MDL-43146 enrol_imsenterprise: missing sesskey protection

moodle · Mar 4, 2014 · 41a19bf · 41a19bf
1 parent ee8f17d
commit 41a19bf
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/enrol/imsenterprise/importnow.php b/enrol/imsenterprise/importnow.php
@@ -24,6 +24,7 @@
 require_once(dirname(dirname(dirname(__FILE__))) . '/config.php');
 require_login(0, false);
 require_capability('moodle/site:config', context_system::instance());
+require_sesskey();
 
 $site = get_site();
 

diff --git a/enrol/imsenterprise/settings.php b/enrol/imsenterprise/settings.php
@@ -119,7 +119,8 @@
     $settings->add(new admin_setting_configcheckbox('enrol_imsenterprise/imscapitafix',
         get_string('usecapitafix', 'enrol_imsenterprise'), get_string('usecapitafix_desc', 'enrol_imsenterprise'), 0));
 
-    $importnowstring = get_string('aftersaving...', 'enrol_imsenterprise').' <a href="../enrol/imsenterprise/importnow.php">';
-    $importnowstring .= get_string('doitnow', 'enrol_imsenterprise').'</a>';
+    $importurl = new moodle_url('/enrol/imsenterprise/importnow.php', array('sesskey' => sesskey()));
+    $importnowstring = get_string('aftersaving...', 'enrol_imsenterprise').' ';
+    $importnowstring .= html_writer::link($importurl, get_string('doitnow', 'enrol_imsenterprise'));
     $settings->add(new admin_setting_heading('enrol_imsenterprise_doitnowmessage', '', $importnowstring));
 }