From a7ea0743287f7f27c0ead471d2c5cb5ed042c91f Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Wed, 25 Jan 2017 14:53:23 +0100
Subject: [PATCH] set formtoken in button to sustitute user

---
 views/bootstrap/class.UsrMgr.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/views/bootstrap/class.UsrMgr.php b/views/bootstrap/class.UsrMgr.php
index a54b43831..5e2e8b8e5 100644
--- a/views/bootstrap/class.UsrMgr.php
+++ b/views/bootstrap/class.UsrMgr.php
@@ -142,7 +142,7 @@ $(document).ready( function() {
 			echo "</table>";
 
 			if($user->isAdmin() && $seluser->getID() != $user->getID())
-				echo "<a href=\"../op/op.SubstituteUser.php?userid=".$seluser->getID()."\" class=\"btn btn-primary\">".getMLText("substitute_user")."</a>\n";
+				echo "<a class=\"btn btn-primary\" href=\"../op/op.SubstituteUser.php?userid=".((int) $seluser->getID())."&formtoken=".createFormKey('substituteuser')."\"><i class=\"icon-exchange\"></i> ".getMLText('substitute_user')."</a> ";
 		}
 	} /* }}} */