diff --git a/main/work/work.lib.php b/main/work/work.lib.php index 9506a586f4..e077669b5e 100755 --- a/main/work/work.lib.php +++ b/main/work/work.lib.php @@ -104,8 +104,9 @@ function display_action_links($cur_dir_path, $always_show_tool_options, $always_ $display_output .= "". Display::return_icon('check.gif', get_lang('ViewUsersWithTask')).' '.get_lang('ViewUsersWithTask'). "\n"; - - $display_output .= "". + + $_SESSION['token'] = time(); + $display_output .= "". Display::return_icon('messagebox_warning.gif', get_lang('ReminderMessage')).' '.get_lang('ReminderMessage'). "\n"; } diff --git a/main/work/work.php b/main/work/work.php index ec11d3930a..7d103a245e 100755 --- a/main/work/work.php +++ b/main/work/work.php @@ -217,8 +217,12 @@ if (isset($_GET['list']) && Security::remove_XSS($_GET['list'])=='without') { $display_list_users_without_publication= false; } -if (isset($_GET['action']) && $_GET['action'] == 'send_mail') { - send_reminder_users_without_publication($publication['id']); + +if (isset($_GET['action']) && $_GET['action'] == 'send_mail') { + if ($_GET['sec_token'] == $_SESSION['token']) { + send_reminder_users_without_publication($publication['id']); + unset($_SESSION['token']); + } } api_protect_course_script(true);