From 719593e83973c136f222f7c8db0c91ec8aca9e5f Mon Sep 17 00:00:00 2001
From: stronk7 <stronk7>
Date: Sat, 2 Oct 2004 22:44:25 +0000
Subject: [PATCH] admin/backup.php is now using sesskey.

---
 admin/backup.php    | 4 ++++
 admin/configure.php | 2 +-
 admin/index.php     | 2 +-
 backup/config.html  | 1 +
 backup/log.php      | 4 ++--
 5 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/admin/backup.php b/admin/backup.php
index 608f39e0689..d97e5239e2c 100644
--- a/admin/backup.php
+++ b/admin/backup.php
@@ -15,6 +15,10 @@
         error("Site isn't defined!");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     //Initialise error variables
     $error = false;
     $sche_destination_error = "";
diff --git a/admin/configure.php b/admin/configure.php
index f51b70fb59e..1059df1de68 100644
--- a/admin/configure.php
+++ b/admin/configure.php
@@ -37,7 +37,7 @@
     $table->data[] = array("<b><a href=\"filters.php\">".get_string("managefilters")."</a></b>",
                            get_string("adminhelpmanagefilters"));
     if (!isset($CFG->disablescheduledbackups)) {
-        $table->data[] = array("<b><a href=\"backup.php\">".get_string("backup")."</a></b>",
+        $table->data[] = array("<b><a href=\"backup.php?sesskey=$USER->sesskey\">".get_string("backup")."</a></b>",
                                get_string("adminhelpbackup"));
     }
 
diff --git a/admin/index.php b/admin/index.php
index 1a5047369ea..106e2b7feda 100644
--- a/admin/index.php
+++ b/admin/index.php
@@ -285,7 +285,7 @@
     $configdata .= "<font size=+1>&nbsp;</font><a href=\"filters.php\">".get_string("managefilters")."</a> - <font size=1>".
                     get_string("adminhelpmanagefilters")."</font><br />";
     if (!isset($CFG->disablescheduledbackups)) {
-        $configdata .= "<font size=+1>&nbsp;</font><a href=\"backup.php\">".get_string("backup")."</a> - <font size=1>".
+        $configdata .= "<font size=+1>&nbsp;</font><a href=\"backup.php?sesskey=$USER->sesskey\">".get_string("backup")."</a> - <font size=1>".
                         get_string("adminhelpbackup")."</font><br />";
     }
     $configdata .= "<font size=+1>&nbsp;</font><a href=\"editor.php\">". get_string("editorsettings") ."</a> - <font size=1>".
diff --git a/backup/config.html b/backup/config.html
index 5dabf688874..9a4c9b6289c 100644
--- a/backup/config.html
+++ b/backup/config.html
@@ -82,6 +82,7 @@
     $keep_array[500] = "500";
 ?>
 <form method="post" action="backup.php" name="form">
+<?php echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">"; ?>
 
 <table cellpadding=9 cellspacing=0 >
 <tr valign=top>
diff --git a/backup/log.php b/backup/log.php
index cf67b31f0ed..83af67c71ad 100644
--- a/backup/log.php
+++ b/backup/log.php
@@ -40,7 +40,7 @@
         print_header("$site->shortname: $strconfiguration: $strbackup", $site->fullname,
                       "<a href=\"../$CFG->admin/index.php\">$stradmin</a> -> ".
                       "<a href=\"../$CFG->admin/configure.php\">$strconfiguration</a> -> ".
-                      "<a href=\"../$CFG->admin/backup.php\">$strbackup</a> -> ".
+                      "<a href=\"../$CFG->admin/backup.php?sesskey=$USER->sesskey\">$strbackup</a> -> ".
                       $strlogs);
 
         print_heading($backuploglaststatus);
@@ -86,7 +86,7 @@
         print_header("$site->shortname: $strconfiguration: $strbackup", $site->fullname,
                       "<a href=\"../$CFG->admin/index.php\">$stradmin</a> -> ".
                       "<a href=\"../$CFG->admin/configure.php\">$strconfiguration</a> -> ".
-                      "<a href=\"../$CFG->admin/backup.php\">$strbackup</a> -> ".
+                      "<a href=\"../$CFG->admin/backup.php?sesskey=$USER->sesskey\">$strbackup</a> -> ".
                       "<a href=\"log.php\">$strlogs</a> -> ".
                       $strbackupdetails);