diff --git a/app/Http/Controllers/ConversationsController.php b/app/Http/Controllers/ConversationsController.php
index 8ead09cb..d59da5ef 100755
--- a/app/Http/Controllers/ConversationsController.php
+++ b/app/Http/Controllers/ConversationsController.php
@@ -482,7 +482,7 @@ class ConversationsController extends Controller
     /**
      * Clone conversation.
      */
-    public function cloneConversation(Request $request, $mailbox_id, $from_thread_id)
+    public function cloneConversation(Request $request, $mailbox_id, $from_thread_id, $token)
     {
         $mailbox = Mailbox::findOrFail($mailbox_id);
         $this->authorize('view', $mailbox);
@@ -494,6 +494,10 @@ class ConversationsController extends Controller
                 $orign_conv = $orig_thread->conversation;
                 $this->authorize('view', $orign_conv);
 
+                if (csrf_token() != $token) {
+                    \Session::flash('flash_error_floating', __('Not enough permissions'));
+                    return redirect()->away($orign_conv->url($orign_conv->folder_id));
+                }
 
 		        // $thread = $orig_thread->replicate();
 		        // $thread->id = '';
diff --git a/resources/views/conversations/partials/thread.blade.php b/resources/views/conversations/partials/thread.blade.php
index eea5f201..b87a4dc0 100644
--- a/resources/views/conversations/partials/thread.blade.php
+++ b/resources/views/conversations/partials/thread.blade.php
@@ -323,7 +323,7 @@
                 @endif
                 <li><a href="{{ route('conversations.create', ['mailbox_id' => $mailbox->id]) }}?from_thread_id={{ $thread->id }}" title="{{ __("Start a conversation from this thread") }}" class="new-conv" role="button">{{ __("New Conversation") }}</a></li>
                 @if ($thread->isCustomerMessage())
-                    <li><a href="{{ route('conversations.clone_conversation', ['mailbox_id' => $mailbox->id, 'from_thread_id' => $thread->id]) }}" title="{{ __("Clone a conversation from this thread") }}" class="new-conv" role="button">{{ __("Clone Conversation") }}</a></li>
+                    <li><a href="{{ route('conversations.clone_conversation', ['mailbox_id' => $mailbox->id, 'from_thread_id' => $thread->id, 'token' => csrf_token()]) }}" title="{{ __("Clone a conversation from this thread") }}" class="new-conv" role="button">{{ __("Clone Conversation") }}</a></li>
                 @endif
                 @action('thread.menu', $thread)
                 @if (Auth::user()->isAdmin())
diff --git a/routes/web.php b/routes/web.php
index f877a4d4..2323986e 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -64,7 +64,7 @@ Route::get('/conversation/{id}', ['uses' => 'ConversationsController@view', 'lar
 Route::post('/conversation/ajax', ['uses' => 'ConversationsController@ajax', 'laroute' => true])->name('conversations.ajax');
 Route::post('/conversation/upload', ['uses' => 'ConversationsController@upload', 'laroute' => true])->middleware('throttle:100,1')->name('conversations.upload');
 Route::get('/mailbox/{mailbox_id}/new-ticket', 'ConversationsController@create')->name('conversations.create');
-Route::get('/mailbox/{mailbox_id}/clone-ticket/{from_thread_id}', 'ConversationsController@cloneConversation')->name('conversations.clone_conversation');
+Route::get('/mailbox/{mailbox_id}/clone-ticket/{from_thread_id}/{token}', 'ConversationsController@cloneConversation')->name('conversations.clone_conversation');
 //Route::get('/conversation/draft/{id}', 'ConversationsController@draft')->name('conversations.draft');
 Route::get('/conversation/ajax-html/{action}', ['uses' => 'ConversationsController@ajaxHtml', 'laroute' => true])->name('conversations.ajax_html');
 Route::get('/search', 'ConversationsController@search')->name('conversations.search');