From 043b38d5809e95a5d16737bd562bdb57890bdd99 Mon Sep 17 00:00:00 2001
From: Damyon Wiese <damyon@moodle.com>
Date: Fri, 17 May 2019 11:26:29 +0800
Subject: [PATCH] MDL-64623 glossary: Check the entry id

The entry must match the glossary before you can do any action on it.
---
 mod/glossary/deleteentry.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mod/glossary/deleteentry.php b/mod/glossary/deleteentry.php
index 8cacbb373eb..624130da916 100644
--- a/mod/glossary/deleteentry.php
+++ b/mod/glossary/deleteentry.php
@@ -39,6 +39,11 @@ if (! $entry = $DB->get_record("glossary_entries", array("id"=>$entry))) {
     print_error('invalidentry');
 }
 
+// Permission checks are based on the course module instance so make sure it is correct.
+if ($cm->instance != $entry->glossaryid) {
+    print_error('invalidentry');
+}
+
 require_login($course, false, $cm);
 $context = context_module::instance($cm->id);
 $manageentries = has_capability('mod/glossary:manageentries', $context);