From 5770e5147838aa06a3ecdff6fc3aebbbd17fff90 Mon Sep 17 00:00:00 2001
From: Andrew Nicols <andrew@nicols.co.uk>
Date: Thu, 20 Nov 2014 09:27:24 +0800
Subject: [PATCH] MDL-48106 mod_glossary: Add missing sesskey checks

---
 mod/glossary/editcategories.html | 1 +
 mod/glossary/editcategories.php  | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/mod/glossary/editcategories.html b/mod/glossary/editcategories.html
index 3b64818ce9f..a5eec6ee009 100644
--- a/mod/glossary/editcategories.html
+++ b/mod/glossary/editcategories.html
@@ -33,6 +33,7 @@
 <tr>
 <td colspan="2">
     <div class="buttons">
+    <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
     <input type="hidden" name="id" value="<?php p($cm->id) ?>" />
     <input type="hidden" name="action" value="<?php p($action) ?>" />
     <input type="hidden" name="confirm" value="1" />
diff --git a/mod/glossary/editcategories.php b/mod/glossary/editcategories.php
index c32444711d3..405b979bb55 100644
--- a/mod/glossary/editcategories.php
+++ b/mod/glossary/editcategories.php
@@ -95,6 +95,7 @@ if ( $hook >0 ) {
 
     if ( $action == "edit" ) {
         if ( $confirm ) {
+            require_sesskey();
             $action = "";
             $cat = new stdClass();
             $cat->id = $hook;
@@ -128,6 +129,7 @@ if ( $hook >0 ) {
 
     } elseif ( $action == "delete" ) {
         if ( $confirm ) {
+            require_sesskey();
             $DB->delete_records("glossary_entries_categories", array("categoryid"=>$hook));
             $DB->delete_records("glossary_categories", array("id"=>$hook));
 
@@ -165,6 +167,7 @@ if ( $hook >0 ) {
                         <td align="$rightalignment" style="width:50%">
                         <form id="form" method="post" action="editcategories.php">
                         <div>
+                        <input type="hidden" name="sesskey"     value="<?php echo sesskey(); ?>" />
                         <input type="hidden" name="id"          value="<?php p($cm->id) ?>" />
                         <input type="hidden" name="action"      value="delete" />
                         <input type="hidden" name="confirm"     value="1" />
@@ -188,6 +191,7 @@ if ( $hook >0 ) {
 
 } elseif ( $action == "add" ) {
     if ( $confirm ) {
+        require_sesskey();
         $dupcategory = $DB->get_records_sql("SELECT * FROM {glossary_categories} WHERE ".$DB->sql_like('name','?', false)." AND glossaryid=?", array($name, $glossary->id));
         if ( $dupcategory ) {
             redirect("editcategories.php?id=$cm->id&amp;action=add&amp;name=$name", get_string("duplicatecategory", "glossary"), 2);