|
@@ -45,7 +45,18 @@ echo Display::page_header(get_lang('CopyCourse'));
|
|
/* MAIN CODE */
|
|
/* MAIN CODE */
|
|
|
|
|
|
// If a CourseSelectForm is posted or we should copy all resources, then copy them
|
|
// If a CourseSelectForm is posted or we should copy all resources, then copy them
|
|
-if ((isset($_POST['action']) && $_POST['action'] == 'course_select_form') || (isset($_POST['copy_option']) && $_POST['copy_option'] == 'full_copy')) {
|
|
|
|
|
|
+if (
|
|
|
|
+ Security::check_token('post') && (
|
|
|
|
+ (
|
|
|
|
+ isset($_POST['action']) &&
|
|
|
|
+ $_POST['action'] == 'course_select_form') || (
|
|
|
|
+ isset($_POST['copy_option']) && $_POST['copy_option'] == 'full_copy'
|
|
|
|
+ )
|
|
|
|
+ )
|
|
|
|
+) {
|
|
|
|
+ // Clear token
|
|
|
|
+ Security::clear_token();
|
|
|
|
+
|
|
if (isset($_POST['action']) && $_POST['action'] == 'course_select_form') {
|
|
if (isset($_POST['action']) && $_POST['action'] == 'course_select_form') {
|
|
$course = CourseSelectForm :: get_posted_course('copy_course');
|
|
$course = CourseSelectForm :: get_posted_course('copy_course');
|
|
} else {
|
|
} else {
|
|
@@ -56,7 +67,15 @@ if ((isset($_POST['action']) && $_POST['action'] == 'course_select_form') || (is
|
|
$cr->set_file_option($_POST['same_file_name_option']);
|
|
$cr->set_file_option($_POST['same_file_name_option']);
|
|
$cr->restore($_POST['destination_course']);
|
|
$cr->restore($_POST['destination_course']);
|
|
Display::display_normal_message(get_lang('CopyFinished').': <a href="'.api_get_course_url($_POST['destination_course']).'">'.$_POST['destination_course'].'</a>', false);
|
|
Display::display_normal_message(get_lang('CopyFinished').': <a href="'.api_get_course_url($_POST['destination_course']).'">'.$_POST['destination_course'].'</a>', false);
|
|
-} elseif (isset ($_POST['copy_option']) && $_POST['copy_option'] == 'select_items') {
|
|
|
|
|
|
+} elseif (
|
|
|
|
+ Security::check_token('post') && (
|
|
|
|
+ isset ($_POST['copy_option']) &&
|
|
|
|
+ $_POST['copy_option'] == 'select_items'
|
|
|
|
+ )
|
|
|
|
+) {
|
|
|
|
+ // Clear token
|
|
|
|
+ Security::clear_token();
|
|
|
|
+
|
|
$cb = new CourseBuilder();
|
|
$cb = new CourseBuilder();
|
|
$course = $cb->build();
|
|
$course = $cb->build();
|
|
$hidden_fields = array();
|
|
$hidden_fields = array();
|
|
@@ -104,6 +123,12 @@ if ((isset($_POST['action']) && $_POST['action'] == 'course_select_form') || (is
|
|
$form->add_progress_bar();
|
|
$form->add_progress_bar();
|
|
$form->addElement('style_submit_button', 'submit', get_lang('CopyCourse'), 'class="save"');
|
|
$form->addElement('style_submit_button', 'submit', get_lang('CopyCourse'), 'class="save"');
|
|
$form->setDefaults(array('copy_option' =>'select_items','same_file_name_option' => FILE_OVERWRITE));
|
|
$form->setDefaults(array('copy_option' =>'select_items','same_file_name_option' => FILE_OVERWRITE));
|
|
|
|
+
|
|
|
|
+ // Add Security token
|
|
|
|
+ $token = Security::get_token();
|
|
|
|
+ $form->addElement('hidden', 'sec_token');
|
|
|
|
+ $form->setConstants(array('sec_token' => $token));
|
|
|
|
+
|
|
$form->display();
|
|
$form->display();
|
|
}
|
|
}
|
|
}
|
|
}
|