MDL-37852 repository: Prevent undesired access to repositories settings

repository/lib.php

@@ -1494,7 +1494,7 @@ abstract class repository {
         //want to display only visible instances, but for every type types. The repository::get_instances()
         //third parameter displays only visible type.
         $params = array();
-        $params['context'] = array($context, get_system_context());
+        $params['context'] = array($context);
         $params['currentcontext'] = $context;
         $params['onlyvisible'] = !$admin;
         $params['type']        = $typename;

repository/manage_instances.php

@@ -150,6 +150,13 @@ if (!empty($edit) || !empty($new)) {
         if ($instance->readonly) {
             throw new repository_exception('readonlyinstance', 'repository');
         }
+        // System instances settings should not be accessible here.
+        $repocontext = context::instance_by_id($instance->instance->contextid);
+        if ($repocontext->contextlevel == CONTEXT_SYSTEM) {
+            throw new repository_exception('nopermissiontoaccess', 'repository');
+        }
+        // Check if we can read the content of the repository, if not exception is thrown.
+        $instance->check_capability();
         $instancetype = repository::get_type_by_id($instance->options['typeid']);
         $classname = 'repository_' . $instancetype->get_typename();
         $configs  = $instance->get_instance_option_names();