From eda7d884baf5e8f41677ffa87c8d92555eae72bf Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Wed, 10 Nov 2021 10:32:31 +0000
Subject: [PATCH] MDL-72367 badges: require sesskey to remove badge alignment.

---
 badges/alignment_action.php |  6 ++++--
 badges/renderer.php         | 15 ++++++++-------
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/badges/alignment_action.php b/badges/alignment_action.php
index a3815469f3ddd..8cad2284ead2f 100644
--- a/badges/alignment_action.php
+++ b/badges/alignment_action.php
@@ -25,9 +25,9 @@
 require_once(__DIR__ . '/../config.php');
 require_once($CFG->libdir . '/badgeslib.php');
 
-$alignmentid = required_param('alignmentid', PARAM_INT); // Related badge ID.
+$alignmentid = required_param('alignmentid', PARAM_INT); // Alignment ID.
 $badgeid = required_param('id', PARAM_INT); // Badge ID.
-$action = optional_param('action', 'remove', PARAM_TEXT); // Remove.
+$action = optional_param('action', 'remove', PARAM_TEXT); // Action to perform.
 
 require_login();
 $return = new moodle_url('/badges/alignment.php', array('id' => $badgeid));
@@ -36,6 +36,8 @@
 require_capability('moodle/badges:configuredetails', $context);
 
 if ($action == 'remove') {
+    require_sesskey();
     $badge->delete_alignment($alignmentid);
 }
+
 redirect($return);
diff --git a/badges/renderer.php b/badges/renderer.php
index c19fe3989d8d0..51cbcf1b3859e 100644
--- a/badges/renderer.php
+++ b/badges/renderer.php
@@ -1339,13 +1339,14 @@ protected function render_badge_alignments(\core_badges\output\badge_alignments
             );
             if (!$currentbadge->is_active() && !$currentbadge->is_locked()) {
                 $delete = $this->output->action_icon(
-                    new moodle_url('alignment_action.php',
-                        array(
-                            'id' => $currentbadge->id,
-                            'alignmentid' => $item->id,
-                            'action' => 'remove'
-                        )
-                    ), new pix_icon('t/delete', get_string('delete')));
+                    new moodle_url('/badges/alignment_action.php', [
+                        'id' => $currentbadge->id,
+                        'alignmentid' => $item->id,
+                        'sesskey' => sesskey(),
+                        'action' => 'remove'
+                    ]),
+                    new pix_icon('t/delete', get_string('delete'))
+                );
                 $edit = $this->output->action_icon(
                     new moodle_url('alignment.php',
                         array(