Browse Source

Merge branch 'danbarretodev-7297' into 1.9.x

Yannick Warnier 10 years ago
parent
commit
76e5a60e86

+ 27 - 4
main/coursecopy/copy_course.php

@@ -42,10 +42,20 @@ $this_section = SECTION_COURSES;
 Display::display_header(get_lang('CopyCourse'));
 echo Display::page_header(get_lang('CopyCourse'));
 
-/*	MAIN CODE */
+/* MAIN CODE */
 
 // If a CourseSelectForm is posted or we should copy all resources, then copy them
-if ((isset($_POST['action']) && $_POST['action'] == 'course_select_form') || (isset($_POST['copy_option']) && $_POST['copy_option'] == 'full_copy')) {
+if (Security::check_token('post') && (
+        (
+            isset($_POST['action']) &&
+            $_POST['action'] == 'course_select_form') || (
+                isset($_POST['copy_option']) && $_POST['copy_option'] == 'full_copy'
+        )
+    )
+) {
+    // Clear token
+    Security::clear_token();
+
     if (isset($_POST['action']) && $_POST['action'] == 'course_select_form') {
         $course = CourseSelectForm :: get_posted_course('copy_course');
     } else {
@@ -56,7 +66,14 @@ if ((isset($_POST['action']) && $_POST['action'] == 'course_select_form') || (is
     $cr->set_file_option($_POST['same_file_name_option']);
     $cr->restore($_POST['destination_course']);
     Display::display_normal_message(get_lang('CopyFinished').': <a href="'.api_get_course_url($_POST['destination_course']).'">'.$_POST['destination_course'].'</a>', false);
-} elseif (isset ($_POST['copy_option']) && $_POST['copy_option'] == 'select_items') {
+} elseif (Security::check_token('post') && (
+        isset ($_POST['copy_option']) &&
+        $_POST['copy_option'] == 'select_items'
+    )
+) {
+    // Clear token
+    Security::clear_token();
+
     $cb = new CourseBuilder();
     $course = $cb->build();
     $hidden_fields = array();
@@ -104,8 +121,14 @@ if ((isset($_POST['action']) && $_POST['action'] == 'course_select_form') || (is
         $form->add_progress_bar();
         $form->addElement('style_submit_button', 'submit', get_lang('CopyCourse'), 'class="save"');
         $form->setDefaults(array('copy_option' =>'select_items','same_file_name_option' => FILE_OVERWRITE));
+
+        // Add Security token
+        $token = Security::get_token();
+        $form->addElement('hidden', 'sec_token');
+        $form->setConstants(array('sec_token' => $token));
+
         $form->display();
-	}
+    }
 }
 
 Display::display_footer();

+ 130 - 113
main/coursecopy/copy_course_session.php

@@ -4,7 +4,7 @@
  * Copy resources from one course in a session to another one.
  *
  * @author Christian Fasanando <christian.fasanando@dokeos.com>
- * @author Julio Montoya	<gugli100@gmail.com> Lots of bug fixes/improvements
+ * @author Julio Montoya <gugli100@gmail.com> Lots of bug fixes/improvements
  * @package chamilo.backup
  */
 /**
@@ -56,13 +56,13 @@ $tbl_course = Database::get_main_table(TABLE_MAIN_COURSE);
 
 function make_select_session_list($name, $sessions, $attr = array())
 {
-    $attrs = '';
+    $attributes = '';
     if (count($attr) > 0) {
         foreach ($attr as $key => $value) {
-            $attrs .= ' '.$key.'="'.$value.'"';
+            $attributes .= ' '.$key.'="'.$value.'"';
         }
     }
-    $output = '<select name="'.$name.'" '.$attrs.'>';
+    $output = '<select name="'.$name.'" '.$attributes.'>';
 
     if (count($sessions) == 0) {
         $output .= '<option value = "0">'.get_lang('ThereIsNotStillASession').'</option>';
@@ -96,7 +96,7 @@ function display_form()
     $html .= '<div class="actions">';
     // Link back to the documents overview
     $html .= '<a href="../admin/index.php">'.
-        Display::return_icon('back.png', get_lang('BackTo').' '.get_lang('PlatformAdmin'),'',ICON_SIZE_MEDIUM).
+        Display::return_icon('back.png', get_lang('BackTo').' '.get_lang('PlatformAdmin'), '', ICON_SIZE_MEDIUM).
         '</a>';
     $html .= '</div>';
 
@@ -131,6 +131,10 @@ function display_form()
     $html .= '<label class="checkbox"><input type="checkbox" id="copy_base_content_id" name="copy_only_session_items" />'.get_lang('CopyOnlySessionItems').'</label><br /><br/>';
 
     $html .= '<button class="save" type="submit" onclick="javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES))."'".')) return false;">'.get_lang('CopyCourse').'</button>';
+
+    // Add Security token
+    $html .= '<input type="hidden" value="' . Security::get_token() . '" name="sec_token">';
+
     $html .= '</form>';
 
     echo $html;
@@ -167,7 +171,9 @@ function search_courses($id_session, $type)
                 $select_destination .= '<select name="sessions_list_destination" width="380px" onchange = "javascript: xajax_search_courses(this.value,\'destination\');">';
                 $select_destination .= '<option value = "0">-- '.get_lang('SelectASession').' --</option>';
                 foreach ($sessions as $session) {
-                    if ($id_session == $session['id']) { continue; };
+                    if ($id_session == $session['id']) {
+                        continue;
+                    };
                     if (!empty($session['category_name'])) {
                         $session['category_name'] = ' ('.$session['category_name'].') ';
                     }
@@ -218,8 +224,7 @@ function search_courses($id_session, $type)
             );
         }
     }
-
-	return $xajax_response;
+    return $xajax_response;
 }
 $xajax->processRequests();
 
@@ -271,126 +276,138 @@ if (isset($_POST['copy_only_session_items']) && $_POST['copy_only_session_items'
 }
 
 /*  MAIN CODE  */
-if ((isset($_POST['action']) && $_POST['action'] == 'course_select_form') ||
-    (isset($_POST['copy_option']) && $_POST['copy_option'] == 'full_copy')
+if (Security::check_token('post') && (
+        (
+            isset($_POST['action']) &&
+            $_POST['action'] == 'course_select_form'
+        ) || (
+            isset($_POST['copy_option']) &&
+            $_POST['copy_option'] == 'full_copy'
+        )
+    )
 ) {
-
-	$destination_course = $origin_course = $destination_session = $origin_session = '';
-
-	if (isset ($_POST['action']) && $_POST['action'] == 'course_select_form') {
-
-		$destination_course	 	= $_POST['destination_course'];
-		$origin_course 			= $_POST['origin_course'];
-		$destination_session 	= $_POST['destination_session'];
-		$origin_session 		= $_POST['origin_session'];
-
-		$course = CourseSelectForm::get_posted_course(
+    // Clear token
+    Security::clear_token();
+    $destination_course = $origin_course = $destination_session = $origin_session = '';
+    if (isset ($_POST['action']) && $_POST['action'] == 'course_select_form') {
+        $destination_course	 	= $_POST['destination_course'];
+        $origin_course 			= $_POST['origin_course'];
+        $destination_session 	= $_POST['destination_session'];
+        $origin_session 		= $_POST['origin_session'];
+
+        $course = CourseSelectForm::get_posted_course(
             'copy_course',
             $origin_session,
             $origin_course
         );
 
-		$cr = new CourseRestorer($course);
-		//$cr->set_file_option($_POST['same_file_name_option']);
-		$cr->restore($destination_course, $destination_session);
-		Display::display_confirmation_message(get_lang('CopyFinished'));
-		display_form();
-	} else {
-
-		$arr_course_origin 		= array();
-		$arr_course_destination = array();
-		$destination_session 	= '';
-		$origin_session 		= '';
-
-		if (isset($_POST['SessionCoursesListOrigin'])) {
-			$arr_course_origin 		= $_POST['SessionCoursesListOrigin'];
-		}
-		if (isset($_POST['SessionCoursesListDestination'])) {
-			$arr_course_destination = $_POST['SessionCoursesListDestination'];
-		}
-		if (isset($_POST['sessions_list_destination'])) {
-			$destination_session 	= $_POST['sessions_list_destination'];
-		}
-		if (isset($_POST['sessions_list_origin'])) {
-			$origin_session 		= $_POST['sessions_list_origin'];
-		}
-
-		if ((is_array($arr_course_origin) && count($arr_course_origin) > 0) && !empty($destination_session)) {
-			//We need only one value
-			if (count($arr_course_origin) > 1 || count($arr_course_destination) > 1) {
-				Display::display_error_message(get_lang('YouMustSelectACourseFromOriginalSession'));
-			} else {
-				//foreach ($arr_course_origin as $course_origin) {
-				//first element of the array
-				$course_code = $arr_course_origin[0];
-				$course_destinatination = $arr_course_destination[0];
-
-				$course_origin = api_get_course_info($course_code);
-				$cb = new CourseBuilder('', $course_origin);
-				$course = $cb->build($origin_session, $course_code, $with_base_content);
-				$cr = new CourseRestorer($course);
-				$cr->restore($course_destinatination, $destination_session);
-
-			}
-			Display::display_confirmation_message(get_lang('CopyFinished'));
-			display_form();
-		} else {
-			Display::display_error_message(get_lang('YouMustSelectACourseFromOriginalSession'));
-			display_form();
-		}
-	}
-} elseif (isset($_POST['copy_option']) && $_POST['copy_option'] == 'select_items') {
-
-	// Else, if a CourseSelectForm is requested, show it
-	if (api_get_setting('show_glossary_in_documents') != 'none') {
-		Display::display_normal_message(get_lang('ToExportDocumentsWithGlossaryYouHaveToSelectGlossary'));
-	}
-
-	$arr_course_origin 		= array();
-	$arr_course_destination = array();
-	$destination_session 	= '';
-	$origin_session 		= '';
-
-	if (isset($_POST['SessionCoursesListOrigin'])) {
-		$arr_course_origin 		= $_POST['SessionCoursesListOrigin'];
-	}
-	if (isset($_POST['SessionCoursesListDestination'])) {
-		$arr_course_destination = $_POST['SessionCoursesListDestination'];
-	}
-	if (isset($_POST['sessions_list_destination'])) {
-		$destination_session 	= $_POST['sessions_list_destination'];
-	}
-	if (isset($_POST['sessions_list_origin'])) {
-		$origin_session 		= $_POST['sessions_list_origin'];
-	}
-
-	if ((is_array($arr_course_origin) && count($arr_course_origin) > 0) && !empty($destination_session)) {
-		Display::display_normal_message(get_lang('ToExportLearnpathWithQuizYouHaveToSelectQuiz'));
-		$course_origin = api_get_course_info($arr_course_origin[0]);
-		$cb = new CourseBuilder('', $course_origin);
-		$course = $cb->build($origin_session, $arr_course_origin[0], $with_base_content);
-		//$hidden_fields['same_file_name_option'] = $_POST['same_file_name_option'];
-		$hidden_fields['destination_course'] 	= $arr_course_destination[0];
-		$hidden_fields['origin_course'] 		= $arr_course_origin[0];
-		$hidden_fields['destination_session'] 	= $destination_session;
-		$hidden_fields['origin_session'] 		= $origin_session;
-
-		CourseSelectForm :: display_form($course, $hidden_fields, true);
-		echo '<div style="float:right"><a href="javascript:window.back();">'.
+        $cr = new CourseRestorer($course);
+        //$cr->set_file_option($_POST['same_file_name_option']);
+        $cr->restore($destination_course, $destination_session);
+        Display::display_confirmation_message(get_lang('CopyFinished'));
+        display_form();
+    } else {
+
+        $arr_course_origin 		= array();
+        $arr_course_destination = array();
+        $destination_session 	= '';
+        $origin_session 		= '';
+
+        if (isset($_POST['SessionCoursesListOrigin'])) {
+            $arr_course_origin 		= $_POST['SessionCoursesListOrigin'];
+        }
+        if (isset($_POST['SessionCoursesListDestination'])) {
+            $arr_course_destination = $_POST['SessionCoursesListDestination'];
+        }
+        if (isset($_POST['sessions_list_destination'])) {
+            $destination_session 	= $_POST['sessions_list_destination'];
+        }
+        if (isset($_POST['sessions_list_origin'])) {
+            $origin_session 		= $_POST['sessions_list_origin'];
+        }
+
+        if ((is_array($arr_course_origin) && count($arr_course_origin) > 0) && !empty($destination_session)) {
+            //We need only one value
+            if (count($arr_course_origin) > 1 || count($arr_course_destination) > 1) {
+                Display::display_error_message(get_lang('YouMustSelectACourseFromOriginalSession'));
+            } else {
+                //foreach ($arr_course_origin as $course_origin) {
+                //first element of the array
+                $course_code = $arr_course_origin[0];
+                $course_destinatination = $arr_course_destination[0];
+
+                $course_origin = api_get_course_info($course_code);
+                $cb = new CourseBuilder('', $course_origin);
+                $course = $cb->build($origin_session, $course_code, $with_base_content);
+                $cr = new CourseRestorer($course);
+                $cr->restore($course_destinatination, $destination_session);
+
+            }
+            Display::display_confirmation_message(get_lang('CopyFinished'));
+            display_form();
+        } else {
+            Display::display_error_message(get_lang('YouMustSelectACourseFromOriginalSession'));
+            display_form();
+        }
+    }
+} elseif (Security::check_token('post') && (
+        isset($_POST['copy_option']) &&
+        $_POST['copy_option'] == 'select_items'
+    )
+) {
+    // Clear token
+    Security::clear_token();
+
+    // Else, if a CourseSelectForm is requested, show it
+    if (api_get_setting('show_glossary_in_documents') != 'none') {
+        Display::display_normal_message(get_lang('ToExportDocumentsWithGlossaryYouHaveToSelectGlossary'));
+    }
+
+    $arr_course_origin 		= array();
+    $arr_course_destination = array();
+    $destination_session 	= '';
+    $origin_session 		= '';
+
+    if (isset($_POST['SessionCoursesListOrigin'])) {
+        $arr_course_origin 		= $_POST['SessionCoursesListOrigin'];
+    }
+    if (isset($_POST['SessionCoursesListDestination'])) {
+        $arr_course_destination = $_POST['SessionCoursesListDestination'];
+    }
+    if (isset($_POST['sessions_list_destination'])) {
+        $destination_session 	= $_POST['sessions_list_destination'];
+    }
+    if (isset($_POST['sessions_list_origin'])) {
+        $origin_session 		= $_POST['sessions_list_origin'];
+    }
+
+    if ((is_array($arr_course_origin) && count($arr_course_origin) > 0) && !empty($destination_session)) {
+        Display::display_normal_message(get_lang('ToExportLearnpathWithQuizYouHaveToSelectQuiz'));
+        $course_origin = api_get_course_info($arr_course_origin[0]);
+        $cb = new CourseBuilder('', $course_origin);
+        $course = $cb->build($origin_session, $arr_course_origin[0], $with_base_content);
+        //$hidden_fields['same_file_name_option'] = $_POST['same_file_name_option'];
+        $hidden_fields['destination_course'] 	= $arr_course_destination[0];
+        $hidden_fields['origin_course'] 		= $arr_course_origin[0];
+        $hidden_fields['destination_session'] 	= $destination_session;
+        $hidden_fields['origin_session'] 		= $origin_session;
+
+        CourseSelectForm :: display_form($course, $hidden_fields, true);
+        echo '<div style="float:right"><a href="javascript:window.back();">'.
             Display::return_icon(
                 'back.png',
                 get_lang('Back').' '.get_lang('To').' '.get_lang('PlatformAdmin'),
                 array('style' => 'vertical-align:middle')
             ).
             get_lang('Back').'</a></div>';
-	} else {
-		Display::display_error_message(
+    } else {
+        Display::display_error_message(
             get_lang('You must select a course from original session and select a destination session')
         );
-		display_form();
-	}
+        display_form();
+    }
 } else {
-	display_form();
+    display_form();
 }
 
 Display::display_footer();

+ 72 - 46
main/coursecopy/create_backup.php

@@ -27,22 +27,25 @@ if (!api_is_allowed_to_edit()) {
 
 // Remove memory and time limits as much as possible as this might be a long process...
 if (function_exists('ini_set')) {
-	api_set_memory_limit('256M');
-	ini_set('max_execution_time', 1800);
+    api_set_memory_limit('256M');
+    ini_set('max_execution_time', 1800);
 }
 
 // Section for the tabs
 $this_section = SECTION_COURSES;
 
 // Breadcrumbs
-$interbreadcrumb[] = array('url' => '../course_info/maintenance.php', 'name' => get_lang('Maintenance'));
+$interbreadcrumb[] = array(
+    'url' => '../course_info/maintenance.php',
+    'name' => get_lang('Maintenance')
+);
 
 // Displaying the header
 $nameTools = get_lang('CreateBackup');
 Display::display_header($nameTools);
 
 // Include additional libraries
-require_once api_get_path(LIBRARY_PATH).'fileManage.lib.php';
+require_once api_get_path(LIBRARY_PATH) . 'fileManage.lib.php';
 require_once 'classes/CourseBuilder.class.php';
 require_once 'classes/CourseArchiver.class.php';
 require_once 'classes/CourseRestorer.class.php';
@@ -53,52 +56,75 @@ echo Display::page_header($nameTools);
 
 /*	MAIN CODE */
 
-if ((isset($_POST['action']) &&
-    $_POST['action'] == 'course_select_form') ||
-    (isset($_POST['backup_option']) &&
-    $_POST['backup_option'] == 'full_backup')
+if (Security::check_token('post') && (
+        (
+            isset($_POST['action']) &&
+            $_POST['action'] == 'course_select_form'
+        ) || (
+            isset($_POST['backup_option']) &&
+            $_POST['backup_option'] == 'full_backup'
+        )
+    )
 ) {
-	if (isset($_POST['action']) && $_POST['action'] == 'course_select_form') {
-		$course = CourseSelectForm::get_posted_course();
-	} else {
-		$cb = new CourseBuilder();
-		$course = $cb->build();
-	}
-
-	$zip_file = CourseArchiver::write_course($course);
-	Display::display_confirmation_message(get_lang('BackupCreated'));
-	echo '<br /><a class="btn btn-primary btn-large" href="'.api_get_path(WEB_CODE_PATH).'course_info/download.php?archive='.$zip_file.'&'.api_get_cidreq().'">
-	'.get_lang('Download').'</a>';
-
-} elseif (isset($_POST['backup_option']) && $_POST['backup_option'] == 'select_items') {
-	$cb = new CourseBuilder('partial');
-	$course = $cb->build();
-	CourseSelectForm::display_form($course);
+    // Clear token
+    Security::clear_token();
+
+    if (isset($_POST['action']) && $_POST['action'] == 'course_select_form') {
+        $course = CourseSelectForm::get_posted_course();
+    } else {
+        $cb = new CourseBuilder();
+        $course = $cb->build();
+    }
+
+    $zip_file = CourseArchiver::write_course($course);
+    Display::display_confirmation_message(get_lang('BackupCreated'));
+    echo '<br /><a class="btn btn-primary btn-large" href="' . api_get_path(WEB_CODE_PATH) . 'course_info/download.php?archive=' . $zip_file . '&' . api_get_cidreq() . '">
+    ' . get_lang('Download') . '</a>';
+
+} elseif (Security::check_token('post') && (
+        isset($_POST['backup_option']) &&
+        $_POST['backup_option'] == 'select_items'
+    )
+) {
+    // Clear token
+    Security::clear_token();
+
+    $cb = new CourseBuilder('partial');
+    $course = $cb->build();
+    CourseSelectForm::display_form($course);
 
 } else {
-	$cb = new CourseBuilder();
-	$course = $cb->build();
-	if (!$course->has_resources()) {
-		echo get_lang('NoResourcesToBackup');
-	} else {
-		$form = new FormValidator('create_backup_form', 'post', api_get_self().'?'.api_get_cidreq());
-		$form->addElement('header',get_lang('SelectOptionForBackup'));
-		$form->addElement('radio', 'backup_option', '', get_lang('CreateFullBackup'), 'full_backup');
-		$form->addElement('radio', 'backup_option', '',  get_lang('LetMeSelectItems'), 'select_items');
-		$form->addElement('style_submit_button', null, get_lang('CreateBackup'), 'class="save"');
-		$form->add_progress_bar();
-		// When progress bar appears we have to hide the title "Please select a backup-option".
-		$form->updateAttributes(
-            array('onsubmit' => str_replace(
-                'javascript: ',
-                'javascript: page_title = getElementById(\'page_title\'); if (page_title) { setTimeout(\'page_title.style.display = \\\'none\\\';\', 2000); } ',
-                $form->getAttribute('onsubmit')
-            ))
+    $cb = new CourseBuilder();
+    $course = $cb->build();
+    if (!$course->has_resources()) {
+        echo get_lang('NoResourcesToBackup');
+    } else {
+        $form = new FormValidator('create_backup_form', 'post', api_get_self() . '?' . api_get_cidreq());
+        $form->addElement('header', get_lang('SelectOptionForBackup'));
+        $form->addElement('radio', 'backup_option', '', get_lang('CreateFullBackup'), 'full_backup');
+        $form->addElement('radio', 'backup_option', '', get_lang('LetMeSelectItems'), 'select_items');
+        $form->addElement('style_submit_button', null, get_lang('CreateBackup'), 'class="save"');
+        $form->add_progress_bar();
+        // When progress bar appears we have to hide the title "Please select a backup-option".
+        $form->updateAttributes(
+            array(
+                'onsubmit' => str_replace(
+                    'javascript: ',
+                    'javascript: page_title = getElementById(\'page_title\'); if (page_title) { setTimeout(\'page_title.style.display = \\\'none\\\';\', 2000); } ',
+                    $form->getAttribute('onsubmit')
+                )
+            )
         );
-		$values['backup_option'] = 'full_backup';
-		$form->setDefaults($values);
-		$form->display();
-	}
+        $values['backup_option'] = 'full_backup';
+        $form->setDefaults($values);
+
+        // Add Security token
+        $token = Security::get_token();
+        $form->addElement('hidden', 'sec_token');
+        $form->setConstants(array('sec_token' => $token));
+
+        $form->display();
+    }
 }
 
 Display::display_footer();

+ 221 - 122
main/coursecopy/import_backup.php

@@ -12,32 +12,35 @@ $language_file = array('exercice', 'coursebackup', 'admin');
 
 // Including the global initialization file
 require '../inc/global.inc.php';
-$current_course_tool  = TOOL_COURSE_MAINTENANCE;
+$current_course_tool = TOOL_COURSE_MAINTENANCE;
 api_protect_course_script(true);
 
 // Check access rights (only teachers are allowed here)
 if (!api_is_allowed_to_edit()) {
-	api_not_allowed(true);
+    api_not_allowed(true);
 }
 
 // Remove memory and time limits as much as possible as this might be a long process...
 if (function_exists('ini_set')) {
-	api_set_memory_limit('256M');
-	ini_set('max_execution_time', 1800);
+    api_set_memory_limit('256M');
+    ini_set('max_execution_time', 1800);
 }
 
 // Section for the tabs
 $this_section = SECTION_COURSES;
 
 // Breadcrumbs
-$interbreadcrumb[] = array('url' => '../course_info/maintenance.php', 'name' => get_lang('Maintenance'));
+$interbreadcrumb[] = array(
+    'url' => '../course_info/maintenance.php',
+    'name' => get_lang('Maintenance')
+);
 
 // Displaying the header
 $nameTools = get_lang('ImportBackup');
 Display::display_header($nameTools);
 
 // Include additional libraries
-require_once api_get_path(LIBRARY_PATH).'fileManage.lib.php';
+require_once api_get_path(LIBRARY_PATH) . 'fileManage.lib.php';
 require_once 'classes/CourseBuilder.class.php';
 require_once 'classes/CourseArchiver.class.php';
 require_once 'classes/CourseRestorer.class.php';
@@ -46,139 +49,230 @@ require_once 'classes/CourseSelectForm.class.php';
 // Display the tool title
 echo Display::page_header($nameTools);
 
-/*	MAIN CODE */
+/* MAIN CODE */
 
-if ((isset($_POST['action']) &&
-    $_POST['action'] == 'course_select_form') ||
-    (isset($_POST['import_option']) &&
-    $_POST['import_option'] == 'full_backup')
+if (Security::check_token('post') && (
+        (
+            isset($_POST['action']) &&
+            $_POST['action'] == 'course_select_form'
+        ) || (
+            isset($_POST['import_option']) &&
+            $_POST['import_option'] == 'full_backup'
+        )
+    )
 ) {
-	$error = false;
-	if (isset($_POST['action']) && $_POST['action'] == 'course_select_form') {
-		// Partial backup here we recover the documents posted
-		$course = CourseSelectForm::get_posted_course();
-
-	} else {
-		if ($_POST['backup_type'] == 'server') {
-			$filename = $_POST['backup_server'];
-			$delete_file = false;
-		} else {
-			if ($_FILES['backup']['error'] == 0) {
-				$filename = CourseArchiver::import_uploaded_file($_FILES['backup']['tmp_name']);
-				if ($filename === false) {
-                	$error = true;
-                } else                {
+    // Clear token
+    Security::clear_token();
+
+    $error = false;
+    if (isset($_POST['action']) && $_POST['action'] == 'course_select_form') {
+        // Partial backup here we recover the documents posted
+        $course = CourseSelectForm::get_posted_course();
+
+    } else {
+        if ($_POST['backup_type'] == 'server') {
+            $filename = $_POST['backup_server'];
+            $delete_file = false;
+        } else {
+            if ($_FILES['backup']['error'] == 0) {
+                $filename = CourseArchiver::import_uploaded_file($_FILES['backup']['tmp_name']);
+                if ($filename === false) {
+                    $error = true;
+                } else {
                     $delete_file = true;
                 }
-			} else {
-				$error = true;
-			}
-		}
+            } else {
+                $error = true;
+            }
+        }
 
         if (!$error) {
-		  // Full backup
-		  $course = CourseArchiver::read_course($filename, $delete_file);
+            // Full backup
+            $course = CourseArchiver::read_course($filename, $delete_file);
         }
-	}
-
-	if (!$error && $course->has_resources()) {
-		$cr = new CourseRestorer($course);
-		$cr->set_file_option($_POST['same_file_name_option']);
-		$cr->restore();
-		Display::display_normal_message(get_lang('ImportFinished'));
-        echo '<a class="btn" href="'.api_get_path(WEB_COURSE_PATH).api_get_course_path().'/index.php">'.get_lang('CourseHomepage').'</a>';
-	} else {
-		if (!$error) {
-			Display::display_warning_message(get_lang('NoResourcesInBackupFile'));
-            echo  '<a class="btn" href="import_backup.php?'.api_get_cidreq().'">'.get_lang('TryAgain').'</a>';
-		} elseif ($filename === false) {
+    }
+
+    if (!$error && $course->has_resources()) {
+        $cr = new CourseRestorer($course);
+        $cr->set_file_option($_POST['same_file_name_option']);
+        $cr->restore();
+        Display::display_normal_message(get_lang('ImportFinished'));
+        echo '<a class="btn" href="' . api_get_path(WEB_COURSE_PATH) . api_get_course_path() . '/index.php">' . get_lang('CourseHomepage') . '</a>';
+    } else {
+        if (!$error) {
+            Display::display_warning_message(get_lang('NoResourcesInBackupFile'));
+            echo '<a class="btn" href="import_backup.php?' . api_get_cidreq() . '">' . get_lang('TryAgain') . '</a>';
+        } elseif ($filename === false) {
             Display::display_error_message(get_lang('ArchivesDirectoryNotWriteableContactAdmin'));
-            echo '<a class="btn" href="import_backup.php?'.api_get_cidreq().'">'.get_lang('TryAgain').'</a>';
+            echo '<a class="btn" href="import_backup.php?' . api_get_cidreq() . '">' . get_lang('TryAgain') . '</a>';
         } else {
             if ($filename == '') {
-               Display::display_error_message(get_lang('SelectBackupFile'));
-               echo '<a class="btn" href="import_backup.php?'.api_get_cidreq().'">'.get_lang('TryAgain').'</a>';
+                Display::display_error_message(get_lang('SelectBackupFile'));
+                echo '<a class="btn" href="import_backup.php?' . api_get_cidreq() . '">' . get_lang('TryAgain') . '</a>';
             } else {
-    			Display::display_error_message(get_lang('UploadError'));
-                echo '<a class="btn" href="import_backup.php?'.api_get_cidreq().'">'.get_lang('TryAgain').'</a>';
+                Display::display_error_message(get_lang('UploadError'));
+                echo '<a class="btn" href="import_backup.php?' . api_get_cidreq() . '">' . get_lang('TryAgain') . '</a>';
             }
-		}
-	}
-	CourseArchiver::clean_backup_dir();
-
-} elseif (isset($_POST['import_option']) && $_POST['import_option'] == 'select_items') {
-	if ($_POST['backup_type'] == 'server') {
-		$filename = $_POST['backup_server'];
-		$delete_file = false;
-	} else {
-		$filename = CourseArchiver::import_uploaded_file($_FILES['backup']['tmp_name']);
-		$delete_file = true;
-	}
-	$course = CourseArchiver::read_course($filename, $delete_file);
-
-	if ($course->has_resources() && ($filename !== false)) {
-		CourseSelectForm::display_form($course, array('same_file_name_option' => $_POST['same_file_name_option']));
-	} elseif ($filename === false) {
-    	Display::display_error_message(get_lang('ArchivesDirectoryNotWriteableContactAdmin'));
-        echo '<a class="btn" href="import_backup.php?'.api_get_cidreq().'">'.get_lang('TryAgain').'</a>';
+        }
+    }
+    CourseArchiver::clean_backup_dir();
+
+} elseif (Security::check_token('post') && (
+        isset($_POST['import_option']) &&
+        $_POST['import_option'] == 'select_items'
+    )
+) {
+    // Clear token
+    Security::clear_token();
+
+    if ($_POST['backup_type'] == 'server') {
+        $filename = $_POST['backup_server'];
+        $delete_file = false;
     } else {
-		Display::display_warning_message(get_lang('NoResourcesInBackupFile'));
-        echo '<a class="btn" href="import_backup.php?'.api_get_cidreq().'">'.get_lang('TryAgain').'</a>';
-	}
+        $filename = CourseArchiver::import_uploaded_file($_FILES['backup']['tmp_name']);
+        $delete_file = true;
+    }
+    $course = CourseArchiver::read_course($filename, $delete_file);
+
+    if ($course->has_resources() && ($filename !== false)) {
+        CourseSelectForm::display_form($course, array('same_file_name_option' => $_POST['same_file_name_option']));
+    } elseif ($filename === false) {
+        Display::display_error_message(get_lang('ArchivesDirectoryNotWriteableContactAdmin'));
+        echo '<a class="btn" href="import_backup.php?' . api_get_cidreq() . '">' . get_lang('TryAgain') . '</a>';
+    } else {
+        Display::display_warning_message(get_lang('NoResourcesInBackupFile'));
+        echo '<a class="btn" href="import_backup.php?' . api_get_cidreq() . '">' . get_lang('TryAgain') . '</a>';
+    }
 } else {
-	$user = api_get_user_info();
-	$backups = CourseArchiver::get_available_backups(
+    $user = api_get_user_info();
+    $backups = CourseArchiver::get_available_backups(
         $is_platformAdmin ? null : $user['user_id']
     );
-	$backups_available = count($backups) > 0;
+    $backups_available = count($backups) > 0;
 
-	$form = new FormValidator('import_backup_form', 'post', api_get_path(WEB_CODE_PATH).'coursecopy/import_backup.php?'.api_get_cidreq(), '', 'multipart/form-data');
+    $form = new FormValidator(
+        'import_backup_form',
+        'post',
+        api_get_path(WEB_CODE_PATH) . 'coursecopy/import_backup.php?' . api_get_cidreq(),
+        '',
+        'multipart/form-data'
+    );
     $form->addElement('header', get_lang('SelectBackupFile'));
-	$renderer = $form->defaultRenderer();
-	$renderer->setElementTemplate('<div>{element}</div> ');
-
-	$form->addElement('hidden', 'action', 'restore_backup');
-
-	$form->addElement('radio', 'backup_type', '', get_lang('LocalFile'), 'local', 'id="bt_local" class="checkbox" onclick="javascript: document.import_backup_form.backup_server.disabled=true;document.import_backup_form.backup.disabled=false;"');
-	$form->addElement('file', 'backup', '', 'style="margin-left: 50px;"');
-	$form->addElement('html', '<br />');
-
-	if ($backups_available) {
-		$form->addElement('radio', 'backup_type', '', get_lang('ServerFile'), 'server', 'id="bt_server" class="checkbox" onclick="javascript: document.import_backup_form.backup_server.disabled=false;document.import_backup_form.backup.disabled=true;"');
-		$options['null'] = '-';
-		foreach ($backups as $index => $backup) {
-			$options[$backup['file']] = $backup['course_code'].' ('.$backup['date'].')';
-		}
-		$form->addElement('select', 'backup_server', '', $options, 'style="margin-left: 50px;"');
-		$form->addElement('html', '<script type="text/javascript">document.import_backup_form.backup_server.disabled=true;</script>');
-	} else {
-		$form->addElement('radio', '', '', '<i>'.get_lang('NoBackupsAvailable').'</i>', '', 'disabled="true"');
-	}
-
-	$form->addElement('html', '<br /><br />');
-
-	$form->addElement('radio', 'import_option', '', get_lang('ImportFullBackup'), 'full_backup', 'id="import_option_1" class="checkbox"');
-	$form->addElement('radio', 'import_option', '', get_lang('LetMeSelectItems'), 'select_items', 'id="import_option_2" class="checkbox"');
-
-	$form->addElement('html', '<br /><br />');
-
-	$form->addElement('html', get_lang('SameFilename'));
-	$form->addElement('html', '<br /><br />');
-	$form->addElement('radio', 'same_file_name_option', '', get_lang('SameFilenameSkip'), FILE_SKIP, 'id="same_file_name_option_1" class="checkbox"');
-	$form->addElement('radio', 'same_file_name_option', '', get_lang('SameFilenameRename'), FILE_RENAME, 'id="same_file_name_option_2" class="checkbox"');
-	$form->addElement('radio', 'same_file_name_option', '', get_lang('SameFilenameOverwrite'), FILE_OVERWRITE, 'id="same_file_name_option_3" class="checkbox"');
-
-	$form->addElement('html', '<br />');
-	$form->addElement('style_submit_button', null, get_lang('ImportBackup'), 'class="save"');
-
-	$values['backup_type'] = 'local';
-	$values['import_option'] = 'full_backup';
-	$values['same_file_name_option'] = FILE_OVERWRITE;
-	$form->setDefaults($values);
-
-	$form->add_progress_bar();
-	// When progress bar appears we have to hide the title "Select backup file".
-	$form->updateAttributes(array(
+    $renderer = $form->defaultRenderer();
+    $renderer->setElementTemplate('<div>{element}</div> ');
+
+    $form->addElement('hidden', 'action', 'restore_backup');
+
+    $form->addElement(
+        'radio',
+        'backup_type',
+        '',
+        get_lang('LocalFile'),
+        'local',
+        'id="bt_local" class="checkbox" onclick="javascript: document.import_backup_form.backup_server.disabled=true;document.import_backup_form.backup.disabled=false;"'
+    );
+    $form->addElement('file', 'backup', '', 'style="margin-left: 50px;"');
+    $form->addElement('html', '<br />');
+
+    if ($backups_available) {
+        $form->addElement(
+            'radio',
+            'backup_type',
+            '',
+            get_lang('ServerFile'),
+            'server',
+            'id="bt_server" class="checkbox" onclick="javascript: document.import_backup_form.backup_server.disabled=false;document.import_backup_form.backup.disabled=true;"'
+        );
+        $options['null'] = '-';
+        foreach ($backups as $index => $backup) {
+            $options[$backup['file']] = $backup['course_code'] . ' (' . $backup['date'] . ')';
+        }
+        $form->addElement(
+            'select',
+            'backup_server',
+            '',
+            $options,
+            'style="margin-left: 50px;"'
+        );
+        $form->addElement(
+            'html',
+            '<script type="text/javascript">document.import_backup_form.backup_server.disabled=true;</script>'
+        );
+    } else {
+        $form->addElement(
+            'radio',
+            '',
+            '',
+            '<i>' . get_lang('NoBackupsAvailable') . '</i>',
+            '',
+            'disabled="true"'
+        );
+    }
+
+    $form->addElement('html', '<br /><br />');
+
+    $form->addElement(
+        'radio',
+        'import_option',
+        '',
+        get_lang('ImportFullBackup'),
+        'full_backup',
+        'id="import_option_1" class="checkbox"'
+    );
+    $form->addElement(
+        'radio',
+        'import_option',
+        '',
+        get_lang('LetMeSelectItems'),
+        'select_items',
+        'id="import_option_2" class="checkbox"'
+    );
+
+    $form->addElement('html', '<br /><br />');
+
+    $form->addElement('html', get_lang('SameFilename'));
+    $form->addElement('html', '<br /><br />');
+    $form->addElement(
+        'radio',
+        'same_file_name_option',
+        '',
+        get_lang('SameFilenameSkip'),
+        FILE_SKIP,
+        'id="same_file_name_option_1" class="checkbox"'
+    );
+    $form->addElement(
+        'radio',
+        'same_file_name_option',
+        '',
+        get_lang('SameFilenameRename'),
+        FILE_RENAME,
+        'id="same_file_name_option_2" class="checkbox"'
+    );
+    $form->addElement(
+        'radio',
+        'same_file_name_option',
+        '',
+        get_lang('SameFilenameOverwrite'),
+        FILE_OVERWRITE,
+        'id="same_file_name_option_3" class="checkbox"'
+    );
+
+    $form->addElement('html', '<br />');
+    $form->addElement(
+        'style_submit_button',
+        null,
+        get_lang('ImportBackup'),
+        'class="save"'
+    );
+
+    $values['backup_type'] = 'local';
+    $values['import_option'] = 'full_backup';
+    $values['same_file_name_option'] = FILE_OVERWRITE;
+    $form->setDefaults($values);
+
+    $form->add_progress_bar();
+    // When progress bar appears we have to hide the title "Select backup file".
+    $form->updateAttributes(array(
         'onsubmit' => str_replace(
             'javascript: ',
             'javascript: page_title = getElementById(\'page_title\'); if (page_title) { setTimeout(\'page_title.style.display = \\\'none\\\';\', 2000); } ',
@@ -186,7 +280,12 @@ if ((isset($_POST['action']) &&
         )
     ));
 
-	$form->display();
+    // Add Security token
+    $token = Security::get_token();
+    $form->addElement('hidden', 'sec_token');
+    $form->setConstants(array('sec_token' => $token));
+
+    $form->display();
 }
 
 Display::display_footer();

+ 52 - 32
main/coursecopy/recycle_course.php

@@ -46,46 +46,66 @@ echo Display::page_header($nameTools);
 
 /*		MAIN CODE	*/
 
-if ((isset($_POST['action']) &&
-    $_POST['action'] == 'course_select_form') ||
-    (isset($_POST['recycle_option']) &&
-    $_POST['recycle_option'] == 'full_backup')
+if (Security::check_token('post') && (
+        isset($_POST['action']) &&
+        $_POST['action'] == 'course_select_form' ||
+        (
+            isset($_POST['recycle_option']) &&
+            $_POST['recycle_option'] == 'full_backup'
+        )
+    )
 ) {
-	if (isset($_POST['action']) && $_POST['action'] == 'course_select_form') {
-		$course = CourseSelectForm::get_posted_course();
-	} else {
-		$cb = new CourseBuilder();
-		$course = $cb->build();
-	}
-	$recycle_type = "";
-	if (isset($_POST['recycle_option']) && $_POST['recycle_option'] == 'full_backup') {
-	    $recycle_type = 'full_backup';
-	} else if (isset($_POST['action']) && $_POST['action'] == 'course_select_form') {
-	    $recycle_type = 'select_items';
-	}
-	$cr = new CourseRecycler($course);
-	$cr->recycle($recycle_type);
+    // Clear token
+    Security::clear_token();
 
-	Display::display_confirmation_message(get_lang('RecycleFinished'));
-} elseif (isset($_POST['recycle_option']) && $_POST['recycle_option'] == 'select_items') {
-	$cb = new CourseBuilder();
-	$course = $cb->build();
-	CourseSelectForm::display_form($course);
+    if (isset($_POST['action']) && $_POST['action'] == 'course_select_form') {
+        $course = CourseSelectForm::get_posted_course();
+    } else {
+        $cb = new CourseBuilder();
+        $course = $cb->build();
+    }
+    $recycle_type = "";
+    if (isset($_POST['recycle_option']) && $_POST['recycle_option'] == 'full_backup') {
+        $recycle_type = 'full_backup';
+    } else if (isset($_POST['action']) && $_POST['action'] == 'course_select_form') {
+        $recycle_type = 'select_items';
+    }
+    $cr = new CourseRecycler($course);
+    $cr->recycle($recycle_type);
+
+    Display::display_confirmation_message(get_lang('RecycleFinished'));
+
+} elseif (Security::check_token('post') && (
+        isset($_POST['recycle_option']) &&
+        $_POST['recycle_option'] == 'select_items'
+    )
+) {
+    // Clear token
+    Security::clear_token();
+
+    $cb = new CourseBuilder();
+    $course = $cb->build();
+    CourseSelectForm::display_form($course);
 } else {
-	$cb = new CourseBuilder();
-	$course = $cb->build();
-	if (!$course->has_resources()) {
-		echo get_lang('NoResourcesToRecycle');
-	} else {
-		Display::display_warning_message(get_lang('RecycleWarning'), false);
+    $cb = new CourseBuilder();
+    $course = $cb->build();
+    if (!$course->has_resources()) {
+        echo get_lang('NoResourcesToRecycle');
+    } else {
+        Display::display_warning_message(get_lang('RecycleWarning'), false);
         $form = new FormValidator('recycle_course', 'post', api_get_self().'?'.api_get_cidreq());
-		$form->addElement('header', get_lang('SelectOptionForBackup'));
-		$form->addElement('radio', 'recycle_option', null, get_lang('FullRecycle'), 'full_backup');
+        $form->addElement('header', get_lang('SelectOptionForBackup'));
+        $form->addElement('radio', 'recycle_option', null, get_lang('FullRecycle'), 'full_backup');
         $form->addElement('radio', 'recycle_option', null, get_lang('LetMeSelectItems'), 'select_items');
         $form->addElement('style_submit_button', 'submit', get_lang('RecycleCourse'), 'class="save"');
         $form->setDefaults(array('recycle_option' => 'select_items'));
+        // Add Security token
+        $token = Security::get_token();
+        $form->addElement('hidden', 'sec_token');
+        $form->setConstants(array('sec_token' => $token));
+
         $form->display();
-	}
+    }
 }
 
 // Display the footer