Added a new sesskey variable to perform better checks of identity

for some scripts.

Thanks to Petr for finding the exploit!

course/teacher.php

@@ -95,7 +95,7 @@
 
 /// Add a teacher if one is specified
 
-    if (!empty($_GET['add'])) {
+    if (!empty($_GET['add']) and confirm_sesskey()) {
         if (! add_teacher($add, $course->id)) {
             error("Could not add that teacher to this course!");
         }
@@ -103,9 +103,9 @@
 
 /// Remove a teacher if one is specified.
 
-    if (!empty($_GET['remove'])) {
+    if (!empty($_GET['remove']) and confirm_sesskey()) {
         if (! remove_teacher($remove, $course->id)) {
-            error("Could not add that teacher to this course!");
+            error("Could not remove that teacher from this course!");
         }
     }
 
@@ -150,7 +150,7 @@
                 $editall = choose_from_menu ($editmenu, "e$teacher->id", $teacher->editall, "", "", "", true);
             }
     
-            $removelink = "<a href=\"teacher.php?id=$course->id&remove=$teacher->id\">$strremoveteacher</a>";
+            $removelink = "<a href=\"teacher.php?id=$course->id&remove=$teacher->id&sesskey=$USER->sesskey\">$strremoveteacher</a>";
 
             if (!$teacher->role) {
                 $teacher->role = $course->teacher;
@@ -201,7 +201,7 @@
 
 
         foreach ($users as $user) {
-            $addlink = "<a href=\"teacher.php?id=$course->id&add=$user->id\">$straddteacher</a>";
+            $addlink = "<a href=\"teacher.php?id=$course->id&add=$user->id&sesskey=$USER->sesskey\">$straddteacher</a>";
             $picture = print_user_picture($user->id, $course->id, $user->picture, false, true);
             $table->data[] = array ($picture, fullname($user, true), $user->email, $addlink);
         }

lib/moodlelib.php

@@ -96,6 +96,23 @@ function clean_param($param, $options) {
     return $param;
 }
 
+function confirm_sesskey($sesskey=NULL) {
+/// For security purposes, this function will check that the currently
+/// given sesskey (passed as a parameter to the script or this function)
+/// matches that of the current user.
+    global $USER;
+
+    if (empty($sesskey)) {
+        $sesskey = required_param('sesskey');  // Check script parameters
+    }
+
+    if (!isset($USER->sesskey)) {
+        return false;
+    }
+
+    return ($USER->sesskey == $sesskey);
+}
+
 function require_variable($var) {
 /// Variable must be present
 /// This old function is retained for backward compatibility

login/index.php

@@ -49,7 +49,8 @@
                 $USER->description = true;       // No need to cart all of it around
             }
             $USER->loggedin = true;
-            $USER->site = $CFG->wwwroot;   // for added security
+            $USER->site     = $CFG->wwwroot;     // for added security, store the site in the session
+            $USER->sesskey  = random_string(10); // for added security, used to check script parameters
             
             if ($USER->username == "guest") {
                 $USER->lang       = $CFG->lang;               // Guest language always same as site