From: Petr Skoda <skodak@moodle.org>
Date: Sat, 21 Nov 2009 20:41:28 +0000 (+0000)
Subject: MDL-20901 fixed input validation
X-Git-Url: http://git.mjollnir.org/gw?a=commitdiff_plain;h=e35139b72c47cb9570b86cd7d5ab6439141a7579;p=moodle.git

MDL-20901 fixed input validation
---

diff --git a/tag/manage.php b/tag/manage.php
index 1c2cf71f99..5dac3512ad 100644
--- a/tag/manage.php
+++ b/tag/manage.php
@@ -116,6 +116,10 @@ switch($action) {
         }
         break;
     case 'addofficialtag':
+        if (!data_submitted() or !confirm_sesskey()) {
+            break;
+        }
+
         $new_otags = explode(',', optional_param('otagsadd', '', PARAM_TAG));
         $notice = '';
         foreach ( $new_otags as $new_otag ) {
@@ -145,6 +149,7 @@ print('<form class="tag-management-form" method="post" action="'.$CFG->wwwroot.'
 print('<input type="hidden" name="action" value="addofficialtag" />');
 print('<div class="tag-management-form generalbox"><label class="accesshide" for="id_otagsadd">'. get_string('addotags', 'tag') .'</label>'.
     '<input name="otagsadd" id="id_otagsadd" type="text" />'.
+    '<input type="hidden" name="sesskey" value="'.sesskey().'">'.
     '<input name="addotags" value="'. get_string('addotags', 'tag') .'" onclick="skipClientValidation = true;" id="id_addotags" type="submit" />'.
     '</div>');
 print('</form>');