From 7a311adbba9471edb5a49e4c4b8c356c87f0e44b Mon Sep 17 00:00:00 2001
From: Andrew Nicols <andrew@nicols.co.uk>
Date: Mon, 3 Nov 2014 09:49:00 +0800
Subject: [PATCH] MDL-48019 mod_forum: Add sesskey checks when setting tracking
 prefs

This also removes set_url() and changes require_course_login to
require_login as guests cannot set tracking.
---
 mod/forum/deprecatedlib.php | 5 ++++-
 mod/forum/forum.js          | 2 +-
 mod/forum/index.php         | 5 ++++-
 mod/forum/lib.php           | 5 ++++-
 mod/forum/settracking.php   | 9 ++-------
 5 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/mod/forum/deprecatedlib.php b/mod/forum/deprecatedlib.php
index 211ad81d87d..65c6052b30a 100644
--- a/mod/forum/deprecatedlib.php
+++ b/mod/forum/deprecatedlib.php
@@ -338,7 +338,10 @@ function forum_get_tracking_link($forum, $messages=array(), $fakelink=true) {
         // use <noscript> to print button in case javascript is not enabled
         $link .= '<noscript>';
     }
-    $url = new moodle_url('/mod/forum/settracking.php', array('id'=>$forum->id));
+    $url = new moodle_url('/mod/forum/settracking.php', array(
+            'id' => $forum->id,
+            'sesskey' => sesskey(),
+        ));
     $link .= $OUTPUT->single_button($url, $linktext, 'get', array('title'=>$linktitle));
 
     if ($fakelink) {
diff --git a/mod/forum/forum.js b/mod/forum/forum.js
index 749b0439347..a6881b33865 100644
--- a/mod/forum/forum.js
+++ b/mod/forum/forum.js
@@ -13,7 +13,7 @@ function forum_produce_tracking_link(forumid, ltext, ltitle) {
     var elementid = "trackinglink";
     var subs_link = document.getElementById(elementid);
     if(subs_link){
-        subs_link.innerHTML = "<a title='"+ltitle+"' href='"+M.cfg.wwwroot+"/mod/forum/settracking.php?id="+forumid+"'>"+ltext+"<\/a>";
+        subs_link.innerHTML = "<a title='"+ltitle+"' href='"+M.cfg.wwwroot+"/mod/forum/settracking.php?id="+forumid+"&amp;sesskey="+M.cfg.sesskey+"'>"+ltext+"<\/a>";
     }
 }
 
diff --git a/mod/forum/index.php b/mod/forum/index.php
index 43d1d9798c8..a64567b0a8c 100644
--- a/mod/forum/index.php
+++ b/mod/forum/index.php
@@ -240,7 +240,10 @@ if ($generalforums) {
                 } else if ($forum->trackingtype === FORUM_TRACKING_OFF || ($USER->trackforums == 0)) {
                     $trackedlink = '-';
                 } else {
-                    $aurl = new moodle_url('/mod/forum/settracking.php', array('id'=>$forum->id));
+                    $aurl = new moodle_url('/mod/forum/settracking.php', array(
+                            'id' => $forum->id,
+                            'sesskey' => sesskey(),
+                        ));
                     if (!isset($untracked[$forum->id])) {
                         $trackedlink = $OUTPUT->single_button($aurl, $stryes, 'post', array('title'=>$strnotrackforum));
                     } else {
diff --git a/mod/forum/lib.php b/mod/forum/lib.php
index de9e678a819..5f042879138 100644
--- a/mod/forum/lib.php
+++ b/mod/forum/lib.php
@@ -7107,7 +7107,10 @@ function forum_extend_settings_navigation(settings_navigation $settingsnav, navi
             } else {
                 $linktext = get_string('trackforum', 'forum');
             }
-            $url = new moodle_url('/mod/forum/settracking.php', array('id'=>$forumobject->id));
+            $url = new moodle_url('/mod/forum/settracking.php', array(
+                    'id' => $forumobject->id,
+                    'sesskey' => sesskey(),
+                ));
             $forumnode->add($linktext, $url, navigation_node::TYPE_SETTING);
         }
     }
diff --git a/mod/forum/settracking.php b/mod/forum/settracking.php
index 91c653c5171..004825f6bee 100644
--- a/mod/forum/settracking.php
+++ b/mod/forum/settracking.php
@@ -29,11 +29,7 @@ require_once("lib.php");
 $id         = required_param('id',PARAM_INT);                           // The forum to subscribe or unsubscribe to
 $returnpage = optional_param('returnpage', 'index.php', PARAM_FILE);    // Page to return to.
 
-$url = new moodle_url('/mod/forum/settracking.php', array('id'=>$id));
-if ($returnpage !== 'index.php') {
-    $url->param('returnpage', $returnpage);
-}
-$PAGE->set_url($url);
+require_sesskey();
 
 if (! $forum = $DB->get_record("forum", array("id" => $id))) {
     print_error('invalidforumid', 'forum');
@@ -46,8 +42,7 @@ if (! $course = $DB->get_record("course", array("id" => $forum->course))) {
 if (! $cm = get_coursemodule_from_instance("forum", $forum->id, $course->id)) {
     print_error('invalidcoursemodule');
 }
-
-require_course_login($course, false, $cm);
+require_login($course, false, $cm);
 
 $returnto = forum_go_back_to($returnpage.'?id='.$course->id.'&f='.$forum->id);