MDL-47949 mod_wiki: Validate parameters for page deletion

mod/wiki/admin.php

@@ -66,6 +66,13 @@ add_to_log($course->id, "wiki", "admin", "admin.php?pageid=".$page->id, $page->i
 
 //Delete page if a page ID to delete was supplied
 if (!empty($delete) && confirm_sesskey()) {
+    if ($pageid != $delete) {
+        // Validate that we are deleting from the same subwiki.
+        $deletepage = wiki_get_page($delete);
+        if (!$deletepage || $deletepage->subwikiid != $page->subwikiid) {
+            print_error('incorrectsubwikiid', 'wiki');
+        }
+    }
     wiki_delete_pages($context, $delete, $page->subwikiid);
     //when current wiki page is deleted, then redirect user to create that page, as
     //current pageid is invalid after deletion.
@@ -107,4 +114,4 @@ $wikipage->print_header();
 $wikipage->set_view($option, empty($listall)?true:false);
 $wikipage->print_content();
 
-$wikipage->print_footer();
+$wikipage->print_footer();