From: Petr Skoda <skodak@moodle.org>
Date: Thu, 19 Nov 2009 19:47:46 +0000 (+0000)
Subject: MDL-20901 fixed input validation
X-Git-Url: http://git.mjollnir.org/gw?a=commitdiff_plain;h=05565daa1e0a7829d5bd6fef59855c3dda0e0a8b;p=moodle.git

MDL-20901 fixed input validation
---

diff --git a/grade/edit/outcome/course.php b/grade/edit/outcome/course.php
index ee8d753dab..a4a625160f 100644
--- a/grade/edit/outcome/course.php
+++ b/grade/edit/outcome/course.php
@@ -98,7 +98,7 @@ foreach ($standardoutcomes as $oid=>$outcome) {
 
 
 /// form processing
-if ($data = data_submitted()) {
+if ($data = data_submitted() and confirm_sesskey()) {
     require_capability('moodle/grade:manageoutcomes', $context);
     if (!empty($data->add) && !empty($data->addoutcomes)) {
     /// add all selected to course list
diff --git a/grade/edit/outcome/course_form.html b/grade/edit/outcome/course_form.html
index 3185580184..29a64465fe 100755
--- a/grade/edit/outcome/course_form.html
+++ b/grade/edit/outcome/course_form.html
@@ -60,5 +60,6 @@
 </table>
 
 <input name="id" type="hidden" value="<?php echo $courseid?>"/>
+<input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 </div>
 </form>