From 135765992f8600eeca91aad89a720dcb985fdbca Mon Sep 17 00:00:00 2001
From: Petr Skoda <skodak@moodle.org>
Date: Fri, 20 Nov 2009 08:34:14 +0000
Subject: [PATCH] MDL-20901 fixed input validation

---
 mod/survey/save.php | 2 +-
 mod/survey/view.php | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/mod/survey/save.php b/mod/survey/save.php
index c5a3885a924..ffe5b532cf6 100644
--- a/mod/survey/save.php
+++ b/mod/survey/save.php
@@ -6,7 +6,7 @@
 
 // Make sure this is a legitimate posting
 
-    if (!$formdata = data_submitted("$CFG->wwwroot/mod/survey/view.php")) {
+    if (!$formdata = data_submitted("$CFG->wwwroot/mod/survey/view.php") or !confirm_sesskey()) {
         error("You are not supposed to use this script like that.");
     }
 
diff --git a/mod/survey/view.php b/mod/survey/view.php
index 74d4ab6f6e1..f9c876c7428 100644
--- a/mod/survey/view.php
+++ b/mod/survey/view.php
@@ -111,6 +111,7 @@
     echo "<form method=\"post\" action=\"save.php\" id=\"surveyform\">";
     echo '<div>';
     echo "<input type=\"hidden\" name=\"id\" value=\"$id\" />";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"".sesskey()."\" />";
 
     print_simple_box(format_text($survey->intro), 'center', '70%', '', 5, 'generalbox', 'intro');