From d84e70d04964ee335d252909126e8655ca472a00 Mon Sep 17 00:00:00 2001
From: stronk7 <stronk7>
Date: Sat, 9 Oct 2004 12:03:55 +0000
Subject: [PATCH] course/groups.php is using sesskey.

Merged from MOODLE_14_STABLE
---
 course/groups-edit.html | 3 +++
 course/groups.php       | 4 +++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/course/groups-edit.html b/course/groups-edit.html
index 04da8d6b99..3eeae5243b 100755
--- a/course/groups-edit.html
+++ b/course/groups-edit.html
@@ -87,6 +87,7 @@ function groupWindow(selectgroup) {
         <form name="form1" id="form1" method="post" action="groups.php">
           <input type="hidden" name="id" value="<?php p($course->id) ?>" />
           <input type="hidden" name="groupid" value="<?php p($selectedgroup) ?>" />
+          <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
           <select name="nonmembers[]" size="15" multiple="multiple">
             <?php 
                 if (!empty($nonmembers)) {
@@ -113,6 +114,7 @@ function groupWindow(selectgroup) {
       <td class="generalboxcontent"><p>
         <form name="form2" id="form2" method="post" action="groups.php">
           <input type="hidden" name="id" value="<?php p($course->id) ?>" />
+          <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
           <select name="groups" size="15" onChange="updateMembers(this)">
             <?php 
                 if (!empty($listgroups)) {
@@ -146,6 +148,7 @@ function groupWindow(selectgroup) {
         <form name="form3" id="form3" method="post" action="groups.php">
           <input type="hidden" name="id" value="<?php p($course->id) ?>" />
           <input type="hidden" name="groupid" value="<?php p($selectedgroup) ?>" />
+          <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
           <select name="members[]" size="15" multiple="multiple">
             <?php 
                 if (!empty($members)) {
diff --git a/course/groups.php b/course/groups.php
index 081beefe0a..a95030bc32 100644
--- a/course/groups.php
+++ b/course/groups.php
@@ -82,7 +82,7 @@
 
 /// We are in editing mode.  First, process any inputs there may be.
 
-    if ($data = data_submitted()) {
+    if ($data = data_submitted() and confirm_sesskey()) {
 
         if (!empty($data->nonmembersadd)) {            /// Add people to a group
             if (!empty($data->nonmembers) and !empty($data->groupid)) {
@@ -219,6 +219,8 @@
         $members = $listmembers[$selectedgroup];
     }
 
+    $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
 /// Print out the complete form
 
     include('groups-edit.html');
-- 
2.39.5