From d7befb3835d031dd750026cabb34e8850d8d6ab8 Mon Sep 17 00:00:00 2001
From: Petr Skoda <skodak@moodle.org>
Date: Sat, 21 Nov 2009 15:35:05 +0000
Subject: [PATCH] MDL-20901 fixed input validation

---
 mod/forum/lib.php  | 1 +
 mod/forum/rate.php | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/mod/forum/lib.php b/mod/forum/lib.php
index 219f081e5ad..c38aa3f4cdf 100644
--- a/mod/forum/lib.php
+++ b/mod/forum/lib.php
@@ -3765,6 +3765,7 @@ function forum_print_discussion($course, $forum, $discussion, $post, $mode, $can
                 echo '<div class="ratingform">';
                 echo '<input type="hidden" name="id" value="'.$course->id.'" />';
                 echo '<input type="hidden" name="forumid" value="'.$forum->id.'" />';
+                echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
                 $ratingsformused = true;
             }
         }
diff --git a/mod/forum/rate.php b/mod/forum/rate.php
index ac0174dab08..4c43be2073e 100644
--- a/mod/forum/rate.php
+++ b/mod/forum/rate.php
@@ -39,7 +39,7 @@
         }
     }
 
-    if ($data) {
+    if ($data and confirm_sesskey()) {
 
         $lastpostid = 0;