MBS-11229: Validate sesskey before state-changing actions

ajax/saveindividualfeedback.php

@@ -69,7 +69,9 @@
     throw new \moodle_exception(get_string('incorrectjournalentry', 'journal'));
 }
 
-confirm_sesskey($sesskey);
+if (!confirm_sesskey($sesskey)) {
+    throw new \moodle_exception('invalidsesskey');
+}
 
 // Only update entries where feedback has actually changed.
 $ratingchanged = false;

report.php

@@ -111,7 +111,7 @@
 
 // Process incoming data if there is any.
 if ($data = data_submitted()) {
-    confirm_sesskey();
+    require_sesskey();
     $feedback = [];
     $data = (array) $data;