moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-03 16:13:28 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-68292 core: Remove sesskey leakage on module pages

Browse source
This commit is contained in:
Brendan Heywood 2020-09-24 17:01:31 +10:00
parent 46f977a8bf
commit 155b0da5a5
3 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
admin/modules.php
View file

@ -49,6 +49,7 @@
array($module->id));
core_plugin_manager::reset_caches();
admin_get_root(true, false); // settings not required - only pages
redirect(new moodle_url('/admin/modules.php'));
}
if (!empty($show) and confirm_sesskey()) {
@ -66,6 +67,7 @@
array($module->id));
core_plugin_manager::reset_caches();
admin_get_root(true, false); // settings not required - only pages
redirect(new moodle_url('/admin/modules.php'));
}
echo $OUTPUT->header();
@ -121,8 +123,8 @@
$count = -1;
}
if ($count>0) {
$countlink = "<a href=\"{$CFG->wwwroot}/course/search.php?modulelist=$module->name" .
"&amp;sesskey=".sesskey()."\" title=\"$strshowmodulecourse\">$count</a>";
$countlink = $OUTPUT->action_link(new moodle_url('/course/search.php', ['modulelist' => $module->name]),
$count, null, ['title' => $strshowmodulecourse]);
} else if ($count < 0) {
$countlink = get_string('error');
} else {

2
admin/plugins.php
View file

@ -53,7 +53,6 @@ $pageurl = new moodle_url('/admin/plugins.php', $pageparams);
$pluginman = core_plugin_manager::instance();
if ($uninstall) {
require_sesskey();
if (!$confirmed) {
admin_externalpage_setup('pluginsoverview', '', $pageparams);
@ -92,6 +91,7 @@ if ($uninstall) {
exit();
} else {
require_sesskey();
$SESSION->pluginuninstallreturn = $pluginfo->get_return_url_after_uninstall($return);
$progress = new progress_trace_buffer(new text_progress_trace(), false);
$pluginman->uninstall_plugin($pluginfo->component, $progress);

1
lib/classes/plugininfo/base.php
View file

@ -621,7 +621,6 @@ abstract class base {
*/
public final function get_default_uninstall_url($return = 'overview') {
return new moodle_url('/admin/plugins.php', array(
'sesskey' => sesskey(),
'uninstall' => $this->component,
'confirm' => 0,
'return' => $return,