- Patch #36407 by DriesK: make sure the private key is set.

includes/form.inc

@@ -54,6 +54,11 @@ function drupal_get_form($form_id, &$form, $callback = NULL) {
 
   $form['#type'] = 'form';
   if (isset($form['#token'])) {
+    // Make sure that a private key is set:
+    if (!variable_get('drupal_private_key', '')) {
+      variable_set('drupal_private_key', mt_rand());
+    }
+
     $form['form_token'] = array('#type' => 'hidden', '#value' => md5($_SERVER['REMOTE_ADDR'] . $form['#token'] . variable_get('drupal_private_key',
 '')));
   }