From 62adf3a036f8fb206f227a01fcb0087a76040441 Mon Sep 17 00:00:00 2001
From: Petr Skoda
Date: Thu, 19 Nov 2009 19:26:38 +0000
Subject: [PATCH] MDL-20901 fixed input validation
---
calendar/event.php | 6 +++---
calendar/event_delete.html | 2 ++
calendar/event_edit.html | 1 +
calendar/event_new.html | 1 +
calendar/preferences.html | 1 +
calendar/preferences.php | 2 +-
6 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/calendar/event.php b/calendar/event.php
index 0238c90f0d6..058f03fa4f5 100644
--- a/calendar/event.php
+++ b/calendar/event.php
@@ -128,7 +128,7 @@
error('You are not authorized to do this');
}
- if($form = data_submitted()) {
+ if($form = data_submitted() and confirm_sesskey()) {
$form->name = clean_param(strip_tags($form->name,''), PARAM_CLEAN);
@@ -193,7 +193,7 @@
case 'new':
$title = get_string('newevent', 'calendar');
$form = data_submitted();
- if(!empty($form) && !empty($form->name)) {
+ if(!empty($form) && !empty($form->name) && confirm_sesskey()) {
$form->name = clean_text(strip_tags($form->name, ''));
@@ -286,7 +286,7 @@
case 'delete':
$confirm = optional_param('confirm', 0, PARAM_INT);
$repeats = optional_param('repeats', 0, PARAM_INT);
- if($confirm) {
+ if($confirm and confirm_sesskey()) {
// Kill it and redirect to day view
if(($event = get_record('event', 'id', $eventid)) !== false) {
diff --git a/calendar/event_delete.html b/calendar/event_delete.html
index 8d013ba942b..d3db9ac5ccb 100644
--- a/calendar/event_delete.html
+++ b/calendar/event_delete.html
@@ -13,6 +13,7 @@
+
@@ -31,6 +32,7 @@
+
diff --git a/calendar/event_edit.html b/calendar/event_edit.html
index 61768604444..1fc0d87d38e 100644
--- a/calendar/event_edit.html
+++ b/calendar/event_edit.html
@@ -89,6 +89,7 @@
+
diff --git a/calendar/event_new.html b/calendar/event_new.html
index 19861c7776d..a7bc0706802 100644
--- a/calendar/event_new.html
+++ b/calendar/event_new.html
@@ -100,6 +100,7 @@
+
diff --git a/calendar/preferences.html b/calendar/preferences.html
index b4e52c07aef..ecb80af117b 100644
--- a/calendar/preferences.html
+++ b/calendar/preferences.html
@@ -71,6 +71,7 @@
+
" />
diff --git a/calendar/preferences.php b/calendar/preferences.php
index 98fd0912bbc..a98a2f0f3f7 100644
--- a/calendar/preferences.php
+++ b/calendar/preferences.php
@@ -18,7 +18,7 @@
/// If data submitted, then process and store.
- if ($form = data_submitted()) {
+ if ($form = data_submitted() and confirm_sesskey()) {
foreach ($form as $preference => $value) {
switch ($preference) {
case 'timeformat':
--
2.11.4.GIT