admin/uploaduser.php is now using sesskey.

Merged from MOODLE_14_STABLE

diff --git a/admin/index.php b/admin/index.php
index 979965d079cec4ce01825e2fe52b1af29392e033..b133284e2937631704cfc540c1d8ade0ae7298a5 100644 (file)
--- a/admin/index.php
+++ b/admin/index.php
@@ -317,7 +317,7 @@
     $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true\">".
                  get_string("addnewuser")."</a> - <font size=\"1\">".
                  get_string("adminhelpaddnewuser")."</font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php\">".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php?sesskey=$USER->sesskey\">".
                  get_string("uploadusers")."</a> - <font size=\"1\">".
                  get_string("adminhelpuploadusers")."</font><br />";
 

diff --git a/admin/uploaduser.php b/admin/uploaduser.php
index 28a4a31e65cb69e9d8014650c38105e41e6ec1b9..aebe3efa40ddfc895dc64e4176e1fe2ee82ccdfc 100755 (executable)
--- a/admin/uploaduser.php
+++ b/admin/uploaduser.php
@@ -1,4 +1,4 @@
-<?PHP // $Id$
+<?php // $Id$
 
 /// Bulk user registration script from a comma separated file
 /// Returns list of users with their user ids
@@ -17,6 +17,10 @@
         error("Could not find site-level course");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     if (!$adminuser = get_admin()) {
         error("Could not find site admin");
     }
@@ -109,7 +113,7 @@
         foreach ($header as $i => $h) {
             $h = trim($h); $header[$i] = $h; // remove whitespace
             if (!($required[$h] or $optionalDefaults[$h] or $optional[$h])) {
-                error(get_string('invalidfieldname', 'error', $h), 'uploaduser.php');
+                error(get_string('invalidfieldname', 'error', $h), 'uploaduser.php?sesskey='.$USER->sesskey);
             }
             if ($required[$h]) {
                 $required[$h] = 2;
@@ -118,7 +122,7 @@
         // check for required fields
         foreach ($required as $key => $value) {
             if ($value < 2) {
-                error(get_string('fieldrequired', 'error', $key), 'uploaduser.php');
+                error(get_string('fieldrequired', 'error', $key), 'uploaduser.php?sesskey='.$USER->sesskey);
             }
         }
         $linenum = 2; // since header is line 1
@@ -144,7 +148,7 @@
                     if ($required[$name] and !$value) {
                         error(get_string('missingfield', 'error', $name). " ".
                               get_string('erroronline', 'error', $linenum), 
-                              'uploaduser.php');
+                              'uploaduser.php?sesskey='.$USER->sesskey);
                     }
                     // password needs to be encrypted
                     else if ($name == "password") {
@@ -262,6 +266,7 @@
     echo '<center>';
     echo '<form method="post" enctype="multipart/form-data" action="uploaduser.php">'.
          $strchoose.':<input type="hidden" name="MAX_FILE_SIZE" value="'.$maxuploadsize.'">'.
+         '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'">'.
          '<input type="file" name="userfile" size="30">'.
          '<input type="submit" value="'.$struploadusers.'">'.
          '</form></br>';

diff --git a/admin/users.php b/admin/users.php
index 1f79835ef71d71fffaa727478cae87b51c23c104..771184fa2c1d7cb64f444aeb985a579fac85cc47 100644 (file)
--- a/admin/users.php
+++ b/admin/users.php
@@ -1,4 +1,4 @@
-<?PHP // $Id$
+<?php // $Id$
 
     require_once("../config.php");
 
@@ -30,7 +30,7 @@
     if (is_internal_auth()) {
         $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true\">".get_string("addnewuser")."</a></b>",
                                get_string("adminhelpaddnewuser"));
-        $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php\">".get_string("uploadusers")."</a></b>",
+        $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php?sesskey=$USER->sesskey\">".get_string("uploadusers")."</a></b>",
                                get_string("adminhelpuploadusers"));
     }
     $table->data[] = array('', '<hr />');