MDL-26198 fix CSRF and missing access control + fix xhtml strict

roddle · Jan 30, 2011 · 9cedb80 · 9cedb80
1 parent ff03c5b
commit 9cedb80
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 10 deletions.
diff --git a/course/report/completion/index.php b/course/report/completion/index.php
@@ -632,7 +632,7 @@ function csv_quote($value) {
                 $describe = get_string('completion-alt-auto-'.$completiontype,'completion');
 
                 print '<td class="completion-progresscell">'.
-                    '<a href="'.$CFG->wwwroot.'/course/togglecompletion.php?user='.$user->id.'&course='.$course->id.'&rolec='.$allow_marking_criteria.'">'.
+                    '<a href="'.$CFG->wwwroot.'/course/togglecompletion.php?user='.$user->id.'&amp;course='.$course->id.'&amp;rolec='.$allow_marking_criteria.'&amp;sesskey='.sesskey().'">'.
                     '<img src="'.$OUTPUT->pix_url('i/completion-manual-'.($is_complete ? 'y' : 'n')).
                     '" alt="'.$describe.'" class="icon" title="Mark as complete" /></a></td>'; //TODO: localize
             } else {

diff --git a/course/togglecompletion.php b/course/togglecompletion.php
@@ -38,9 +38,10 @@
 // Process self completion
 if ($courseid) {
     $PAGE->set_url(new moodle_url('/course/togglecompletion.php', array('course'=>$courseid)));
-    
+
     // Check user is logged in
     $course = $DB->get_record('course', array('id' => $courseid), '*', MUST_EXIST);
+    $context = get_context_instance(CONTEXT_COURSE, $course->id);
     require_login($course);
 
     $completion = new completion_info($course);
@@ -50,14 +51,19 @@
     $rolec = optional_param('rolec', 0, PARAM_INT);
 
     if ($user && $rolec) {
+        require_sesskey();
+
+        completion_criteria::factory((object) array('id'=>$rolec, 'criteriatype'=>COMPLETION_CRITERIA_TYPE_ROLE)); //TODO: this is dumb, because it does not fetch the data?!?!
+        $criteria = completion_criteria_role::fetch(array('id'=>$rolec));
 
-        $criteria = completion_criteria::factory((object) array('id'=>$rolec, 'criteriatype'=>COMPLETION_CRITERIA_TYPE_ROLE));
-        $criteria_completions = $completion->get_completions($user, COMPLETION_CRITERIA_TYPE_ROLE);
+        if ($criteria and user_has_role_assignment($USER->id, $criteria->role, $context->id)) {
+            $criteria_completions = $completion->get_completions($user, COMPLETION_CRITERIA_TYPE_ROLE);
 
-        foreach ($criteria_completions as $criteria_completion) {
-            if ($criteria_completion->criteriaid == $rolec) {
-                $criteria->complete($criteria_completion);
-                break;
+            foreach ($criteria_completions as $criteria_completion) {
+                if ($criteria_completion->criteriaid == $rolec) {
+                    $criteria->complete($criteria_completion);
+                    break;
+                }
             }
         }
 
@@ -71,7 +77,7 @@
     } else {
 
         // Confirm with user
-        if ($confirm) {
+        if ($confirm and confirm_sesskey()) {
             $completion = $completion->get_completion($USER->id, COMPLETION_CRITERIA_TYPE_SELF);
 
             if (!$completion) {
@@ -94,7 +100,7 @@
         $PAGE->set_heading($course->fullname);
         $PAGE->navbar->add($strconfirm);
         echo $OUTPUT->header();
-        $buttoncontinue = new single_button(new moodle_url('/course/togglecompletion.php', array('course'=>$courseid, 'confirm'=>1)), get_string('yes'), 'post');
+        $buttoncontinue = new single_button(new moodle_url('/course/togglecompletion.php', array('course'=>$courseid, 'confirm'=>1, 'sesskey'=>sesskey())), get_string('yes'), 'post');
         $buttoncancel   = new single_button(new moodle_url('/course/view.php', array('id'=>$courseid)), get_string('no'), 'get');
         echo $OUTPUT->confirm($strconfirm, $buttoncontinue, $buttoncancel);
         echo $OUTPUT->footer();