From: Petr Skoda <skodak@moodle.org>
Date: Fri, 20 Nov 2009 08:33:33 +0000 (+0000)
Subject: MDL-20901 fixed input validation
X-Git-Url: http://git.mjollnir.org/gw?a=commitdiff_plain;h=c2dcbfe3a688deaa656c73b5cc42298baba30189;p=moodle.git

MDL-20901 fixed input validation
---

diff --git a/mod/survey/save.php b/mod/survey/save.php
index b6934bfa20..228c932fd0 100644
--- a/mod/survey/save.php
+++ b/mod/survey/save.php
@@ -30,7 +30,7 @@
 
 // Make sure this is a legitimate posting
 
-    if (!$formdata = data_submitted()) {
+    if (!$formdata = data_submitted() or !confirm_sesskey()) {
         print_error('cannotcallscript');
     }
 
diff --git a/mod/survey/view.php b/mod/survey/view.php
index 45a484140e..6b84b6b065 100644
--- a/mod/survey/view.php
+++ b/mod/survey/view.php
@@ -135,6 +135,7 @@
     echo "<form method=\"post\" action=\"save.php\" id=\"surveyform\">";
     echo '<div>';
     echo "<input type=\"hidden\" name=\"id\" value=\"$id\" />";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"".sesskey()."\" />";
 
     echo $OUTPUT->box(format_module_intro('survey', $survey, $cm->id), 'generalbox boxaligncenter bowidthnormal', 'intro');