diff --git a/grade/edit/outcome/course.php b/grade/edit/outcome/course.php
index da3aec78aca..45461b3411f 100644
--- a/grade/edit/outcome/course.php
+++ b/grade/edit/outcome/course.php
@@ -96,7 +96,7 @@ foreach ($standardoutcomes as $oid=>$outcome) {
 
 
 /// form processing
-if ($data = data_submitted()) {
+if ($data = data_submitted() and confirm_sesskey()) {
     require_capability('moodle/grade:manageoutcomes', $context);
     if (!empty($data->add) && !empty($data->addoutcomes)) {
     /// add all selected to course list
diff --git a/grade/edit/outcome/course_form.html b/grade/edit/outcome/course_form.html
index 3185580184b..29a64465feb 100755
--- a/grade/edit/outcome/course_form.html
+++ b/grade/edit/outcome/course_form.html
@@ -60,5 +60,6 @@
 </table>
 
 <input name="id" type="hidden" value="<?php echo $courseid?>"/>
+<input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 </div>
 </form>