Permalink
Browse files

MDL-26198 fix CSRF and missing access control + fix xhtml strict

  • Loading branch information...
1 parent ff03c5b commit 9cedb80c5d6318aa17cd66912d37e6ef3dca9455 @skodak skodak committed Jan 30, 2011
Showing with 16 additions and 10 deletions.
  1. +1 −1 course/report/completion/index.php
  2. +15 −9 course/togglecompletion.php
@@ -632,7 +632,7 @@ function csv_quote($value) {
$describe = get_string('completion-alt-auto-'.$completiontype,'completion');
print '<td class="completion-progresscell">'.
- '<a href="'.$CFG->wwwroot.'/course/togglecompletion.php?user='.$user->id.'&course='.$course->id.'&rolec='.$allow_marking_criteria.'">'.
+ '<a href="'.$CFG->wwwroot.'/course/togglecompletion.php?user='.$user->id.'&amp;course='.$course->id.'&amp;rolec='.$allow_marking_criteria.'&amp;sesskey='.sesskey().'">'.
'<img src="'.$OUTPUT->pix_url('i/completion-manual-'.($is_complete ? 'y' : 'n')).
'" alt="'.$describe.'" class="icon" title="Mark as complete" /></a></td>'; //TODO: localize
} else {
@@ -38,9 +38,10 @@
// Process self completion
if ($courseid) {
$PAGE->set_url(new moodle_url('/course/togglecompletion.php', array('course'=>$courseid)));
-
+
// Check user is logged in
$course = $DB->get_record('course', array('id' => $courseid), '*', MUST_EXIST);
+ $context = get_context_instance(CONTEXT_COURSE, $course->id);
require_login($course);
$completion = new completion_info($course);
@@ -50,14 +51,19 @@
$rolec = optional_param('rolec', 0, PARAM_INT);
if ($user && $rolec) {
+ require_sesskey();
+
+ completion_criteria::factory((object) array('id'=>$rolec, 'criteriatype'=>COMPLETION_CRITERIA_TYPE_ROLE)); //TODO: this is dumb, because it does not fetch the data?!?!
+ $criteria = completion_criteria_role::fetch(array('id'=>$rolec));
- $criteria = completion_criteria::factory((object) array('id'=>$rolec, 'criteriatype'=>COMPLETION_CRITERIA_TYPE_ROLE));
- $criteria_completions = $completion->get_completions($user, COMPLETION_CRITERIA_TYPE_ROLE);
+ if ($criteria and user_has_role_assignment($USER->id, $criteria->role, $context->id)) {
+ $criteria_completions = $completion->get_completions($user, COMPLETION_CRITERIA_TYPE_ROLE);
- foreach ($criteria_completions as $criteria_completion) {
- if ($criteria_completion->criteriaid == $rolec) {
- $criteria->complete($criteria_completion);
- break;
+ foreach ($criteria_completions as $criteria_completion) {
+ if ($criteria_completion->criteriaid == $rolec) {
+ $criteria->complete($criteria_completion);
+ break;
+ }
}
}
@@ -71,7 +77,7 @@
} else {
// Confirm with user
- if ($confirm) {
+ if ($confirm and confirm_sesskey()) {
$completion = $completion->get_completion($USER->id, COMPLETION_CRITERIA_TYPE_SELF);
if (!$completion) {
@@ -94,7 +100,7 @@
$PAGE->set_heading($course->fullname);
$PAGE->navbar->add($strconfirm);
echo $OUTPUT->header();
- $buttoncontinue = new single_button(new moodle_url('/course/togglecompletion.php', array('course'=>$courseid, 'confirm'=>1)), get_string('yes'), 'post');
+ $buttoncontinue = new single_button(new moodle_url('/course/togglecompletion.php', array('course'=>$courseid, 'confirm'=>1, 'sesskey'=>sesskey())), get_string('yes'), 'post');
$buttoncancel = new single_button(new moodle_url('/course/view.php', array('id'=>$courseid)), get_string('no'), 'get');
echo $OUTPUT->confirm($strconfirm, $buttoncontinue, $buttoncancel);
echo $OUTPUT->footer();

0 comments on commit 9cedb80

Please sign in to comment.