-
Bug
-
Resolution: Fixed
-
Minor
-
3.11.3
-
MOODLE_311_STABLE
-
MOODLE_310_STABLE, MOODLE_311_STABLE
-
- Navigate to Site administration > Notifications
- Press Blocks editing on
- Add a HTML block (or Text block after
MDL-72118) - Press Actions menu > Configure
- Page reloads (can't configure block)
- Press Actions menu > Delete
- Page reloads (can't delete block)
Possible a regression from MDL-69807. I note that if you manually add the sesskey to the configure/delete URL's then you can load the appropriate page to complete those actions
There is a note (line 74): https://github.com/moodle/moodle/blob/1d700796ca80e86ceee39f1a5da5d87aa042dbd8/admin/index.php#L70-L74 that indicates the sesskey was used apparently for this page only, in order to disable caching and allow the block configure/delete pages to load
- is a regression caused by
-
MDL-69807 Editing a block exposes the CSRF token (sesskey) in the url
-
- Closed
-