[svn r12203] Added token in form to avoid double submit

main/work/work.php

@@ -23,7 +23,7 @@
 * 	@author Patrick Cool <patrick.cool@UGent.be>, Ghent University - ability for course admins to specify wether uploaded documents are visible or invisible by default.
 * 	@author Roan Embrechts, code refactoring and virtual course support
 * 	@author Frederic Vauthier, directories management
-*  	@version $Id: work.php 12084 2007-04-23 12:47:19Z elixir_julian $
+*  	@version $Id: work.php 12203 2007-04-30 14:06:24Z yannoo $
 *
 * 	@todo refactor more code into functions, use quickforms, coding standards, ...
 */
@@ -465,7 +465,6 @@ if (api_is_allowed_to_edit())
 	 --------------------*/
 	if(!empty($_REQUEST['delete_dir']))
 	{
-		//TODO implement
 		del_dir($base_work_dir.'/',$_REQUEST['delete_dir']);
 		Display::display_normal_message($_REQUEST['delete_dir'].' '.get_lang('DirDeleted'));
 	}
@@ -599,7 +598,8 @@ else
 
 $error_message="";
 
-if($_POST['submitWork'] && $is_course_member)
+$check = Security::check_token('post'); //check the token inserted into the form
+if($_POST['submitWork'] && $is_course_member && $check)
 {
 	if($_FILES['file']['size'])
 	{
@@ -739,10 +739,11 @@ if($_POST['submitWork'] && $is_course_member)
 			$error_message = get_lang('TooBig');
 		}
 	}
+	Security::clear_token();//clear the token to prevent re-executing the request with back button
 }
 if ($_POST['submitWork'] && $succeed &&!$id) //last value is to check this is not "just" an edit
 {
-		//YW Tis part serve to send a e-mail to the tutors when a new file is send
+		//YW Tis part serve to send a e-mail to the tutors when a new file is sent
 	// Lets predefine some variables. Be sure to change the from address!
 	$table_course_user = Database::get_main_table(TABLE_MAIN_COURSE_USER);
 	$table_user = Database::get_main_table(TABLE_MAIN_USER);
@@ -801,6 +802,7 @@ if ($_POST['submitWork'] && $succeed &&!$id) //last value is to check this is no
 	{
 		if ($display_upload_form || $edit)
 		{
+			$token = Security::get_token(); //generate token to be used to check validity of request
 			if($edit){
 				//Get the author ID for that document from the item_property table
 				$is_author = false;
@@ -859,7 +861,8 @@ if ($_POST['submitWork'] && $succeed &&!$id) //last value is to check this is no
 
 			$form->addElement('hidden', 'active', 1);
 			$form->addElement('hidden', 'accepted', 1);
-
+			$form->addElement('hidden', 'sec_token', $token);
+			
 			$form->addElement('submit', 'submitWork', get_lang('Ok'));
 
 			if(empty($authors))