MDL-80877 tool_mfa: protect logout process with sesskey check.

admin/tool/mfa/auth.php

@@ -42,7 +42,20 @@ $PAGE->set_title($pagetitle);
 
 // Logout if it was requested.
 $logout = optional_param('logout', false, PARAM_BOOL);
+$sesskey = optional_param('sesskey', '_none_', PARAM_RAW);
+
 if ($logout) {
+    if (!confirm_sesskey($sesskey)) {
+        echo $OUTPUT->header();
+        echo $OUTPUT->confirm(
+            get_string('logoutconfirm'),
+            new moodle_url($PAGE->url, ['logout' => 1, 'sesskey' => sesskey()]),
+            new moodle_url('/'),
+        );
+        echo $OUTPUT->footer();
+        die;
+    }
+
     if (!empty($SESSION->wantsurl)) {
         // If we have the wantsurl, we should redirect there, to keep it intact.
         $wantsurl = $SESSION->wantsurl;

admin/tool/mfa/classes/output/renderer.php

@@ -637,6 +637,7 @@ class renderer extends \plugin_renderer_base {
                 'hasadditionalfactors' => $hasadditionalfactors,
                 'additionalfactors' => $alladitionalfactors,
                 'authurl' => $authurl->out(),
+                'sesskey' => sesskey(),
                 'supportlink' => $this->get_support_link(),
                 'disablefactor' => $disablefactor
         ];

admin/tool/mfa/templates/verification_form.mustache

@@ -83,6 +83,7 @@
     <div class="d-flex justify-content-center">
         <form id="cancelmfa" method="POST" action="{{{authurl}}}">
             <input type="hidden" id="{{uniqid}}-logout" name="logout" value="true">
+            <input type="hidden" name="sesskey" value="{{sesskey}}">
             <input type="submit" class="btn btn-secondary"
                    name="cancelmfa" id="cancelmfa_button"
                    value="{{#str}} cancellogin, tool_mfa {{/str}}">