MDL-84479 tool_usertours: verify sesskey prior to tour duplication.

admin/tool/usertours/classes/helper.php

@@ -218,12 +218,11 @@ class helper {
      * @return  \moodle_url             The URL.
      */
     public static function get_duplicate_tour_link($tourid) {
-        $link = new \moodle_url('/admin/tool/usertours/configure.php', [
+        return new \moodle_url('/admin/tool/usertours/configure.php', [
                 'action'    => manager::ACTION_DUPLICATETOUR,
                 'id'        => $tourid,
+                'sesskey'   => sesskey(),
         ]);
-
-        return $link;
     }
 
     /**

admin/tool/usertours/classes/manager.php

@@ -512,8 +512,9 @@ class manager {
      * @param   int         $tourid     The ID of the tour to duplicate.
      */
     protected function duplicate_tour($tourid) {
-        $tour = helper::get_tour($tourid);
+        require_sesskey();
 
+        $tour = helper::get_tour($tourid);
         $export = $tour->to_record();
         // Remove the id.
         unset($export->id);