From e041c56184d7fe867099287c7be2e8b4733d4ead Mon Sep 17 00:00:00 2001
From: stronk7 <stronk7>
Date: Thu, 25 Sep 2008 22:36:18 +0000
Subject: [PATCH] Protect message settings with sesskey. MDL-16688 ; backported
 from 19_STABLE

---
 message/lib.php       | 2 +-
 message/settings.html | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/message/lib.php b/message/lib.php
index 1f303cc729b..330744ebbae 100644
--- a/message/lib.php
+++ b/message/lib.php
@@ -268,7 +268,7 @@ function message_print_search() {
 function message_print_settings() {
     global $USER;
 
-    if ($frm = data_submitted()) {
+    if ($frm = data_submitted() and confirm_sesskey()) {
 
         $pref = array();
         $pref['message_showmessagewindow'] = (isset($frm->showmessagewindow)) ? '1' : '0';
diff --git a/message/settings.html b/message/settings.html
index 1c0ddcec9b2..fdd83757fe6 100644
--- a/message/settings.html
+++ b/message/settings.html
@@ -1,5 +1,6 @@
 <form id="message_settings" action="index.php" method="post">
 <input type="hidden" name="tab" value="settings" />
+<input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 
 
 <table cellpadding="5" align="center" class="message_form">