From be7c8bb2c2b4b5ceb3e59564652c0444a65e4d13 Mon Sep 17 00:00:00 2001
From: David Mudrak <david@moodle.com>
Date: Wed, 5 Jan 2011 15:58:41 +0100
Subject: [PATCH] MDL-24561 forum: require sesskey for the course-wide
 subscriptions - backported from 2.0

mod/forum/index.php allows to subscribe to and unsubscribe from all
forums in the course. However, sesskey was not checked here.
---
 mod/forum/index.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/mod/forum/index.php b/mod/forum/index.php
index 692657b1570..d23a17ff2c4 100644
--- a/mod/forum/index.php
+++ b/mod/forum/index.php
@@ -119,6 +119,7 @@
                                         
     /// Do course wide subscribe/unsubscribe
     if (!is_null($subscribe) and !isguestuser() and !isguest()) {
+        require_sesskey();
         foreach ($modinfo->instances['forum'] as $forumid=>$cm) {
             $forum = $forums[$forumid];
             $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); 
@@ -387,9 +388,9 @@
     if (!isguest()) {
         print_box_start('subscription');
         echo '<span class="helplink">';
-        echo '<a href="index.php?id='.$course->id.'&amp;subscribe=1">'.get_string('allsubscribe', 'forum').'</a>';
+        echo '<a href="index.php?id='.$course->id.'&amp;subscribe=1&amp;sesskey='.sesskey().'">'.get_string('allsubscribe', 'forum').'</a>';
         echo '</span><br /><span class="helplink">';
-        echo '<a href="index.php?id='.$course->id.'&amp;subscribe=0">'.get_string('allunsubscribe', 'forum').'</a>';
+        echo '<a href="index.php?id='.$course->id.'&amp;subscribe=0&amp;sesskey='.sesskey().'">'.get_string('allunsubscribe', 'forum').'</a>';
         echo '</span>';
         print_box_end();
         print_box('&nbsp;', 'clearer');