From 1e54b2a86bb7cb056c1dc4e011a2f2fb68eb24f2 Mon Sep 17 00:00:00 2001 From: Stefan Hanauska Date: Mon, 3 Nov 2025 06:56:07 +0100 Subject: [PATCH] MDL-86960 mod_forum: Check user --- mod/forum/lib.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mod/forum/lib.php b/mod/forum/lib.php index da61386c237..d06d82ed7aa 100644 --- a/mod/forum/lib.php +++ b/mod/forum/lib.php @@ -2300,6 +2300,12 @@ function mod_forum_rating_can_see_item_ratings($params) { $forum = $DB->get_record('forum', array('id' => $discussion->forum), '*', MUST_EXIST); $course = $DB->get_record('course', array('id' => $forum->course), '*', MUST_EXIST); $cm = get_coursemodule_from_instance('forum', $forum->id, $course->id , false, MUST_EXIST); + $context = context_module::instance($cm->id); + $ratingpermissions = forum_rating_permissions($context->id, 'mod_forum', 'post'); + $requiredpermission = ($post->userid != $USER->id) ? 'viewall' : 'view'; + if (!$ratingpermissions[$requiredpermission]) { + return false; + } // Perform some final capability checks. if (!forum_user_can_see_post($forum, $discussion, $post, $USER, $cm)) {