-
Bug
-
Resolution: Fixed
-
Minor
-
4.5.4, 5.0
Found when looking at MDL-85333.
To replicate:
- Go to course home and make sure editing is enabled
- Click the vertical ellipsis menu for a course module
- Mouse over the "edit settings" link
Expected: sesskey isn't present in the link to mod.php
Actual: sesskey IS present in the link
As in other issues of this nature, we should remove sesskey from GET requests and only include it when we're POSTing to make a change.
Looking quickly at the path through mod.php in this case, it doesn't appear to do anything with sesskey anyway (nor should it really).
- Discovered while testing
-
MDL-85333 Editing LTI tools exposes the sesskey in a read GET request
-
- Waiting for component lead review
-