From b6098b92b05a490e23d56576a19d1d23bad2bb7b Mon Sep 17 00:00:00 2001
From: Marina Glancy <marina@moodle.com>
Date: Fri, 28 Apr 2017 12:20:46 +0800
Subject: [PATCH] MDL-58740 block_course_overview: check session key

Thanks to Kukas Schmidt for initial patch
---
 blocks/course_overview/block_course_overview.php | 2 +-
 blocks/course_overview/renderer.php              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/blocks/course_overview/block_course_overview.php b/blocks/course_overview/block_course_overview.php
index ae244ef1082..95aa9db9e4d 100644
--- a/blocks/course_overview/block_course_overview.php
+++ b/blocks/course_overview/block_course_overview.php
@@ -64,7 +64,7 @@ class block_course_overview extends block_base {
         $content = array();
 
         $updatemynumber = optional_param('mynumber', -1, PARAM_INT);
-        if ($updatemynumber >= 0) {
+        if ($updatemynumber >= 0 && optional_param('sesskey', '', PARAM_RAW) && confirm_sesskey()) {
             block_course_overview_update_mynumber($updatemynumber);
         }
 
diff --git a/blocks/course_overview/renderer.php b/blocks/course_overview/renderer.php
index 420e241657a..e8c85108c15 100644
--- a/blocks/course_overview/renderer.php
+++ b/blocks/course_overview/renderer.php
@@ -213,7 +213,7 @@ class block_course_overview_renderer extends plugin_renderer_base {
         for ($i = 1; $i <= $max; $i++) {
             $options[$i] = $i;
         }
-        $url = new moodle_url('/my/index.php');
+        $url = new moodle_url('/my/index.php', ['sesskey' => sesskey()]);
         $select = new single_select($url, 'mynumber', $options, block_course_overview_get_max_user_courses(), array());
         $select->set_label(get_string('numtodisplay', 'block_course_overview'));
         $output .= $this->output->render($select);