Now actions for meta-courses (add, delete...) are using sesskey.

diff --git a/course/importstudents.html b/course/importstudents.html
index d0d1fd6e2d6c1ddc18ea09cbf2f312a9d0eb0402..9257bd7593b7c57c09ff35e369c2bd35578d72e5 100644 (file)
--- a/course/importstudents.html
+++ b/course/importstudents.html
@@ -1,6 +1,7 @@
 
 <form name="studentform" id="studentform" method="post" action="importstudents.php">
 <input type="hidden" name="previoussearch" value="<?php echo $previoussearch ?>">
+<input type="hidden" name="sesskey" value="<?php echo sesskey() ?>">
 <input type="hidden" name="id" value="<?php echo $id?>">
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>

diff --git a/course/importstudents.php b/course/importstudents.php
index 7e5d72f8185ed7e96012220d67256cad8d35088c..da91c3ec9bae6d8fdfb4feb68c1aba590c2a75bc 100644 (file)
--- a/course/importstudents.php
+++ b/course/importstudents.php
@@ -63,20 +63,20 @@
 /// A form was submitted so process the input
 
     } else {
-        if (!empty($frm->add) and !empty($frm->addselect)) {
+        if (!empty($frm->add) and !empty($frm->addselect) and confirm_sesskey()) {
             $timestart = $timeend = 0;
             foreach ($frm->addselect as $addcourse) {
                 if (!add_to_metacourse($course->id,$addcourse)) {
                     error("Could not add the selected course to this meta course!");
                 }
             }
-        } else if (!empty($frm->remove) and !empty($frm->removeselect)) {
+        } else if (!empty($frm->remove) and !empty($frm->removeselect) and confirm_sesskey()) {
             foreach ($frm->removeselect as $removecourse) {
                 if (! remove_from_metacourse($course->id,$removecourse)) {
                     error("Could not remove the selected course to this meta course!");
                 }
             }
-        } else if (!empty($frm->showall)) {
+        } else if (!empty($frm->showall) and confirm_sesskey()) {
             unset($frm->searchtext);
             $frm->previoussearch = 0;
         }
@@ -93,7 +93,7 @@
 
 
 /// Get search results excluding any users already in this course
-    if (!empty($frm->searchtext) and $previoussearch) {
+    if (!empty($frm->searchtext) and $previoussearch and confirm_sesskey()) {
         $searchcourses = get_courses_search(explode(" ",$frm->searchtext),'fullname ASC',0,99999,$numcourses);
         foreach ($searchcourses as $tmp) {
             if (array_key_exists($tmp->id,$alreadycourses)) {