Skip to content

Commit d672d11

Browse files
committed
Security: Set token validation to set a student as tutor
1 parent c3ef857 commit d672d11

File tree

1 file changed

+14
-3
lines changed

1 file changed

+14
-3
lines changed

main/user/user.php

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -82,8 +82,8 @@
8282
if (isset($_GET['action'])) {
8383
switch ($_GET['action']) {
8484
case 'set_tutor':
85-
if (!$canEdit) {
86-
api_not_allowed();
85+
if (!$canEdit || !Security::check_token('get', null, 'tutor')) {
86+
api_not_allowed(true);
8787
}
8888
$userId = isset($_GET['user_id']) ? (int) $_GET['user_id'] : null;
8989
$isTutor = isset($_GET['is_tutor']) ? (int) $_GET['is_tutor'] : 0;
@@ -100,6 +100,7 @@
100100
Display::addFlash(
101101
Display::return_message(get_lang('Updated'))
102102
);
103+
Security::clear_token('tutor');
103104
} else {
104105
Display::addFlash(
105106
Display::return_message(
@@ -108,6 +109,10 @@
108109
)
109110
);
110111
}
112+
header(
113+
'Location: '.api_get_path(WEB_CODE_PATH).'user/user.php?'.api_get_cidreq().'&type='.$type
114+
);
115+
exit;
111116
}
112117
}
113118
break;
@@ -1052,7 +1057,13 @@ function modify_filter($user_id, $row, $data)
10521057
if ($data['user_status_in_course'] == STUDENT) {
10531058
$result .= Display::url(
10541059
$text,
1055-
'user.php?'.api_get_cidreq().'&action=set_tutor&is_tutor='.$isTutor.'&user_id='.$user_id.'&type='.$type,
1060+
'user.php?'.api_get_cidreq().'&'.http_build_query([
1061+
'action' => 'set_tutor',
1062+
'is_tutor' => $isTutor,
1063+
'user_id' => $user_id,
1064+
'type' => $type,
1065+
'tutor_sec_token' => Security::get_existing_token('tutor'),
1066+
]),
10561067
['class' => 'btn btn-default '.$disabled]
10571068
).' ';
10581069
}

0 commit comments

Comments
 (0)