From 19c795b83742c5aaa463e84c523ea9d41b800c10 Mon Sep 17 00:00:00 2001
From: Petr Skoda <skodak@moodle.org>
Date: Thu, 19 Nov 2009 19:28:19 +0000
Subject: [PATCH] MDL-20901 fixed input validation

---
 calendar/preferences.html | 1 +
 calendar/preferences.php  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/calendar/preferences.html b/calendar/preferences.html
index 8ca47f1bea..646f776f07 100644
--- a/calendar/preferences.html
+++ b/calendar/preferences.html
@@ -83,6 +83,7 @@
 
 <tr>
     <td colspan="2" style="text-align: center;">
+    <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
     <input type="submit" value="<?php print_string("savechanges") ?>" /></td>
 </tr>
 </table>
diff --git a/calendar/preferences.php b/calendar/preferences.php
index bd806941c7..01a1c2b23e 100644
--- a/calendar/preferences.php
+++ b/calendar/preferences.php
@@ -21,7 +21,7 @@ calendar_session_vars();
 
 /// If data submitted, then process and store.
 
-if ($form = data_submitted()) {
+if ($form = data_submitted() and confirm_sesskey()) {
     foreach ($form as $preference => $value) {
         switch ($preference) {
             case 'timeformat':
-- 
2.39.5