diff --git a/htdocs/don/card.php b/htdocs/don/card.php
index 0b5f2d124e8b6..a0f7f138cba7d 100644
--- a/htdocs/don/card.php
+++ b/htdocs/don/card.php
@@ -876,7 +876,7 @@
 
 	// Classify 'paid'
 	if ($object->statut == $object::STATUS_VALIDATED && round($remaintopay) == 0 && $object->paid == 0 && $user->rights->don->creer) {
-		print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?rowid='.$object->id.'&action=set_paid">'.$langs->trans("ClassifyPaid")."</a></div>";
+		print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?rowid='.$object->id.'&action=set_paid&token='.newToken().'">'.$langs->trans("ClassifyPaid")."</a></div>";
 	}
 
 	// Delete
diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php
index ad7ac652a4d6c..3fe6e8d8d5676 100644
--- a/htdocs/main.inc.php
+++ b/htdocs/main.inc.php
@@ -466,7 +466,7 @@ function analyseVarsForSqlAndScriptsInjection(&$var, $type)
 		'activate', 'add', 'addrights', 'addtimespent',
 		'doprev', 'donext', 'dvprev', 'dvnext',
 		'install',
-		'setpricelevel',
+		'setpricelevel', 'set_paid',
 		'update'
 	);
 	$sensitiveget = false;