From 57b2fa96d43ffaea8bb0645ad116254ab7544d38 Mon Sep 17 00:00:00 2001
From: Petr Skoda <skodak@moodle.org>
Date: Sat, 21 Nov 2009 15:16:40 +0000
Subject: [PATCH] MDL-20901 fixed input validation

---
 mod/choice/lib.php  | 3 ++-
 mod/choice/view.php | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/mod/choice/lib.php b/mod/choice/lib.php
index 3438bec3814..ccba62ef993 100644
--- a/mod/choice/lib.php
+++ b/mod/choice/lib.php
@@ -222,6 +222,7 @@ function choice_show_form($choice, $user, $cm, $allresponses) {
     //show save choice button
     echo '<div class="button">';
     echo "<input type=\"hidden\" name=\"id\" value=\"$cm->id\" />";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"".sesskey()."\" />";
     if (has_capability('mod/choice:choose', $context, $user->id, false)) { //don't show save button if the logged in user is the guest user.
         if ($choicefull) {
             print_string('choicefull', 'choice');
@@ -230,7 +231,7 @@ function choice_show_form($choice, $user, $cm, $allresponses) {
             echo "<input type=\"submit\" value=\"".get_string("savemychoice","choice")."\" />";
         }
         if ($choice->allowupdate && $aaa = get_record('choice_answers', 'choiceid', $choice->id, 'userid', $user->id)) {
-            echo "<br /><a href='view.php?id=".$cm->id."&amp;action=delchoice'>".get_string("removemychoice","choice")."</a>";
+            echo "<br /><a href='view.php?id=".$cm->id."&amp;action=delchoice&amp;sesskey=".sesskey()."'>".get_string("removemychoice","choice")."</a>";
         }
     } else {
         print_string('havetologin', 'choice');
diff --git a/mod/choice/view.php b/mod/choice/view.php
index dc8ec470e06..df8ad6f29ec 100644
--- a/mod/choice/view.php
+++ b/mod/choice/view.php
@@ -28,7 +28,7 @@
         print_error('badcontext');
     }
 
-    if ($action == 'delchoice') {
+    if ($action == 'delchoice' and confirm_sesskey() and has_capability('mod/choice:choose', $context) and $choice->allowupdate) {
         if ($answer = get_record('choice_answers', 'choiceid', $choice->id, 'userid', $USER->id)) {
             //print_object($answer);
             delete_records('choice_answers', 'id', $answer->id);
@@ -39,7 +39,7 @@
                   update_module_button($cm->id, $course->id, $strchoice), navmenu($course, $cm));
 
 /// Submit any new data if there is any
-    if ($form = data_submitted() && has_capability('mod/choice:choose', $context)) {
+    if ($form = data_submitted() && has_capability('mod/choice:choose', $context) && confirm_sesskey()) {
         $timenow = time();
         if (has_capability('mod/choice:deleteresponses', $context)) {
             if ($action == 'delete') { //some responses need to be deleted