From eaba24251754b4d492768551f9bad617518ebf29 Mon Sep 17 00:00:00 2001
From: Petr Skoda <skodak@moodle.org>
Date: Sun, 22 Nov 2009 11:09:31 +0000
Subject: [PATCH] MDL-20929 fixed input validation

---
 mod/choice/lib.php    | 1 +
 mod/choice/report.php | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/mod/choice/lib.php b/mod/choice/lib.php
index ccba62ef993..567717183df 100644
--- a/mod/choice/lib.php
+++ b/mod/choice/lib.php
@@ -353,6 +353,7 @@ function choice_show_results($choice, $course, $cm, $allresponses, $forcepublish
                 echo '<form id="attemptsform" method="post" action="'.$_SERVER['PHP_SELF'].'" onsubmit="var menu = document.getElementById(\'menuaction\'); return (menu.options[menu.selectedIndex].value == \'delete\' ? \''.addslashes(get_string('deleteattemptcheck','quiz')).'\' : true);">';
                 echo '<div>';
                 echo '<input type="hidden" name="id" value="'.$cm->id.'" />';
+                echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
                 echo '<input type="hidden" name="mode" value="overview" />';
             }
 
diff --git a/mod/choice/report.php b/mod/choice/report.php
index 77f2edeb903..1db34d0d3f9 100644
--- a/mod/choice/report.php
+++ b/mod/choice/report.php
@@ -32,8 +32,8 @@
     $strresponses = get_string("responses", "choice");
 
     add_to_log($course->id, "choice", "report", "report.php?id=$cm->id", "$choice->id",$cm->id);
-      
-    if ($action == 'delete' && has_capability('mod/choice:deleteresponses',$context)) {
+
+    if (data_submitted() && $action == 'delete' && has_capability('mod/choice:deleteresponses',$context) && confirm_sesskey()) {
         choice_delete_responses($attemptids, $choice->id); //delete responses.
         redirect("report.php?id=$cm->id");
     }
-- 
2.11.4.GIT