MDL-76862 user: ensure user can only update own preferred start page.

This commit is contained in:
Paul Holden
2023-01-12 11:35:10 +08:00
committed by Jun Pataleta
parent f516200459
commit 2dfc273752
+3 -2
View File
@@ -980,8 +980,9 @@ class core_user {
'default' => get_default_home_page(),
'choices' => $choices,
'permissioncallback' => function ($user, $preferencename) {
global $CFG;
return (!empty($CFG->defaulthomepage) && ($CFG->defaulthomepage == HOMEPAGE_USER));
global $CFG, $USER;
return $user->id == $USER->id &&
(!empty($CFG->defaulthomepage) && ($CFG->defaulthomepage == HOMEPAGE_USER));
}
];