From 26d18490d49dde5f3807b8ef77ba14eb30d86adc Mon Sep 17 00:00:00 2001
From: Ian <aristophian@googlemail.com>
Date: Mon, 26 Oct 2015 10:15:57 +0100
Subject: [PATCH] avoid doubled GET token and fill form_hidden only in case
 default

---
 include/functions_images.inc.php | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/include/functions_images.inc.php b/include/functions_images.inc.php
index a1128b03..cf1b6ffc 100644
--- a/include/functions_images.inc.php
+++ b/include/functions_images.inc.php
@@ -2907,9 +2907,13 @@ function serendipity_showMedia(&$file, &$paths, $url = '', $manage = false, $lin
     global $serendipity;
 
     $form_hidden = '';
-    foreach($serendipity['GET'] AS $g_key => $g_val) {
-        if (!is_array($g_val) && $g_key != 'page') {
-            $form_hidden .= '        <input type="hidden" name="serendipity[' . $g_key . ']" value="' . serendipity_specialchars($g_val) . '">'."\n";
+    // do not add, if not for the default media list form
+    if (($serendipity['GET']['adminAction'] == 'default' || empty($serendipity['GET']['adminAction'])) && !$serendipity['GET']['fid']) {
+        foreach($serendipity['GET'] AS $g_key => $g_val) {
+            // do not add token, since this is assigned separately to properties and list forms
+            if (!is_array($g_val) && $g_key != 'page' && $g_key != 'token') {
+                $form_hidden .= '        <input type="hidden" name="serendipity[' . $g_key . ']" value="' . serendipity_specialchars($g_val) . '">'."\n";
+            }
         }
     }