admin/admin.php is now using sesskey.

Merged from MOODLE_14_STABLE

diff --git a/admin/admin.html b/admin/admin.html
index 5d6edcdb08c8028bcf565f83ffa47de4637deb5c..aac0373d927e05253d910bdeefe2a8ee139793ef 100644 (file)
--- a/admin/admin.html
+++ b/admin/admin.html
@@ -1,6 +1,7 @@
 
 <form name="adminform" id="adminform" method="post" action="admin.php">
 <input type="hidden" name="previoussearch" value="<?php echo $previoussearch ?>">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>
       <td valign="top">

diff --git a/admin/admin.php b/admin/admin.php
index 50324f349237968a519fec623d40965a0f825e76..d5c99987795224ade7042c6bb97fdca9d49763d8 100644 (file)
--- a/admin/admin.php
+++ b/admin/admin.php
@@ -19,6 +19,10 @@
         error("You must be an administrator to use this page.");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     $primaryadmin = get_admin();
 
 /// If you want any administrator to have the ability to assign admin

diff --git a/admin/index.php b/admin/index.php
index cb1cfc6ed5995f243624883accb50d69141c6a42..1a8d1da947a6326ebecc1b447ef067f2ded18868 100644 (file)
--- a/admin/index.php
+++ b/admin/index.php
@@ -331,7 +331,7 @@
                  " <img src=\"../pix/t/user.gif\" height=\"11\" width=\"11\" alt=\"\"></font><br />";
     $userdata .= "<font size=+1>&nbsp;</font><a href=\"creators.php\">".get_string("assigncreators")."</a> - <font size=\"1\">".
                  get_string("adminhelpassigncreators")."</font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"admin.php\">".get_string("assignadmins")."</a> - <font size=\"1\">".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"admin.php?sesskey=$USER->sesskey\">".get_string("assignadmins")."</a> - <font size=\"1\">".
                  get_string("adminhelpassignadmins")."</font><br />";
 
     $table->data[] = array("<font size=+1><b><a href=\"users.php\">".get_string("users")."</a></b>", $userdata);

diff --git a/admin/users.php b/admin/users.php
index 008841e0d7ea6f11903fbfc80d8edb2594dee690..71bb38d91ba99331ee2d8bc8943b5316d44a9df2 100644 (file)
--- a/admin/users.php
+++ b/admin/users.php
@@ -42,7 +42,7 @@
                            get_string("adminhelpassignteachers")." <img src=\"../pix/t/user.gif\" height=\"11\" width=\"11\" alt=\"\" />");
     $table->data[] = array("<b><a href=\"creators.php\">".get_string("assigncreators")."</a></b>",
                            get_string("adminhelpassigncreators"));
-    $table->data[] = array("<b><a href=\"admin.php\">".get_string("assignadmins")."</a></b>",
+    $table->data[] = array("<b><a href=\"admin.php?sesskey=$USER->sesskey\">".get_string("assignadmins")."</a></b>",
                            get_string("adminhelpassignadmins"));
 
     print_table($table);