The restore.php file does not check for the valid sesskey token before proceeding the action. As a result, it makes the site vulnerable towards the CSRF attack that can lead to serious data-loss as the content of the current course is deleted and replaced with the one from the template.
https://docs.moodle.org/dev/Security:Cross-site_request_forgery
The restore.php file does not check for the valid sesskey token before proceeding the action. As a result, it makes the site vulnerable towards the CSRF attack that can lead to serious data-loss as the content of the current course is deleted and replaced with the one from the template.
https://docs.moodle.org/dev/Security:Cross-site_request_forgery