From: Petr Skoda <skodak@moodle.org>
Date: Thu, 19 Nov 2009 19:28:19 +0000 (+0000)
Subject: MDL-20901 fixed input validation
X-Git-Url: http://git.mjollnir.org/gw?a=commitdiff_plain;h=19c795b83742c5aaa463e84c523ea9d41b800c10;p=moodle.git

MDL-20901 fixed input validation
---

diff --git a/calendar/preferences.html b/calendar/preferences.html
index 8ca47f1bea..646f776f07 100644
--- a/calendar/preferences.html
+++ b/calendar/preferences.html
@@ -83,6 +83,7 @@
 
 <tr>
     <td colspan="2" style="text-align: center;">
+    <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
     <input type="submit" value="<?php print_string("savechanges") ?>" /></td>
 </tr>
 </table>
diff --git a/calendar/preferences.php b/calendar/preferences.php
index bd806941c7..01a1c2b23e 100644
--- a/calendar/preferences.php
+++ b/calendar/preferences.php
@@ -21,7 +21,7 @@ calendar_session_vars();
 
 /// If data submitted, then process and store.
 
-if ($form = data_submitted()) {
+if ($form = data_submitted() and confirm_sesskey()) {
     foreach ($form as $preference => $value) {
         switch ($preference) {
             case 'timeformat':