admin/auth.php is now using sesskey.

Merged from MOODLE_14_STABLE

diff --git a/admin/auth.php b/admin/auth.php
index 2a1c93dcf52b6bfe705f9ce3a515cd1a1d12fa7a..6a808835c070ad0b5d0be0e709660328ffc1e3d4 100644 (file)
--- a/admin/auth.php
+++ b/admin/auth.php
@@ -12,6 +12,9 @@
         error("Only the admin can use this page");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
 
 /// If data submitted, then process and store.
 
@@ -27,7 +30,7 @@
                     notify("Problem saving config $name as $value");
                 }
             }
-            redirect("auth.php", get_string("changessaved"), 1);
+            redirect("auth.php?sesskey=$USER->sesskey", get_string("changessaved"), 1);
             exit;
 
         } else {
@@ -94,9 +97,10 @@
 
     echo "<center><p><b>";
     echo "<form target=\"{$CFG->framename}\" name=\"authmenu\" method=\"post\" action=\"auth.php\">";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">";
     print_string("chooseauthmethod","auth");
 
-    choose_from_menu ($options, "auth", $auth, "","document.location='auth.php?auth='+document.authmenu.auth.options[document.authmenu.auth.selectedIndex].value", "");
+    choose_from_menu ($options, "auth", $auth, "","document.location='auth.php?sesskey=$USER->sesskey&auth='+document.authmenu.auth.options[document.authmenu.auth.selectedIndex].value", "");
 
     echo "</b></p></center>";
         

diff --git a/admin/index.php b/admin/index.php
index 1a8d1da947a6326ebecc1b447ef067f2ded18868..1809bdd08495b4906f830c00ea1eda0dcea2a6c4 100644 (file)
--- a/admin/index.php
+++ b/admin/index.php
@@ -310,7 +310,7 @@
                             $configdata);
 
 
-    $userdata = "<font size=+1>&nbsp;</font><a href=\"auth.php\">".get_string("authentication")."</a> - <font size=\"1\">".
+    $userdata = "<font size=+1>&nbsp;</font><a href=\"auth.php?sesskey=$USER->sesskey\">".get_string("authentication")."</a> - <font size=\"1\">".
                  get_string("adminhelpauthentication")."</font><br />";
     $userdata .= "<font size=+1>&nbsp;</font><a href=\"user.php\">".get_string("edituser")."</a> - <font size=\"1\">".
                  get_string("adminhelpedituser")."</font><br />";

diff --git a/admin/users.php b/admin/users.php
index 71bb38d91ba99331ee2d8bc8943b5316d44a9df2..e9f72fb8a73e3999aeb5f1f60a04b4f4bfeb606c 100644 (file)
--- a/admin/users.php
+++ b/admin/users.php
@@ -22,7 +22,7 @@
 
     $table->align = array ("right", "left");
 
-    $table->data[] = array("<b><a href=\"auth.php\">".get_string("authentication")."</a></b>",
+    $table->data[] = array("<b><a href=\"auth.php?sesskey=$USER->sesskey\">".get_string("authentication")."</a></b>",
                            get_string("adminhelpauthentication"));
 
     $table->data[] = array("<b><a href=\"user.php\">".get_string("edituser")."</a></b>",