From 05565daa1e0a7829d5bd6fef59855c3dda0e0a8b Mon Sep 17 00:00:00 2001
From: Petr Skoda <skodak@moodle.org>
Date: Thu, 19 Nov 2009 19:47:46 +0000
Subject: [PATCH] MDL-20901 fixed input validation

---
 grade/edit/outcome/course.php       | 2 +-
 grade/edit/outcome/course_form.html | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/grade/edit/outcome/course.php b/grade/edit/outcome/course.php
index ee8d753dab..a4a625160f 100644
--- a/grade/edit/outcome/course.php
+++ b/grade/edit/outcome/course.php
@@ -98,7 +98,7 @@ foreach ($standardoutcomes as $oid=>$outcome) {
 
 
 /// form processing
-if ($data = data_submitted()) {
+if ($data = data_submitted() and confirm_sesskey()) {
     require_capability('moodle/grade:manageoutcomes', $context);
     if (!empty($data->add) && !empty($data->addoutcomes)) {
     /// add all selected to course list
diff --git a/grade/edit/outcome/course_form.html b/grade/edit/outcome/course_form.html
index 3185580184..29a64465fe 100755
--- a/grade/edit/outcome/course_form.html
+++ b/grade/edit/outcome/course_form.html
@@ -60,5 +60,6 @@
 </table>
 
 <input name="id" type="hidden" value="<?php echo $courseid?>"/>
+<input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 </div>
 </form>
-- 
2.39.5