From 853fdc207690b58485ece441f415ae37dc1ab1cc Mon Sep 17 00:00:00 2001
From: moodler <moodler>
Date: Mon, 4 Oct 2004 13:40:32 +0000
Subject: [PATCH] Added sesskey checking for confirmuser variable

---
 admin/user.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/admin/user.php b/admin/user.php
index d2830723e63..cb1023f5c22 100644
--- a/admin/user.php
+++ b/admin/user.php
@@ -119,7 +119,7 @@
                          "<a href=\"users.php\">$strusers</a> -> $stredituser");
         }
 
-        if ($confirmuser) {
+        if ($confirmuser and confirm_sesskey()) {
             if (!$user = get_record("user", "id", "$confirmuser")) {
                 error("No such user!");
             }
@@ -309,7 +309,7 @@
                     $strlastaccess = get_string("never");
                 }
                 if ($user->confirmed == 0) {
-                    $confirmbutton = "<a href=\"user.php?confirmuser=$user->id\">" . get_string("confirm") . "</a>";
+                    $confirmbutton = "<a href=\"user.php?confirmuser=$user->id&sesskey=$USER->sesskey\">" . get_string("confirm") . "</a>";
                 } else {
                     $confirmbutton = "";
                 }