Fixed #5425 Valid delete requests blocked by CSRF check

Author: Till Brehm

interface/lib/classes/plugin_listview.inc.php

@@ -123,6 +123,10 @@ function onShow() {
 		$lng_file = "lib/lang/".$app->functions->check_language($_SESSION["s"]["language"])."_".$app->listform->listDef['name']."_list.lng";
 		include $lng_file;
 		$listTpl->setVar($wb);
+		
+		$csrf_token = $app->auth->csrf_token_get($app->listform->listDef['name']);
+		$_csrf_id = $csrf_token['csrf_id'];
+		$_csrf_key = $csrf_token['csrf_key'];
 
 
 		// Get the data
@@ -157,6 +161,10 @@ function onShow() {
 				// The variable "id" contains always the index field
 				$rec["id"] = $rec[$idx_key];
 				$rec["delete_confirmation"] = $wb['delete_confirmation'];
+				
+				// CSRF Token
+				$rec["csrf_id"] = $_csrf_id;
+				$rec["csrf_key"] = $_csrf_key;
 
 				$records_new[] = $rec;
 			}

interface/web/admin/templates/remote_user_list.htm

@@ -33,7 +33,7 @@ <h1><tmpl_var name="list_head_txt"></h1>
                             <td><a href="#" data-load-content="admin/remote_user_edit.php?id={tmpl_var name='remote_userid'}">{tmpl_var name="remote_userid"}</a></td>
                             <td><a href="#" data-load-content="admin/remote_user_edit.php?id={tmpl_var name='remote_userid'}">{tmpl_var name="remote_username"}</a></td>
                             <td class="text-right">
-                                <a class="btn btn-default formbutton-danger formbutton-narrow" href="javascript: ISPConfig.confirm_action('admin/remote_user_del.php?id={tmpl_var name='remote_userid'}&phpsessid={tmpl_var name='phpsessid'}','{tmpl_var name='delete_confirmation'}');"><span class="icon icon-delete"></span></a>
+                                <a class="btn btn-default formbutton-danger formbutton-narrow" href="javascript: ISPConfig.confirm_action('admin/remote_user_del.php?id={tmpl_var name='remote_userid'}&_csrf_id={tmpl_var name='csrf_id'}&_csrf_key={tmpl_var name='csrf_key'}&phpsessid={tmpl_var name='phpsessid'}','{tmpl_var name='delete_confirmation'}');"><span class="icon icon-delete"></span></a>
                             </td>
                         </tr>
                     </tmpl_loop>