MDL-72367 badges: require sesskey to remove badge alignment.

moodle · Jan 11, 2022 · eda7d88 · eda7d88
1 parent b09d50d
commit eda7d88
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 9 deletions.
diff --git a/badges/alignment_action.php b/badges/alignment_action.php
@@ -25,9 +25,9 @@
 require_once(__DIR__ . '/../config.php');
 require_once($CFG->libdir . '/badgeslib.php');
 
-$alignmentid = required_param('alignmentid', PARAM_INT); // Related badge ID.
+$alignmentid = required_param('alignmentid', PARAM_INT); // Alignment ID.
 $badgeid = required_param('id', PARAM_INT); // Badge ID.
-$action = optional_param('action', 'remove', PARAM_TEXT); // Remove.
+$action = optional_param('action', 'remove', PARAM_TEXT); // Action to perform.
 
 require_login();
 $return = new moodle_url('/badges/alignment.php', array('id' => $badgeid));
@@ -36,6 +36,8 @@
 require_capability('moodle/badges:configuredetails', $context);
 
 if ($action == 'remove') {
+    require_sesskey();
     $badge->delete_alignment($alignmentid);
 }
+
 redirect($return);
diff --git a/badges/renderer.php b/badges/renderer.php
@@ -1339,13 +1339,14 @@ protected function render_badge_alignments(\core_badges\output\badge_alignments
             );
             if (!$currentbadge->is_active() && !$currentbadge->is_locked()) {
                 $delete = $this->output->action_icon(
-                    new moodle_url('alignment_action.php',
-                        array(
-                            'id' => $currentbadge->id,
-                            'alignmentid' => $item->id,
-                            'action' => 'remove'
-                        )
-                    ), new pix_icon('t/delete', get_string('delete')));
+                    new moodle_url('/badges/alignment_action.php', [
+                        'id' => $currentbadge->id,
+                        'alignmentid' => $item->id,
+                        'sesskey' => sesskey(),
+                        'action' => 'remove'
+                    ]),
+                    new pix_icon('t/delete', get_string('delete'))
+                );
                 $edit = $this->output->action_icon(
                     new moodle_url('alignment.php',
                         array(