admin/filters.php is now using sesskey.

Merged from MOODLE_14_STABLE

diff --git a/admin/configure.php b/admin/configure.php
index 44adfdf3348729185b02285e5a2e2a96b5124562..3c3ac45f8f717e9e3589f2745bd9a566e98d9079 100644 (file)
--- a/admin/configure.php
+++ b/admin/configure.php
@@ -34,7 +34,7 @@
                            get_string("adminhelpmanagemodules"));
     $table->data[] = array("<b><a href=\"blocks.php\">".get_string("manageblocks")."</a></b>",
                            get_string("adminhelpmanageblocks"));
-    $table->data[] = array("<b><a href=\"filters.php\">".get_string("managefilters")."</a></b>",
+    $table->data[] = array("<b><a href=\"filters.php?sesskey=$USER->sesskey\">".get_string("managefilters")."</a></b>",
                            get_string("adminhelpmanagefilters"));
     if (!isset($CFG->disablescheduledbackups)) {
         $table->data[] = array("<b><a href=\"backup.php?sesskey=$USER->sesskey\">".get_string("backup")."</a></b>",

diff --git a/admin/filters.html b/admin/filters.html
index 79f0c55f10d6ab4eb3cbaa43b93943f993f6fa55..fb84bc93b16caffb456db82775851b1da0e69220 100644 (file)
--- a/admin/filters.html
+++ b/admin/filters.html
@@ -1,6 +1,7 @@
 <?php print_simple_box_start("center", "", "$THEME->cellheading"); ?>
 
 <form name="filters" id="filters" method="post" action="filters.php">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>
       <td valign="top"><div align="right">
@@ -80,6 +81,7 @@
 <?php print_simple_box_start("center", "", "$THEME->cellheading"); ?>
 
 <form name="options" id="options" method="post" action="filters.php">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
 <input type="hidden" name="options" value="1">
 <table cellpadding="20">
 <tr valign="top">

diff --git a/admin/filters.php b/admin/filters.php
index 7c9da07d7725759abb334818ca5c66dd4675e71c..62a159177ef31c0500d27c950aff8d9efa895819 100644 (file)
--- a/admin/filters.php
+++ b/admin/filters.php
@@ -16,6 +16,10 @@
         error("Only administrators can use this page!");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     if (!$site = get_site()) {
         error("Site isn't defined!");
     }

diff --git a/admin/index.php b/admin/index.php
index 8577db4da5775340a998e6fa87142b0d8479f71c..6429a9cc452d52abcdf223bfb45f01424ffd2fb9 100644 (file)
--- a/admin/index.php
+++ b/admin/index.php
@@ -297,7 +297,7 @@
                     get_string("adminhelpmanagemodules")."</font><br />";
     $configdata .= "<font size=+1>&nbsp;</font><a href=\"blocks.php\">".get_string("manageblocks")."</a> - <font size=\"1\">".
                     get_string("adminhelpmanageblocks")."</font><br />";
-    $configdata .= "<font size=+1>&nbsp;</font><a href=\"filters.php\">".get_string("managefilters")."</a> - <font size=\"1\">".
+    $configdata .= "<font size=+1>&nbsp;</font><a href=\"filters.php?sesskey=$USER->sesskey\">".get_string("managefilters")."</a> - <font size=\"1\">".
                     get_string("adminhelpmanagefilters")."</font><br />";
     if (!isset($CFG->disablescheduledbackups)) {
         $configdata .= "<font size=+1>&nbsp;</font><a href=\"backup.php?sesskey=$USER->sesskey\">".get_string("backup")."</a> - <font size=\"1\">".