From 5af0b52558468aa8ede9eac463dfe4417eb8966b Mon Sep 17 00:00:00 2001
From: toyomoyo <toyomoyo>
Date: Tue, 21 Feb 2006 02:02:24 +0000
Subject: [PATCH] changed data_submitted for secureform; added sesskey

---
 mod/data/add.php       | 2 +-
 mod/data/fields.php    | 2 +-
 mod/data/lib.php       | 1 +
 mod/data/rate.php      | 6 +++---
 mod/data/templates.php | 2 +-
 5 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/mod/data/add.php b/mod/data/add.php
index 4090a62fc7f..0291aa24d85 100755
--- a/mod/data/add.php
+++ b/mod/data/add.php
@@ -111,7 +111,7 @@
  ********************************************/
     $entrysaved = false;    //flag for displaying entry saved msg
 
-    if ($datarecord = data_submitted() and confirm_sesskey()) {        
+    if ($datarecord = data_submitted($CFG->wwwroot.'/mod/data/add.php') and confirm_sesskey()) {
         //if rid is present, we are in updating mode
         if ($rid){
 
diff --git a/mod/data/fields.php b/mod/data/fields.php
index de3ca33b351..186505f8b96 100755
--- a/mod/data/fields.php
+++ b/mod/data/fields.php
@@ -156,7 +156,7 @@
             break;
 
         case 'update':    ///update a field
-            if (confirm_sesskey() and $field = data_submitted()){
+            if (confirm_sesskey() and $field = data_submitted($CFG->wwwroot.'/mod/data/fields.php')){
                 $field->id = $fid;
 
                 $field->name = optional_param('name','',PARAM_NOTAGS);
diff --git a/mod/data/lib.php b/mod/data/lib.php
index 5661f3b00d4..ffbb3a90cb5 100755
--- a/mod/data/lib.php
+++ b/mod/data/lib.php
@@ -944,6 +944,7 @@ function data_print_ratings($data, $record) {
 
                 if ($ratingsmenuused) {
                     echo '<input type="hidden" name="id" value="'.$course->id.'" />';
+                    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
                     echo "<input type=\"submit\" value=\"".get_string("sendinratings", "data")."\" />";
                 }
                 echo '</div>';
diff --git a/mod/data/rate.php b/mod/data/rate.php
index da157245ca9..8715ea6dc38 100755
--- a/mod/data/rate.php
+++ b/mod/data/rate.php
@@ -18,12 +18,12 @@
 
     $returntoview = false;
 
-    if ($data = data_submitted()) {
+    if (($data = data_submitted($CFG->wwwroot.'/mod/data/view.php')) and confirm_sesskey()) {
 
         $lastrecordid = 0;
 
         foreach ((array)$data as $recordid => $rating) {
-            if ($recordid == "id") {
+            if (($recordid == 'id') || ($recordid=='sesskey')) {
                 continue;
             }
 
@@ -41,7 +41,7 @@
                 $newrating->userid = $USER->id;
                 $newrating->recordid = $recordid;
                 $newrating->rating = $rating;
-                
+                print_object($newrating);
                 if (! insert_record("data_ratings", $newrating)) {
                     error("Could not insert a new rating ($recordid = $rating)");
                 }
diff --git a/mod/data/templates.php b/mod/data/templates.php
index b2dfdd398a3..c998a891f09 100755
--- a/mod/data/templates.php
+++ b/mod/data/templates.php
@@ -77,7 +77,7 @@
     print_heading(format_string($data->name));
     
      ///processing submitted data, i.e updating form
-    if (($mytemplate = data_submitted()) && confirm_sesskey()){
+    if (($mytemplate = data_submitted($CFG->wwwroot.'/mod/data/templates.php')) && confirm_sesskey()){
 
         //generate default template
         if (!empty($mytemplate->defaultform)){