From 441bef0f7a3683c96d3c1fb07d13fec916aabb72 Mon Sep 17 00:00:00 2001
From: Petr Skoda <skodak@moodle.org>
Date: Sat, 21 Nov 2009 15:26:54 +0000
Subject: [PATCH] MDL-20901 fixed input validation

---
 mod/forum/subscriber.html | 1 +
 mod/forum/subscribers.php | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/mod/forum/subscriber.html b/mod/forum/subscriber.html
index 4fe214e8ca5..5ea4b0fedb2 100644
--- a/mod/forum/subscriber.html
+++ b/mod/forum/subscriber.html
@@ -1,6 +1,7 @@
 
 <form id="subscriberform" method="post" action="subscribers.php">
 <input type="hidden" name="id" value="<?php echo $id?>" />
+<input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>
       <td valign="top">
diff --git a/mod/forum/subscribers.php b/mod/forum/subscribers.php
index 35c7d6ec484..ddf802b02f0 100644
--- a/mod/forum/subscribers.php
+++ b/mod/forum/subscribers.php
@@ -102,7 +102,7 @@ $strsubscribers = get_string("subscribers", "forum");
 $strforums      = get_string("forums", "forum");
 
 $searchtext = optional_param('searchtext', '', PARAM_RAW);
-if ($frm = data_submitted()) {
+if ($frm = data_submitted() and confirm_sesskey()) {
 
 /// A form was submitted so process the input
     if (!empty($frm->add) and !empty($frm->addselect)) {