MDL-84479 tool_usertours: verify sesskey prior to tour duplication.

admin/tool/usertours/classes/helper.php

@@ -208,12 +208,11 @@ class helper {
      * @return  \moodle_url             The URL.
      */
     public static function get_duplicate_tour_link($tourid) {
-        $link = new \moodle_url('/admin/tool/usertours/configure.php', [
+        return new \moodle_url('/admin/tool/usertours/configure.php', [
             'action'    => manager::ACTION_DUPLICATETOUR,
             'id'        => $tourid,
+            'sesskey'   => sesskey(),
         ]);
-
-        return $link;
     }
 
     /**

admin/tool/usertours/classes/manager.php

@@ -503,8 +503,9 @@ class manager {
      * @param   int         $tourid     The ID of the tour to duplicate.
      */
     protected function duplicate_tour($tourid) {
-        $tour = helper::get_tour($tourid);
+        require_sesskey();
 
+        $tour = helper::get_tour($tourid);
         $export = $tour->to_record();
         // Remove the id.
         unset($export->id);