From: Petr Skoda <skodak@moodle.org>
Date: Sat, 21 Nov 2009 15:26:54 +0000 (+0000)
Subject: MDL-20901 fixed input validation
X-Git-Url: http://git.mjollnir.org/gw?a=commitdiff_plain;h=441bef0f7a3683c96d3c1fb07d13fec916aabb72;p=moodle.git

MDL-20901 fixed input validation
---

diff --git a/mod/forum/subscriber.html b/mod/forum/subscriber.html
index 4fe214e8ca..5ea4b0fedb 100644
--- a/mod/forum/subscriber.html
+++ b/mod/forum/subscriber.html
@@ -1,6 +1,7 @@
 
 <form id="subscriberform" method="post" action="subscribers.php">
 <input type="hidden" name="id" value="<?php echo $id?>" />
+<input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>
       <td valign="top">
diff --git a/mod/forum/subscribers.php b/mod/forum/subscribers.php
index 35c7d6ec48..ddf802b02f 100644
--- a/mod/forum/subscribers.php
+++ b/mod/forum/subscribers.php
@@ -102,7 +102,7 @@ $strsubscribers = get_string("subscribers", "forum");
 $strforums      = get_string("forums", "forum");
 
 $searchtext = optional_param('searchtext', '', PARAM_RAW);
-if ($frm = data_submitted()) {
+if ($frm = data_submitted() and confirm_sesskey()) {
 
 /// A form was submitted so process the input
     if (!empty($frm->add) and !empty($frm->addselect)) {