course/group.php is using sesskey.

course/group-edit.html

@@ -50,4 +50,5 @@
 
 <input type="hidden" name="group" value="<?php p($group->id) ?>"> 
 <input type="hidden" name="id" value="<?php p($course->id) ?>"> 
+<input type="hidden" name="sesskey" value="<?php p($sesskey) ?>"> 
 </form>

course/group.php

@@ -58,7 +58,7 @@
 
 /// If data submitted, then process and store.
 
-    if ($form = data_submitted()) { 
+    if ($form = data_submitted() and confirm_sesskey()) { 
 
         if (empty($form->name)) {
             $edit = true;
@@ -92,6 +92,8 @@
             $defaultformat = FORMAT_MOODLE;
         }
 
+        $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
         include('group-edit.html');
 
         if ($usehtmleditor) {