To give a more comprehensive solution, here are all template files updated by this patch:
M frontend/base/default/template/checkout/cart.phtml
M frontend/base/default/template/checkout/onepage/review/info.phtml
M frontend/base/default/template/wishlist/view.phtml
M frontend/base/default/template/sales/reorder/sidebar.phtml
M frontend/base/default/template/tag/customer/view.phtml
M frontend/base/default/template/persistent/customer/form/login.phtml
M frontend/base/default/template/customer/form/login.phtml
M frontend/base/default/template/review/form.phtml
M frontend/base/default/template/catalog/product/view.phtml
So if you theme rewrites any of these, you will need to update your local files accordingly (there's more than the hidden input). I had to update 5 files in my theme and it now works like a charm.
Many thanks for all the help posted here. Greatly appreciated!
The correct method is to add:
<?php echo $this->getBlockHtml('formkey'); ?>
in the appropriate places for your onepage checkout and your customer login page. To find the correct file that is used for your theme you need to turn the hints on in the developer area of the system configuration and visit those pages on the frontend, making sure that your shop is selected rather than it being set to store wide (top left hand drop down).
It is best not to add html but rather use the call to the html block, that way if on future patches they update this code you do not have to go back into your templates to edit it.
was form key not introduced for 1.8 and later?