From 64da68314000f974afa9123a71786bb41debed57 Mon Sep 17 00:00:00 2001
From: Petr Skoda <skodak@moodle.org>
Date: Sat, 21 Nov 2009 22:23:03 +0000
Subject: [PATCH] MDL-20901 fixed input validation

---
 mod/glossary/formats.php  | 5 +++--
 mod/glossary/settings.php | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/mod/glossary/formats.php b/mod/glossary/formats.php
index e8e22839bb3..19ee665c61a 100644
--- a/mod/glossary/formats.php
+++ b/mod/glossary/formats.php
@@ -15,7 +15,7 @@
     }
 
     $form = data_submitted();
-    if ( $mode == 'visible' ) {
+    if ( $mode == 'visible' and confirm_sesskey()) {
         if ( $displayformat ) {
             if ( $displayformat->visible ) {
                 $displayformat->visible = 0;
@@ -26,7 +26,7 @@
         }
         redirect("$CFG->wwwroot/$CFG->admin/settings.php?section=modsettingglossary#glossary_formats_header");
         die;
-    } elseif ( $mode == 'edit' and $form) {
+    } elseif ( $mode == 'edit' and $form and confirm_sesskey()) {
 
         $displayformat->popupformatname = $form->popupformatname;
         $displayformat->showgroup   = $form->showgroup;
@@ -246,6 +246,7 @@
         <input type="submit" value="<?php print_string("savechanges") ?>" /></td>
     </tr>
     <input type="hidden" name="id"    value="<?php p($id) ?>" />
+    <input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
     <input type="hidden" name="mode"    value="edit" />
     <?php
 
diff --git a/mod/glossary/settings.php b/mod/glossary/settings.php
index cb9f5c31009..e1f0cd5bece 100644
--- a/mod/glossary/settings.php
+++ b/mod/glossary/settings.php
@@ -67,7 +67,7 @@ foreach ($formats as $formatid=>$formatname) {
         $vtitle = get_string("show");
         $vicon  = "show.gif";
     }
-    $vicon = "<a title=\"".$vtitle."\" href=\"$CFG->wwwroot/mod/glossary/formats.php?id=$formatid&amp;mode=visible\"><img class=\"iconsmall\" src=\"$CFG->pixpath/t/".$vicon."\" alt=\"$vtitle\" /></a>";
+    $vicon = "<a title=\"".$vtitle."\" href=\"$CFG->wwwroot/mod/glossary/formats.php?id=$formatid&amp;mode=visible&amp;sesskey=".sesskey()."\"><img class=\"iconsmall\" src=\"$CFG->pixpath/t/".$vicon."\" alt=\"$vtitle\" /></a>";
 
     $str .= '<td align="center">'.$eicon.'&nbsp;&nbsp;'.$vicon.'</td>';
     $str .= '</tr>';