L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-24561 forum: require sesskey for the course-wide subscriptions

Browse Source 
mod/forum/index.php allows to subscribe to and unsubscribe from all
forums in the course. However, sesskey was not checked here.
This commit is contained in:
David Mudrak
2011-01-05 13:01:46 +01:00
parent 6f7d65c724
commit c56ed7bb85
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/forum/index.php
+9 -5
View File
@@ -31,6 +31,7 @@ $subscribe = optional_param('subscribe', null, PARAM_INT); // Subscribe/Unsubsc
$url = new moodle_url('/mod/forum/index.php', array('id'=>$id));
if ($subscribe !== null) {
require_sesskey();
$url->param('subscribe', $subscribe);
}
$PAGE->set_url($url);
@@ -410,11 +411,14 @@ echo $OUTPUT->header();
if (!isguestuser()) {
echo $OUTPUT->box_start('subscription');
echo '<span class="helplink">';
echo '<a href="index.php?id='.$course->id.'&amp;subscribe=1">'.get_string('allsubscribe', 'forum').'</a>';
echo '</span><br /><span class="helplink">';
echo '<a href="index.php?id='.$course->id.'&amp;subscribe=0">'.get_string('allunsubscribe', 'forum').'</a>';
echo '</span>';
echo html_writer::tag('div',
html_writer::link(new moodle_url('/mod/forum/index.php', array('id'=>$course->id, 'subscribe'=>1, 'sesskey'=>sesskey())),
get_string('allsubscribe', 'forum')),
array('class'=>'helplink'));
echo html_writer::tag('div',
html_writer::link(new moodle_url('/mod/forum/index.php', array('id'=>$course->id, 'subscribe'=>0, 'sesskey'=>sesskey())),
get_string('allunsubscribe', 'forum')),
array('class'=>'helplink'));
echo $OUTPUT->box_end();
echo $OUTPUT->box('&nbsp;', 'clearer');
}