From 41790d2e48322bd8560438aa1e8c7a588caeb0f0 Mon Sep 17 00:00:00 2001
From: Jun Pataleta <jun@moodle.com>
Date: Wed, 24 Oct 2018 09:32:48 +0800
Subject: [PATCH] MDL-63183 login: Add hidden login token input in guest login
 forms

* Affected forms:
  - login/index_form.html
  - auth/shibboleth/index_form.html
---
 auth/shibboleth/index_form.html | 1 +
 login/index_form.html           | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/auth/shibboleth/index_form.html b/auth/shibboleth/index_form.html
index 29943d6a8ea..7f46c14875a 100644
--- a/auth/shibboleth/index_form.html
+++ b/auth/shibboleth/index_form.html
@@ -54,6 +54,7 @@ if ($show_instructions) {
         </div>
         <form action="../../login/index.php" method="post" id="guestlogin">
           <div class="guestform">
+            <input type="hidden" name="logintoken" value="<?php echo s(\core\session\manager::get_login_token()); ?>" />
             <input type="hidden" name="username" value="guest" />
             <input type="hidden" name="password" value="guest" />
             <input type="submit" value="<?php print_string("loginguest") ?>" />
diff --git a/login/index_form.html b/login/index_form.html
index 11f568ae9d7..388df91735a 100644
--- a/login/index_form.html
+++ b/login/index_form.html
@@ -74,9 +74,10 @@ if (empty($CFG->authloginviaemail)) {
         </div>
         <form action="index.php" method="post" id="guestlogin">
           <div class="guestform">
+            <input type="hidden" name="logintoken" value="<?php echo s(\core\session\manager::get_login_token()); ?>" />
             <input type="hidden" name="username" value="guest" />
             <input type="hidden" name="password" value="guest" />
-            <input type="submit" value="<?php print_string("loginguest") ?>" />
+            <input type="submit" value="<?php print_string("loginguest"); ?>" />
           </div>
         </form>
       </div>