diff --git a/htdocs/admin/const.php b/htdocs/admin/const.php
index 0a1889e2179..72fb1ebc09b 100644
--- a/htdocs/admin/const.php
+++ b/htdocs/admin/const.php
@@ -34,12 +34,6 @@ $langs->load("admin");
 if (! empty($_SERVER['HTTP_REFERER']) && !eregi(DOL_MAIN_URL_ROOT, $_SERVER['HTTP_REFERER']))
 accessforbidden();
 
-//Todo: Verification de la presence et de la validite du jeton précédent
-if (isset($_POST['token']) && isset($_SESSION['oldtoken']))
-{
-	if ($_POST['token'] != $_SESSION['oldtoken']) accessforbidden();
-}
-
 if (!$user->admin)
 accessforbidden();
 
diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php
index b089ec30951..a26a7b79cf5 100644
--- a/htdocs/main.inc.php
+++ b/htdocs/main.inc.php
@@ -168,11 +168,17 @@ session_name($sessionname);
 session_start();
 dol_syslog("Start session name=".$sessionname." Session id()=".session_id().", _SESSION['dol_login']=".(isset($_SESSION["dol_login"])?$_SESSION["dol_login"]:'').", ".ini_get("session.gc_maxlifetime"));
 
-//Todo: Creation d'un jeton contre les failles CSRF
+// Creation d'un jeton contre les failles CSRF
 $token = md5(uniqid(rand(),TRUE)); // Genere un hash d'un nombre aleatoire
-$_SESSION['oldtoken'] = $_SESSION['newtoken']; // roulement des jetons car créé à chaque appel
+$_SESSION['oldtoken'] = $_SESSION['newtoken']; // roulement des jetons car cree a chaque appel
 $_SESSION['newtoken'] = $token;
 
+// Verification de la presence et de la validite du jeton
+if (isset($_POST['token']) && isset($_SESSION['oldtoken']))
+{
+	if ($_POST['token'] != $_SESSION['oldtoken']) unset($_POST);
+}
+
 // Retrieve the entity in login form or in the cookie.
 // This must be after the init of session (session_start) or this create serious pb of corrupted session.
 /*