course/view.php is using sesskey

(changes in blocks done, please check them)

Merged from MOODLE_14_STABLE

diff --git a/blocks/moodleblock.class.php b/blocks/moodleblock.class.php
index b4b8493a1de8bd25296d342847453118d0c0f1c4..69cd7190ac4a72e5eba4f64f57c49ad7a6ec89a7 100644 (file)
--- a/blocks/moodleblock.class.php
+++ b/blocks/moodleblock.class.php
@@ -119,7 +119,7 @@ class MoodleBlock {
     }
 
     function add_edit_controls($options, $blockid) {
-        global $CFG, $THEME;
+        global $CFG, $THEME, $USER;
 
         // The block may be disabled
         $blockid = intval($blockid);
@@ -143,6 +143,8 @@ class MoodleBlock {
         } else {
             $pixpath = $path.'/../theme/'.$CFG->theme.'/pix';
         }
+ 
+        $sesskeystr = '&sesskey='.$USER->sesskey;
 
         $movebuttons = '<div style="float: right;">';
 
@@ -155,26 +157,26 @@ class MoodleBlock {
             $title = $this->str->show;
         }
 
-        $movebuttons .= '<a style="margin-right: 6px; margin-left: 3px;" title="'.$title.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=toggle&amp;blockid='.$blockid.'">' .
+        $movebuttons .= '<a style="margin-right: 6px; margin-left: 3px;" title="'.$title.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=toggle&amp;blockid='.$blockid.$sesskeystr.'">' .
                         '<img src="'.$pixpath.$icon.'" alt="" /></a>';
 
-        $movebuttons .= '<a title="'.$this->str->delete.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=delete&amp;blockid='.$blockid.'">' .
+        $movebuttons .= '<a title="'.$this->str->delete.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=delete&amp;blockid='.$blockid.$sesskeystr.'">' .
                         '<img src="'.$pixpath.'/t/delete.gif" alt="" /></a> ';
 
         if ($options & BLOCK_MOVE_LEFT) {
-            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveleft.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveside&amp;blockid='.$blockid.'">' .
+            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveleft.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveside&amp;blockid='.$blockid.$sesskeystr.'">' .
                             '<img src="'.$pixpath.'/t/left.gif" alt="" /></a>';
         }
         if ($options & BLOCK_MOVE_UP) {
-            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveup.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveup&amp;blockid='.$blockid.'">' .
+            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveup.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveup&amp;blockid='.$blockid.$sesskeystr.'">' .
                             '<img src="'.$pixpath.'/t/up.gif" alt="" /></a>';
         }
         if ($options & BLOCK_MOVE_DOWN) {
-            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->movedown.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=movedown&amp;blockid='.$blockid.'">' .
+            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->movedown.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=movedown&amp;blockid='.$blockid.$sesskeystr.'">' .
                             '<img src="'.$pixpath.'/t/down.gif" alt="" /></a>';
         }
         if ($options & BLOCK_MOVE_RIGHT) {
-            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveright.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveside&amp;blockid='.$blockid.'">' .
+            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveright.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveside&amp;blockid='.$blockid.$sesskeystr.'">' .
                             '<img src="'.$pixpath.'/t/right.gif" alt="" /></a>';
         }
 

diff --git a/course/format/topics/format.php b/course/format/topics/format.php
index 8cd777243afea026bef1084def41a28adadbab6b..49e3ac5b81de144556e37e28ca6195334278f489 100644 (file)
--- a/course/format/topics/format.php
+++ b/course/format/topics/format.php
@@ -31,7 +31,7 @@
         }
     }
 
-    if (isteacher($course->id) and isset($marker)) {
+    if (isteacher($course->id) and isset($marker) and confirm_sesskey()) {
         $course->marker = $marker;
         if (! set_field("course", "marker", $marker, "id", $course->id)) {
             error("Could not mark that topic for this course");
@@ -222,28 +222,28 @@
 
             if (isediting($course->id)) {
                 if ($course->marker == $section) {  // Show the "light globe" on/off
-                    echo "<a href=\"view.php?id=$course->id&amp;marker=0\" title=\"$strmarkedthistopic\">".
+                    echo "<a href=\"view.php?id=$course->id&amp;marker=0&amp;sesskey=$USER->sesskey\" title=\"$strmarkedthistopic\">".
                          "<img src=\"$CFG->pixpath/i/marked.gif\" vspace=\"3\" height=\"16\" width=\"16\" border=\"0\" alt=\"\" /></a><br />";
                 } else {
-                    echo "<a href=\"view.php?id=$course->id&amp;marker=$section\" title=\"$strmarkthistopic\">".
+                    echo "<a href=\"view.php?id=$course->id&amp;marker=$section&amp;sesskey=$USER->sesskey\" title=\"$strmarkthistopic\">".
                          "<img src=\"$CFG->pixpath/i/marker.gif\" vspace=\"3\" height=\"16\" width=\"16\" border=\"0\" alt=\"\" /></a><br />";
                 }
 
                 if ($thissection->visible) {        // Show the hide/show eye
-                    echo "<a href=\"view.php?id=$course->id&amp;hide=$section\" title=\"$strtopichide\">".
+                    echo "<a href=\"view.php?id=$course->id&amp;hide=$section&amp;sesskey=$USER->sesskey\" title=\"$strtopichide\">".
                          "<img src=\"$CFG->pixpath/i/hide.gif\" vspace=\"3\" height=\"16\" width=\"16\" border=\"0\" alt=\"\" /></a><br />";
                 } else {
-                    echo "<a href=\"view.php?id=$course->id&amp;show=$section\" title=\"$strtopicshow\">".
+                    echo "<a href=\"view.php?id=$course->id&amp;show=$section&amp;sesskey=$USER->sesskey\" title=\"$strtopicshow\">".
                          "<img src=\"$CFG->pixpath/i/show.gif\" vspace=\"3\" height=\"16\" width=\"16\" border=\"0\" alt=\"\" /></a><br />";
                 }
 
                 if ($section > 1) {                       // Add a arrow to move section up
-                    echo "<a href=\"view.php?id=$course->id&amp;section=$section&amp;move=-1\" title=\"$strmoveup\">".
+                    echo "<a href=\"view.php?id=$course->id&amp;section=$section&amp;move=-1&amp;sesskey=$USER->sesskey\" title=\"$strmoveup\">".
                          "<img src=\"$CFG->pixpath/t/up.gif\" vspace=\"3\" height=\"11\" width=\"11\" border=\"0\" alt=\"\" /></a><br />";
                 }
 
                 if ($section < $course->numsections) {    // Add a arrow to move section down
-                    echo "<a href=\"view.php?id=$course->id&amp;section=$section&amp;move=1\" title=\"$strmovedown\">".
+                    echo "<a href=\"view.php?id=$course->id&amp;section=$section&amp;move=1&amp;sesskey=$USER->sesskey\" title=\"$strmovedown\">".
                          "<img src=\"$CFG->pixpath/t/down.gif\" vspace=\"3\" height=\"11\" width=\"11\" border=\"0\" alt=\"\" /></a><br />";
                 }
 

diff --git a/course/format/weeks/format.php b/course/format/weeks/format.php
index 1d09b5f19152c2f674378e89936552f1f187ba05..be5b94a6ce4d8c1964b6e9e7d3056a9b672af77d 100644 (file)
--- a/course/format/weeks/format.php
+++ b/course/format/weeks/format.php
@@ -215,20 +215,20 @@
     
             if (isediting($course->id)) {
                 if ($thissection->visible) {        // Show the hide/show eye
-                    echo "<a href=\"view.php?id=$course->id&amp;hide=$section\" title=\"$strweekhide\">".
+                    echo "<a href=\"view.php?id=$course->id&amp;hide=$section&amp;sesskey=$USER->sesskey\" title=\"$strweekhide\">".
                          "<img src=\"$CFG->pixpath/i/hide.gif\" vspace=\"3\" height=\"16\" width=\"16\" border=\"0\" alt=\"\" /></a><br />";
                 } else {
-                    echo "<a href=\"view.php?id=$course->id&amp;show=$section\" title=\"$strweekshow\">".
+                    echo "<a href=\"view.php?id=$course->id&amp;show=$section&amp;sesskey=$USER->sesskey\" title=\"$strweekshow\">".
                          "<img src=\"$CFG->pixpath/i/show.gif\" vspace=\"3\" height=\"16\" width=\"16\" border=\"0\" alt=\"\" /></a><br />";
                 }
     
                 if ($section > 1) {                       // Add a arrow to move section up
-                    echo "<a href=\"view.php?id=$course->id&amp;section=$section&amp;move=-1\" title=\"$strmoveup\">".
+                    echo "<a href=\"view.php?id=$course->id&amp;section=$section&amp;move=-1&amp;sesskey=$USER->sesskey\" title=\"$strmoveup\">".
                          "<img src=\"$CFG->pixpath/t/up.gif\" vspace=\"3\" height=\"11\" width=\"11\" border=\"0\" alt=\"\" /></a><br />";
                 }
     
                 if ($section < $course->numsections) {    // Add a arrow to move section down
-                    echo "<a href=\"view.php?id=$course->id&amp;section=$section&amp;move=1\" title=\"$strmovedown\">".
+                    echo "<a href=\"view.php?id=$course->id&amp;section=$section&amp;move=1&amp;sesskey=$USER->sesskey\" title=\"$strmovedown\">".
                          "<img src=\"$CFG->pixpath/t/down.gif\" vspace=\"3\" height=\"11\" width=\"11\" border=\"0\" alt=\"\" /></a><br />";
                 }
     

diff --git a/course/view.php b/course/view.php
index 3e53f96a9405a9e28b7879ba6059a9472f288961..4b9bb405261f0c39479d1c47b0512d95f900eb05 100644 (file)
--- a/course/view.php
+++ b/course/view.php
@@ -75,15 +75,15 @@
 
         $editing = $USER->editing;
 
-        if (isset($hide)) {
+        if (isset($hide) and confirm_sesskey()) {
             set_section_visible($course->id, $hide, '0');
         }
 
-        if (isset($show)) {
+        if (isset($show) and confirm_sesskey()) {
             set_section_visible($course->id, $show, '1');
         }
 
-        if (isset($_GET['blockaction'])) {
+        if (isset($_GET['blockaction']) and confirm_sesskey()) {
             if (isset($_GET['blockid'])) {
                 block_action($course, $leftblocks, $rightblocks, strtolower($_GET['blockaction']), intval($_GET['blockid']));
             }
@@ -118,7 +118,7 @@
         }
 
         if (!empty($section)) {
-            if (!empty($move)) {
+            if (!empty($move) and confirm_sesskey()) {
                 if (!move_section($course, $section, $move)) {
                     notify("An error occurred while moving a section");
                 }

diff --git a/lib/blocklib.php b/lib/blocklib.php
index 6d3ac1c6f3aa6e1c96e46eb5e14500bd20584bff..4884b29f6934accc643e25881372702bc878fee7 100644 (file)
--- a/lib/blocklib.php
+++ b/lib/blocklib.php
@@ -405,6 +405,9 @@ function block_find($blockid, $leftblocks, $rightblocks) {
 
 //This function prints the block to admin blocks as necessary
 function block_print_blocks_admin(&$course, $missingblocks) {
+
+    global $USER;
+
     if (isediting($course->id)) {
         $strblocks = get_string('blocks');
         $stradd    = get_string('add');
@@ -425,7 +428,7 @@ function block_print_blocks_admin(&$course, $missingblocks) {
                 else {
                     $target = 'view.php';
                 }
-                $content = popup_form($target.'?id='.$course->id.'&blockaction=add&blockid=',
+                $content = popup_form($target.'?id='.$course->id.'&blockaction=add&sesskey='.$USER->sesskey.'&blockid=',
                                       $menu, 'add_block', '', "$stradd...", '', '', true);
                 $content = '<div align="center">'.$content.'</div>';
                 print_side_block($strblocks, $content, NULL, NULL, NULL);