From 73f67f3e9bb85b80d472ab925e6adaaad271a524 Mon Sep 17 00:00:00 2001
From: Petr Skoda <skodak@moodle.org>
Date: Sat, 21 Nov 2009 16:29:06 +0000
Subject: [PATCH] MDL-20925 fixed input validation and course ajax now fully
 respects the disable course ajax option

---
 course/rest.php        | 5 +++++
 lib/ajax/ajaxcourse.js | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/course/rest.php b/course/rest.php
index fbc976c72a7..a90cd52ea7e 100644
--- a/course/rest.php
+++ b/course/rest.php
@@ -44,7 +44,12 @@ $context = get_context_instance(CONTEXT_COURSE, $course->id);
 require_login($course->id);
 require_capability('moodle/course:update', $context);
 
+if (!empty($CFG->disablecourseajax)) {
+    errorl_log('Course AJAX not allowed');
+    die;
+}
 
+require_sesskey();
 
 // OK, now let's process the parameters and do stuff
 
diff --git a/lib/ajax/ajaxcourse.js b/lib/ajax/ajaxcourse.js
index 3c17de75e54..03daa203554 100644
--- a/lib/ajax/ajaxcourse.js
+++ b/lib/ajax/ajaxcourse.js
@@ -220,7 +220,7 @@ main_class.prototype.connect = function(method, urlStub, callback, body) {
             callback = {};
         }
     }
-    return YAHOO.util.Connect.asyncRequest(method, this.portal.strings['wwwroot']+"/course/rest.php?courseId="+main.portal.id+"&"+urlStub, callback, body);
+    return YAHOO.util.Connect.asyncRequest(method, this.portal.strings['wwwroot']+"/course/rest.php?courseId="+main.portal.id+"&sesskey="+this.portal.strings['sesskey']+"&"+urlStub, callback, body);
 }