From 73958caa7f379c39d5f5e2450ca95f200f6cd985 Mon Sep 17 00:00:00 2001
From: Peter Mayer <admin@pemasoft.de>
Date: Sun, 13 Sep 2026 20:52:47 +0200
Subject: [PATCH] MBS-11229: Validate sesskey before state-changing actions

---
 ajax/saveindividualfeedback.php | 4 +++-
 report.php                      | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/ajax/saveindividualfeedback.php b/ajax/saveindividualfeedback.php
index 3b4a556..96c580c 100644
--- a/ajax/saveindividualfeedback.php
+++ b/ajax/saveindividualfeedback.php
@@ -69,7 +69,9 @@
     throw new \moodle_exception(get_string('incorrectjournalentry', 'journal'));
 }
 
-confirm_sesskey($sesskey);
+if (!confirm_sesskey($sesskey)) {
+    throw new \moodle_exception('invalidsesskey');
+}
 
 // Only update entries where feedback has actually changed.
 $ratingchanged = false;
diff --git a/report.php b/report.php
index b1e9b6d..c6ed932 100644
--- a/report.php
+++ b/report.php
@@ -111,7 +111,7 @@
 
 // Process incoming data if there is any.
 if ($data = data_submitted()) {
-    confirm_sesskey();
+    require_sesskey();
     $feedback = [];
     $data = (array) $data;