MDL-49994 files: Prevent to browse private files when are disabled

2015-05-06 10:27:40 +08:00
parent 80eb5bc7b7
commit 350397da93
1 changed files with 1 additions and 0 deletions
@@ -321,6 +321,7 @@ class core_files_external extends external_api {
        $context = self::get_context_from_params($fileinfo);
        self::validate_context($context);
        if (($fileinfo['component'] == 'user' and $fileinfo['filearea'] == 'private')) {
+            require_capability('moodle/user:manageownfiles', $context);
            debugging('Uploading directly to user private files area is deprecated. Upload to a draft area and then move the files with core_user::add_user_private_files');
        }