Index: openacs-4/packages/acs-templating/tcl/list-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/list-procs.tcl,v
diff -u -r1.60.2.9 -r1.60.2.10
--- openacs-4/packages/acs-templating/tcl/list-procs.tcl	18 Nov 2015 08:34:08 -0000	1.60.2.9
+++ openacs-4/packages/acs-templating/tcl/list-procs.tcl	22 May 2016 19:25:47 -0000	1.60.2.10
@@ -348,13 +348,18 @@
             error "You cannot have bulk_actions without providing a key for list '$name'"
         }
         # Create the checkbox element
+        set label {<input type="checkbox" name="_dummy" onclick="acs_ListCheckAll('$name', this.checked)"
+            onkeypress="acs_ListCheckAll('$name', this.checked)" title="[_ acs-templating.lt_Checkuncheck_all_rows]">}
+        if {[info exists ::__csrf_token]} {
+            append label \n [subst {<input type="hidden" name="__csrf_token" value="$::__csrf_token">}]
+        }
+        
         # We only ulevel 1 here, because we want the subst to be done in this namespace
         template::list::element::create \
             -list_name $name \
             -element_name $checkbox_name \
             -spec {
-                label {<input type="checkbox" name="_dummy" onclick="acs_ListCheckAll('$name', this.checked)"
-                    onkeypress="acs_ListCheckAll('$name', this.checked)" title="[_ acs-templating.lt_Checkuncheck_all_rows]">}
+                label $label
                 display_template {<input type="checkbox" name="$key" value="@$list_properties(multirow).$key@"
                     id="$name.@$list_properties(multirow).$key@" title="[_ acs-templating.lt_Checkuncheck_this_row]">}
                 sub_class {narrow}
@@ -507,10 +512,16 @@
         set list_properties(orderby_selected_name) $orderby_name
 
         if { $orderby_direction eq "" } {
-            template::list::orderby::get_reference \
-                -list_name $name \
-                -orderby_name $orderby_name
 
+            if {[catch {
+                template::list::orderby::get_reference \
+                    -list_name $name \
+                    -orderby_name $orderby_name
+            } errorMsg]} {
+                ad_page_contract_handle_datasource_error $errorMsg
+                ad_script_abort
+            }
+
             set orderby_direction $orderby_properties(default_direction)
         }
         set list_properties(orderby_selected_direction) $orderby_direction
@@ -1043,7 +1054,12 @@
     set result {}
     template::list::orderby::get_reference -list_name $name -orderby_name $list_properties(orderby_selected_name)
 
+    if {![info exists orderby_properties(orderby_$list_properties(orderby_selected_direction))]} {
+        ad_page_contract_handle_datasource_error "invalid value for orderby: $list_properties(orderby_selected_direction)"
+        ad_script_abort
+    }
     set result $orderby_properties(orderby_$list_properties(orderby_selected_direction))
+
     if { $orderby_p && $result ne "" } {
         set result "order by $result"
     }