mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-04-13 12:32:08 +02:00
Code Issues Projects Releases Wiki Activity

MDL-50881 calendar: do not throw exception without sesskey

Browse Source
This commit is contained in:
Marina Glancy 2015-07-28 18:06:36 +08:00
parent 57739a72cb
commit 10c82ca307
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
calendar/set.php
View File

@ -41,8 +41,6 @@
require_once('../config.php');
require_once($CFG->dirroot.'/calendar/lib.php');
require_sesskey();
$var = required_param('var', PARAM_ALPHA);
$return = clean_param(base64_decode(required_param('return', PARAM_RAW)), PARAM_LOCALURL);
$courseid = optional_param('id', -1, PARAM_INT);
@ -51,6 +49,12 @@ if ($courseid != -1) {
} else {
$return = new moodle_url($return);
}
if (!confirm_sesskey()) {
// Do not call require_sesskey() since this page may be accessed without session (for example by bots).
redirect($return);
}
$url = new moodle_url('/calendar/set.php', array('return'=>base64_encode($return->out_as_local_url(false)), 'course' => $courseid, 'var'=>$var, 'sesskey'=>sesskey()));
$PAGE->set_url($url);
$PAGE->set_context(context_system::instance());