Fixed #372 and #366. Emit csrf_token when rendering forms if it is present

flask_admin/templates/admin/actions.html

@@ -12,6 +12,9 @@
 {% macro form(actions, url) %}
     {% if actions %}
     <form id="action_form" action="{{ url }}" method="POST" style="display: none">
+        {% if csrf_token %}
+        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+        {% endif %}
         <input type="hidden" id="action" name="action" />
     </form>
     {% endif %}

flask_admin/templates/admin/lib.html

@@ -112,7 +112,11 @@
     {% if form.hidden_tag is defined %}
         {{ form.hidden_tag() }}
     {% else %}
-        {% for f in form if f.type == 'HiddenField' %}
+
+    {% if csrf_token %}
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+    {% endif %}
+    {% for f in form if f.type == 'HiddenField' %}
             {{ f }}
         {% endfor %}
     {% endif %}