Replaced require_variable() and optional_variable() with required_param()

& optional_param(). Added sesskey check to forgot password form too.

login/confirm.php

@@ -3,9 +3,12 @@
     require_once("../config.php");
     require_once("../auth/$CFG->auth/lib.php");
 
-    if (isset($_GET['p']) and isset($_GET['s']) ) {     #  p = user.secret   s = user.username
+    $p = required_param( 'p' ); // user.secret
+    $s = required_param( 's' ); // user.username
 
-        $user = get_complete_user_data('username', $_GET['s']);
+    if (!empty($p) and !empty($s) ) {    
+
+        $user = get_complete_user_data('username', $s );
 
         if (!empty($user)) {
 
@@ -18,7 +21,7 @@
                 exit;
             }
 
-            if ($user->secret == $_GET['p']) {   // They have provided the secret key to get in
+            if ($user->secret == $p) {   // They have provided the secret key to get in
 
                 if (!set_field("user", "confirmed", 1, "id", $user->id)) {
                     error("Could not confirm this user!");

login/forgot_password.php

@@ -2,8 +2,8 @@
 
     require_once("../config.php");
 
-    optional_variable($p, "");
-    optional_variable($s, "");
+    $p = optional_param('p','');
+    $s = optional_param('s','');
 
     if (!empty($p) and !empty($s)) {  // User trying to authenticate change password routine
 
@@ -38,6 +38,10 @@
 
     if ($frm = data_submitted()) {    // Initial request for new password
 
+        if (!confirm_sesskey()) {
+            error( 'sesskey invalid' );
+        }
+
         validate_form($frm, $err);
 
         if (count((array)$err) == 0) {

login/forgot_password_form.html

@@ -7,6 +7,7 @@
 
   <td>
     <form action="<?php p("$CFG->wwwroot/login/forgot_password.php") ?>" method="post" name="form" id="form">
+    <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
     <table>
     <tr>
         <td class="label"><?php print_string("email") ?>:</td>