portfolio: MDL-19358 and MDL-19354 added sesskey() protection when first initating...

diff --git a/lib/portfolio/exporter.php b/lib/portfolio/exporter.php
index 3938a8e25ec029d872f6bd1a50e25b7858137241..007e55950cadddbd96028259199555c04f5c3b6a 100644 (file)
--- a/lib/portfolio/exporter.php
+++ b/lib/portfolio/exporter.php
@@ -676,6 +676,10 @@ class portfolio_exporter {
         if (!$readonly && !confirm_sesskey($this->get('sesskey'))) {
             throw new portfolio_exception('confirmsesskeybad');
         }
+        if (!$this->caller->check_permissions()) {
+            throw new portfolio_caller_exception('nopermissions', 'portfolio', $this->caller->get_return_url());
+        }
+        error_log("checking permissions after waking");
     }
     /**
     * copies a file from somewhere else in moodle

diff --git a/lib/portfoliolib.php b/lib/portfoliolib.php
index d37b94c7ce45b7d65706739d6142c1e2cdcd6c7b..c0a4041784d139fa16c4bcba013a421e86a3a89b 100644 (file)
--- a/lib/portfoliolib.php
+++ b/lib/portfoliolib.php
@@ -224,6 +224,8 @@ class portfolio_add_button {
             $linkoutput .= 'ca_' . $key . '=' . $value . '&';
             $formoutput .= "\n" . '<input type="hidden" name="ca_' . $key . '" value="' . $value . '" />';
         }
+        $formoutput .= "\n" . '<input type="hidden" name="sesskey" value="' . sesskey() . '" />';
+        $linkoutput .= 'sesskey=' . sesskey() . '&amp;';
         $formoutput .= "\n" . '<input type="hidden" name="callbackfile" value="' . $this->callbackfile . '" />';
         $formoutput .= "\n" . '<input type="hidden" name="callbackclass" value="' . $this->callbackclass . '" />';
         $formoutput .= "\n" . '<input type="hidden" name="course" value="' . (!empty($COURSE) ? $COURSE->id : 0) . '" />';

diff --git a/portfolio/add.php b/portfolio/add.php
index 1feb0768ffb443eb5f5b1ed211e2ccc5f5f00db9..1b1942e30688eb271da571e76ef07a0537d715d7 100644 (file)
--- a/portfolio/add.php
+++ b/portfolio/add.php
@@ -139,10 +139,16 @@ if (!empty($dataid)) {
             $callbackargs[substr($key, 3)] = $value;
         }
     }
+    if (!confirm_sesskey()) {
+        throw new portfolio_caller_exception('confirmsesskeybad', 'error');
+    }
     // righto, now we have the callback args set up
     // load up the caller file and class and tell it to set up all the data
     // it needs
     require_once($CFG->dirroot . $callbackfile);
+    if (!class_exists($callbackclass) || !is_subclass_of($callbackclass, 'portfolio_caller_base')) {
+        throw new portfolio_caller_exception('callbackclassinvalid', 'portfolio');
+    }
     $caller = new $callbackclass($callbackargs);
     $caller->set('user', $USER);
     $caller->load_data();