Index: openacs-4/packages/xotcl-core/xotcl-core.info
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xotcl-core/xotcl-core.info,v
diff -u -N -r1.92.2.13 -r1.92.2.14
--- openacs-4/packages/xotcl-core/xotcl-core.info	23 May 2016 16:39:57 -0000	1.92.2.13
+++ openacs-4/packages/xotcl-core/xotcl-core.info	25 May 2016 19:27:50 -0000	1.92.2.14
@@ -10,7 +10,7 @@
     <inherit-templates-p>t</inherit-templates-p>
     <auto-mount>xotcl</auto-mount>
 
-    <version name="0.147" url="http://media.wu-wien.ac.at/download/xotcl-core-0.147.apm">
+    <version name="0.148" url="http://media.wu-wien.ac.at/download/xotcl-core-0.148.apm">
         <owner url="mailto:neumann@wu-wien.ac.at">Gustaf Neumann</owner>
         <summary>XOTcl library functionality (e.g. thread handling, online documentation, Generic Form and List Classes)</summary>
         <release-date>2016-02-13</release-date>
@@ -48,7 +48,7 @@
         <license>BSD-Style</license>
         <maturity>2</maturity>
 
-        <provides url="xotcl-core" version="0.147"/>
+        <provides url="xotcl-core" version="0.148"/>
 	<requires url="acs-kernel" version="5.9.0"/>
 	<requires url="acs-api-browser" version="5.9.1d1"/>
 	<requires url="acs-content-repository" version="5.9.1d10"/>
Index: openacs-4/packages/xotcl-core/tcl/30-widget-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xotcl-core/tcl/30-widget-procs.tcl,v
diff -u -N -r1.57.2.5 -r1.57.2.6
--- openacs-4/packages/xotcl-core/tcl/30-widget-procs.tcl	23 May 2016 16:39:57 -0000	1.57.2.5
+++ openacs-4/packages/xotcl-core/tcl/30-widget-procs.tcl	25 May 2016 19:27:50 -0000	1.57.2.6
@@ -189,7 +189,11 @@
     foreach o [my children] { $o render }
   }
 
-  ::xo::tdom::Object instproc CSRFToken {} {
+  #
+  # General of HTML markup CSRF tokens in tdom contexts
+  #
+  namespace eval ::html {}
+  proc ::html::CSRFToken {} {
     if {[info exists ::__csrf_token]} {
       ::html::input -type hidden -name __csrf_token -value [set ::__csrf_token] {}
     }
@@ -355,7 +359,7 @@
         next
         my render_localizer
       }
-  
+   
   #
   # for the time being, just a proc
   #
@@ -826,6 +830,7 @@
       html::input -type checkbox -name __bulkaction \
           -onclick "acs_ListCheckAll('$name', this.checked)" \
           -title "Mark/Unmark all rows"
+      ::html::CSRFToken
     }
   }
   TABLE::BulkAction instproc render-data {line} {