/Canvas/Templates/canvasDialog.blade.php
@@ -34,6 +34,7 @@
     {!! $tpl->displayNotification() !!}
 
     <form class="formModal" method="post" action="{{ BASE_URL }}/{{ $canvasName }}canvas/editCanvasItem/{{ $id }}">
+    @csrf
 
         <input type="hidden" value="{{ $currentCanvas }}" name="canvasId" />
         <input type="hidden" value="{{ $canvasItem['box'] }}" name="box" id="box"/>
diff --git a/app/Domain/Canvas/Templates/delCanvas.blade.php b/app/Domain/Canvas/Templates/delCanvas.blade.php
index d61ce3df7f..65056d4178 100644
--- a/app/Domain/Canvas/Templates/delCanvas.blade.php
+++ b/app/Domain/Canvas/Templates/delCanvas.blade.php
@@ -5,6 +5,7 @@
 <h4 class="widgettitle title-light">{!! __('subtitles.delete') !!}</h4>
 
 <form method="post" action="{{ BASE_URL }}/{{ $canvasName }}canvas/delCanvas/{{ $id }}">
+@csrf
     <p>{!! __('text.confirm_board_deletion') !!}</p><br />
     <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
     <x-global::forms.button tag="a" contentRole="tertiary"
diff --git a/app/Domain/Canvas/Templates/delCanvasItem.blade.php b/app/Domain/Canvas/Templates/delCanvasItem.blade.php
index 42620a8597..4c7b7f2726 100644
--- a/app/Domain/Canvas/Templates/delCanvasItem.blade.php
+++ b/app/Domain/Canvas/Templates/delCanvasItem.blade.php
@@ -6,6 +6,7 @@
 <hr style="margin-top: 5px; margin-bottom: 15px;">
 
 <form method="post" action="{{ BASE_URL }}/{{ $canvasName }}canvas/delCanvasItem/{{ $id }}">
+@csrf
     <p>{!! __('text.confirm_board_item_deletion') !!}</p><br />
     <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
     <x-global::forms.button tag="a" contentRole="tertiary" link="{{ BASE_URL }}/{{ $canvasName }}canvas/showCanvas">{!! __('buttons.back') !!}</x-global::forms.button>
diff --git a/app/Domain/Clients/Templates/delClient.blade.php b/app/Domain/Clients/Templates/delClient.blade.php
index f01f33397a..72e9cf1518 100644
--- a/app/Domain/Clients/Templates/delClient.blade.php
+++ b/app/Domain/Clients/Templates/delClient.blade.php
@@ -22,6 +22,7 @@
         <div class="widgetcontent">
 
             <form method="post">
+            @csrf
 
                 @dispatchEvent('afterFormOpen')
 
diff --git a/app/Domain/Clients/Templates/editClient.blade.php b/app/Domain/Clients/Templates/editClient.blade.php
index 624fb7cffd..7554064138 100644
--- a/app/Domain/Clients/Templates/editClient.blade.php
+++ b/app/Domain/Clients/Templates/editClient.blade.php
@@ -19,6 +19,7 @@
         {!! $tpl->displayNotification() !!}
 
         <form action="" method="post" class="stdform">
+        @csrf
 
             <div class="widget">
             <h4 class="widgettitle">{!! __('OVERVIEW') !!}</h4>
diff --git a/app/Domain/Clients/Templates/newClient.blade.php b/app/Domain/Clients/Templates/newClient.blade.php
index 756363beaa..cacb4ddee7 100644
--- a/app/Domain/Clients/Templates/newClient.blade.php
+++ b/app/Domain/Clients/Templates/newClient.blade.php
@@ -23,6 +23,7 @@
            <div class="widgetcontent">
 
                 <form action="" method="post" class="stdform">
+                @csrf
 
                     @dispatchEvent('afterFormOpen')
 
diff --git a/app/Domain/Comments/Templates/showAll.blade.php b/app/Domain/Comments/Templates/showAll.blade.php
index fb9f60c004..872b2aec9b 100644
--- a/app/Domain/Comments/Templates/showAll.blade.php
+++ b/app/Domain/Comments/Templates/showAll.blade.php
@@ -21,6 +21,7 @@ class="fa fa-comments"></span>{!! __('subtitles.discussion') !!}
 
 <form method="post" accept-charset="utf-8" action="{{ $formUrl }}"
       id="commentForm">
+@csrf
     <a href="javascript:void(0);" onclick="toggleCommentBoxes(0)"
        style="display:none;" id="mainToggler"><span
                 class="fa fa-plus-square"></span> {!! __('links.add_new_comment') !!}
diff --git a/app/Domain/Comments/Templates/submodules/generalComment.blade.php b/app/Domain/Comments/Templates/submodules/generalComment.blade.php
index 86da350b54..b05826aaa9 100644
--- a/app/Domain/Comments/Templates/submodules/generalComment.blade.php
+++ b/app/Domain/Comments/Templates/submodules/generalComment.blade.php
@@ -20,6 +20,7 @@
 @endphp
 
 <form method="post" accept-charset="utf-8" action="{{ $formUrl }}" id="commentForm-{{ $formHash }}" class="formModal">
+@csrf
 
     @if ($login::userIsAtLeast($roles::$commenter))
         <div class="mainToggler-{{ $formHash }}" id="">
diff --git a/app/Domain/Connector/Templates/integrationEntity.blade.php b/app/Domain/Connector/Templates/integrationEntity.blade.php
index 39cf3d37be..8fc8305f8b 100644
--- a/app/Domain/Connector/Templates/integrationEntity.blade.php
+++ b/app/Domain/Connector/Templates/integrationEntity.blade.php
@@ -39,6 +39,7 @@
             The arrow indicates that we will synchronize from one location to the other.<br /><br />
 
             <form method="post" action="{{ BASE_URL }}/connector/integration/?provider={{ $provider->id }}&step=fields{{ $urlAppend }}">
+            @csrf
 
                 <div class="row">
                     <div class="col-md-3"></div>
diff --git a/app/Domain/Connector/Templates/integrationFields.blade.php b/app/Domain/Connector/Templates/integrationFields.blade.php
index ab989b8db2..e5f38684f9 100644
--- a/app/Domain/Connector/Templates/integrationFields.blade.php
+++ b/app/Domain/Connector/Templates/integrationFields.blade.php
@@ -39,6 +39,7 @@
                 <p class="mb-2">Match the fields from your source to the corresponding fields in Leantime</p><br />
 
                 <form method="post" action="{{ BASE_URL }}/connector/integration/?provider={{ $provider->id }}&step=parse{{ $urlAppend }}">
+                @csrf
                     <table class="table table-bordered">
                         <thead>
                         <tr>
diff --git a/app/Domain/Dashboard/Templates/show.blade.php b/app/Domain/Dashboard/Templates/show.blade.php
index 6bd574f29a..f30ca19771 100644
--- a/app/Domain/Dashboard/Templates/show.blade.php
+++ b/app/Domain/Dashboard/Templates/show.blade.php
@@ -321,6 +321,7 @@ class="action-link"
                 <h5 class="subtitle">{{ __('subtitles.project_updates') }}</h5>
 
                 <form method="post" action="{{ BASE_URL }}/dashboard/show">
+                @csrf
                     <input type="hidden" name="comment" value="1" />
                         @if ($login::userIsAtLeast($roles::$editor))
                             <div id="comment0" class="commentBox tw-hidden">
diff --git a/app/Domain/Goalcanvas/Templates/bigRockDialog.blade.php b/app/Domain/Goalcanvas/Templates/bigRockDialog.blade.php
index 78b65bc638..6ef544f675 100644
--- a/app/Domain/Goalcanvas/Templates/bigRockDialog.blade.php
+++ b/app/Domain/Goalcanvas/Templates/bigRockDialog.blade.php
@@ -5,6 +5,7 @@
 
 <form class="formModal" method="post"
     action="{{ BASE_URL }}/goalcanvas/bigRock/{{ !empty($bigRock['id']) ? $bigRock['id'] : '' }}">
+@csrf
 
     <br />
     <label>{{ __('label.goal_description') }}</label>
diff --git a/app/Domain/Goalcanvas/Templates/canvasDialog.blade.php b/app/Domain/Goalcanvas/Templates/canvasDialog.blade.php
index 3fe5f08859..6230fa7515 100644
--- a/app/Domain/Goalcanvas/Templates/canvasDialog.blade.php
+++ b/app/Domain/Goalcanvas/Templates/canvasDialog.blade.php
@@ -18,6 +18,7 @@
             {{ $canvasTypes[$canvasItem['box']]['title'] }}</h1>
 
         <form class="formModal" method="post" action="{{ BASE_URL . "/goalcanvas/editCanvasItem/$id" }}">
+        @csrf
 
             <input type="hidden" value="{{ $currentCanvas }}" name="canvasId">
             <input type="hidden" value="{{ $canvasItem['box'] }}" name="box" id="box">
diff --git a/app/Domain/Goalcanvas/Templates/delCanvasItem.blade.php b/app/Domain/Goalcanvas/Templates/delCanvasItem.blade.php
index ea8b00ff14..18c7918722 100644
--- a/app/Domain/Goalcanvas/Templates/delCanvasItem.blade.php
+++ b/app/Domain/Goalcanvas/Templates/delCanvasItem.blade.php
@@ -5,6 +5,7 @@
 <hr style="margin-top: 5px; margin-bottom: 15px;">
 
 <form method="post" action="{{ BASE_URL }}/goalcanvas/delCanvasItem/{{ $id }}">
+@csrf
     <p>{{ __('text.confirm_board_item_deletion') }}</p><br />
     <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
     <x-global::forms.button tag="a" contentRole="tertiary" link="{{ BASE_URL }}/goalcanvas/showCanvas">{{ __('buttons.back') }}</x-global::forms.button>
diff --git a/app/Domain/Help/Templates/firstTaskStep.blade.php b/app/Domain/Help/Templates/firstTaskStep.blade.php
index 2214f4fed3..1ecb6da3fe 100644
--- a/app/Domain/Help/Templates/firstTaskStep.blade.php
+++ b/app/Domain/Help/Templates/firstTaskStep.blade.php
@@ -1,5 +1,6 @@
 <div style="max-width:700px;">
     <form class="onboardingModal" method="post" id="firstTaskOnboarding" action="{{ BASE_URL }}/help/firstLogin?step={{ $nextStep }}">
+    @csrf
         <input type="hidden" name="currentStep" value="{{ $currentStep }}" />
         <div class="row">
             <div class="col-md-8">
diff --git a/app/Domain/Help/Templates/inviteTeamStep.blade.php b/app/Domain/Help/Templates/inviteTeamStep.blade.php
index b00f40d6c3..9e70dad37c 100644
--- a/app/Domain/Help/Templates/inviteTeamStep.blade.php
+++ b/app/Domain/Help/Templates/inviteTeamStep.blade.php
@@ -1,4 +1,5 @@
 <form class="onboardingModal" method="post" action="{{ BASE_URL }}/help/firstLogin?step={{ $nextStep }}">
+@csrf
     <input type="hidden" name="currentStep" value="{{ $currentStep }}" />
     <div class="row">
         <div class="col-md-6">
diff --git a/app/Domain/Help/Templates/projectDefinitionStep.blade.php b/app/Domain/Help/Templates/projectDefinitionStep.blade.php
index 2dc4dad524..af2910d4a5 100644
--- a/app/Domain/Help/Templates/projectDefinitionStep.blade.php
+++ b/app/Domain/Help/Templates/projectDefinitionStep.blade.php
@@ -1,5 +1,6 @@
 <div style="max-width:900px;">
     <form class="onboardingModal" method="post" action="{{ BASE_URL }}/help/firstLogin?step={{ $nextStep }}">
+    @csrf
         <input type="hidden" name="currentStep" value="{{ $currentStep }}" />
         <div class="row">
             <div class="col-md-8">
diff --git a/app/Domain/Help/Templates/projectIntroStep.blade.php b/app/Domain/Help/Templates/projectIntroStep.blade.php
index 9670489464..c61ed58061 100644
--- a/app/Domain/Help/Templates/projectIntroStep.blade.php
+++ b/app/Domain/Help/Templates/projectIntroStep.blade.php
@@ -1,5 +1,6 @@
 <div style="max-width:700px;">
     <form class="onboardingModal" method="post" id="projectTitleOnboarding" action="{{ BASE_URL }}/help/firstLogin?step={{ $nextStep }}">
+    @csrf
         <input type="hidden" name="currentStep" value="{{ $currentStep }}" />
         <div class="row">
             <div class="col-md-8">
diff --git a/app/Domain/Ideas/Templates/advancedBoards.blade.php b/app/Domain/Ideas/Templates/advancedBoards.blade.php
index 79563d4690..544639b740 100644
--- a/app/Domain/Ideas/Templates/advancedBoards.blade.php
+++ b/app/Domain/Ideas/Templates/advancedBoards.blade.php
@@ -230,6 +230,7 @@ class="addCanvasLink" contentRole="primary">{!! __('buttons.start_new_idea_board
             <div class="modal-dialog modal-lg">
                 <div class="modal-content">
                     <form action="" method="post">
+                    @csrf
                         <div class="modal-header">
                             <button type="button" class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
                             <h4 class="modal-title">{!! __('headlines.start_new_idea_board') !!}</h4>
@@ -255,6 +256,7 @@ class="addCanvasLink" contentRole="primary">{!! __('buttons.start_new_idea_board
             <div class="modal-dialog modal-lg">
                 <div class="modal-content">
                     <form action="" method="post">
+                    @csrf
                         <div class="modal-header">
                             <button type="button" class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
                             <h4 class="modal-title">{!! __('headlines.edit_board_name') !!}</h4>
diff --git a/app/Domain/Ideas/Templates/delCanvas.blade.php b/app/Domain/Ideas/Templates/delCanvas.blade.php
index c1ca5a7366..f209eaa85e 100644
--- a/app/Domain/Ideas/Templates/delCanvas.blade.php
+++ b/app/Domain/Ideas/Templates/delCanvas.blade.php
@@ -15,6 +15,7 @@
         <h4 class="widget widgettitle">{!! __('subtitles.delete') !!}</h4>
         <div class="widgetcontent">
             <form method="post" action="{{ BASE_URL }}/ideas/delCanvas/{{ $tpl->escape($_GET['id']) }}">
+            @csrf
                 <p>{!! __('text.are_you_sure_delete_idea_board') !!}</p>
                 <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
                 <x-global::forms.button tag="a" contentRole="tertiary" link="{{ BASE_URL }}/ideas/showBoards">{!! __('buttons.back') !!}</x-global::forms.button>
diff --git a/app/Domain/Ideas/Templates/delCanvasItem.blade.php b/app/Domain/Ideas/Templates/delCanvasItem.blade.php
index d167d91a29..fef69db194 100644
--- a/app/Domain/Ideas/Templates/delCanvasItem.blade.php
+++ b/app/Domain/Ideas/Templates/delCanvasItem.blade.php
@@ -5,6 +5,7 @@
 <h4 class="widgettitle title-light"><i class="fa fa-trash"></i> {!! __('buttons.delete') !!}</h4>
 
 <form method="post" action="{{ BASE_URL }}/ideas/delCanvasItem/{{ (int) $_GET['id'] }}">
+@csrf
     <p>{!! __('text.are_you_sure_delete_idea') !!}</p><br />
     <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
     <x-global::forms.button tag="a" contentRole="tertiary" link="{{ BASE_URL }}/ideas/showBoards/">{!! __('buttons.back') !!}</x-global::forms.button>
diff --git a/app/Domain/Ideas/Templates/ideaDialog.blade.php b/app/Domain/Ideas/Templates/ideaDialog.blade.php
index 97178ae651..2aff69ecca 100644
--- a/app/Domain/Ideas/Templates/ideaDialog.blade.php
+++ b/app/Domain/Ideas/Templates/ideaDialog.blade.php
@@ -15,6 +15,7 @@
 {!! $tpl->displayNotification() !!}
 
 <form class="formModal" method="post" action="{{ BASE_URL }}/ideas/ideaDialog/{{ $id }}">
+@csrf
 
 <div class="row">
 
diff --git a/app/Domain/Ideas/Templates/showBoards.blade.php b/app/Domain/Ideas/Templates/showBoards.blade.php
index 4a88364233..a0c930d17d 100644
--- a/app/Domain/Ideas/Templates/showBoards.blade.php
+++ b/app/Domain/Ideas/Templates/showBoards.blade.php
@@ -226,6 +226,7 @@ class="addCanvasLink" contentRole="primary">{!! __('links.icon.create_new_board'
             <div class="modal-dialog modal-lg">
                 <div class="modal-content">
                     <form action="" method="post">
+                    @csrf
                         <div class="modal-header">
                             <button type="button" class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
                             <h4 class="modal-title">{!! __('headlines.start_new_idea_board') !!}</h4>
@@ -249,6 +250,7 @@ class="addCanvasLink" contentRole="primary">{!! __('links.icon.create_new_board'
             <div class="modal-dialog modal-lg">
                 <div class="modal-content">
                     <form action="" method="post">
+                    @csrf
                         <div class="modal-header">
                             <button type="button" class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
                             <h4 class="modal-title">{!! __('headlines.edit_board_name') !!}</h4>
diff --git a/app/Domain/Install/Templates/new.blade.php b/app/Domain/Install/Templates/new.blade.php
index 27758577f2..89b158c3bc 100644
--- a/app/Domain/Install/Templates/new.blade.php
+++ b/app/Domain/Install/Templates/new.blade.php
@@ -14,6 +14,7 @@
     {!! $tpl->displayInlineNotification() !!}
 
     <form action="{{ BASE_URL }}/install" method="post" class="registrationForm">
+    @csrf
         <h3 class="subtitle">{!! __('subtitles.login_info') !!}</h3>
         <x-global::forms.text-input type="email" name="email" placeholder="{{ __('label.email') }}" value="" /><br />
         <br /><br />
diff --git a/app/Domain/Install/Templates/update.blade.php b/app/Domain/Install/Templates/update.blade.php
index e7771659b3..63f334db50 100644
--- a/app/Domain/Install/Templates/update.blade.php
+++ b/app/Domain/Install/Templates/update.blade.php
@@ -11,6 +11,7 @@
 <div class="regcontent" id="login">
     <p>{!! __('text.new_db_version') !!}</p><br />
     <form action="{{ BASE_URL }}/install/update" method="post" class="registrationForm">
+    @csrf
         <input type="hidden" name="updateDB" value="1" />
         <p><x-global::forms.button tag="input" inputType="submit" name="updateAction" contentRole="primary" :labelText="__('buttons.update_now')" onClick="this.form.submit(); this.disabled=true; this.value='Updating…'; " /></p>
     </form>
diff --git a/app/Domain/Logicmodelcanvas/Templates/canvasDialog.blade.php b/app/Domain/Logicmodelcanvas/Templates/canvasDialog.blade.php
index 995cbdec87..5e85c017e4 100644
--- a/app/Domain/Logicmodelcanvas/Templates/canvasDialog.blade.php
+++ b/app/Domain/Logicmodelcanvas/Templates/canvasDialog.blade.php
@@ -57,6 +57,7 @@
     {!! $tpl->displayNotification() !!}
 
     <form class="formModal" method="post" action="{{ BASE_URL }}/{{ $canvasName }}canvas/editCanvasItem/{{ $id }}">
+    @csrf
 
         <input type="hidden" value="{{ $tpl->get('currentCanvas') }}" name="canvasId" />
         <input type="hidden" value="{{ $id }}" name="itemId" id="itemId"/>
diff --git a/app/Domain/Projects/Templates/delProject.blade.php b/app/Domain/Projects/Templates/delProject.blade.php
index 685bb3ebf4..1180d34a2b 100644
--- a/app/Domain/Projects/Templates/delProject.blade.php
+++ b/app/Domain/Projects/Templates/delProject.blade.php
@@ -20,6 +20,7 @@
         <div class="widgetcontent">
 
             <form method="post">
+            @csrf
                 <p>{!! __('text.confirm_project_deletion') !!}</p><br />
                 <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
                 <x-global::forms.button tag="a" link="{{ BASE_URL }}/projects/showProject/{{ $project['id'] }}" contentRole="tertiary">{!! __('buttons.back') !!}</x-global::forms.button>
diff --git a/app/Domain/Projects/Templates/duplicateProject.blade.php b/app/Domain/Projects/Templates/duplicateProject.blade.php
index 46019aadb7..14c692979e 100644
--- a/app/Domain/Projects/Templates/duplicateProject.blade.php
+++ b/app/Domain/Projects/Templates/duplicateProject.blade.php
@@ -3,6 +3,7 @@
 {!! $tpl->displayNotification() !!}
 
 <form class="formModal" method="post" action="{{ BASE_URL }}/projects/duplicateProject/{{ $project['id'] }}">
+@csrf
 
     <label>{!! __('label.newProjectName') !!}</label>
     <x-global::forms.text-input name="projectName" value="{!! __('label.copy_of') !!} {{ $project['name'] }}" /><br />
diff --git a/app/Domain/Projects/Templates/newProject.blade.php b/app/Domain/Projects/Templates/newProject.blade.php
index 09e48fa802..8afa195c05 100644
--- a/app/Domain/Projects/Templates/newProject.blade.php
+++ b/app/Domain/Projects/Templates/newProject.blade.php
@@ -25,6 +25,7 @@
 
             <div id="projectdetails">
                 <form action="" method="post" class="">
+                @csrf
 
                     <div class="row">
 
diff --git a/app/Domain/Projects/Templates/showAll.blade.php b/app/Domain/Projects/Templates/showAll.blade.php
index ad85070e7d..98d92173ed 100644
--- a/app/Domain/Projects/Templates/showAll.blade.php
+++ b/app/Domain/Projects/Templates/showAll.blade.php
@@ -23,6 +23,7 @@
 
         <div class="pull-right">
             <form action="" method="post">
+            @csrf
                 <input type="hidden" name="hideClosedProjects" value="1" />
                 <input type="checkbox" name="showClosedProjects" onclick="form.submit();" id="showClosed" @if ($showClosedProjects) checked='checked' @endif />&nbsp;<label for="showClosed" class="pull-right">Show Closed Projects</label>
             </form>
diff --git a/app/Domain/Projects/Templates/showProject.blade.php b/app/Domain/Projects/Templates/showProject.blade.php
index e44295dcd8..7f511f1374 100644
--- a/app/Domain/Projects/Templates/showProject.blade.php
+++ b/app/Domain/Projects/Templates/showProject.blade.php
@@ -44,6 +44,7 @@
 
             <div id="team">
                 <form method="post" action="{{ BASE_URL }}/projects/showProject/{{ $project['id'] }}#team">
+                @csrf
                     <input type="hidden" name="saveUsers" value="1" />
 
 
@@ -217,6 +218,7 @@
                     <div class="col-md-4">
                         <strong>{!! __('label.webhook_url') !!}</strong><br />
                         <form action="{{ BASE_URL }}/projects/showProject/{{ $project['id'] }}#integrations" method="post">
+                        @csrf
                             <x-global::forms.text-input name="mattermostWebhookURL" id="mattermostWebhookURL" value="{{ e($mattermostWebhookURL) }}" />
                             <br />
                             <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.save')" name="mattermostSave" />
@@ -236,6 +238,7 @@
                     <div class="col-md-4">
                         <strong>{!! __('label.webhook_url') !!}</strong><br />
                         <form action="{{ BASE_URL }}/projects/showProject/{{ $project['id'] }}#integrations" method="post">
+                        @csrf
                             <x-global::forms.text-input name="slackWebhookURL" id="slackWebhookURL" value="{{ e($slackWebhookURL) }}" />
                             <br />
                             <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.save')" name="slackSave" />
@@ -255,6 +258,7 @@
                     <div class="col-md-4">
 
                         <form action="{{ BASE_URL }}/projects/showProject/{{ $project['id'] }}#integrations" method="post">
+                        @csrf
                             <strong>{!! __('label.base_url') !!}</strong><br />
                             <x-global::forms.text-input name="zulipURL" id="zulipURL" placeholder="{{ __('input.placeholders.zulip_url') }}" value="{{ $zulipHook['zulipURL'] }}" />
                             <br />
@@ -288,6 +292,7 @@
                     <div class="col-md-4">
                         <strong>{!! __('label.webhook_url') !!}</strong><br/>
                         <form action="{{ BASE_URL }}/projects/showProject/{{ $project['id'] }}#integrations" method="post">
+                        @csrf
                             @for ($i = 1; $i <= 3; $i++)
                             @php $discordVarName = 'discordWebhookURL'.$i; $discordVarVal = $$discordVarName ?? ''; @endphp
                             <input type="text" name="discordWebhookURL{{ $i }}" id="discordWebhookURL{{ $i }}" placeholder="{{ __('input.placeholders.discord_url') }}" value="{{ e($discordVarVal) }}"/><br/>
@@ -301,6 +306,7 @@
 
             <div id="todosettings">
                 <form action="{{ BASE_URL }}/projects/showProject/{{ $project['id'] }}#todosettings" method="post">
+                @csrf
                     <ul class="sortableTicketList" id="todoStatusList">
                         @foreach ($todoStatus as $key => $ticketStatus)
                             <li>
diff --git a/app/Domain/Projects/Templates/submodules/projectDetails.blade.php b/app/Domain/Projects/Templates/submodules/projectDetails.blade.php
index ba7d1943c2..87d14b2faf 100644
--- a/app/Domain/Projects/Templates/submodules/projectDetails.blade.php
+++ b/app/Domain/Projects/Templates/submodules/projectDetails.blade.php
@@ -3,6 +3,7 @@
 @endphp
 
 <form action="" method="post" class="stdform">
+@csrf
 
     <div class="row">
 
diff --git a/app/Domain/Setting/Templates/editBoxDialog.blade.php b/app/Domain/Setting/Templates/editBoxDialog.blade.php
index 1ef8bb0f3c..154d1ee53a 100644
--- a/app/Domain/Setting/Templates/editBoxDialog.blade.php
+++ b/app/Domain/Setting/Templates/editBoxDialog.blade.php
@@ -6,6 +6,7 @@
 {!! $tpl->displayNotification() !!}
 
 <form class="formModal" method="post" action="{{ BASE_URL }}/setting/editBoxLabel?{{ http_build_query(['module' => request()->query('module', ''), 'label' => request()->query('label', '')]) }}">
+@csrf
 
     <label>{!! __('label.label') !!}</label>
     <x-global::forms.text-input name="newLabel" value="{{ $currentLabel }}" /><br />
diff --git a/app/Domain/Setting/Templates/editCompanySettings.blade.php b/app/Domain/Setting/Templates/editCompanySettings.blade.php
index 14d78a8b76..e13267e0b6 100644
--- a/app/Domain/Setting/Templates/editCompanySettings.blade.php
+++ b/app/Domain/Setting/Templates/editCompanySettings.blade.php
@@ -31,6 +31,7 @@
                         <div class="row">
                             <div class="col-md-8">
                                 <form class="" method="post" id="" action="{{ BASE_URL }}/setting/editCompanySettings#details" >
+                                @csrf
                                     <p>{!! __('text.these_are_system_wide_settings') !!}</p>
                                     <br />
                                     <input type="hidden" value="1" name="saveSettings" />
@@ -150,6 +151,7 @@ class="fa fa-sliders"></span>{!! __('label.default_notification_relevance') !!}
                             <div class="col-md-4">
 
                                 <form class="" method="post" id="" action="{{ BASE_URL }}/setting/editCompanySettings" >
+                                @csrf
                                     <input type="hidden" value="1" name="saveLogo" />
                                     <h5 class="widgettitle title-light">{!! __('headlines.logo') !!}</h5>
                                     <br />
diff --git a/app/Domain/Sprints/Templates/delSprint.blade.php b/app/Domain/Sprints/Templates/delSprint.blade.php
index 2206b39ec7..f08218dd3c 100644
--- a/app/Domain/Sprints/Templates/delSprint.blade.php
+++ b/app/Domain/Sprints/Templates/delSprint.blade.php
@@ -5,6 +5,7 @@
 <h4 class="widgettitle title-light">{!! __('headlines.delete_sprint') !!}</h4>
 
 <form method="post" action="{{ BASE_URL }}/sprints/delSprint/{{ $id }}">
+@csrf
     <p>{!! __('text.are_you_sure_delete_sprint') !!}</p><br />
     <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
     <x-global::forms.button tag="a" contentRole="tertiary" link="{{ session('lastPage') }}">{!! __('buttons.back') !!}</x-global::forms.button>
diff --git a/app/Domain/Sprints/Templates/sprintdialog.blade.php b/app/Domain/Sprints/Templates/sprintdialog.blade.php
index 250f00de7e..7d24e26692 100644
--- a/app/Domain/Sprints/Templates/sprintdialog.blade.php
+++ b/app/Domain/Sprints/Templates/sprintdialog.blade.php
@@ -16,6 +16,7 @@
 {!! $tpl->displayNotification() !!}
 
 <form class="formModal" method="post" action="{{ BASE_URL }}/sprints/editSprint/{{ $id }}">
+@csrf
 
     <label>{!! __('label.sprint_name') !!}</label>
     <x-global::forms.text-input name="name" value="{{ $currentSprint->name }}" placeholder="{{ __('label.sprint_name') }}" /><br />
diff --git a/app/Domain/Tickets/Templates/delMilestone.blade.php b/app/Domain/Tickets/Templates/delMilestone.blade.php
index df3d57fb84..0f8bd51981 100644
--- a/app/Domain/Tickets/Templates/delMilestone.blade.php
+++ b/app/Domain/Tickets/Templates/delMilestone.blade.php
@@ -1,6 +1,7 @@
 <h4 class="widgettitle title-light">{!! __('subtitles.delete_milestone') !!}</h4>
 
 <form method="post" action="{{ BASE_URL }}/tickets/delMilestone/{{ $ticket->id }}">
+@csrf
     <p>{!! __('text.confirm_milestone_deletion') !!}</p><br />
     <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
     <x-global::forms.button tag="a" contentRole="tertiary" link="{{ BASE_URL }}/tickets/roadmap/">{!! __('buttons.back') !!}</x-global::forms.button>
diff --git a/app/Domain/Tickets/Templates/delTicket.blade.php b/app/Domain/Tickets/Templates/delTicket.blade.php
index c4d3f3d924..c46f22a860 100644
--- a/app/Domain/Tickets/Templates/delTicket.blade.php
+++ b/app/Domain/Tickets/Templates/delTicket.blade.php
@@ -6,6 +6,7 @@
 
     @if (is_object($ticket))
         <form method="post" action="{{ BASE_URL }}/tickets/delTicket/{{ $ticket->id }}">
+        @csrf
             <p>{!! __('text.confirm_ticket_deletion') !!}</p><br />
             <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
 
diff --git a/app/Domain/Tickets/Templates/milestoneDialog.blade.php b/app/Domain/Tickets/Templates/milestoneDialog.blade.php
index 88b0224608..0bacf9a2a9 100644
--- a/app/Domain/Tickets/Templates/milestoneDialog.blade.php
+++ b/app/Domain/Tickets/Templates/milestoneDialog.blade.php
@@ -24,6 +24,7 @@
 {!! $tpl->displayNotification() !!}
 
 <form class="formModal" method="post" action="{{ BASE_URL }}/tickets/editMilestone/{{ $currentMilestone->id }}" style="min-width: 250px;">
+@csrf
 
     <label>{!! __('label.milestone_title') !!}</label>
     <x-global::forms.text-input name="headline" value="{{ $currentMilestone->headline }}" placeholder="{{ __('label.milestone_title') }}" /><br />
diff --git a/app/Domain/Tickets/Templates/moveTicket.blade.php b/app/Domain/Tickets/Templates/moveTicket.blade.php
index 0607f3e099..416f4d1fc8 100644
--- a/app/Domain/Tickets/Templates/moveTicket.blade.php
+++ b/app/Domain/Tickets/Templates/moveTicket.blade.php
@@ -6,6 +6,7 @@
 
 
     <form method="post" action="{{ BASE_URL }}/tickets/moveTicket/{{ $ticket->id }}" class="formModal">
+    @csrf
         <h3>#{{ $ticket->id }} - {{ $ticket->headline }}</h3> <br />
         <p>
             @if ($ticket->type == 'milestone')
diff --git a/app/Domain/Tickets/Templates/newTicket.blade.php b/app/Domain/Tickets/Templates/newTicket.blade.php
index 63fa702f01..7694f61017 100644
--- a/app/Domain/Tickets/Templates/newTicket.blade.php
+++ b/app/Domain/Tickets/Templates/newTicket.blade.php
@@ -30,6 +30,7 @@
 
             <div id="ticketdetails">
                 <form class="ticketModal" action="{{ BASE_URL }}/tickets/newTicket" method="post">
+                @csrf
                     @include('tickets::submodules.ticketDetails')
                 </form>
             </div>
diff --git a/app/Domain/Tickets/Templates/newTicketModal.blade.php b/app/Domain/Tickets/Templates/newTicketModal.blade.php
index 6b05c9a251..ef1ca3a182 100644
--- a/app/Domain/Tickets/Templates/newTicketModal.blade.php
+++ b/app/Domain/Tickets/Templates/newTicketModal.blade.php
@@ -16,6 +16,7 @@
 
             <div id="ticketdetails">
                 <form class="formModal" action="{{ BASE_URL }}/tickets/newTicket" method="post">
+                @csrf
                     @include('tickets::submodules.ticketDetails')
                 </form>
             </div>
diff --git a/app/Domain/Tickets/Templates/partials/quickadd-form.blade.php b/app/Domain/Tickets/Templates/partials/quickadd-form.blade.php
index a76e5eb37e..fedb919fd3 100644
--- a/app/Domain/Tickets/Templates/partials/quickadd-form.blade.php
+++ b/app/Domain/Tickets/Templates/partials/quickadd-form.blade.php
@@ -32,6 +32,7 @@ class="quickAddForm {{ $isActive ? 'active' : '' }}"
           data-quickadd-form
           style="{{ $isActive ? '' : 'display:none;' }}"
           data-submitting="false">
+    @csrf
         <input type="hidden" name="quickadd" value="1" />
         <input type="hidden" name="status" value="{{ $statusId }}" />
         <input type="hidden" name="swimlane" value="{{ $swimlaneKey ?? '' }}" />
diff --git a/app/Domain/Tickets/Templates/partials/subtasks.blade.php b/app/Domain/Tickets/Templates/partials/subtasks.blade.php
index f203b6c299..d30fb0e302 100644
--- a/app/Domain/Tickets/Templates/partials/subtasks.blade.php
+++ b/app/Domain/Tickets/Templates/partials/subtasks.blade.php
@@ -8,6 +8,7 @@
                   hx-post="{{ BASE_URL }}/tickets/subtasks/save?ticketId={{ $ticket->id }}"
                 hx-indicator=".htmx-indicator-small"
                 hx-target="#ticketSubtasks">
+            @csrf
                 <input type="hidden" value="new" name="subtaskId" />
                 <input type="hidden" value="1" name="subtaskSave" />
                 <input name="headline" type="text" title="{{ __("label.headline") }}" style="width:100%" placeholder="{{ __("input.placeholders.what_are_you_working_on") }}" />
diff --git a/app/Domain/Tickets/Templates/showAll.blade.php b/app/Domain/Tickets/Templates/showAll.blade.php
index f05ca194ba..4df1ef5767 100644
--- a/app/Domain/Tickets/Templates/showAll.blade.php
+++ b/app/Domain/Tickets/Templates/showAll.blade.php
@@ -47,6 +47,7 @@
             {{-- Program (cross-project) board: consistent inline quick-add with a required
                  project picker, matching the kanban/list add affordance. --}}
             <form action="" method="post" class="tw-mb-m" style="display:flex; gap:10px; align-items:flex-start; flex-wrap:wrap;">
+            @csrf
                 <input type="text" name="headline" placeholder="{{ __('input.placeholders.create_task') }}" style="flex:1 1 280px; min-width:240px;" />
                 <select name="quickaddProjectId" class="form-control" required style="width:auto;" aria-label="{{ __('label.project') }}">
                     <option value="">{{ __('label.project') }}…</option>
diff --git a/app/Domain/Tickets/Templates/showList.blade.php b/app/Domain/Tickets/Templates/showList.blade.php
index 6448b9ced6..e2db3258bd 100644
--- a/app/Domain/Tickets/Templates/showList.blade.php
+++ b/app/Domain/Tickets/Templates/showList.blade.php
@@ -43,6 +43,7 @@
             <div class="col-md-3">
                 <div class="quickAddForm" style="margin-top:15px;">
                     <form action="" method="post">
+                    @csrf
                         <x-global::forms.text-input name="headline" autofocus placeholder="{{ __('input.placeholders.create_task') }}" style="width: 100%;" />
                         @if (isset($availableProjects))
                             {{-- Program (cross-project) board: a task must belong to one child project. --}}
diff --git a/app/Domain/Tickets/Templates/showTicket.blade.php b/app/Domain/Tickets/Templates/showTicket.blade.php
index ceb88a41aa..1865f25039 100644
--- a/app/Domain/Tickets/Templates/showTicket.blade.php
+++ b/app/Domain/Tickets/Templates/showTicket.blade.php
@@ -39,6 +39,7 @@
 
             <div id="ticketdetails">
                 <form class="formModal" action="{{ BASE_URL }}/tickets/showTicket/{{ $ticket->id }}" method="post">
+                @csrf
                     @include('tickets::submodules.ticketDetails')
                 </form>
             </div>
@@ -51,6 +52,7 @@
 
             <div id="files">
                 <form action='#files' method='POST' enctype="multipart/form-data" class="formModal">
+                @csrf
                     @include('tickets::submodules.attachments')
                 </form>
             </div>
@@ -67,6 +69,7 @@
 
     <div class="maincontentinner">
         <form method="post" action="{{ BASE_URL }}/tickets/showTicket/{{ $ticket->id }}#comments" class="formModal">
+        @csrf
             <input type="hidden" name="comment" value="1" />
             @include('comments::submodules.generalComment', ['formUrl' => BASE_URL.'/tickets/showTicket/'.$ticket->id])
         </form>
diff --git a/app/Domain/Tickets/Templates/showTicketModal.blade.php b/app/Domain/Tickets/Templates/showTicketModal.blade.php
index 9f26b82e05..e44d9f06bc 100644
--- a/app/Domain/Tickets/Templates/showTicketModal.blade.php
+++ b/app/Domain/Tickets/Templates/showTicketModal.blade.php
@@ -93,6 +93,7 @@ class="timerContainer">
 
         <div id="ticketdetails">
             <form class="formModal" action="{{ BASE_URL }}/tickets/showTicket/{{ $ticket->id }}" method="post">
+            @csrf
                 @include('tickets::submodules.ticketDetails')
             </form>
         </div>
diff --git a/app/Domain/Tickets/Templates/submodules/subTasks.blade.php b/app/Domain/Tickets/Templates/submodules/subTasks.blade.php
index 61cba5bdef..cbf21527d9 100644
--- a/app/Domain/Tickets/Templates/submodules/subTasks.blade.php
+++ b/app/Domain/Tickets/Templates/submodules/subTasks.blade.php
@@ -7,6 +7,7 @@
         <div class="ticketBox hideOnLoad" id="subticket_new" >
 
             <form method="post" class="form-group formModal" action="{{ BASE_URL }}/tickets/showTicket/{{ $ticket->id }}#substasks">
+            @csrf
                 <input type="hidden" value="new" name="subtaskId" />
                 <input type="hidden" value="1" name="subtaskSave" />
                 <x-global::forms.text-input name="headline" title="{{ __('label.headline') }}" style="width:100%" placeholder="{{ __('input.placeholders.what_are_you_working_on') }}" />
diff --git a/app/Domain/Tickets/Templates/submodules/ticketDetails.blade.php b/app/Domain/Tickets/Templates/submodules/ticketDetails.blade.php
index fa8bb3b77b..87d0d5d28c 100644
--- a/app/Domain/Tickets/Templates/submodules/ticketDetails.blade.php
+++ b/app/Domain/Tickets/Templates/submodules/ticketDetails.blade.php
@@ -168,6 +168,7 @@ class="fa-solid fa-comments"></span>{!! __('subtitles.discussion') !!}</h4>
 
         <div class="row-fluid">
         <form method="post" action="{{ BASE_URL }}/tickets/showTicket/{{ $ticket->id }}" class="formModal">
+        @csrf
             <input type="hidden" name="comment" value="1" />
             @include('comments::submodules.generalComment', ['formUrl' => BASE_URL . '/tickets/showTicket/' . $ticket->id])
         </form>
diff --git a/app/Domain/Tickets/Templates/submodules/timesheet.blade.php b/app/Domain/Tickets/Templates/submodules/timesheet.blade.php
index 36b6ff096f..281f98446a 100644
--- a/app/Domain/Tickets/Templates/submodules/timesheet.blade.php
+++ b/app/Domain/Tickets/Templates/submodules/timesheet.blade.php
@@ -14,6 +14,7 @@
                 <br />
 
                 <form method="post" action="{{ BASE_URL }}/tickets/showTicket/{{ $ticket->id }}#timesheet" class="formModal">
+                @csrf
 
                     <label for="kind">{!! __('label.timesheet_kind') !!}</label>
                     <span class="field">
diff --git a/app/Domain/Timesheets/Templates/addTime.blade.php b/app/Domain/Timesheets/Templates/addTime.blade.php
index 09b600d8cb..c80c741535 100644
--- a/app/Domain/Timesheets/Templates/addTime.blade.php
+++ b/app/Domain/Timesheets/Templates/addTime.blade.php
@@ -7,6 +7,7 @@
 
 <div class="pageheader">
     <form action="index.php?act=tickets.showAll" method="post" class="searchbar">
+    @csrf
         <x-global::forms.text-input name="term"
                placeholder="{{ __('input.placeholders.search_type_hit_enter') }}" />
     </form>
@@ -30,6 +31,7 @@
 
         <div id="loader">&nbsp;</div>
         <form action="" method="post" class="stdform">
+        @csrf
 
             <div class="row-fluid">
                 <div class="span12">
diff --git a/app/Domain/Timesheets/Templates/delTime.blade.php b/app/Domain/Timesheets/Templates/delTime.blade.php
index b607928b0b..057dacfd5a 100644
--- a/app/Domain/Timesheets/Templates/delTime.blade.php
+++ b/app/Domain/Timesheets/Templates/delTime.blade.php
@@ -5,6 +5,7 @@
 <h4 class="widgettitle title-light">{!! __('headlines.delete_time') !!}</h4>
 
 <form method="post" action="{{ BASE_URL }}/timesheets/delTime/{{ $id }}">
+@csrf
     <p>{!! __('text.confirm_delete_timesheet') !!}</p><br />
     <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
     <x-global::forms.button tag="a" contentRole="tertiary" link="{{ session('lastPage') }}">{!! __('buttons.back') !!}</x-global::forms.button>
diff --git a/app/Domain/Timesheets/Templates/editTime.blade.php b/app/Domain/Timesheets/Templates/editTime.blade.php
index cfebdc2caa..c65789ca76 100644
--- a/app/Domain/Timesheets/Templates/editTime.blade.php
+++ b/app/Domain/Timesheets/Templates/editTime.blade.php
@@ -71,6 +71,7 @@ function filterProjectsByClient() {
 
 <h4  class="widgettitle title-light"><span class="fa-regular fa-clock"></span> {!! __('headlines.edit_time') !!}</h4>
 <form action="{{ BASE_URL }}/timesheets/editTime/{{ (int) $_GET['id'] }}" method="post" class="editTimeModal">
+@csrf
 
 <label for="clients">{!! __('label.client') !!}</label>
 <select name="clients" id="clients" class="client-select" onchange="filterProjectsByClient();">
diff --git a/app/Domain/Timesheets/Templates/showAll.blade.php b/app/Domain/Timesheets/Templates/showAll.blade.php
index 63afbc1c26..3b84a12f88 100644
--- a/app/Domain/Timesheets/Templates/showAll.blade.php
+++ b/app/Domain/Timesheets/Templates/showAll.blade.php
@@ -104,6 +104,7 @@ function filterTicketsByProject() {
 <div class="maincontent">
     <div class="maincontentinner">
         <form action="{{ BASE_URL }}/timesheets/showAll" method="post" id="form" name="form">
+        @csrf
 
             <div class="pull-right">
                 <div id="tableButtons" style="display:inline-block"></div>
diff --git a/app/Domain/Timesheets/Templates/showMy.blade.php b/app/Domain/Timesheets/Templates/showMy.blade.php
index e5e9d3dfd3..4c8d7e04bf 100644
--- a/app/Domain/Timesheets/Templates/showMy.blade.php
+++ b/app/Domain/Timesheets/Templates/showMy.blade.php
@@ -192,6 +192,7 @@
         {!! $tpl->displayNotification() !!}
 
         <form action="{{ BASE_URL }}/timesheets/showMy" method="post" id="timesheetList">
+        @csrf
             <div class="btn-group viewDropDown pull-right">
                 <button class="btn dropdown-toggle" data-toggle="dropdown">
                     {!! __('links.week_view') !!} {!! __('links.view') !!}
diff --git a/app/Domain/Timesheets/Templates/showMyList.blade.php b/app/Domain/Timesheets/Templates/showMyList.blade.php
index 8e0bcf3c89..5324e8fd5a 100644
--- a/app/Domain/Timesheets/Templates/showMyList.blade.php
+++ b/app/Domain/Timesheets/Templates/showMyList.blade.php
@@ -21,6 +21,7 @@
         {!! $tpl->displayNotification() !!}
 
         <form action="{{ BASE_URL }}/timesheets/showMyList" method="post" id="form" name="form">
+        @csrf
             <div class="filterWrapper tw-relative">
                 <a onclick="jQuery('.filterBar').toggle();" class="btn btn-default pull-left">{!! __('links.filter') !!} (1)</a>
                 <div class="filterBar" style="display:none; top:30px;">
diff --git a/app/Domain/TwoFA/Templates/edit.blade.php b/app/Domain/TwoFA/Templates/edit.blade.php
index 50bb99e9ce..d4fefecd16 100644
--- a/app/Domain/TwoFA/Templates/edit.blade.php
+++ b/app/Domain/TwoFA/Templates/edit.blade.php
@@ -27,6 +27,7 @@
                             <img src="{{ $qrData }}" style="border-radius: var(--box-radius);"/><br />
                             Secret: <p>{{ $secret }}</p><br/>
                             <form action="" method="post" class='stdform'>
+                            @csrf
                                 <h5>2. {!! __('text.twoFA_verify_code') !!}</h5>
                                 <p>
                                     <span>{!! __('label.twoFACode_short') !!}:</span>
@@ -41,6 +42,7 @@
                             </form>
                         @else
                             <form action="" method="post" class='stdform'>
+                            @csrf
                                 <h5>{!! __('text.twoFA_already_enabled') !!}</h5>
                                 <input type="hidden" name="{{ session('formTokenName') }}" value="{{ session('formTokenValue') }}" />
                                 <p class='stdformbutton'>
diff --git a/app/Domain/TwoFA/Templates/verify.blade.php b/app/Domain/TwoFA/Templates/verify.blade.php
index 8570ba3ad9..801f9294d9 100644
--- a/app/Domain/TwoFA/Templates/verify.blade.php
+++ b/app/Domain/TwoFA/Templates/verify.blade.php
@@ -9,6 +9,7 @@
 </div>
 <div class="regcontent">
     <form id="login" action="{{ BASE_URL }}/twoFA/verify" method="post">
+    @csrf
         <input type="hidden" name="redirectUrl" value="{{ $redirectUrl }}"/>
 
         {!! $tpl->displayInlineNotification() !!}
diff --git a/app/Domain/Users/Templates/delUser.blade.php b/app/Domain/Users/Templates/delUser.blade.php
index 9435f27d2b..496beb444b 100644
--- a/app/Domain/Users/Templates/delUser.blade.php
+++ b/app/Domain/Users/Templates/delUser.blade.php
@@ -18,6 +18,7 @@
         <div class="widgetcontent">
 
             <form method="post">
+            @csrf
                 <input type="hidden" name="{{ session('formTokenName') }}" value="{{ session('formTokenValue') }}" />
                 <p>{!! __('text.confirm_user_deletion') !!}</p><br />
                 <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
diff --git a/app/Domain/Users/Templates/editOwn.blade.php b/app/Domain/Users/Templates/editOwn.blade.php
index f9dd47e9b1..90ecbe8364 100644
--- a/app/Domain/Users/Templates/editOwn.blade.php
+++ b/app/Domain/Users/Templates/editOwn.blade.php
@@ -30,6 +30,7 @@
                         <div class="row">
                             <div class="col-md-8">
                                 <form action="" method="post">
+                                @csrf
                                     <h4 class="widgettitle title-light"><?php echo $tpl->__('label.profile_information'); ?></h4>
                                     <input type="hidden" name="{{ session("formTokenName") }}" value="{{ session("formTokenValue") }}" />
                                     <div class="row-fluid">
@@ -151,6 +152,7 @@
                             <strong> {{  __("text.account_managed_external_auth") }}</strong><br /><br />
                         @endif
                         <form method="post">
+                        @csrf
                             <input type="hidden" name="{{ session("formTokenName") }}" value="{{ session("formTokenValue") }}" />
                             <div class="row-fluid">
                                 <div class="form-group">
@@ -202,6 +204,7 @@
 
                     <div id="settings">
                         <form action="" method="post">
+                        @csrf
                             <input type="hidden" name="{{ session("formTokenName") }}" value="{{ session("formTokenValue") }}" />
                             <div class="row-fluid">
                                 <div class="form-group">
@@ -278,6 +281,7 @@
 
                     <div id="theme">
                         <form action="" method="post">
+                        @csrf
                             <input type="hidden" name="{{ session("formTokenName") }}" value="{{ session("formTokenValue") }}" />
                             <div class="row-fluid">
                                 <div class="form-group">
@@ -356,6 +360,7 @@
 
                     <div id="notifications">
                         <form action="" method="post">
+                        @csrf
                             <input type="hidden" name="{{ session("formTokenName") }}" value="{{ session("formTokenValue") }}" />
                             <div class="row-fluid">
                                 <div class="form-group">
diff --git a/app/Domain/Users/Templates/editUser.blade.php b/app/Domain/Users/Templates/editUser.blade.php
index 6766420ccf..645c13f845 100644
--- a/app/Domain/Users/Templates/editUser.blade.php
+++ b/app/Domain/Users/Templates/editUser.blade.php
@@ -16,6 +16,7 @@
 </div><!--pageheader-->
 
 <form action="" method="post" class="stdform userEditModal">
+@csrf
         <input type="hidden" name="{{ session('formTokenName') }}" value="{{ session('formTokenValue') }}" />
         <div class="maincontent">
             <div class="row">
diff --git a/app/Domain/Users/Templates/importLdapDialog.blade.php b/app/Domain/Users/Templates/importLdapDialog.blade.php
index 7e719794af..4bd9dae618 100644
--- a/app/Domain/Users/Templates/importLdapDialog.blade.php
+++ b/app/Domain/Users/Templates/importLdapDialog.blade.php
@@ -11,6 +11,7 @@
 
     @if ($confirmUsers)
         <form class="importModal userImportModal" method="post" action="{{ BASE_URL }}/users/import">
+        @csrf
             @foreach ($allLdapUsers as $user)
                 <input type="checkbox" value="{{ $user['user'] }}" id="{{ $user['user'] }}" name="users[]" checked="checked"/>
                 <label for="{{ $user['user'] }}" style="display:inline;">{{ $user['user'] }} - {{ $user['firstname'] }},  {{ $user['lastname'] }}<br />
@@ -22,6 +23,7 @@
 
     @else
         <form class="importModal userImportModal" method="post" action="{{ BASE_URL }}/users/import">
+        @csrf
             <label>{!! __('label.please_enter_password') !!} </label>
             <x-global::forms.text-input type="password" name="password" />
             <input type="hidden" name="pwSubmit" value="1"/>
diff --git a/app/Domain/Users/Templates/newUser.blade.php b/app/Domain/Users/Templates/newUser.blade.php
index 132a1640e5..0e67c241ea 100644
--- a/app/Domain/Users/Templates/newUser.blade.php
+++ b/app/Domain/Users/Templates/newUser.blade.php
@@ -10,6 +10,7 @@
 {!! $tpl->displayNotification() !!}
 
 <form action="{{ BASE_URL }}/users/newUser" method="post" class="stdform userEditModal formModal">
+@csrf
     <div class="row" style="width:800px;">
         <div class="col-md-7">
 
diff --git a/app/Domain/Widgets/Templates/partials/myToDos.blade.php b/app/Domain/Widgets/Templates/partials/myToDos.blade.php
index 8428321594..48bfca3aea 100644
--- a/app/Domain/Widgets/Templates/partials/myToDos.blade.php
+++ b/app/Domain/Widgets/Templates/partials/myToDos.blade.php
@@ -172,6 +172,7 @@ class='active'
                               hx-target="#yourToDoContainer"
                               hx-swap="outerHTML"
                               hx-indicator="#todoWidgetLoader">
+                        @csrf
                             <div class="tw-flex tw-flex-row tw-gap-2">
                                 <div class="tw-flex-grow">
                                     <x-global::forms.text-input variant="headline" name="headline"
@@ -248,6 +249,7 @@ class='active'
                                   hx-target="#yourToDoContainer"
                                   hx-swap="outerHTML"
                                   hx-indicator="#todoWidgetLoader">
+                            @csrf
                                 <div class="tw-flex tw-flex-row tw-gap-2">
                                     <div class="tw-flex-grow">
                                         <x-global::forms.text-input variant="headline" name="headline"
diff --git a/app/Domain/Wiki/Templates/articleDialog.blade.php b/app/Domain/Wiki/Templates/articleDialog.blade.php
index 6ca7061f18..12440d94a9 100644
--- a/app/Domain/Wiki/Templates/articleDialog.blade.php
+++ b/app/Domain/Wiki/Templates/articleDialog.blade.php
@@ -45,6 +45,7 @@ function createTree($id, $parentId, &$wikiHeadlines, &$wikiHL, $indent)
 @endphp
 
 <form class="formModal" method="post" action="{{ CURRENT_URL }}">
+@csrf
 
     <div class="row">
         <div class="col-md-2">
diff --git a/app/Domain/Wiki/Templates/delArticle.blade.php b/app/Domain/Wiki/Templates/delArticle.blade.php
index 1ee44cd206..77598edae2 100644
--- a/app/Domain/Wiki/Templates/delArticle.blade.php
+++ b/app/Domain/Wiki/Templates/delArticle.blade.php
@@ -9,6 +9,7 @@
 <h4 class="widgettitle title-light"><i class="fa fa-trash"></i> {!! __('buttons.delete') !!}</h4>
 
 <form method="post" action="{{ BASE_URL }}/wiki/delArticle/{{ (int) $_GET['id'] }}">
+@csrf
     <p>{!! __('text.are_you_sure_delete_article') !!}</p><br />
     <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
     <x-global::forms.button tag="a" contentRole="tertiary" link="{{ BASE_URL }}/wiki/show/">{!! __('buttons.back') !!}</x-global::forms.button>
diff --git a/app/Domain/Wiki/Templates/delWiki.blade.php b/app/Domain/Wiki/Templates/delWiki.blade.php
index d8446057c6..cd289f2849 100644
--- a/app/Domain/Wiki/Templates/delWiki.blade.php
+++ b/app/Domain/Wiki/Templates/delWiki.blade.php
@@ -5,6 +5,7 @@
 <h4 class="widgettitle title-light"><i class="fa fa-trash"></i> {!! __('buttons.delete') !!}</h4>
 
 <form method="post" action="{{ BASE_URL }}/wiki/delWiki/{{ $tpl->escape($_GET['id']) }}">
+@csrf
     <p>{!! __('text.are_you_sure_delete_wiki') !!}</p>
     <x-global::forms.button tag="input" inputType="submit" contentRole="primary" :labelText="__('buttons.yes_delete')" name="del" />
     <x-global::forms.button tag="a" contentRole="tertiary" link="{{ BASE_URL }}/wiki/show">{!! __('buttons.back') !!}</x-global::forms.button>
diff --git a/app/Domain/Wiki/Templates/show.blade.php b/app/Domain/Wiki/Templates/show.blade.php
index 1f65d5a0d5..6ca38c88e0 100644
--- a/app/Domain/Wiki/Templates/show.blade.php
+++ b/app/Domain/Wiki/Templates/show.blade.php
@@ -253,6 +253,7 @@ class="wiki-tags-input"
                             <h4 class="widgettitle title-light"><span class="fa-solid fa-comments"></span> {!! __('subtitles.discussion') !!}</h4>
 
                             <form method="post" action="{{ BASE_URL }}/wiki/show/{{ $currentArticle->id }}#comment">
+                            @csrf
                                 <input type="hidden" name="comment" value="1" />
                                 @include('comments::submodules.generalComment', ['formUrl' => BASE_URL . '/wiki/show/' . $currentArticle->id])
                             </form>
diff --git a/app/Domain/Wiki/Templates/wikiDialog.blade.php b/app/Domain/Wiki/Templates/wikiDialog.blade.php
index 639cbbead6..55aca70ef8 100644
--- a/app/Domain/Wiki/Templates/wikiDialog.blade.php
+++ b/app/Domain/Wiki/Templates/wikiDialog.blade.php
@@ -18,6 +18,7 @@
 @endphp
 
 <form class="formModal" method="post" action="{{ BASE_URL }}/wiki/wikiModal/{{ $id }}">
+@csrf
 
     <label>{!! __('label.wiki_title') !!}</label>
     <x-global::forms.text-input name="title" id="wikiTitle" value="{{ $tpl->escape($currentWiki->title) }}" placeholder="{{ __('input.placeholders.wiki_title') }}" /><br />