MDL-15450 CSRF prevention; merged from MOODLE_16_STABLE

user/edit.html

@@ -411,4 +411,5 @@ if (has_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM, SI
 </table>
 <input type="hidden" name="course" value="<?php p($course->id) ?>" />
 <input type="hidden" name="id" value="<?php p($user->id) ?>" />
+<input type="hidden" name="sesskey" value="<?php p(sesskey()) ?>" />
 </form>

user/edit.php

@@ -71,7 +71,7 @@
     
 /// If data submitted, then process and store.
 
-    if ($usernew = data_submitted()) {
+    if ($usernew = data_submitted() and confirm_sesskey()) {
         
         $context = get_context_instance(CONTEXT_SYSTEM, SITEID);
         // if userid = x and name = changeme then we are adding 1