From ee225061dcb3493e9dc8d5bc25fd89bfdde1c1f7 Mon Sep 17 00:00:00 2001
From: Damyon Wiese <damyon.wiese@netspot.com.au>
Date: Fri, 4 May 2012 14:36:06 +0800
Subject: [PATCH] MDL-32774: Require sesskey for all actions in the assignment
 upgrade tool

---
 admin/tool/assignmentupgrade/batchupgrade.php               | 2 ++
 admin/tool/assignmentupgrade/listnotupgraded.php            | 1 +
 admin/tool/assignmentupgrade/upgradableassignmentstable.php | 2 +-
 admin/tool/assignmentupgrade/upgradesingle.php              | 2 ++
 admin/tool/assignmentupgrade/upgradesingleconfirm.php       | 2 ++
 5 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/admin/tool/assignmentupgrade/batchupgrade.php b/admin/tool/assignmentupgrade/batchupgrade.php
index b62260eecb9..20ebf5c9958 100644
--- a/admin/tool/assignmentupgrade/batchupgrade.php
+++ b/admin/tool/assignmentupgrade/batchupgrade.php
@@ -28,6 +28,8 @@ require_once(dirname(__FILE__) . '/upgradableassignmentstable.php');
 require_once(dirname(__FILE__) . '/upgradableassignmentsbatchform.php');
 require_once($CFG->libdir . '/adminlib.php');
 
+require_sesskey();
+
 // admin_externalpage_setup calls require_login and checks moodle/site:config
 admin_externalpage_setup('assignmentupgrade', '', array(), tool_assignmentupgrade_url('batchupgrade'));
 $PAGE->navbar->add(get_string('batchupgrade', 'tool_assignmentupgrade'));
diff --git a/admin/tool/assignmentupgrade/listnotupgraded.php b/admin/tool/assignmentupgrade/listnotupgraded.php
index 488ec6e91b8..37605a5d36a 100644
--- a/admin/tool/assignmentupgrade/listnotupgraded.php
+++ b/admin/tool/assignmentupgrade/listnotupgraded.php
@@ -40,6 +40,7 @@ $assignments = new tool_assignmentupgrade_assignments_table($perpage);
 $batchform = new tool_assignmentupgrade_batchoperations_form();
 $data = $batchform->get_data();
 if ($data && $data->selectedassignments != '' || $data && isset($data->upgradeall)) {
+    require_sesskey();
     echo $renderer->confirm_batch_operation_page($data);
 } else {
     echo $renderer->assignment_list_page($assignments, $batchform);
diff --git a/admin/tool/assignmentupgrade/upgradableassignmentstable.php b/admin/tool/assignmentupgrade/upgradableassignmentstable.php
index ed830f6e20d..0e4830ba602 100644
--- a/admin/tool/assignmentupgrade/upgradableassignmentstable.php
+++ b/admin/tool/assignmentupgrade/upgradableassignmentstable.php
@@ -132,7 +132,7 @@ class tool_assignmentupgrade_assignments_table extends table_sql implements rend
     function col_upgradable(stdClass $row) {
         if ($row->upgradable) {
             return html_writer::link(new moodle_url('/admin/tool/assignmentupgrade/upgradesingleconfirm.php',
-                    array('id' => $row->id)), get_string('supported', 'tool_assignmentupgrade'));
+                    array('id' => $row->id, 'sesskey' => sesskey())), get_string('supported', 'tool_assignmentupgrade'));
         } else {
             return get_string('notsupported', 'tool_assignmentupgrade');
         }
diff --git a/admin/tool/assignmentupgrade/upgradesingle.php b/admin/tool/assignmentupgrade/upgradesingle.php
index 8ae2aab5451..2464ebea56c 100644
--- a/admin/tool/assignmentupgrade/upgradesingle.php
+++ b/admin/tool/assignmentupgrade/upgradesingle.php
@@ -26,6 +26,8 @@ require_once(dirname(__FILE__) . '/../../../config.php');
 require_once(dirname(__FILE__) . '/locallib.php');
 require_once($CFG->libdir . '/adminlib.php');
 
+require_sesskey();
+
 $assignmentid = required_param('id', PARAM_INT);
 
 // admin_externalpage_setup calls require_login and checks moodle/site:config
diff --git a/admin/tool/assignmentupgrade/upgradesingleconfirm.php b/admin/tool/assignmentupgrade/upgradesingleconfirm.php
index 015d2173167..0325b4a09d4 100644
--- a/admin/tool/assignmentupgrade/upgradesingleconfirm.php
+++ b/admin/tool/assignmentupgrade/upgradesingleconfirm.php
@@ -26,6 +26,8 @@ require_once(dirname(__FILE__) . '/../../../config.php');
 require_once(dirname(__FILE__) . '/locallib.php');
 require_once($CFG->libdir . '/adminlib.php');
 
+require_sesskey();
+
 $assignmentid = required_param('id', PARAM_INT);
 
 // admin_externalpage_setup calls require_login and checks moodle/site:config