MDL-20901 fixed input validation

mod/forum/lib.php

@@ -5822,6 +5822,7 @@ function forum_print_discussion($course, $cm, $forum, $discussion, $post, $mode,
                 echo '<form id="form" method="post" action="rate.php">';
                 echo '<div class="ratingform">';
                 echo '<input type="hidden" name="forumid" value="'.$forum->id.'" />';
+                echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
                 $ratingsformused = true;
             }
           // preload all ratings - one query only and minimal memory

mod/forum/rate.php

@@ -38,7 +38,7 @@ if (!$forum->assessed) {
 $context = get_context_instance(CONTEXT_MODULE, $cm->id);
 require_capability('mod/forum:rate', $context);
 
-if ($data = data_submitted()) {
+if ($data = data_submitted() and confirm_sesskey()) {
 
     $discussionid = false;