MDL-20925 fixed input validation and course ajax now fully respects t…

…he disable course ajax option
mudrd8mz · Nov 21, 2009 · 73f67f3 · 73f67f3
1 parent 9208e5e
commit 73f67f3
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/course/rest.php b/course/rest.php
@@ -44,7 +44,12 @@
 require_login($course->id);
 require_capability('moodle/course:update', $context);
 
+if (!empty($CFG->disablecourseajax)) {
+    errorl_log('Course AJAX not allowed');
+    die;
+}
 
+require_sesskey();
 
 // OK, now let's process the parameters and do stuff
 

diff --git a/lib/ajax/ajaxcourse.js b/lib/ajax/ajaxcourse.js
@@ -220,7 +220,7 @@ main_class.prototype.connect = function(method, urlStub, callback, body) {
             callback = {};
         }
     }
-    return YAHOO.util.Connect.asyncRequest(method, this.portal.strings['wwwroot']+"/course/rest.php?courseId="+main.portal.id+"&"+urlStub, callback, body);
+    return YAHOO.util.Connect.asyncRequest(method, this.portal.strings['wwwroot']+"/course/rest.php?courseId="+main.portal.id+"&sesskey="+this.portal.strings['sesskey']+"&"+urlStub, callback, body);
 }