Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-69807

Editing a block exposes the CSRF token (sesskey) in the url

    XMLWordPrintable

Details

    • MOODLE_39_STABLE
    • MOODLE_38_STABLE, MOODLE_39_STABLE
    • Hide
      1. Login as admin
      2. Create a course
      3. Turn editing on
      4. Add a HTML block
      5. From the HTML block, click Actions menu > Configure (new HTML block) block
      6. Confirm there is no "&sesskey=...." parameter present in the URL
      7. Add some content and press Save changes
      8. Confirm HTML block content has been updated on the course page
      9. From the HTML block, click Actions menu > Delete (new HTML block) block
      10. Confirm there is no "&sesskey=...." parameter present in the URL

       

      Show
      Login as admin Create a course Turn editing on Add a HTML block From the HTML block, click Actions menu > Configure (new HTML block) block Confirm there is no "&sesskey=...." parameter present in the URL Add some content and press Save changes Confirm HTML block content has been updated on the course page From the HTML block, click Actions menu > Delete (new HTML block) block Confirm there is no "&sesskey=...." parameter present in the URL  

    Description

      Just another sesskey which is not needed in the original get, only on the subsequent posts when saving the form.

       

      Attachments

        Issue Links

          caused a regression

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-72599 Cannot configure or delete blocks added to admin/index.php

          • Minor - Minor loss of function where workaround is possible
          • Closed
          will help resolve

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-40715 Problem with changing language while editing block

          • Minor - Minor loss of function where workaround is possible
          • Closed

          Activity

            People

              pholden Paul Holden
              brendanheywood Brendan Heywood
              Brendan Heywood Brendan Heywood
              Adrian Greeve Adrian Greeve
              Janelle Barcega Janelle Barcega
              David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:
                9/Nov/20

                Time Tracking

                  Estimated:
                  Original Estimate - 0 minutes
                  0m
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 1 hour, 50 minutes
                  1h 50m