L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-71978 core_calendar: only allow owner to edit user subscriptions

Browse Source
This commit is contained in:
Dongsheng Cai
2021-07-08 23:33:31 +02:00
committed by Eloy Lafuente (stronk7)
parent 2a26fa5c33
commit 1e199ea63d
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
calendar/lib.php
+2 -1
View File
@@ -3205,6 +3205,7 @@ function calendar_update_subscription($subscription) {
* @return bool true if current user can edit the subscription else false
*/
function calendar_can_edit_subscription($subscriptionorid) {
global $USER;
if (is_array($subscriptionorid)) {
$subscription = (object)$subscriptionorid;
} else if (is_object($subscriptionorid)) {
@@ -3225,7 +3226,7 @@ function calendar_can_edit_subscription($subscriptionorid) {
calendar_get_allowed_types($allowed, $courseid, null, $category);
switch ($subscription->eventtype) {
case 'user':
return $allowed->user;
return ($USER->id == $subscription->userid && $allowed->user);
case 'course':
if (isset($allowed->courses[$courseid])) {
return $allowed->courses[$courseid];