roundcubemail/program/include/rcmail_output_html.php
protected function alter_form_tag($matches)
    {
        $out    = $matches[0];
        $attrib = html::parse_attrib_string($matches[1]);

        if (strtolower($attrib['method']) == 'post') {
            $hidden = new html_hiddenfield(array('name' => '_token', 'value' => $this->app->get_request_token()));
            $out .= "\n" . $hidden->show();
        }

        return $out;
    }
protected function alter_form_tag($matches)
    {
        $out    = $matches[0];
        $attrib = html::parse_attrib_string($matches[1]);

        if (strtolower($attrib['method']) == 'post') {
            $hidden = new html_hiddenfield(array('name' => '_token', 'value' => $this->app->get_request_token()));
            $out .= "\n" . $hidden->show();
        }

        return $out;
    }
protected function alter_form_tag ( $ matches ) { $ out = $ matches [ 0 ] ; $ attrib = html :: parse_attrib_string ( $ matches [ 1 ] ) ; if ( strtolower ( $ attrib [ 'method' ] ) == 'post' ) { $ hidden = new html_hiddenfield ( array ( 'name' => '_token' , 'value' => $ this -> app -> get_request_token ( ) ) ) ; $ out .= "\n" . $ hidden -> show ( ) ; } return $ out ; }
Inserts hidden field with CSRF-prevention-token into POST forms
Inserts hidden field with CSRF - prevention - token into POST forms