From 8733010253f627475b83a0db67f3d02a66cd9fdf Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Mon, 10 Feb 2025 10:54:09 +0000
Subject: [PATCH] MDL-84479 tool_usertours: verify sesskey prior to tour
 duplication.

---
 admin/tool/usertours/classes/helper.php  | 5 ++---
 admin/tool/usertours/classes/manager.php | 3 ++-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/admin/tool/usertours/classes/helper.php b/admin/tool/usertours/classes/helper.php
index 6c2befa697a..20424a2167a 100644
--- a/admin/tool/usertours/classes/helper.php
+++ b/admin/tool/usertours/classes/helper.php
@@ -218,12 +218,11 @@ class helper {
      * @return  \moodle_url             The URL.
      */
     public static function get_duplicate_tour_link($tourid) {
-        $link = new \moodle_url('/admin/tool/usertours/configure.php', [
+        return new \moodle_url('/admin/tool/usertours/configure.php', [
                 'action'    => manager::ACTION_DUPLICATETOUR,
                 'id'        => $tourid,
+                'sesskey'   => sesskey(),
         ]);
-
-        return $link;
     }
 
     /**
diff --git a/admin/tool/usertours/classes/manager.php b/admin/tool/usertours/classes/manager.php
index afe7194867b..b8bbc4e75a7 100644
--- a/admin/tool/usertours/classes/manager.php
+++ b/admin/tool/usertours/classes/manager.php
@@ -512,8 +512,9 @@ class manager {
      * @param   int         $tourid     The ID of the tour to duplicate.
      */
     protected function duplicate_tour($tourid) {
-        $tour = helper::get_tour($tourid);
+        require_sesskey();
 
+        $tour = helper::get_tour($tourid);
         $export = $tour->to_record();
         // Remove the id.
         unset($export->id);