From 473d3495a517dda6b3753ffd5c5fc650a741c8b6 Mon Sep 17 00:00:00 2001
From: stronk7 <stronk7>
Date: Sat, 9 Oct 2004 18:43:32 +0000
Subject: [PATCH] course/student.php is using sesskey.

---
 course/student.html | 1 +
 course/student.php  | 6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/course/student.html b/course/student.html
index af6f16a9d41..0f20e8e1d90 100644
--- a/course/student.html
+++ b/course/student.html
@@ -1,6 +1,7 @@
 
 <form name="studentform" id="studentform" method="post" action="student.php">
 <input type="hidden" name="previoussearch" value="<?php echo $previoussearch ?>">
+<input type="hidden" name="sesskey" value="<?php echo $sesskey ?>">
 <input type="hidden" name="id" value="<?php echo $id?>">
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>
diff --git a/course/student.php b/course/student.php
index a83d68c4757..9263a55be5a 100644
--- a/course/student.php
+++ b/course/student.php
@@ -67,7 +67,7 @@
 /// A form was submitted so process the input
 
     } else {
-        if (!empty($frm->add) and !empty($frm->addselect)) {
+        if (!empty($frm->add) and !empty($frm->addselect) and confirm_sesskey()) {
             if ($course->enrolperiod) {
                 $timestart = time();
                 $timeend   = $timestart + $course->enrolperiod;
@@ -79,7 +79,7 @@
                     error("Could not add student with id $addstudent to this course!");
                 }
             }
-        } else if (!empty($frm->remove) and !empty($frm->removeselect)) {
+        } else if (!empty($frm->remove) and !empty($frm->removeselect) and confirm_sesskey()) {
             foreach ($frm->removeselect as $removestudent) {
                 if (! unenrol_student($removestudent, $course->id)) {
                     error("Could not remove student with id $removestudent from this course!");
@@ -135,6 +135,8 @@
 
     print_simple_box_start("center", "", "$THEME->cellheading");
 
+    $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
     include('student.html');
 
     print_simple_box_end();