|
@@ -46,11 +46,19 @@ echo Display::page_header($nameTools);
|
|
|
|
|
|
/* MAIN CODE */
|
|
|
|
|
|
-if ((isset($_POST['action']) &&
|
|
|
- $_POST['action'] == 'course_select_form') ||
|
|
|
- (isset($_POST['recycle_option']) &&
|
|
|
- $_POST['recycle_option'] == 'full_backup')
|
|
|
+if (
|
|
|
+ Security::check_token('post') && (
|
|
|
+ isset($_POST['action']) &&
|
|
|
+ $_POST['action'] == 'course_select_form' ||
|
|
|
+ (
|
|
|
+ isset($_POST['recycle_option']) &&
|
|
|
+ $_POST['recycle_option'] == 'full_backup'
|
|
|
+ )
|
|
|
+ )
|
|
|
) {
|
|
|
+ // Clear token
|
|
|
+ Security::clear_token();
|
|
|
+
|
|
|
if (isset($_POST['action']) && $_POST['action'] == 'course_select_form') {
|
|
|
$course = CourseSelectForm::get_posted_course();
|
|
|
} else {
|
|
@@ -67,7 +75,16 @@ if ((isset($_POST['action']) &&
|
|
|
$cr->recycle($recycle_type);
|
|
|
|
|
|
Display::display_confirmation_message(get_lang('RecycleFinished'));
|
|
|
-} elseif (isset($_POST['recycle_option']) && $_POST['recycle_option'] == 'select_items') {
|
|
|
+
|
|
|
+} elseif (
|
|
|
+ Security::check_token('post') && (
|
|
|
+ isset($_POST['recycle_option']) &&
|
|
|
+ $_POST['recycle_option'] == 'select_items'
|
|
|
+ )
|
|
|
+) {
|
|
|
+ // Clear token
|
|
|
+ Security::clear_token();
|
|
|
+
|
|
|
$cb = new CourseBuilder();
|
|
|
$course = $cb->build();
|
|
|
CourseSelectForm::display_form($course);
|
|
@@ -84,6 +101,11 @@ if ((isset($_POST['action']) &&
|
|
|
$form->addElement('radio', 'recycle_option', null, get_lang('LetMeSelectItems'), 'select_items');
|
|
|
$form->addElement('style_submit_button', 'submit', get_lang('RecycleCourse'), 'class="save"');
|
|
|
$form->setDefaults(array('recycle_option' => 'select_items'));
|
|
|
+ // Add Security token
|
|
|
+ $token = Security::get_token();
|
|
|
+ $form->addElement('hidden', 'sec_token');
|
|
|
+ $form->setConstants(array('sec_token' => $token));
|
|
|
+
|
|
|
$form->display();
|
|
|
}
|
|
|
}
|