course/groups.php is using sesskey.

moodle · Oct 9, 2004 · bccdea5 · bccdea5
1 parent ecea154
commit bccdea5
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/course/groups-edit.html b/course/groups-edit.html
@@ -87,6 +87,7 @@
         <form name="form1" id="form1" method="post" action="groups.php">
           <input type="hidden" name="id" value="<?php p($course->id) ?>" />
           <input type="hidden" name="groupid" value="<?php p($selectedgroup) ?>" />
+          <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
           <select name="nonmembers[]" size="15" multiple="multiple">
             <?php 
                 if (!empty($nonmembers)) {
@@ -113,6 +114,7 @@
       <td class="generalboxcontent"><p>
         <form name="form2" id="form2" method="post" action="groups.php">
           <input type="hidden" name="id" value="<?php p($course->id) ?>" />
+          <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
           <select name="groups" size="15" onChange="updateMembers(this)">
             <?php 
                 if (!empty($listgroups)) {
@@ -146,6 +148,7 @@
         <form name="form3" id="form3" method="post" action="groups.php">
           <input type="hidden" name="id" value="<?php p($course->id) ?>" />
           <input type="hidden" name="groupid" value="<?php p($selectedgroup) ?>" />
+          <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
           <select name="members[]" size="15" multiple="multiple">
             <?php 
                 if (!empty($members)) {

diff --git a/course/groups.php b/course/groups.php
@@ -82,7 +82,7 @@
 
 /// We are in editing mode.  First, process any inputs there may be.
 
-    if ($data = data_submitted()) {
+    if ($data = data_submitted() and confirm_sesskey()) {
 
         if (!empty($data->nonmembersadd)) {            /// Add people to a group
             if (!empty($data->nonmembers) and !empty($data->groupid)) {
@@ -219,6 +219,8 @@
         $members = $listmembers[$selectedgroup];
     }
 
+    $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
 /// Print out the complete form
 
     include('groups-edit.html');