Protect message settings with sesskey. MDL-16688 ; backported from 17_STABLE

message/lib.php

@@ -248,8 +248,8 @@ function message_print_search() {
 
 function message_print_settings() {
     global $USER;
-    
-    if ($frm = data_submitted()) {
+
+    if ($frm = data_submitted() and confirm_sesskey()) {
 
         $pref = array();
         $pref['message_showmessagewindow'] = (isset($frm->showmessagewindow)) ? '1' : '0';

message/settings.html

@@ -1,5 +1,6 @@
 <form name="message_settings" action="index.php" method="post">
 <input type="hidden" name="tab" value="settings" />
+<input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 
 
 <table cellpadding="5" align="center" class="message_form">