course/group.php is using sesskey.

Merged from MOODLE_14_STABLE

diff --git a/course/group-edit.html b/course/group-edit.html
index fe3e336da7061f50fced8b23f26891efe335fa88..a3090cece339966e9930db67afd1df6ebd1712e3 100644 (file)
--- a/course/group-edit.html
+++ b/course/group-edit.html
@@ -50,4 +50,5 @@
 
 <input type="hidden" name="group" value="<?php p($group->id) ?>" /> 
 <input type="hidden" name="id" value="<?php p($course->id) ?>" /> 
+<input type="hidden" name="sesskey" value="<?php p($sesskey) ?>" /> 
 </form>

diff --git a/course/group.php b/course/group.php
index afd049253a6e8751a01c567c02419d96007aafec..c2045410966bf7c9de01d3adfc1bc4316f3b20f3 100644 (file)
--- a/course/group.php
+++ b/course/group.php
@@ -58,7 +58,7 @@
 
 /// If data submitted, then process and store.
 
-    if ($form = data_submitted()) { 
+    if ($form = data_submitted() and confirm_sesskey()) { 
 
         if (empty($form->name)) {
             $edit = true;
@@ -93,6 +93,8 @@
             $defaultformat = FORMAT_MOODLE;
         }
 
+        $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
         include('group-edit.html');
 
         if ($usehtmleditor) {