MDL-11979 Forum subscriptions loop hole allowing users to subscribe to forums they should not have access to.

2007-11-16 16:23:42 +00:00
parent fc4a2fffc6
commit 2bb2aa4dbb
1 changed files with 3 additions and 0 deletions
@@ -94,6 +94,9 @@
                    !has_capability('mod/forum:managesubscriptions', $context)) {
            error(get_string('disallowsubscribe'),$_SERVER["HTTP_REFERER"]);
        }
+        if (!has_capability('mod/forum:viewdiscussion', $context)) {
+            error("Could not subscribe you to that forum", $_SERVER["HTTP_REFERER"]);
+        }
        if (forum_subscribe($user->id, $forum->id) ) {
            add_to_log($course->id, "forum", "subscribe", "view.php?f=$forum->id", $forum->id, $cm->id);
            redirect($returnto, get_string("nowsubscribed", "forum", $info), 1);