From 973d2660e6d550895587da5a141e2b7693255e59 Mon Sep 17 00:00:00 2001
From: skodak <skodak>
Date: Fri, 2 Jan 2009 10:51:26 +0000
Subject: [PATCH] MDL-16613 sesskey cleanup

---
 admin/modules.php                        |  6 +++---
 admin/timezone.php                       |  2 +-
 admin/user.php                           |  4 ++--
 blocks/tags/block_tags.php               |  3 ++-
 course/index.php                         |  2 +-
 course/search.php                        |  8 ++++----
 grade/edit/outcome/index.php             |  6 +++---
 grade/edit/scale/index.php               |  4 ++--
 grade/lib.php                            |  4 ++--
 index.php                                |  2 +-
 lib/weblib.php                           |  2 +-
 mod/chat/report.php                      |  2 +-
 mod/feedback/complete_guest.php          | 10 ++++------
 mod/feedback/delete_template.php         |  4 ++--
 mod/feedback/edit.php                    |  4 ++--
 mod/feedback/edit_item.php               |  2 +-
 mod/feedback/show_entries.php            |  8 ++++----
 mod/feedback/show_entries_anonym.php     |  4 ++--
 mod/feedback/view.php                    |  2 +-
 mod/hotpot/index.php                     |  7 +------
 mod/quiz/editlib.php                     |  4 ++--
 mod/resource/type/ims/resource.class.php |  2 +-
 mod/scorm/datamodels/aicc.js.php         |  2 +-
 mod/scorm/datamodels/scorm_12.js.php     |  2 +-
 mod/scorm/datamodels/scorm_13.js.php     |  2 +-
 question/editlib.php                     |  2 +-
 tag/coursetags_edit.php                  |  5 +++--
 theme/index.php                          |  2 +-
 28 files changed, 51 insertions(+), 56 deletions(-)

diff --git a/admin/modules.php b/admin/modules.php
index e8d5099b2d..ffb22524b7 100644
--- a/admin/modules.php
+++ b/admin/modules.php
@@ -205,7 +205,7 @@
         // took out hspace="\10\", because it does not validate. don't know what to replace with.
         $icon = "<img src=\"$CFG->modpixpath/$module->name/icon.gif\" class=\"icon\" alt=\"\" />";
 
-        $delete = "<a href=\"modules.php?delete=$module->name&amp;sesskey=$USER->sesskey\">$strdelete</a>";
+        $delete = "<a href=\"modules.php?delete=$module->name&amp;sesskey=".sesskey()."\">$strdelete</a>";
 
         if (file_exists("$CFG->dirroot/mod/$module->name/settings.php") ||
                 file_exists("$CFG->dirroot/mod/$module->name/settingstree.php")) {
@@ -224,11 +224,11 @@
         }
 
         if ($module->visible) {
-            $visible = "<a href=\"modules.php?hide=$module->name&amp;sesskey=$USER->sesskey\" title=\"$strhide\">".
+            $visible = "<a href=\"modules.php?hide=$module->name&amp;sesskey=".sesskey()."\" title=\"$strhide\">".
                        "<img src=\"$CFG->pixpath/i/hide.gif\" class=\"icon\" alt=\"$strhide\" /></a>";
             $class = "";
         } else {
-            $visible = "<a href=\"modules.php?show=$module->name&amp;sesskey=$USER->sesskey\" title=\"$strshow\">".
+            $visible = "<a href=\"modules.php?show=$module->name&amp;sesskey=".sesskey()."\" title=\"$strshow\">".
                        "<img src=\"$CFG->pixpath/i/show.gif\" class=\"icon\" alt=\"$strshow\" /></a>";
             $class = " class=\"dimmed_text\"";
         }
diff --git a/admin/timezone.php b/admin/timezone.php
index 1c23e90248..d09f0e6cdd 100644
--- a/admin/timezone.php
+++ b/admin/timezone.php
@@ -40,7 +40,7 @@
     echo '<center><form action="timezone.php" method="post">';
     echo "$strusers ($strall): ";
     choose_from_menu ($timezones, "zone", $current, get_string("serverlocaltime"), "", "99");
-    echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"".sesskey()."\" />";
     echo '<input type="submit" value="'.s($strsavechanges).'" />';
     echo "</form></center>";
 
diff --git a/admin/user.php b/admin/user.php
index 10325bd446..94c2e98b4b 100644
--- a/admin/user.php
+++ b/admin/user.php
@@ -225,7 +225,7 @@
                 $deletebutton = "";
             } else {
                 if (has_capability('moodle/user:delete', $sitecontext)) {
-                    $deletebutton = "<a href=\"user.php?delete=$user->id&amp;sesskey=$USER->sesskey\">$strdelete</a>";
+                    $deletebutton = "<a href=\"user.php?delete=$user->id&amp;sesskey=".sesskey()."\">$strdelete</a>";
                 } else {
                     $deletebutton ="";
                 }
@@ -234,7 +234,7 @@
             if (has_capability('moodle/user:update', $sitecontext) and ($user->id==$USER->id or $user->id != $mainadmin->id) and !is_mnet_remote_user($user)) {
                 $editbutton = "<a href=\"$securewwwroot/user/editadvanced.php?id=$user->id&amp;course=$site->id\">$stredit</a>";
                 if ($user->confirmed == 0) {
-                    $confirmbutton = "<a href=\"user.php?confirmuser=$user->id&amp;sesskey=$USER->sesskey\">" . get_string('confirm') . "</a>";
+                    $confirmbutton = "<a href=\"user.php?confirmuser=$user->id&amp;sesskey=".sesskey()."\">" . get_string('confirm') . "</a>";
                 } else {
                     $confirmbutton = "";
                 }
diff --git a/blocks/tags/block_tags.php b/blocks/tags/block_tags.php
index 90f598e531..fecd63475f 100644
--- a/blocks/tags/block_tags.php
+++ b/blocks/tags/block_tags.php
@@ -230,6 +230,7 @@ class block_tags extends block_base {
                     $buttonadd = get_string('add', $tagslang);
                     $arrowtitle = get_string('arrowtitle', $tagslang);
                     $coursetaghelpbutton = helpbutton('addtags', 'adding tags', $tagslang, TRUE, FALSE, '', TRUE);
+                    $sesskey = sesskey();
                     $this->content->footer .= <<<EOT
                         <hr />
                         <form action="{$CFG->wwwroot}/tag/coursetags_add.php" method="post" id="coursetag"
@@ -237,7 +238,7 @@ class block_tags extends block_base {
                             <div style="display: none;">
                                 <input type="hidden" name="entryid" value="$COURSE->id" />
                                 <input type="hidden" name="userid" value="$USER->id" />
-                                <input type="hidden" name="sesskey" value="$USER->sesskey" />
+                                <input type="hidden" name="sesskey" value="$sesskey" />
                             </div>
                             <div><label for="coursetag_new_tag">$tagthisunit</label></div>
                             <div class="coursetag_form_wrapper">
diff --git a/course/index.php b/course/index.php
index 49f374799d..e01fe6408c 100644
--- a/course/index.php
+++ b/course/index.php
@@ -332,7 +332,7 @@ function print_category_edit($category, $displaylist, $parentslist, $depth=-1, $
                     unset($tempdisplaylist[$key]);
                 }
             }
-            popup_form ("index.php?move=$category->id&amp;sesskey=$USER->sesskey&amp;moveto=", $tempdisplaylist, "moveform$category->id", $category->parent, '', '', '', false);
+            popup_form ("index.php?move=$category->id&amp;sesskey=".sesskey()."&amp;moveto=", $tempdisplaylist, "moveform$category->id", $category->parent, '', '', '', false);
         }
         echo '</td>';
         echo '</tr>';
diff --git a/course/search.php b/course/search.php
index 299bb1400f..73bf8e9daf 100644
--- a/course/search.php
+++ b/course/search.php
@@ -188,7 +188,7 @@
      ///add the module parameter to the paging bar if they exists
         $modulelink = "";
         if (!empty($modulelist) and confirm_sesskey()) {
-            $modulelink = "&amp;modulelist=".$modulelist."&amp;sesskey=".$USER->sesskey;
+            $modulelink = "&amp;modulelist=".$modulelist."&amp;sesskey=".sesskey();
         }
 
         print_navigation_bar($totalcount, $page, $perpage, $encodedsearch, $modulelink);
@@ -205,7 +205,7 @@
         } else {
         /// Show editing UI.
             echo "<form id=\"movecourses\" action=\"search.php\" method=\"post\">\n";
-            echo "<div><input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />\n";
+            echo "<div><input type=\"hidden\" name=\"sesskey\" value=\"".sesskey()."\" />\n";
             echo "<input type=\"hidden\" name=\"search\" value=\"".s($search)."\" />\n";
             echo "<input type=\"hidden\" name=\"page\" value=\"$page\" />\n";
             echo "<input type=\"hidden\" name=\"perpage\" value=\"$perpage\" /></div>\n";
@@ -277,10 +277,10 @@
                 // checks whether user can change visibility
                 if (has_capability('moodle/course:visibility', $coursecontext)) {
                     if (!empty($course->visible)) {
-                        echo "<a title=\"".get_string("hide")."\" href=\"search.php?search=$encodedsearch&amp;perpage=$perpage&amp;page=$page&amp;hide=$course->id&amp;sesskey=$USER->sesskey\">\n<img".
+                        echo "<a title=\"".get_string("hide")."\" href=\"search.php?search=$encodedsearch&amp;perpage=$perpage&amp;page=$page&amp;hide=$course->id&amp;sesskey=".sesskey()."\">\n<img".
                             " src=\"$pixpath/t/hide.gif\" class=\"iconsmall\" alt=\"".get_string("hide")."\" /></a>\n ";
                     } else {
-                        echo "<a title=\"".get_string("show")."\" href=\"search.php?search=$encodedsearch&amp;perpage=$perpage&amp;page=$page&amp;show=$course->id&amp;sesskey=$USER->sesskey\">\n<img".
+                        echo "<a title=\"".get_string("show")."\" href=\"search.php?search=$encodedsearch&amp;perpage=$perpage&amp;page=$page&amp;show=$course->id&amp;sesskey=".sesskey()."\">\n<img".
                             " src=\"$pixpath/t/show.gif\" class=\"iconsmall\" alt=\"".get_string("show")."\" /></a>\n ";
                     }
                 }
diff --git a/grade/edit/outcome/index.php b/grade/edit/outcome/index.php
index 3ce3632ac6..b24c14c46d 100644
--- a/grade/edit/outcome/index.php
+++ b/grade/edit/outcome/index.php
@@ -107,7 +107,7 @@ switch ($action) {
                     "index.php?id={$courseid}", "index.php?id={$courseid}",
                     array('outcomeid' => $outcome->id,
                         'action'=> 'delete',
-                        'sesskey' =>  $USER->sesskey,
+                        'sesskey' =>  sesskey(),
                         'deleteconfirmed'=> 1)
                     );
             print_footer();
@@ -176,7 +176,7 @@ if ($courseid and $outcomes = grade_outcome::fetch_all_local($courseid)) {
         $buttons .= "<a title=\"$stredit\" href=\"edit.php?courseid=$courseid&amp;id=$outcome->id\"><img".
                     " src=\"$CFG->pixpath/t/edit.gif\" class=\"iconsmall\" alt=\"$stredit\" /></a> ";
         if ($outcome->can_delete()) {
-            $buttons .= "<a title=\"$strdelete\" href=\"index.php?id=$courseid&amp;outcomeid=$outcome->id&amp;action=delete&amp;sesskey=$USER->sesskey\"><img".
+            $buttons .= "<a title=\"$strdelete\" href=\"index.php?id=$courseid&amp;outcomeid=$outcome->id&amp;action=delete&amp;sesskey=".sesskey()."\"><img".
                         " src=\"$CFG->pixpath/t/delete.gif\" class=\"iconsmall\" alt=\"$strdelete\" /></a> ";
         }
         $line[] = $buttons;
@@ -233,7 +233,7 @@ if ($outcomes = grade_outcome::fetch_all_global()) {
                         " src=\"$CFG->pixpath/t/edit.gif\" class=\"iconsmall\" alt=\"$stredit\" /></a> ";
         }
         if (has_capability('moodle/grade:manage', get_context_instance(CONTEXT_SYSTEM)) and $outcome->can_delete()) {
-            $buttons .= "<a title=\"$strdelete\" href=\"index.php?id=$courseid&amp;outcomeid=$outcome->id&amp;action=delete&amp;sesskey=$USER->sesskey\"><img".
+            $buttons .= "<a title=\"$strdelete\" href=\"index.php?id=$courseid&amp;outcomeid=$outcome->id&amp;action=delete&amp;sesskey=".sesskey()."\"><img".
                         " src=\"$CFG->pixpath/t/delete.gif\" class=\"iconsmall\" alt=\"$strdelete\" /></a> ";
         }
         $line[] = $buttons;
diff --git a/grade/edit/scale/index.php b/grade/edit/scale/index.php
index 18f2ee10a1..da240fd4c0 100644
--- a/grade/edit/scale/index.php
+++ b/grade/edit/scale/index.php
@@ -112,7 +112,7 @@ if ($courseid and $scales = grade_scale::fetch_all_local($courseid)) {
         $buttons .= "<a title=\"$stredit\" href=\"edit.php?courseid=$courseid&amp;id=$scale->id\"><img".
                     " src=\"$CFG->pixpath/t/edit.gif\" class=\"iconsmall\" alt=\"$stredit\" /></a> ";
         if (!$used) {
-            $buttons .= "<a title=\"$strdelete\" href=\"index.php?id=$courseid&amp;scaleid=$scale->id&amp;action=delete&amp;sesskey=$USER->sesskey\"><img".
+            $buttons .= "<a title=\"$strdelete\" href=\"index.php?id=$courseid&amp;scaleid=$scale->id&amp;action=delete&amp;sesskey=".sesskey()."\"><img".
                         " src=\"$CFG->pixpath/t/delete.gif\" class=\"iconsmall\" alt=\"$strdelete\" /></a> ";
         }
         $line[] = $buttons;
@@ -142,7 +142,7 @@ if ($scales = grade_scale::fetch_all_global()) {
                         " src=\"$CFG->pixpath/t/edit.gif\" class=\"iconsmall\" alt=\"$stredit\" /></a> ";
         }
         if (!$used and has_capability('moodle/course:managescales', get_context_instance(CONTEXT_SYSTEM))) {
-            $buttons .= "<a title=\"$strdelete\" href=\"index.php?id=$courseid&amp;scaleid=$scale->id&amp;action=delete&amp;sesskey=$USER->sesskey\"><img".
+            $buttons .= "<a title=\"$strdelete\" href=\"index.php?id=$courseid&amp;scaleid=$scale->id&amp;action=delete&amp;sesskey=".sesskey()."\"><img".
                         " src=\"$CFG->pixpath/t/delete.gif\" class=\"iconsmall\" alt=\"$strdelete\" /></a> ";
         }
         $line[] = $buttons;
diff --git a/grade/lib.php b/grade/lib.php
index 319b49aa1a..bf55900d78 100644
--- a/grade/lib.php
+++ b/grade/lib.php
@@ -1166,7 +1166,7 @@ class grade_seq extends grade_structure {
         global $USER, $CFG;
 
         $this->courseid   = $courseid;
-        $this->commonvars = "&amp;sesskey=$USER->sesskey&amp;id=$this->courseid";
+        $this->commonvars = "&amp;sesskey=".sesskey()."&amp;id=$this->courseid";
         $this->context    = get_context_instance(CONTEXT_COURSE, $courseid);
 
         // get course grade tree
@@ -1310,7 +1310,7 @@ class grade_tree extends grade_structure {
         global $USER, $CFG;
 
         $this->courseid   = $courseid;
-        $this->commonvars = "&amp;sesskey=$USER->sesskey&amp;id=$this->courseid";
+        $this->commonvars = "&amp;sesskey=".sesskey()."&amp;id=$this->courseid";
         $this->levels     = array();
         $this->context    = get_context_instance(CONTEXT_COURSE, $courseid);
 
diff --git a/index.php b/index.php
index 0a7cb9d1ac..351c584b22 100644
--- a/index.php
+++ b/index.php
@@ -156,7 +156,7 @@
             if (ismoving($SITE->id)) {
                 $stractivityclipboard = strip_tags(get_string('activityclipboard', '', $USER->activitycopyname));
                 echo '<p><font size="2">';
-                echo "$stractivityclipboard&nbsp;&nbsp;(<a href=\"course/mod.php?cancelcopy=true&amp;sesskey=$USER->sesskey\">". get_string('cancel') .'</a>)';
+                echo "$stractivityclipboard&nbsp;&nbsp;(<a href=\"course/mod.php?cancelcopy=true&amp;sesskey=".sesskey()."\">". get_string('cancel') .'</a>)';
                 echo '</font></p>';
             }
 
diff --git a/lib/weblib.php b/lib/weblib.php
index fac80a4a55..aefb110be1 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -5335,7 +5335,7 @@ function update_categories_search_button($search,$page,$perpage) {
         return "<form $CFG->frametarget method=\"get\" action=\"$CFG->wwwroot/course/search.php\">".
                '<div>'.
                "<input type=\"hidden\" name=\"edit\" value=\"$edit\" />".
-               "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />".
+               "<input type=\"hidden\" name=\"sesskey\" value=\"".sesskey()."\" />".
                "<input type=\"hidden\" name=\"search\" value=\"".s($search, true)."\" />".
                "<input type=\"hidden\" name=\"page\" value=\"$page\" />".
                "<input type=\"hidden\" name=\"perpage\" value=\"$perpage\" />".
diff --git a/mod/chat/report.php b/mod/chat/report.php
index 19e72c6bdc..6858eecd63 100644
--- a/mod/chat/report.php
+++ b/mod/chat/report.php
@@ -60,7 +60,7 @@
 
         if ($deletesession and has_capability('mod/chat:deletelog', $context)) {
             notice_yesno(get_string('deletesessionsure', 'chat'),
-                         "report.php?id=$cm->id&amp;deletesession=1&amp;confirmdelete=1&amp;start=$start&amp;end=$end&amp;sesskey=$USER->sesskey",
+                         "report.php?id=$cm->id&amp;deletesession=1&amp;confirmdelete=1&amp;start=$start&amp;end=$end&amp;sesskey=".sesskey(),
                          "report.php?id=$cm->id");
         }
 
diff --git a/mod/feedback/complete_guest.php b/mod/feedback/complete_guest.php
index df48c61429..8afd260fe1 100644
--- a/mod/feedback/complete_guest.php
+++ b/mod/feedback/complete_guest.php
@@ -77,9 +77,7 @@
     }
     
     //check whether the user has a session
-    if(!isset($USER->sesskey) OR !$USER->sesskey) {
-        print_error('error');
-    }
+    // there used to be a sesskey test - this could not work - sorry
     
     //check whether the feedback is located and! started from the mainsite
     if($course->id == SITEID AND !$courseid) {
@@ -150,7 +148,7 @@
             //check, if all required items have a value
             if(feedback_check_values($_POST, $startitempos, $lastitempos)) {
                 $userid = $USER->id; //arb
-                if($completedid = feedback_save_guest_values($_POST, $USER->sesskey)){
+                if($completedid = feedback_save_guest_values($_POST, sesskey())){
                     add_to_log($course->id, 'feedback', 'startcomplete', 'view.php?id='.$cm->id, $feedback->id); //arb: log even guest submissions or at least the startcomplete since the other add log event is elsewhere
                     
                     if(!$gonextpage AND !$gopreviouspage) $preservevalues = false;//es kann gespeichert werden
@@ -220,7 +218,7 @@
             $firstpagebreak = false;
         }
         $maxitemcount = $DB->count_records('feedback_item', array('feedback'=>$feedback->id));
-        $feedbackcompletedtmp = feedback_get_current_completed($feedback->id, true, $courseid, $USER->sesskey);
+        $feedbackcompletedtmp = feedback_get_current_completed($feedback->id, true, $courseid, sesskey());
 
         /// Print the main part of the page
         ///////////////////////////////////////////////////////////////////////////
@@ -308,7 +306,7 @@
                         $value =  isset($formdata->{$frmvaluename})?$formdata->{$frmvaluename}:NULL;
                     }else {
                         if(isset($feedbackcompletedtmp->id)) {
-                            $value = feedback_get_item_value($feedbackcompletedtmp->id, $feedbackitem->id, $USER->sesskey);
+                            $value = feedback_get_item_value($feedbackcompletedtmp->id, $feedbackitem->id, sesskey());
                         }
                     }
                     echo '<tr>';
diff --git a/mod/feedback/delete_template.php b/mod/feedback/delete_template.php
index 8a52966419..af312fe804 100644
--- a/mod/feedback/delete_template.php
+++ b/mod/feedback/delete_template.php
@@ -114,7 +114,7 @@
                 echo '<input type="hidden" name="deletetempl" value="'.$template->id.'" />';
                 echo '<input type="hidden" name="shoulddelete" value="1" />';
                 echo '<input type="hidden" name="id" value="'.$id.'" />';
-                echo '<input type="hidden" name="sesskey" value="' . $USER->sesskey . '" />';
+                echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
                 echo '</form>';
                 echo '</td></tr>';
             }
@@ -122,7 +122,7 @@
         }
 ?>
         <form name="frm" action="<?php echo $ME;?>" method="post">
-            <input type="hidden" name="sesskey" value="<?php echo $USER->sesskey;?>" />
+            <input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
             <input type="hidden" name="id" value="<?php echo $id;?>" />
             <input type="hidden" name="canceldelete" value="0" />
             <button type="button" onclick="this.form.canceldelete.value=1;this.form.submit();"><?php print_string('cancel');?></button>
diff --git a/mod/feedback/edit.php b/mod/feedback/edit.php
index e872121f11..f117b66c59 100644
--- a/mod/feedback/edit.php
+++ b/mod/feedback/edit.php
@@ -408,7 +408,7 @@
         
         $query = 'id='.$id;
         $query .= '&do_show='.$tab;
-        //$query .= '&sesskey='.$USER->sesskey;
+        //$query .= '&sesskey='.sesskey();
         
         return $query;
     }
@@ -416,7 +416,7 @@
     function feedback_edit_print_default_form_values($id, $tab) {
         global $USER;
         
-        echo '<input type="hidden" name="sesskey" value="' . $USER->sesskey . '" />';
+        echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
         echo '<input type="hidden" name="id" value="'.$id.'" />';
         echo '<input type="hidden" name="do_show" value="'.$tab.'" />';
     }
diff --git a/mod/feedback/edit_item.php b/mod/feedback/edit_item.php
index faa8feb801..f2e4000499 100644
--- a/mod/feedback/edit_item.php
+++ b/mod/feedback/edit_item.php
@@ -185,7 +185,7 @@
     // print_simple_box_start('center');
     print_box_start('generalbox boxwidthwide boxaligncenter');
         echo '<form action="'.$ME.'" method="post">';
-        echo '<input type="hidden" name="sesskey" value="' . $USER->sesskey . '" />';
+        echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     
     //this div makes the buttons stand side by side
     echo '<div>';
diff --git a/mod/feedback/show_entries.php b/mod/feedback/show_entries.php
index 006ba70497..286725144f 100644
--- a/mod/feedback/show_entries.php
+++ b/mod/feedback/show_entries.php
@@ -193,7 +193,7 @@
                                 <td align="right">
                                 <?php
                                     $show_button_link = $ME;
-                                    $show_button_options = array('sesskey'=>$USER->sesskey, 'userid'=>$student->id, 'do_show'=>'showoneentry', 'id'=>$id);
+                                    $show_button_options = array('sesskey'=>sesskey(), 'userid'=>$student->id, 'do_show'=>'showoneentry', 'id'=>$id);
                                     $show_button_label = get_string('show_entries', 'feedback');
                                     print_single_button($show_button_link, $show_button_options, $show_button_label, 'post');
                                 ?>
@@ -204,7 +204,7 @@
                                 <td align="right">
                                 <?php
                                     $delete_button_link = 'delete_completed.php';
-                                    $delete_button_options = array('sesskey'=>$USER->sesskey, 'completedid'=>$feedbackcompleted->id, 'do_show'=>'showoneentry', 'id'=>$id);
+                                    $delete_button_options = array('sesskey'=>sesskey(), 'completedid'=>$feedbackcompleted->id, 'do_show'=>'showoneentry', 'id'=>$id);
                                     $delete_button_label = get_string('delete_entry', 'feedback');
                                     print_single_button($delete_button_link, $delete_button_options, $delete_button_label, 'post');
                                 ?>
@@ -228,7 +228,7 @@
                     <td align="right">
                         <?php
                             $show_anon_button_link = 'show_entries_anonym.php';
-                            $show_anon_button_options = array('sesskey'=>$USER->sesskey, 'userid'=>0, 'do_show'=>'showoneentry', 'id'=>$id);
+                            $show_anon_button_options = array('sesskey'=>sesskey(), 'userid'=>0, 'do_show'=>'showoneentry', 'id'=>$id);
                             $show_anon_button_label = get_string('show_entries', 'feedback');
                             print_single_button($show_anon_button_link, $show_anon_button_options, $show_anon_button_label, 'post');
                         ?>
@@ -259,7 +259,7 @@
             // print_simple_box_start("center", '50%');
             print_box_start('generalbox boxaligncenter boxwidthnormal');
             echo '<form>';
-            echo '<input type="hidden" name="sesskey" value="' . $USER->sesskey . '" />';
+            echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
             echo '<table width="100%">';
             $itemnr = 0;
             foreach($feedbackitems as $feedbackitem){
diff --git a/mod/feedback/show_entries_anonym.php b/mod/feedback/show_entries_anonym.php
index bed5ba0418..228db2ec01 100644
--- a/mod/feedback/show_entries_anonym.php
+++ b/mod/feedback/show_entries_anonym.php
@@ -98,7 +98,7 @@
         <table>
             <tr>
                 <td>
-                    <input type="hidden" name="sesskey" value="<?php echo $USER->sesskey;?>" />
+                    <input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
                     <select name="completedid" size="<?php echo (sizeof($feedbackcompleteds)>10)?10:5;?>">
 <?php
                     if(is_array($feedbackcompleteds)) {
@@ -142,7 +142,7 @@
             // print_simple_box_start("center", '50%');
             print_box_start('generalbox boxaligncenter boxwidthnormal');
             echo '<form>';
-            echo '<input type="hidden" name="sesskey" value="' . $USER->sesskey . '" />';
+            echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
             echo '<table width="100%">';
             $itemnr = 0;
             foreach($feedbackitems as $feedbackitem){
diff --git a/mod/feedback/view.php b/mod/feedback/view.php
index 1641e893f1..abb656f199 100644
--- a/mod/feedback/view.php
+++ b/mod/feedback/view.php
@@ -186,7 +186,7 @@
             //if the user is not known so we cannot save the values temporarly
             if(!isset($USER->username) OR $USER->username == 'guest') {
                 $completefile = 'complete_guest.php';
-                $guestid = $USER->sesskey;
+                $guestid = sesskey();
             }else {
                 $completefile = 'complete.php';
                 $guestid = false;
diff --git a/mod/hotpot/index.php b/mod/hotpot/index.php
index 8e51480e57..d5dfce79bd 100644
--- a/mod/hotpot/index.php
+++ b/mod/hotpot/index.php
@@ -18,12 +18,7 @@
 
     add_to_log($course->id, "hotpot", "view all", "index.php?id=$course->id", "");
 
-    // Moodle 1.4+ requires sesskey to be passed in forms
-    if (isset($USER->sesskey)) {
-        $sesskey = '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
-    } else {
-        $sesskey = '';
-    }
+    $sesskey = '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
 
     // get message strings for titles
     $strmodulenameplural = get_string("modulenameplural", "hotpot");
diff --git a/mod/quiz/editlib.php b/mod/quiz/editlib.php
index 2f3e97f915..767edb255c 100644
--- a/mod/quiz/editlib.php
+++ b/mod/quiz/editlib.php
@@ -447,7 +447,7 @@ function quiz_print_question_list($quiz, $pageurl, $allowdelete=true,
 <form method="post" action="edit.php"><div>
     <fieldset class="invisiblefieldset" style="display: block;">
     <label for="<?php echo "inputq$qnum" ?>"><?php echo $strgrade; ?></label>:<br />
-    <input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>" />
+    <input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
     <?php echo $pageurl->hidden_params_out(); ?>
     <input type="hidden" name="savechanges" value="save" />
         <?php
@@ -1499,7 +1499,7 @@ function quiz_print_grading_form($quiz, $pageurl, $tabindex){
     $strsave=get_string('save',"quiz");
     echo "<form method=\"post\" action=\"edit.php\"><div>";
     echo '<fieldset class="invisiblefieldset" style="display: block;">';
-    echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"".sesskey()."\" />";
     echo $pageurl->hidden_params_out();
     $a='<input type="text" id="inputmaxgrade" name="maxgrade" size="' . ($quiz->decimalpoints + 2) . '" tabindex="'.($tabindex)
          .'" value="'.quiz_format_grade($quiz, $quiz->grade).'" />';
diff --git a/mod/resource/type/ims/resource.class.php b/mod/resource/type/ims/resource.class.php
index d1a4bca280..2e97e3c4a7 100644
--- a/mod/resource/type/ims/resource.class.php
+++ b/mod/resource/type/ims/resource.class.php
@@ -384,7 +384,7 @@ class resource_ims extends resource_base {
                 $options['courseid'] = $course->id;
                 $options['cmid'] = $cm->id;
                 $options['file'] = $resource->reference;
-                $options['sesskey'] = $USER->sesskey;
+                $options['sesskey'] = sesskey();
                 $options['inpopup'] = $inpopup;
                 if ($errorcode == 3) {
                     $label = get_string ('deploy', 'resource');
diff --git a/mod/scorm/datamodels/aicc.js.php b/mod/scorm/datamodels/aicc.js.php
index 64a3069f32..1e2271002c 100644
--- a/mod/scorm/datamodels/aicc.js.php
+++ b/mod/scorm/datamodels/aicc.js.php
@@ -527,7 +527,7 @@ function AICCapi() {
         }
         //popupwin(datastring);
         var myRequest = NewHttpReq();
-        result = DoRequest(myRequest,"<?php p($CFG->wwwroot) ?>/mod/scorm/datamodel.php","id=<?php p($id) ?>&sesskey=<?php p($USER->sesskey) ?>"+datastring);
+        result = DoRequest(myRequest,"<?php p($CFG->wwwroot) ?>/mod/scorm/datamodel.php","id=<?php p($id) ?>&sesskey=<?php echo sesskey() ?>"+datastring);
         results = result.split('\n');
         errorCode = results[1];
         return results[0];
diff --git a/mod/scorm/datamodels/scorm_12.js.php b/mod/scorm/datamodels/scorm_12.js.php
index 4e4589f99e..f7d6c9d256 100644
--- a/mod/scorm/datamodels/scorm_12.js.php
+++ b/mod/scorm/datamodels/scorm_12.js.php
@@ -585,7 +585,7 @@ function SCORMapi1_2() {
         datastring += '&scoid=<?php echo $scoid ?>';
         
         var myRequest = NewHttpReq();
-        result = DoRequest(myRequest,"<?php p($CFG->wwwroot) ?>/mod/scorm/datamodel.php","id=<?php p($id) ?>&sesskey=<?php p($USER->sesskey) ?>"+datastring);
+        result = DoRequest(myRequest,"<?php p($CFG->wwwroot) ?>/mod/scorm/datamodel.php","id=<?php p($id) ?>&sesskey=<?php echo sesskey() ?>"+datastring);
         results = String(result).split('\n');
         errorCode = results[1];
         return results[0];
diff --git a/mod/scorm/datamodels/scorm_13.js.php b/mod/scorm/datamodels/scorm_13.js.php
index 8ee312e890..d075ea6726 100644
--- a/mod/scorm/datamodels/scorm_13.js.php
+++ b/mod/scorm/datamodels/scorm_13.js.php
@@ -1237,7 +1237,7 @@ function SCORMapi1_3() {
 //            }
         ?>
         var myRequest = NewHttpReq();
-        var result = DoRequest(myRequest,"<?php p($CFG->wwwroot) ?>/mod/scorm/datamodel.php","id=<?php p($id) ?>&sesskey=<?php p($USER->sesskey) ?>"+datastring);
+        var result = DoRequest(myRequest,"<?php p($CFG->wwwroot) ?>/mod/scorm/datamodel.php","id=<?php p($id) ?>&sesskey=<?php echo sesskey() ?>"+datastring);
         <?php
 //            if (scorm_debugging($scorm)) {
 //                echo 'popupwin(result);';
diff --git a/question/editlib.php b/question/editlib.php
index 72721d301b..60afa8e56c 100644
--- a/question/editlib.php
+++ b/question/editlib.php
@@ -338,7 +338,7 @@ function question_list($contexts, $pageurl, $categoryandcontext, $cm = null,
         if (question_has_capability_on($question, 'edit', $question->category)) {
             // hide-feature
             if($question->hidden) {
-                echo "<a title=\"$strrestore\" href=\"edit.php?".$pageurl->get_query_string()."&amp;unhide=$question->id&amp;sesskey=$USER->sesskey\"><img
+                echo "<a title=\"$strrestore\" href=\"edit.php?".$pageurl->get_query_string()."&amp;unhide=$question->id&amp;sesskey=".sesskey()."\"><img
                         src=\"$CFG->pixpath/t/restore.gif\" alt=\"$strrestore\" /></a>";
             } else {
                 echo "<a title=\"$strdelete\" href=\"edit.php?".$pageurl->get_query_string()."&amp;deleteselected=$question->id&amp;q$question->id=1\"><img
diff --git a/tag/coursetags_edit.php b/tag/coursetags_edit.php
index 124a1ab0de..fd454385b6 100644
--- a/tag/coursetags_edit.php
+++ b/tag/coursetags_edit.php
@@ -117,13 +117,14 @@ print_header_simple($title, '', $nav, '', '', false);
         $script = coursetag_get_jscript();
         $addtagshelp = helpbutton('addtags', 'adding tags', $tagslang, TRUE, FALSE, '', TRUE);
         $edittagthisunit = get_string('edittagthisunit', $tagslang);
-    $arrowtitle = get_string('arrowtitle', $tagslang);
+        $arrowtitle = get_string('arrowtitle', $tagslang);
+        $sesskey = sesskey();
         $outstr .= <<<EOT
             $script
             <form action="$CFG->wwwroot/tag/coursetags_edit.php" method="post" id="coursetag">
                 <div style="display: none;">
                     <input type="hidden" name="courseid" value="$course->id" />
-                    <input type="hidden" name="sesskey" value="$USER->sesskey" />
+                    <input type="hidden" name="sesskey" value="$sesskey" />
                 </div>
                 <div class="coursetag_edit_centered">
                     <div class="coursetag_edit_row">
diff --git a/theme/index.php b/theme/index.php
index 636e4f5c82..dfd65e9e35 100644
--- a/theme/index.php
+++ b/theme/index.php
@@ -57,7 +57,7 @@
     print_heading($strthemes);
 
     $themes = get_list_of_plugins("theme");
-    $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+    $sesskey = sesskey();
 
     echo "<table style=\"margin-left:auto;margin-right:auto;\" cellpadding=\"7\" cellspacing=\"5\">\n";
 
-- 
2.39.5