diff --git a/main/work/work.lib.php b/main/work/work.lib.php
index 9506a586f4..e077669b5e 100755
--- a/main/work/work.lib.php
+++ b/main/work/work.lib.php
@@ -104,8 +104,9 @@ function display_action_links($cur_dir_path, $always_show_tool_options, $always_
$display_output .= "".
Display::return_icon('check.gif', get_lang('ViewUsersWithTask')).' '.get_lang('ViewUsersWithTask').
"\n";
-
- $display_output .= "".
+
+ $_SESSION['token'] = time();
+ $display_output .= "".
Display::return_icon('messagebox_warning.gif', get_lang('ReminderMessage')).' '.get_lang('ReminderMessage').
"\n";
}
diff --git a/main/work/work.php b/main/work/work.php
index ec11d3930a..7d103a245e 100755
--- a/main/work/work.php
+++ b/main/work/work.php
@@ -217,8 +217,12 @@ if (isset($_GET['list']) && Security::remove_XSS($_GET['list'])=='without') {
$display_list_users_without_publication= false;
}
-if (isset($_GET['action']) && $_GET['action'] == 'send_mail') {
- send_reminder_users_without_publication($publication['id']);
+
+if (isset($_GET['action']) && $_GET['action'] == 'send_mail') {
+ if ($_GET['sec_token'] == $_SESSION['token']) {
+ send_reminder_users_without_publication($publication['id']);
+ unset($_SESSION['token']);
+ }
}
api_protect_course_script(true);