Adding cidReq in work forms see BT#6294

main/work/work.lib.php

@@ -981,7 +981,7 @@ function build_work_move_to_selector($folders, $curdirpath, $move_file, $group_d
 	$title 		= Database::fetch_row($result);
 	global $gradebook;
     //@todo use formvalidator please!
-	$form = '<form class="form-horizontal" name="move_to_form" action="'.api_get_self().'?gradebook='.$gradebook.'&curdirpath='.Security::remove_XSS($curdirpath).'" method="POST">';
+	$form = '<form class="form-horizontal" name="move_to_form" action="'.api_get_self().'?'.api_get_cidreq().'&gradebook='.$gradebook.'&curdirpath='.Security::remove_XSS($curdirpath).'" method="POST">';
 	$form .= '<legend>'.get_lang('MoveFile').' - '.Security::remove_XSS($title[0]).'</legend>';
 	$form .= '<input type="hidden" name="item_id" value="'.$move_file.'" />';
 	$form .= '<input type="hidden" name="action" value="move_to" />';

main/work/work.php

@@ -409,7 +409,7 @@ switch ($action) {
             }
         }
 
-        $form = new FormValidator('form', 'POST', api_get_self() . "?action=upload&id=".$work_id."&gradebook=".Security::remove_XSS($_GET['gradebook'])."&origin=$origin", '', array('enctype' => "multipart/form-data"));
+        $form = new FormValidator('form', 'POST', api_get_self()."?".api_get_cidreq()."&action=upload&id=".$work_id."&gradebook=".Security::remove_XSS($_GET['gradebook'])."&origin=$origin", '', array('enctype' => "multipart/form-data"));
 
         // form title
         if ($item_id) {
@@ -717,7 +717,7 @@ switch ($action) {
                     $emailbody .= get_lang('WorkName')." : ".$title."\n\n".get_lang('DownloadLink')."\n";
                     $url = api_get_path(WEB_CODE_PATH)."work/work.php?".api_get_cidreq()."&id=".$work_id;
                     $emailbody .= $url;
-                    
+
                     MessageManager::send_message_simple($to_user_id, $emailsubject, $emailbody);
                 }
             }