From a8adf25d119e48e935cd1236eeab7a04c8be9809 Mon Sep 17 00:00:00 2001
From: Petr Skoda <skodak@moodle.org>
Date: Thu, 19 Nov 2009 18:11:45 +0000
Subject: [PATCH] MDL-20901 fixed input validation

---
 backup/backup.php        | 2 +-
 backup/backup_check.html | 1 +
 backup/backup_form.html  | 2 ++
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/backup/backup.php b/backup/backup.php
index 3e45cc4cfd0..788616ce2b1 100644
--- a/backup/backup.php
+++ b/backup/backup.php
@@ -123,7 +123,7 @@
     raise_memory_limit("192M");
 
     //Call the form, depending the step we are
-    if (!$launch) {
+    if (!$launch or !data_submitted() or !confirm_sesskey()) {
         // if we're at the start, clear the cache of prefs
         if (isset($SESSION->backupprefs[$course->id])) {
             unset($SESSION->backupprefs[$course->id]);
diff --git a/backup/backup_check.html b/backup/backup_check.html
index a2ba9d2bb01..c864706ffe2 100644
--- a/backup/backup_check.html
+++ b/backup/backup_check.html
@@ -50,6 +50,7 @@
 <form id="form" method="post" action="backup.php">
 <table cellpadding="5" style="text-align:center;margin-left:auto;margin-right:auto">
 <?php
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
 
     if (empty($to)) {
         //Now print the Backup Name tr
diff --git a/backup/backup_form.html b/backup/backup_form.html
index c0b43751c17..37113fd4740 100644
--- a/backup/backup_form.html
+++ b/backup/backup_form.html
@@ -123,6 +123,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
 <form id="form1" method="post" action="backup.php">
 <table cellpadding="5" style="margin-left:auto;margin-right:auto;">
 <?php
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
+
 /// Acummulator for hidden options and proper XHTML output
     $hidden_options = '';
     //Now, check modules and info and show posibilities