Index: typo3/sysext/tstemplate/ts/index.php
===================================================================
--- typo3/sysext/tstemplate/ts/index.php	(revision 10191)
+++ typo3/sysext/tstemplate/ts/index.php	(working copy)
@@ -106,7 +106,13 @@
 		if ($this->id && $this->access) {
 			$this->doc->form = '<form action="index.php?id=' . $this->id . '" method="post" enctype="' . $GLOBALS['TYPO3_CONF_VARS']['SYS']['form_enctype'] . '" name="editForm">';
 
+			$formProtection = t3lib_formProtection_Factory::get(
+				't3lib_formprotection_BackendFormProtection'
+			);
+			$formToken = $formProtection->generateToken('Template', 'edit');
 
+			$this->doc->form .= '<input type="hidden" name="formToken" value="' . $formToken . '" />';
+
 				// JavaScript
 			$this->doc->JScode = '
 		<script language="javascript" type="text/javascript">
@@ -397,6 +403,7 @@
 						$opt .= '<option value="' . $row['uid'] . '">' . htmlspecialchars($row['title']) . '</option>';
 					}
  				}
+				$GLOBALS['TYPO3_DB']->sql_free_result($res);
 				$selector = '<select name="createStandard"><option></option>' . $opt . '</select><br />';
 				$staticsText = ', optionally based on one of the standard templates';
 			} else {
Index: typo3/sysext/tstemplate_ceditor/class.tx_tstemplateceditor.php
===================================================================
--- typo3/sysext/tstemplate_ceditor/class.tx_tstemplateceditor.php	(revision 10191)
+++ typo3/sysext/tstemplate_ceditor/class.tx_tstemplateceditor.php	(working copy)
@@ -116,7 +116,15 @@
 		//		debug($tmpl->changed);
 		//		debug($tmpl->raw);
 		//		$tmpl->changed=0;
-				if ($tmpl->changed)	{
+
+				$formProtection = t3lib_formProtection_Factory::get(
+					't3lib_formprotection_BackendFormProtection'
+				);
+
+				if ($tmpl->changed && $formProtection->validateToken(
+					(string) t3lib_div::_POST('formToken'),
+					'Template', 'edit'
+				) )	{
 						// Set the data to be saved
 					$recData=array();
 					$recData["sys_template"][$saveId]["constants"] = implode($tmpl->raw,LF);
Index: typo3/sysext/tstemplate_info/class.tx_tstemplateinfo.php
===================================================================
--- typo3/sysext/tstemplate_info/class.tx_tstemplateinfo.php	(revision 10191)
+++ typo3/sysext/tstemplate_info/class.tx_tstemplateinfo.php	(working copy)
@@ -311,7 +311,13 @@
 				if (strcmp($resList, $tplRow['resources']))	{
 					$recData['sys_template'][$saveId]['resources'] = $resList;
 				}
-				if (count($recData))	{
+				$formProtection = t3lib_formProtection_Factory::get(
+					't3lib_formprotection_BackendFormProtection'
+				);
+				if (count($recData) && $formProtection->validateToken(
+					(string) t3lib_div::_POST('formToken'),
+					'Template', 'edit'
+				))	{
 					
 					$recData['sys_template'][$saveId] = $this->processTemplateRowBeforeSaving($recData['sys_template'][$saveId]);
 					
Index: typo3/sysext/tstemplate_objbrowser/class.tx_tstemplateobjbrowser.php
===================================================================
--- typo3/sysext/tstemplate_objbrowser/class.tx_tstemplateobjbrowser.php	(revision 10191)
+++ typo3/sysext/tstemplate_objbrowser/class.tx_tstemplateobjbrowser.php	(working copy)
@@ -231,7 +231,15 @@
 			if ($POST["add_property"] || $POST["update_value"] || $POST["clear_object"])	{
 					// add property
 				$line="";
-				if (is_array($POST["data"]))	{
+
+				$formProtection = t3lib_formProtection_Factory::get(
+					't3lib_formprotection_BackendFormProtection'
+				);
+
+				if (is_array($POST["data"]) && $formProtection->validateToken(
+					(string) t3lib_div::_POST('formToken'),
+					'Template', 'edit'
+				)) {
 					$name = key($POST["data"]);
 					if ($POST['data'][$name]['name']!=='') {
 							// Workaround for this special case: User adds a key and submits by pressing the return key. The form however will use "add_property" which is the name of the first submit button in this form.