From 233d271a918d5a1ec501d5103bb5c336a4608c57 Mon Sep 17 00:00:00 2001 From: Simey Lameze Date: Wed, 9 Aug 2017 15:22:07 +0800 Subject: [PATCH] MDL-59776 core_calendar: prevent deletion of module events --- calendar/delete.php | 7 ++++--- calendar/externallib.php | 5 +++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/calendar/delete.php b/calendar/delete.php index 93c6c4d6bce..f993e21f961 100644 --- a/calendar/delete.php +++ b/calendar/delete.php @@ -58,9 +58,11 @@ if (!$course) { $PAGE->set_context(context_system::instance()); //TODO: wrong } +$title = get_string('deleteevent', 'calendar'); + // Check the user has the required capabilities to edit an event -if (!calendar_edit_event_allowed($event)) { - print_error('nopermissions'); +if (!calendar_edit_event_allowed($event) || !empty($event->modulename)) { + print_error('nopermissions', 'error', $PAGE->url, $title); } // Count the repeats, do we need to consider the possibility of deleting repeats @@ -88,7 +90,6 @@ if ($confirm) { } // Prepare the page to show the confirmation form -$title = get_string('deleteevent', 'calendar'); $strcalendar = get_string('calendar', 'calendar'); $PAGE->navbar->add($strcalendar, $viewcalendarurl); diff --git a/calendar/externallib.php b/calendar/externallib.php index bf0855be580..2aab02c55f2 100644 --- a/calendar/externallib.php +++ b/calendar/externallib.php @@ -86,8 +86,9 @@ class core_calendar_external extends external_api { $eventobj = calendar_event::load($event['eventid']); // Let's check if the user is allowed to delete an event. - if (!calendar_edit_event_allowed($eventobj)) { - throw new moodle_exception("nopermissions"); + if (!empty($eventobj->modulename) || !calendar_edit_event_allowed($eventobj)) { + throw new moodle_exception("nopermissions", 'error', '', + get_string('deleteevent', 'calendar')); } // Time to do the magic. $eventobj->delete($event['repeat']);