admin bookmark cleanup

diff --git a/blocks/admin_bookmarks/block_admin_bookmarks.php b/blocks/admin_bookmarks/block_admin_bookmarks.php
index cbf524fd9c80b7b438c50d5c505c9ecd21d8d571..e332ca0edea3d243e67eeb605c8e2c3dff3295a2 100644 (file)
--- a/blocks/admin_bookmarks/block_admin_bookmarks.php
+++ b/blocks/admin_bookmarks/block_admin_bookmarks.php
@@ -26,10 +26,10 @@ class block_admin_bookmarks extends block_base {
     function get_content() {
 
         global $CFG, $USER, $PAGE;
-        
+
         require_once($CFG->libdir.'/adminlib.php');
         $adminroot = admin_get_root();
-        
+
         if ($this->content !== NULL) {
             return $this->content;
         }
@@ -40,31 +40,31 @@ class block_admin_bookmarks extends block_base {
             $bookmarks = explode(',',$USER->preference['admin_bookmarks']);
             // hmm... just a liiitle (potentially) processor-intensive
             // (recall that $adminroot->locate is a huge recursive call... and we're calling it repeatedly here
-            
+
             /// Accessibility: markup as a list.
             $this->content->text .= '<ol class="list">'."\n";
-            
+
             foreach($bookmarks as $bookmark) {
                 $temp = $adminroot->locate($bookmark);
                 if (is_a($temp, 'admin_settingpage')) {
                     $this->content->text .= '<li><a href="' . $CFG->wwwroot . '/' . $CFG->admin . '/settings.php?section=' . $bookmark . '">' . $temp->visiblename . "</a></li>\n";
                 } elseif (is_a($temp, 'admin_externalpage')) {
                     $this->content->text .= '<li><a href="' . $temp->url . '">' . $temp->visiblename . "</a></li>\n";
-                }                
+                }
             }
             $this->content->text .= "</ol>\n";
         } else {
             $bookmarks = array();
         }
-        
+
         if (($section = (isset($PAGE->section) ? $PAGE->section : '')) && (in_array($section, $bookmarks))) {
-            $this->content->footer = '<a href="' . $CFG->wwwroot . '/blocks/admin_bookmarks/delete.php?section=' . $section . '&returnurl=' . $CFG->wwwroot . '">' . get_string('unbookmarkthispage','admin') . '</a>';    
+            $this->content->footer = '<a href="' . $CFG->wwwroot . '/blocks/admin_bookmarks/delete.php?section=' . $section . '&amp;sesskey='.sesskey().'">' . get_string('unbookmarkthispage','admin') . '</a>';
         } elseif ($section = (isset($PAGE->section) ? $PAGE->section : '')) {
-            $this->content->footer = '<a href="' . $CFG->wwwroot . '/blocks/admin_bookmarks/create.php?section=' . $section . '">' . get_string('bookmarkthispage','admin') . '</a>';        
+            $this->content->footer = '<a href="' . $CFG->wwwroot . '/blocks/admin_bookmarks/create.php?section=' . $section . '&amp;sesskey='.sesskey().'">' . get_string('bookmarkthispage','admin') . '</a>';
         } else {
             $this->content->footer = '';
         }
-    
+
         return $this->content;
 
     }

diff --git a/blocks/admin_bookmarks/create.php b/blocks/admin_bookmarks/create.php
index d730dcaaa24ededdae8a86c7cd4374f0ac09fc31..1f365cea43e2f0311af67ad74b49f25adf76ab29 100644 (file)
--- a/blocks/admin_bookmarks/create.php
+++ b/blocks/admin_bookmarks/create.php
@@ -4,46 +4,47 @@ require('../../config.php');
 
 require_once($CFG->libdir.'/adminlib.php');
 $adminroot = admin_get_root();
+require_login();
 
-if ($section = optional_param('section', '', PARAM_ALPHAEXT)) {
+if ($section = optional_param('section', '', PARAM_ALPHAEXT) and confirm_sesskey()) {
 
     if (isset($USER->preference['admin_bookmarks'])) {
         $bookmarks = explode(',',$USER->preference['admin_bookmarks']);
-        
+
         if (in_array($section, $bookmarks)) {
             error(get_string('bookmarkalreadyexists','admin'));
             die;
         }
-        
+
     } else {
         $bookmarks = array();
     }
 
     $temp = $adminroot->locate($section);
-    
+
     if (is_a($temp, 'admin_settingpage') || is_a($temp, 'admin_externalpage')) {
-    
+
         $bookmarks[] = $section;
-    
+
         $bookmarks = implode(',',$bookmarks);
-    
+
         set_user_preference('admin_bookmarks', $bookmarks);
-    
+
     } else {
-   
-        error(get_string('invaludsection','admin')); 
+
+        error(get_string('invaludsection','admin'));
         die;
-        
+
     }
-    
+
     if (is_a($temp, 'admin_settingpage')) {
-    
-        redirect($CFG->wwwroot . '/' . $CFG->admin . '/settings.php?section=' . $section, 'Bookmark added.',1);    
-    
+
+        redirect($CFG->wwwroot . '/' . $CFG->admin . '/settings.php?section=' . $section, get_string('bookmarkadded','admin'), 1);
+
     } elseif (is_a($temp, 'admin_externalpage')) {
-    
+
         redirect($temp->url, get_string('bookmarkadded','admin'), 1);
-        
+
     }
 
 } else {

diff --git a/blocks/admin_bookmarks/delete.php b/blocks/admin_bookmarks/delete.php
index e826f31d3d0d216ba9903437dc9febb5bd8f327a..63875bff0f7e21ca0e9c7bdfb9fd437f70d78cb9 100644 (file)
--- a/blocks/admin_bookmarks/delete.php
+++ b/blocks/admin_bookmarks/delete.php
@@ -4,8 +4,9 @@ require('../../config.php');
 
 require_once($CFG->libdir.'/adminlib.php');
 $adminroot = admin_get_root();
+require_login();
 
-if ($section = optional_param('section', '', PARAM_ALPHAEXT)) {
+if ($section = optional_param('section', '', PARAM_ALPHAEXT) and confirm_sesskey()) {
 
     if (isset($USER->preference['admin_bookmarks'])) {
 
@@ -21,13 +22,13 @@ if ($section = optional_param('section', '', PARAM_ALPHAEXT)) {
         unset($bookmarks[$key]);
         $bookmarks = implode(',',$bookmarks);
         set_user_preference('admin_bookmarks', $bookmarks);
-        
+
         $temp = $adminroot->locate($section);
-        
+
         if (is_a($temp, 'admin_externalpage')) {
-            redirect($temp->url, get_string('bookmarkdeleted','admin'),1);
+            redirect($temp->url, get_string('bookmarkdeleted','admin'));
         } elseif (is_a($temp, 'admin_settingpage')) {
-            redirect($CFG->wwwroot . '/' . $CFG->admin . '/settings.php?section=' . $section, 'Bookmark deleted.',1);        
+            redirect($CFG->wwwroot . '/' . $CFG->admin . '/settings.php?section=' . $section, get_string('bookmarkdeleted','admin'), 1);
         } else {
             redirect($CFG->wwwroot, get_string('bookmarkdeleted', 'admin'),1);
         }
@@ -35,7 +36,7 @@ if ($section = optional_param('section', '', PARAM_ALPHAEXT)) {
 
 
     }
-    
+
         error(get_string('nobookmarksforuser','admin'));
     die;