Fix missing sesskey validation on state-changing admin endpoints

[Patryk Mroczko (patmr7)]

No description provided.

[Copilot]

Pull request overview

This PR tightens CSRF protection for Microsoft 365 admin tools in the local_o365 plugin by ensuring state-changing actions validate Moodle’s session key (sesskey).

Changes:

• Added require_sesskey() to state-changing endpoints (delete actions, queue clear, Teams connection actions, maintenance tools, user connection actions).
• Updated generated action URLs to include sesskey so the new validation passes for link- and JS-triggered requests.
• Replaced some confirm_sesskey() calls with require_sesskey() for consistent enforcement.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
local/o365/cohortsync.php	Adds require_sesskey() before performing mapping deletion.
local/o365/classes/page/acp.php	Enforces sesskey validation on multiple admin actions and updates related URLs to include sesskey.
local/o365/classes/form/cohortsync.php	Adds sesskey to the “delete mapping” action URL so deletion continues to work with validation enabled.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.