From a2016d0d1a50286c80ae2cc6311a177eaa1263b9 Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Fri, 6 Dec 2024 16:23:13 +0000
Subject: [PATCH] MDL-55034 blog: update external blog deletion to not leak
 sesskey.

---
 blog/external_blogs.php | 43 +++++++++++++++++++++++++----------------
 lang/en/blog.php        |  4 +++-
 lang/en/deprecated.txt  |  1 +
 3 files changed, 30 insertions(+), 18 deletions(-)

diff --git a/blog/external_blogs.php b/blog/external_blogs.php
index 667f4b70c1a..3da0c615268 100644
--- a/blog/external_blogs.php
+++ b/blog/external_blogs.php
@@ -34,15 +34,21 @@ $PAGE->set_url(new moodle_url('/blog/external_blogs.php'));
 require_capability('moodle/blog:manageexternal', $context);
 
 $delete = optional_param('delete', null, PARAM_INT);
+$confirm = optional_param('confirm', false, PARAM_BOOL);
 
 $strexternalblogs = get_string('externalblogs', 'blog');
 $straddnewexternalblog = get_string('addnewexternalblog', 'blog');
 $strblogs = get_string('blogs', 'blog');
-$message = null;
 
-if ($delete && confirm_sesskey()) {
-    $externalblog = $DB->get_record('blog_external', array('id' => $delete));
-    if ($externalblog->userid == $USER->id) {
+$PAGE->set_title("{$strblogs}: {$strexternalblogs}");
+$PAGE->set_pagelayout('standard');
+
+if ($delete) {
+    $externalblog = $DB->get_record('blog_external', ['id' => $delete, 'userid' => $USER->id], '*', MUST_EXIST);
+
+    if ($confirm) {
+        require_sesskey();
+
         // Delete the external blog.
         $DB->delete_records('blog_external', array('id' => $delete));
 
@@ -60,23 +66,28 @@ if ($delete && confirm_sesskey()) {
         $event = \core\event\blog_external_removed::create($eventparms);
         $event->add_record_snapshot('blog_external', $externalblog);
         $event->trigger();
-        $message = get_string('externalblogdeleted', 'blog');
+
+        redirect($PAGE->url, get_string('externalblogdeleted', 'blog'));
+    } else {
+        echo $OUTPUT->header();
+        echo $OUTPUT->heading("{$strexternalblogs}: " . s($externalblog->name), 2);
+
+        echo $OUTPUT->confirm(
+            get_string('deleteexternalblog', 'blog'),
+            new moodle_url($PAGE->url->out_omit_querystring(), ['delete' => $delete, 'confirm' => 1]),
+            $PAGE->url,
+        );
+
+        echo $OUTPUT->footer();
+        die;
     }
 }
 
 $blogs = $DB->get_records('blog_external', array('userid' => $USER->id));
 
-$PAGE->set_heading(fullname($USER));
-$PAGE->set_title("$strblogs: $strexternalblogs");
-$PAGE->set_pagelayout('standard');
-
 echo $OUTPUT->header();
 echo $OUTPUT->heading($strexternalblogs, 2);
 
-if (!empty($message)) {
-    echo $OUTPUT->notification($message);
-}
-
 echo $OUTPUT->box_start('generalbox boxaligncenter');
 
 if (!empty($blogs)) {
@@ -99,10 +110,8 @@ if (!empty($blogs)) {
         $editurl = new moodle_url('/blog/external_blog_edit.php', array('id' => $blog->id));
         $editicon = $OUTPUT->action_icon($editurl, new pix_icon('t/edit', get_string('editexternalblog', 'blog')));
 
-        $deletelink = new moodle_url('/blog/external_blogs.php', array('delete' => $blog->id, 'sesskey' => sesskey()));
-        $action = new confirm_action(get_string('externalblogdeleteconfirm', 'blog'));
-        $deleteicon = $OUTPUT->action_icon($deletelink, new pix_icon('t/delete', get_string('deleteexternalblog', 'blog')),
-                                           $action);
+        $deletelink = new moodle_url('/blog/external_blogs.php', ['delete' => $blog->id]);
+        $deleteicon = $OUTPUT->action_icon($deletelink, new pix_icon('t/delete', get_string('deleteexternalblog', 'blog')));
 
         $table->data[] = new html_table_row(array($blog->name,
                                                   $blog->url,
diff --git a/lang/en/blog.php b/lang/en/blog.php
index b021c8c9400..4f43579e387 100644
--- a/lang/en/blog.php
+++ b/lang/en/blog.php
@@ -98,7 +98,6 @@ $string['evententryadded'] = 'Blog entry added';
 $string['evententrydeleted'] = 'Blog entry deleted';
 $string['evententryupdated'] = 'Blog entry updated';
 $string['externalblogcrontime'] = 'External blog cron schedule';
-$string['externalblogdeleteconfirm'] = 'Unregister this external blog?';
 $string['externalblogdeleted'] = 'External blog unregistered';
 $string['externalblogs'] = 'External blogs';
 $string['eventexternalblogsviewed'] = 'External registered blogs viewed';
@@ -217,3 +216,6 @@ $string['wrongexternalid'] = 'Wrong external blog ID';
 $string['page-blog-edit'] = 'Blog editing pages';
 $string['page-blog-index'] = 'Blog listing pages';
 $string['page-blog-x'] = 'All blog pages';
+
+// Deprecated since Moodle 5.1.
+$string['externalblogdeleteconfirm'] = 'Unregister this external blog?';
diff --git a/lang/en/deprecated.txt b/lang/en/deprecated.txt
index 731ce479ab2..77be331a46e 100644
--- a/lang/en/deprecated.txt
+++ b/lang/en/deprecated.txt
@@ -72,3 +72,4 @@ tt_deleteevent,core_calendar
 tt_editevent,core_calendar
 userevent,core_calendar
 togglenotificationmenu,core_message
+externalblogdeleteconfirm,core_blog