MDL-17227 forum: seekey-ize forum prune (split). Merged from 19_STABLE

diff --git a/mod/forum/post.php b/mod/forum/post.php
index ec84a584bfd18815ad7d40c2a10e714a46ee20f6..69fccd5c67fc7f1b533bbec17c691e0245ffeab2 100644 (file)
--- a/mod/forum/post.php
+++ b/mod/forum/post.php
@@ -368,7 +368,7 @@
             error("You can't split discussions!");
         }
 
-        if (!empty($name)) {    // User has confirmed the prune
+        if (!empty($name) && confirm_sesskey()) {    // User has confirmed the prune
 
             $newdiscussion = new object();
             $newdiscussion->course       = $discussion->course;

diff --git a/mod/forum/prune.html b/mod/forum/prune.html
index 383b3a9b73f1976706cc27764afc9f773c800543..1a4f4b78a57df699538d074f0946934af23cc432 100644 (file)
--- a/mod/forum/prune.html
+++ b/mod/forum/prune.html
@@ -11,6 +11,7 @@
     <td align="center" colspan="2">
     <input type="hidden" name="prune"   value="<?php p($prune) ?>" />
     <input type="hidden" name="confirm" value="<?php p($prune) ?>" />
+    <input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
     <input type="submit" value="<?php print_string('prune', 'forum'); ?>" />
     </td>
 </tr>