From e522e7fc67cb90aa9fc4633f58ce6b830f419489 Mon Sep 17 00:00:00 2001
From: Vincent Schneider <22986332+cli-ish@users.noreply.github.com>
Date: Fri, 11 Apr 2025 11:01:05 +0200
Subject: [PATCH] MDL-84497 badges: fix missing action sesskey checks.

---
 badges/backpacks.php                              | 2 +-
 badges/templates/external_backpacks_page.mustache | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/badges/backpacks.php b/badges/backpacks.php
index 7a18276336c..2685ca89e56 100644
--- a/badges/backpacks.php
+++ b/badges/backpacks.php
@@ -56,7 +56,7 @@ if ($action == 'delete' && $confirm && confirm_sesskey()) {
     } else {
         $msg = get_string('sitebackpacknotdeleted', 'badges');
     }
-} else if ($action == 'moveup' || $action == 'movedown') {
+} else if (($action == 'moveup' || $action == 'movedown') && confirm_sesskey()) {
     // If no backpack has been selected, there isn't anything to move.
     if (empty($id)) {
         redirect($url);
diff --git a/badges/templates/external_backpacks_page.mustache b/badges/templates/external_backpacks_page.mustache
index 92eb673a2cc..eb43dfbc491 100644
--- a/badges/templates/external_backpacks_page.mustache
+++ b/badges/templates/external_backpacks_page.mustache
@@ -56,13 +56,13 @@
             <td> {{{backpackweburl}}} </td>
             <td>
                 {{#canmoveup}}
-                    <a href="{{baseurl}}?id={{id}}&action=moveup">{{#pix}}t/up, core,{{#str}}moveup{{/str}}{{/pix}}</a>
+                    <a href="{{baseurl}}?id={{id}}&sesskey={{sesskey}}&action=moveup">{{#pix}}t/up, core,{{#str}}moveup{{/str}}{{/pix}}</a>
                 {{/canmoveup}}
                 {{^canmoveup}}
                     {{#pix}}spacer, moodle{{/pix}}
                 {{/canmoveup}}
                 {{#canmovedown}}
-                    <a href="{{baseurl}}?id={{id}}&action=movedown">{{#pix}}t/down, core,{{#str}}movedown{{/str}}{{/pix}}</a>
+                    <a href="{{baseurl}}?id={{id}}&sesskey={{sesskey}}&action=movedown">{{#pix}}t/down, core,{{#str}}movedown{{/str}}{{/pix}}</a>
                 {{/canmovedown}}
                 {{^canmovedown}}
                     {{#pix}}spacer, moodle{{/pix}}