sesskey added to logout.php MDL-8727 ; backported from HEAD

enrol/authorize/enrol.php

@@ -638,7 +638,7 @@ class enrolment_plugin_authorize
         }
         if (isset($SESSION->ccpaid)) {
             unset($SESSION->ccpaid);
-            redirect($CFG->wwwroot . '/login/logout.php');
+            redirect($CFG->wwwroot . '/login/logout.php?sesskey='.sesskey());
             return;
         }
     }

lang/en_utf8/moodle.php

@@ -746,6 +746,7 @@ $string['loginstepsnone'] = '<p>Hi!</p>
 $string['loginto'] = 'Login to $a';
 $string['loginusing'] = 'Login here using your username and password';
 $string['logout'] = 'Logout';
+$string['logoutconfirm'] = 'Do you really want to logout?';
 $string['logs'] = 'Logs';
 $string['logtoomanycourses'] = ' [ <a href=\"$a->url\">more</a> ] ';
 $string['logtoomanyusers'] = ' [ <a href=\"$a->url\">more</a> ] ';

lib/weblib.php

@@ -2463,7 +2463,7 @@ function user_login_string($course=NULL, $user=NULL) {
                       " (<a target=\"{$CFG->framename}\" href=\"$wwwroot/login/index.php\">".get_string('login').'</a>)';
         } else {
             $loggedinas = $realuserinfo.get_string('loggedinas', 'moodle', $username).' '.$instudentview.
-                      " (<a target=\"{$CFG->framename}\" href=\"$CFG->wwwroot/login/logout.php\">".get_string('logout').'</a>)';
+                      " (<a target=\"{$CFG->framename}\" href=\"$CFG->wwwroot/login/logout.php?sesskey=".sesskey()."\">".get_string('logout').'</a>)';
         }
     } else {
         $loggedinas = get_string('loggedinnot', 'moodle').

login/logout.php

@@ -3,6 +3,16 @@
 
     require_once("../config.php");
 
+
+    $sesskey = optional_param('sesskey', '__notpresent__', PARAM_RAW); // we want not null default to prevent required sesskey warning
+
+    if (!confirm_sesskey($sesskey)) {
+        print_header($SITE->fullname, $SITE->fullname, 'home');
+        notice_yesno(get_string('logoutconfirm'), 'logout.php?sesskey='.sesskey(), $CFG->wwwroot.'/');
+        print_footer();
+        die;
+    }
+
     require_logout();
 
     redirect("$CFG->wwwroot/");