From 2fb84af3378a60ba928bfeb949a4421f3e8ec1d8 Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Thu, 11 May 2023 22:46:18 +0100
Subject: [PATCH] MDL-78225 output: add sesskey for post requests only in
 renderables.

---
 lib/outputcomponents.php | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/lib/outputcomponents.php b/lib/outputcomponents.php
index f7c6f4f12a0..87e5e4939b3 100644
--- a/lib/outputcomponents.php
+++ b/lib/outputcomponents.php
@@ -1012,7 +1012,10 @@ class single_button implements renderable {
         }
 
         // Form parameters.
-        $actionurl = new moodle_url($this->url, ['sesskey' => sesskey()]);
+        $actionurl = new moodle_url($this->url);
+        if ($this->method === 'post') {
+            $actionurl->param('sesskey', sesskey());
+        }
         $data->params = $actionurl->export_params_for_template();
 
         // Button actions.
@@ -1215,7 +1218,10 @@ class single_select implements renderable, templatable {
         }, array_keys($attributes));
 
         // Form parameters.
-        $actionurl = new moodle_url($this->url, ['sesskey' => sesskey()]);
+        $actionurl = new moodle_url($this->url);
+        if ($this->method === 'post') {
+            $actionurl->param('sesskey', sesskey());
+        }
         $data->params = $actionurl->export_params_for_template();
 
         // Select options.