diff --git a/course/jumpto.php b/course/jumpto.php
index <HASH>..<HASH> 100644
--- a/course/jumpto.php
+++ b/course/jumpto.php
@@ -10,6 +10,10 @@
 
     $jump = optional_param('jump', '', PARAM_RAW);
 
+    if (!confirm_sesskey()) {
+        print_error('confirmsesskeybad');
+    }
+
     if (strpos($jump, $CFG->wwwroot) === 0) {            // Anything on this site
         redirect(urldecode($jump));
     } else if (preg_match('/^[a-z]+\.php\?/', $jump)) { 
diff --git a/lib/weblib.php b/lib/weblib.php
index <HASH>..<HASH> 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -1053,6 +1053,7 @@ function popup_form($common, $options, $formname, $selected='', $nothing='choose
     }
 
     $output .= '</select>';
+    $output .= '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     $output .= '<noscript id="noscript'.$formname.'" style="display: inline;">';
     $output .= '<input type="submit" value="'.$go.'" /></noscript>';
     $output .= '<script type="text/javascript">'.
validate local redirection actions in jumpto.php SC#<I>