diff --git a/src/messenger/webim/libs/common.php b/src/messenger/webim/libs/common.php
index 8a0d63c4..71e33f7c 100644
--- a/src/messenger/webim/libs/common.php
+++ b/src/messenger/webim/libs/common.php
@@ -767,17 +767,22 @@ function jspath()
 
 /* authorization token check for CSRF attack */
 function csrfchecktoken(){
+  /* if auth token not set, set it now */
   if(!isset($_SESSION['csrf_token'])){
       $_SESSION['csrf_token']=sha1(rand(10000000,99999999));
-    }
-		// check the turing code
-    if ($_SERVER['REQUEST_METHOD'] == 'POST'){
-      //if token match
-      if(!isset($_POST['csrf_token']) || ($_POST['csrf_token'] != $_SESSION['csrf_token'])){
+  }
 
-        die("CSRF failure");
-      }
+  // check the turing code for post requests and del requests
+  if ($_SERVER['REQUEST_METHOD'] == 'POST'){
+    //if token match
+    if(!isset($_POST['csrf_token']) || ($_POST['csrf_token'] != $_SESSION['csrf_token'])){
+
+      die("CSRF failure");
     }
+  } else if($_GET['act'] == 'del' && $_GET['csrf_token'] != $_SESSION['csrf_token']){
+      
+    die("CSRF failure");
+  }
 }
 
 /* print csrf token as a hidden field*/
@@ -785,4 +790,9 @@ function print_csrf_token_input(){
   echo "<input name='csrf_token' type='hidden' value='".$_SESSION['csrf_token']."' />";
 }
 
+/* print csrf token in url format */
+function print_csrf_token_in_url(){
+  echo "&amp;csrf_token=".$_SESSION['csrf_token'];
+}
+
 ?>
diff --git a/src/messenger/webim/operator/operators.php b/src/messenger/webim/operator/operators.php
index 729fc2c9..c2e8b06e 100644
--- a/src/messenger/webim/operator/operators.php
+++ b/src/messenger/webim/operator/operators.php
@@ -22,6 +22,8 @@
 require_once('../libs/common.php');
 require_once('../libs/operator.php');
 
+csrfchecktoken();
+
 $operator = check_login();
 force_password($operator);
 
diff --git a/src/messenger/webim/view/agents.php b/src/messenger/webim/view/agents.php
index 25ba3577..4b6a50c5 100644
--- a/src/messenger/webim/view/agents.php
+++ b/src/messenger/webim/view/agents.php
@@ -120,7 +120,7 @@ require_once('inc_errors.php');
 <?php } ?>
 	</td>
 	<td>
-		<a class="removelink" id="i<?php echo $a['operatorid'] ?>" href="<?php echo $webimroot ?>/operator/operators.php?act=del&amp;id=<?php echo $a['operatorid'] ?>">
+		<a class="removelink" id="i<?php echo $a['operatorid'] ?>" href="<?php echo $webimroot ?>/operator/operators.php?act=del&amp;id=<?php echo $a['operatorid'] ?><?php print_csrf_token_in_url() ?>">
 			<?php echo getlocal("remove.item") ?>
 		</a>
 	</td>
@@ -140,4 +140,4 @@ $('a.removelink').click(function(){
 } /* content */
 
 require_once('inc_main.php');
-?>
\ No newline at end of file
+?>