Index: openacs-4/packages/xowiki/xowiki.info
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/xowiki.info,v
diff -u -r1.153.2.12 -r1.153.2.13
--- openacs-4/packages/xowiki/xowiki.info	11 May 2016 08:59:48 -0000	1.153.2.12
+++ openacs-4/packages/xowiki/xowiki.info	23 May 2016 16:40:32 -0000	1.153.2.13
@@ -10,7 +10,7 @@
     <inherit-templates-p>t</inherit-templates-p>
     <auto-mount>xowiki</auto-mount>
 
-    <version name="5.9.1d6" url="http://openacs.org/repository/download/apm/xowiki-5.9.1d6.apm">
+    <version name="5.9.1d7" url="http://openacs.org/repository/download/apm/xowiki-5.9.1d7.apm">
         <owner url="mailto:neumann@wu-wien.ac.at">Gustaf Neumann</owner>
         <summary>A xotcl-based enterprise wiki system with multiple object types</summary>
         <release-date>2015-10-04</release-date>
@@ -55,7 +55,7 @@
         <license>BSD-Style</license>
         <maturity>2</maturity>
 
-        <provides url="xowiki" version="5.9.1d6"/>
+        <provides url="xowiki" version="5.9.1d7"/>
         <requires url="acs-datetime" version="5.9.0"/>
         <requires url="acs-kernel" version="5.9.0"/>
 	<requires url="acs-tcl" version="5.9.1d1"/>
@@ -64,7 +64,7 @@
         <requires url="categories" version="1.0d3"/>
         <requires url="file-storage" version="5.9.0"/>
         <requires url="general-comments" version="5.9.0"/>
-        <requires url="xotcl-core" version="0.145"/>
+        <requires url="xotcl-core" version="0.147"/>
 
         <callbacks>
             <callback type="before-uninstall"  proc="::xowiki::before-uninstall"/>
Index: openacs-4/packages/xowiki/tcl/bootstrap-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/bootstrap-procs.tcl,v
diff -u -r1.3.2.6 -r1.3.2.7
--- openacs-4/packages/xowiki/tcl/bootstrap-procs.tcl	12 May 2016 08:08:45 -0000	1.3.2.6
+++ openacs-4/packages/xowiki/tcl/bootstrap-procs.tcl	23 May 2016 16:40:32 -0000	1.3.2.7
@@ -147,17 +147,17 @@
           var progressBar = document.getElementById('dropzone-progress-bar');
           var uploadFileRunning = 0;
           
-          var startUpload = function(files) {
+          var startUpload = function(files, csrf) {
             if (typeof files !== "undefined") {
                for (var i=0, l=files.length; i<l; i++) {
-                 uploadFile(files[i]);
+                 uploadFile(files[i], csrf);
                }
             } else {
               alert("No support for the File API in this web browser");
             }
           }
 
-          var uploadFile = function(file) {
+          var uploadFile = function(file, csrf) {
             var xhr;
             var formData = new FormData();
             var url = "$uploadlink" + "&name=" + file.name;
@@ -179,22 +179,25 @@
             }, false);
             xhr.open("post", url, true);
             formData.append("upload", file);
+            formData.append("__csrf_token", csrf);
             uploadFileRunning++;
-
             xhr.send(formData);
           }
 
           uploadForm.addEventListener('submit', function(e) {
-            var uploadFiles = document.getElementById('js-upload-files').files;
+            var input = document.getElementById('js-upload-files');
+            var uploadFiles = input.files;
+            var csrf = input.form.elements["__csrf_token"].value;
             e.preventDefault();
-            startUpload(uploadFiles)
+            startUpload(input.files, csrf)
           })
 
           dropZone.ondrop = function(e) {
             e.preventDefault();
             this.className = 'upload-drop-zone';
-            
-            startUpload(e.dataTransfer.files)
+            var form = document.getElementById('js-upload-files').form;
+            var csrf = form.elements["__csrf_token"].value;
+            startUpload(e.dataTransfer.files, csrf)
           }
 
           dropZone.ondragover = function() {
@@ -225,6 +228,7 @@
                 html::button -type "submit" -class "btn btn-sm btn-primary" -id "js-upload-submit" {
                   html::t ${:text}
                 }
+                :CSRFToken
               }
             }
       }
@@ -307,7 +311,7 @@
   #   # method.
   #   #
   #   ::xo::tdom::Class create ::mystyle::BootstrapNavbarModeButton \
-  #       -superclass ::xowiki::BootstrapNavbarModeButton
+  #       -superclass ::xowiki::MenuItem
   #
   #   ::xowiki::BootstrapNavbarModeButton instproc init args {
   #     set :CSSclass checkbox-slider--a
Index: openacs-4/packages/xowiki/tcl/xowiki-www-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/xowiki-www-procs.tcl,v
diff -u -r1.327.2.17 -r1.327.2.18
--- openacs-4/packages/xowiki/tcl/xowiki-www-procs.tcl	11 Apr 2016 14:20:30 -0000	1.327.2.17
+++ openacs-4/packages/xowiki/tcl/xowiki-www-procs.tcl	23 May 2016 16:40:32 -0000	1.327.2.18
@@ -1095,6 +1095,7 @@
     #   - ::xowiki::UploadFile
     #   - ::xowiki::UploadPhotoForm
     #
+    ::security::csrf::validate
     set uploader [ns_set get $form uploader File]
     set uploaderClass ::xowiki::UploadFile
     if {[info command ::xowiki::Upload$uploader] ne ""} {