From 263f78b8b804fe7dbcd6ffadcadad2c94a0093f7 Mon Sep 17 00:00:00 2001
From: John Okely <john@moodle.com>
Date: Wed, 29 Oct 2014 10:50:25 +0800
Subject: [PATCH] MDL-47921 mod_lti: Add access control to mod/lti/launch.php

---
 mod/lti/launch.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mod/lti/launch.php b/mod/lti/launch.php
index 67e88ab1382..015329a7f25 100644
--- a/mod/lti/launch.php
+++ b/mod/lti/launch.php
@@ -56,7 +56,10 @@ $cm = get_coursemodule_from_id('lti', $id, 0, false, MUST_EXIST);
 $lti = $DB->get_record('lti', array('id' => $cm->instance), '*', MUST_EXIST);
 $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
 
-require_login($course);
+$context = context_module::instance($cm->id);
+
+require_login($course, true, $cm);
+require_capability('mod/lti:view', $context);
 
 $lti->cmid = $cm->id;
 lti_view($lti);