General developer forum

Dear Lasse,
The Sesskey() security feature has been around since 1.4.3. It seems that the attendance module has not been updated to that standard. Do not fear. It is pretty easy to update modules to the post 1.4.3 standard.

You have to pass a variable called sesskey() as a hidden variable in all html forms. Sesskey is a unique random number generated on the fly so that the server can tell that the person that is sending in data to the form is the person that is browsed to the form page and not some hacker who is just trying to inject nasty scripts into the form. Or something like that.  

To make an as yet unreleased module jive with sesskey, I added the following into a list of hidden variables that it had.

<INPUT type="hidden" name=sesskey       value="<?php  p($USER->sesskey) ?>">

So at a guess (and don't do this if you do not like guessing) have a look at the page that makes new attendance activities, see if there are any hidden variables, and try adding the above in the immediate vicinity.

If not, get in touch with the module developer and ask them to integrate this security feature.

Timothy