From 36b1e811e4cb10f3f68116ca0bedbb0a3b3eb863 Mon Sep 17 00:00:00 2001
From: stronk7 <stronk7>
Date: Sat, 2 Oct 2004 23:07:22 +0000
Subject: [PATCH] admin/block.php is now using sesskey.

And solved bug when trying to unset config['block']. It isn't
an array but an object.
---
 admin/block.php  | 12 ++++++++----
 admin/blocks.php |  2 +-
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/admin/block.php b/admin/block.php
index a3387c39c9f..d6eb8da1a61 100644
--- a/admin/block.php
+++ b/admin/block.php
@@ -14,6 +14,10 @@
         error("Site isn't defined!");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     require_variable($_REQUEST['block']);
     $blockid = intval($_REQUEST['block']);
 
@@ -28,13 +32,13 @@
 
 /// If data submitted, then process and store.
 
-	if ($config = data_submitted()) {
-	    unset($config['block']); // This will always be set if we have reached this point
-	    $block->handle_config($config);
+    if ($config = data_submitted()) {
+        unset($config->block); // This will always be set if we have reached this point
+        $block->handle_config($config);
         print_header();
         redirect("$CFG->wwwroot/$CFG->admin/blocks.php", get_string("changessaved"), 1);
         exit;
-	}
+    }
 
 /// Otherwise print the form.
 
diff --git a/admin/blocks.php b/admin/blocks.php
index 95d5947e9b2..4b73e1e128a 100644
--- a/admin/blocks.php
+++ b/admin/blocks.php
@@ -152,7 +152,7 @@
 
         $settings = ''; // By default, no configuration
         if($blockobject->has_config()) {
-            $settings = '<a href="block.php?block='.$blockid.'">'.$strsettings.'</a>';
+            $settings = '<a href="block.php?block='.$blockid.'&sesskey='.$USER->sesskey.'">'.$strsettings.'</a>';
         }
 
         $count = blocks_get_courses_using_block_by_id($blockid);