ZCS-18382: set X-Zimbra-Csrf-Token http request header in ChangePassword

Author: k-kato

WebRoot/js/zimbraAdmin/common/ZaController.js

@@ -652,14 +652,14 @@ function(authToken, csrfToken, uname, oldPass, newPass, conPass) {
     soapDoc.set("oldPassword", oldPass);
     soapDoc.set("password", newPass);
     soapDoc.set("authToken", authToken);
-    soapDoc.set("csrfToken", csrfToken);
     soapDoc.set("virtualHost", window.location.hostname);
     var resp = null;
     try {
         if(ZaController.changePwdCommand)
             return;
 
         ZaController.changePwdCommand = new ZmCsfeCommand();
+        window.csrfToken = csrfToken;
         resp = ZaController.changePwdCommand.invoke({soapDoc: soapDoc, noAuthToken: true, ignoreAuthToken: true,  noSession: true}).Body.ChangePasswordResponse;
 
         if (resp) {