L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FIxes so that no-one can "login as" users who have "doanything". MDL-8411

Browse Source
This commit is contained in:
moodler
2007-02-13 08:30:25 +00:00
parent 593d5992c0
commit 08f4e03f53
4 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/weblib.php
+2 -1
View File
@@ -3178,7 +3178,8 @@ has_capability('moodle/course:viewhiddenuserfields', $context)) {
if (has_capability('moodle/role:assign', $context, NULL)) { // Includes admins
$output .= '<a href="'. $CFG->wwwroot .'/course/unenrol.php?id='. $course->id .'&amp;user='. $user->id .'">'. $string->unenrol .'</a><br />';
}
if ($USER->id != $user->id && has_capability('moodle/user:loginas', $context)) {
if ($USER->id != $user->id && has_capability('moodle/user:loginas', $context) &&
! has_capability('moodle/site:doanything', $context, $user->id, false)) {
$output .= '<a href="'. $CFG->wwwroot .'/course/loginas.php?id='. $course->id .'&amp;user='. $user->id .'">'. $string->loginas .'</a><br />';
}
$output .= '<a href="'. $CFG->wwwroot .'/user/view.php?id='. $user->id .'&amp;course='. $course->id .'">'. $string->fullprofile .'...</a>';