From 8a7934f7b1d6e40b4ce7cd1be2882b94b1d445b2 Mon Sep 17 00:00:00 2001 From: Petr Skoda Date: Tue, 3 Aug 2010 11:00:02 +0000 Subject: [PATCH] we really should redirect after each action, otherwise sloppy referer tricks fail back especially when action is using POST --- course/view.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/course/view.php b/course/view.php index 6fe94fef6da..4ca99c8cfcb 100644 --- a/course/view.php +++ b/course/view.php @@ -106,12 +106,14 @@ if ($PAGE->user_allowed_editing()) { if (($edit == 1) and confirm_sesskey()) { $USER->editing = 1; + redirect($PAGE->url); } else if (($edit == 0) and confirm_sesskey()) { $USER->editing = 0; if(!empty($USER->activitycopy) && $USER->activitycopycourse == $course->id) { $USER->activitycopy = false; $USER->activitycopycourse = NULL; } + redirect($PAGE->url); } if ($hide && confirm_sesskey()) { @@ -187,8 +189,8 @@ $PAGE->requires->js_init_call('M.core_completion.init'); } - // We are currently keeping the button here from 1.x to help new teachers figure out - // what to do, even though the link also appears in the course admin block. It also + // We are currently keeping the button here from 1.x to help new teachers figure out + // what to do, even though the link also appears in the course admin block. It also // means you can back out of a situation where you removed the admin block. :) if ($PAGE->user_allowed_editing()) { $buttons = $OUTPUT->edit_button(new moodle_url('/course/view.php', array('id' => $course->id)));