From 2b98208b2caff14f2e63508ae0e19065c6a2b043 Mon Sep 17 00:00:00 2001
From: Petr Skoda <skodak@moodle.org>
Date: Thu, 19 Nov 2009 19:48:00 +0000
Subject: [PATCH] MDL-20901 fixed input validation

---
 grade/edit/outcome/course.php       | 2 +-
 grade/edit/outcome/course_form.html | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/grade/edit/outcome/course.php b/grade/edit/outcome/course.php
index da3aec78aca..45461b3411f 100644
--- a/grade/edit/outcome/course.php
+++ b/grade/edit/outcome/course.php
@@ -96,7 +96,7 @@ foreach ($standardoutcomes as $oid=>$outcome) {
 
 
 /// form processing
-if ($data = data_submitted()) {
+if ($data = data_submitted() and confirm_sesskey()) {
     require_capability('moodle/grade:manageoutcomes', $context);
     if (!empty($data->add) && !empty($data->addoutcomes)) {
     /// add all selected to course list
diff --git a/grade/edit/outcome/course_form.html b/grade/edit/outcome/course_form.html
index 3185580184b..29a64465feb 100755
--- a/grade/edit/outcome/course_form.html
+++ b/grade/edit/outcome/course_form.html
@@ -60,5 +60,6 @@
 </table>
 
 <input name="id" type="hidden" value="<?php echo $courseid?>"/>
+<input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 </div>
 </form>
-- 
2.11.4.GIT