diff --git a/debian/patches/CVE-2019-18345_183456_183457 b/debian/patches/CVE-2019-18345_183456_183457
index 1935dcee..97422bd2 100644
--- a/debian/patches/CVE-2019-18345_183456_183457
+++ b/debian/patches/CVE-2019-18345_183456_183457
@@ -8,8 +8,6 @@ Subject: fix CVE-2019-18345 CVE-2019-18346 CVE-2019-18347
  The fix was developed by nielsvangijzen <n.van.gijzen@gmail.com>
 Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946343
 
-diff --git a/htdocs/admin.php b/htdocs/admin.php
-index b48b8558..3efe4b8a 100644
 --- a/htdocs/admin.php
 +++ b/htdocs/admin.php
 @@ -1,4 +1,5 @@
@@ -18,7 +16,7 @@ index b48b8558..3efe4b8a 100644
  require_once('./always.php');
  require_once('classEditor.php');
  require_once('classBrowser.php');
-@@ -25,7 +26,12 @@ require_once('interactive-page.php');
+@@ -25,7 +26,12 @@
  $page_elements = array();
  $code_file = sprintf( 'ui/%s-%s.php', $component, $action );
  if ( ! @include_once( $code_file ) ) {
@@ -32,8 +30,6 @@ index b48b8558..3efe4b8a 100644
    include('page-header.php');
    include('page-footer.php');
    @ob_flush(); exit(0);
-diff --git a/htdocs/always.php b/htdocs/always.php
-index 3e457bee..cd223e7d 100644
 --- a/htdocs/always.php
 +++ b/htdocs/always.php
 @@ -8,6 +8,47 @@
@@ -84,9 +80,6 @@ index 3e457bee..cd223e7d 100644
  // Ensure the configuration starts out as an empty object.
  $c = (object) array();
  $c->script_start_time = microtime(true);
-diff --git a/inc/csrf_tokens.php b/inc/csrf_tokens.php
-new file mode 100644
-index 00000000..9d05ec4e
 --- /dev/null
 +++ b/inc/csrf_tokens.php
 @@ -0,0 +1,119 @@
@@ -210,11 +203,9 @@ index 00000000..9d05ec4e
 +    return (isset($_POST['csrf_token']) && verifyCsrf($_POST['csrf_token']));
 +}
 \ No newline at end of file
-diff --git a/inc/interactive-page.php b/inc/interactive-page.php
-index 86c88898..c0e87389 100644
 --- a/inc/interactive-page.php
 +++ b/inc/interactive-page.php
-@@ -20,6 +20,9 @@ if ( isset($_SERVER['SCRIPT_NAME']) ) {
+@@ -20,6 +20,9 @@
    if ( $wiki_help == 'admin' ) {
      $wiki_help .= '/' . $_GET['t'] . '/' . $_GET['action'];
    }
@@ -224,8 +215,6 @@ index 86c88898..c0e87389 100644
    $wiki_help = 'w/Help/'.$wiki_help;
  }
  
-diff --git a/inc/ui/collection-edit.php b/inc/ui/collection-edit.php
-index 4fa778c9..81bffb0b 100644
 --- a/inc/ui/collection-edit.php
 +++ b/inc/ui/collection-edit.php
 @@ -1,4 +1,5 @@
@@ -234,7 +223,7 @@ index 4fa778c9..81bffb0b 100644
  
  // Editor component for collections
  $editor = new Editor(translate('Collection'), 'collection');
-@@ -65,6 +66,12 @@ if ( isset($privsql) ) {
+@@ -65,6 +66,12 @@
    $can_write_collection = ($session->AllowedTo('Admin') || (bindec($permissions->priv) & privilege_to_bits('DAV::bind')) );
  }
  
@@ -247,7 +236,7 @@ index 4fa778c9..81bffb0b 100644
  dbg_error_log('collection-edit', "Can write collection: %s", ($can_write_collection? 'yes' : 'no') );
  
  $pwstars = '@@@@@@@@@@';
-@@ -273,6 +280,7 @@ EOPRIV;
+@@ -259,6 +266,7 @@
    $submit_row = '';
  }
  
@@ -255,7 +244,7 @@ index 4fa778c9..81bffb0b 100644
  $id = $editor->Value('collection_id');
  $template = <<<EOTEMPLATE
  ##form##
-@@ -384,6 +392,7 @@ label.privilege {
+@@ -370,6 +378,7 @@
   <tr> <th class="right">$prompt_description:</th>      <td class="left">##description.textarea.78x6##</td> </tr>
   $submit_row
  </table>
@@ -263,7 +252,7 @@ index 4fa778c9..81bffb0b 100644
  </form>
  <script language="javascript">
  toggle_enabled('fld_is_calendar','=fld_timezone','=fld_schedule_transp','!fld_is_addressbook');
-@@ -453,9 +462,11 @@ if ( $editor->Available() ) {
+@@ -439,9 +448,11 @@
      $orig_to_id = $row_data->to_principal;
      $form_id = $grantrow->Id();
      $form_url = preg_replace( '#&(edit|delete)_grant=\d+#', '', $_SERVER['REQUEST_URI'] );
@@ -275,8 +264,6 @@ index 4fa778c9..81bffb0b 100644
    <td class="left" colspan="2"><input type="hidden" name="id" value="$id"><input type="hidden" name="orig_to_id" value="$orig_to_id">##to_principal.select##</td>
    <td class="left" colspan="2">
  <input type="button" value="$btn_all" class="submit" title="$btn_all_title" onclick="toggle_privileges('grant_privileges', 'all', 'form_$form_id');">
-diff --git a/inc/ui/principal-edit.php b/inc/ui/principal-edit.php
-index 2e37cd59..6646b7c2 100644
 --- a/inc/ui/principal-edit.php
 +++ b/inc/ui/principal-edit.php
 @@ -1,4 +1,5 @@
@@ -285,7 +272,7 @@ index 2e37cd59..6646b7c2 100644
  
  param_to_global('id', 'int', 'old_id', 'principal_id' );
  
-@@ -181,6 +182,13 @@ function principal_editor() {
+@@ -181,6 +182,13 @@
    $editor->AddAttribute( 'email', 'title', translate("The email address identifies principals when processing invitations and freebusy lookups. It should be set to a unique value.") );
    $editor->SetWhere( 'principal_id='.$id );
  
@@ -299,7 +286,7 @@ index 2e37cd59..6646b7c2 100644
    $editor->AddField('is_admin', 'EXISTS( SELECT 1 FROM role_member WHERE role_no = 1 AND role_member.user_no = dav_principal.user_no )' );
    $editor->AddAttribute('is_admin', 'title', translate('An "Administrator" user has full rights to the whole DAViCal System'));
  
-@@ -396,6 +404,7 @@ label.privilege {
+@@ -396,6 +404,7 @@
   <tr> <th class="right" style="white-space:normal;">$prompt_privileges:</th><td class="left">$privs_html</td> </tr>
   $submit_row
  </table>
@@ -307,7 +294,7 @@ index 2e37cd59..6646b7c2 100644
  </form>
  EOTEMPLATE;
  
-@@ -545,9 +554,11 @@ function edit_group_row( $row_data ) {
+@@ -545,9 +554,11 @@
    global $id, $grouprow;
  
    $form_url = preg_replace( '#&(edit|delete)_group=\d+#', '', $_SERVER['REQUEST_URI'] );
@@ -319,7 +306,7 @@ index 2e37cd59..6646b7c2 100644
    <td class="left"><input type="hidden" name="id" value="$id"></td>
    <td class="left" colspan="3">##member_id.select## &nbsp; ##Add.submit##</td>
    <td class="center"></td>
-@@ -660,8 +671,11 @@ function edit_grant_row_principal( $row_data ) {
+@@ -660,8 +671,11 @@
    $form_id = $grantrow->Id();
    $form_url = preg_replace( '#&(edit|delete)_grant=\d+#', '', $_SERVER['REQUEST_URI'] );
  
@@ -331,7 +318,7 @@ index 2e37cd59..6646b7c2 100644
    <td class="left" colspan="2"><input type="hidden" name="id" value="$id"><input type="hidden" name="orig_to_id" value="$orig_to_id">##to_principal.select##</td>
    <td class="left" colspan="2">$privs_html</td>
    <td class="center">##submit##</td>
-@@ -788,9 +802,11 @@ function edit_ticket_row( $row_data ) {
+@@ -788,9 +802,11 @@
    $form_id = $ticketrow->Id();
    $ticket_id = $row_data->ticket_id;
    $form_url = preg_replace( '#&(edit|delete)_[a-z]+=\d+#', '', $_SERVER['REQUEST_URI'] );
@@ -343,7 +330,7 @@ index 2e37cd59..6646b7c2 100644
    <td class="left">$ticket_id<input type="hidden" name="id" value="$id"><input type="hidden" name="ticket_id" value="$ticket_id"></td>
    <td class="left"><input type="text" name="target" value="$row_data->target"></td>
    <td class="left"><input type="text" name="expires" value="$row_data->expires" size="10"></td>
-@@ -1011,8 +1027,11 @@ function edit_binding_row( $row_data ) {
+@@ -1011,8 +1027,11 @@
    $source_title = translate('Path to collection you wish to bind, like /user1/calendar/ or https://cal.example.com/user2/cal/');
    $access_title = translate('optional');