Skip to content

Commit

Permalink
course/category.php is using sesskey
Browse files Browse the repository at this point in the history 
Merged from MOODLE_14_STABLE
  • Loading branch information
stronk7 committed Oct 8, 2004
1 parent 78a5d54 commit abf45be
Show file tree
Hide file tree
Showing 3 changed files with 19 additions and 13 deletions.
25 changes: 15 additions & 10 deletions course/category.php
View file
Expand Up @@ -23,7 +23,7 @@
}

if (iscreator()) {
if (isset($_GET['edit'])) {
if (isset($_GET['edit']) and confirm_sesskey()) {
if ($edit == "on") {
$USER->categoryediting = true;
} else if ($edit == "off") {
Expand All @@ -47,7 +47,7 @@

if (isadmin()) {
/// Rename the category if requested
if (!empty($_POST['rename'])) {
if (!empty($_POST['rename']) and confirm_sesskey()) {
$category->name = $_POST['rename'];
if (! set_field("course_categories", "name", $category->name, "id", $category->id)) {
notify("An error occurred while renaming the category");
Expand All @@ -56,7 +56,7 @@

/// Resort the category if requested

if (!empty($_GET['resort'])) {
if (!empty($_GET['resort']) and confirm_sesskey()) {
if ($courses = get_courses($category->id, "fullname ASC")) {
$count = 0;
foreach ($courses as $course) {
Expand Down Expand Up @@ -114,17 +114,19 @@

/// Move a specified course to a new category

if (isset($moveto) and $data = data_submitted()) { // Some courses are being moved
if (isset($moveto) and $data = data_submitted() and confirm_sesskey()) { // Some courses are being moved

if (! $destcategory = get_record("course_categories", "id", $data->moveto)) {
error("Error finding the category");
}

unset($data->moveto);
unset($data->id);
unset($data->sesskey);

if ($data) {
foreach ($data as $code => $junk) {

$courseid = substr($code, 1);

if (! $course = get_record("course", "id", $courseid)) {
Expand All @@ -143,7 +145,7 @@

/// Hide or show a course

if (isset($hide) or isset($show)) {
if ((isset($hide) or isset($show)) and confirm_sesskey()) {
if (isset($hide)) {
$course = get_record("course", "id", $hide);
$visible = 0;
Expand All @@ -161,7 +163,7 @@

/// Move a course up or down

if (isset($moveup) or isset($movedown)) {
if ((isset($moveup) or isset($movedown)) and confirm_sesskey()) {

$movecourse = NULL;
$swapcourse = NULL;
Expand Down Expand Up @@ -274,6 +276,7 @@
}

echo '<form name="movecourses" action="category.php" method="post">';
echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\">";
echo '<table align="center" border="0" cellspacing="2" cellpadding="4" class="generalbox"><tr>';
echo "<th>$strcourses</th>";
if ($creatorediting) {
Expand Down Expand Up @@ -311,11 +314,11 @@
'<img src="'.$pixpath.'/t/delete.gif" height="11" width="11" border="0" alt="" /></a> ';
if (!empty($acourse->visible)) {
echo '<a title="'.$strhide.'" href="category.php?id='.$category->id.
'&amp;hide='.$acourse->id.'">'.
'&amp;hide='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
'<img src="'.$pixpath.'/t/hide.gif" height="11" width="11" border="0" alt="" /></a> ';
} else {
echo '<a title="'.$strshow.'" href="category.php?id='.$category->id.
'&amp;show='.$acourse->id.'">'.
'&amp;show='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
'<img src="'.$pixpath.'/t/show.gif" height="11" width="11" border="0" alt="" /></a> ';
}

Expand All @@ -328,15 +331,15 @@

if ($up) {
echo '<a title="'.$strmoveup.'" href="category.php?id='.$category->id.
'&amp;moveup='.$acourse->id.'">'.
'&amp;moveup='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
'<img src="'.$pixpath.'/t/up.gif" height="11" width="11" border="0" alt="" /></a> ';
} else {
echo '<img src="'.$CFG->wwwroot.'/pix/spacer.gif" height="11" width="11" border="0" alt="" /></a> ';
}

if ($down) {
echo '<a title="'.$strmovedown.'" href="category.php?id='.$category->id.
'&amp;movedown='.$acourse->id.'">'.
'&amp;movedown='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
'<img src="'.$pixpath.'/t/down.gif" height="11" width="11" border="0" alt="" /></a> ';
} else {
echo '<img src="'.$CFG->wwwroot.'/pix/spacer.gif" height="11" width="11" border="0" alt="" /></a> ';
Expand Down Expand Up @@ -397,6 +400,7 @@
unset($options);
$options["id"] = $category->id;
$options["resort"] = "name";
$options["sesskey"] = $USER->sesskey;
print_single_button("category.php", $options, get_string("resortcoursesbyname"), "get");
}

Expand All @@ -411,6 +415,7 @@
$strrename= get_string("rename");
echo '<form name="renameform" action="category.php" method="post">';
echo '<input type="hidden" name="id" value="'.$category->id.'" />';
echo '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'" />';
echo '<input type="text" size="30" name="rename" value="'.s($category->name).'" alt="'.$strrename.'" />';
echo '<input type="submit" value="'.$strrename.'" />';
echo "</form>";
Expand Down
4 changes: 2 additions & 2 deletions course/index.php
View file
Expand Up @@ -299,7 +299,7 @@
function print_category_edit($category, $displaylist, $parentslist, $depth=-1, $up=false, $down=false) {
/// Recursive function to print all the categories ready for editing

global $THEME, $CFG;
global $THEME, $CFG, $USER;

static $str = '';
static $pixpath = '';
Expand Down Expand Up @@ -328,7 +328,7 @@ function print_category_edit($category, $displaylist, $parentslist, $depth=-1, $
echo "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
}
$linkcss = $category->visible ? "" : " class=\"dimmed\" ";
echo "<a $linkcss title=\"$str->edit\" href=\"category.php?id=$category->id&amp;edit=on\">$category->name</a>";
echo "<a $linkcss title=\"$str->edit\" href=\"category.php?id=$category->id&amp;edit=on&amp;sesskey=$USER->sesskey\">$category->name</a>";
echo "</p>";
echo "</td>";

Expand Down
3 changes: 2 additions & 1 deletion lib/weblib.php
View file
@@ -1,4 +1,4 @@
<?php
<?php // $Id$

///////////////////////////////////////////////////////////////////////////
// //
Expand Down Expand Up @@ -2476,6 +2476,7 @@ function update_category_button($categoryid) {
return "<form target=\"$CFG->framename\" method=\"get\" action=\"$CFG->wwwroot/course/category.php\">".
"<input type=\"hidden\" name=\"id\" value=\"$categoryid\" />".
"<input type=\"hidden\" name=\"edit\" value=\"$edit\" />".
"<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />".
"<input type=\"submit\" value=\"$string\" /></form>";
}
}
Expand Down

0 comments on commit abf45be

Please sign in to comment.