From 35ca63c166c2ef21a77cb0db92f6391fe877c946 Mon Sep 17 00:00:00 2001 From: Adrian Greeve Date: Fri, 25 May 2012 11:45:08 +0800 Subject: [PATCH] MDL-33297 - forum - workshop - glossary - data - Updated the check for files to allow students to see files they recently uploaded. --- lib/filebrowser/file_browser.php | 1 + mod/data/lib.php | 13 ++++++++----- mod/forum/lib.php | 12 ++++++------ mod/glossary/lib.php | 13 ++++++++----- mod/workshop/lib.php | 11 ++++++----- 5 files changed, 29 insertions(+), 21 deletions(-) diff --git a/lib/filebrowser/file_browser.php b/lib/filebrowser/file_browser.php index 2b1a83d1d1d..f2105cb8d11 100644 --- a/lib/filebrowser/file_browser.php +++ b/lib/filebrowser/file_browser.php @@ -93,6 +93,7 @@ class file_browser { /** * Returns info about the files at System context + * @todo MDL-33372 - Provide a way of displaying recent files for blog entries. * * @param object $context context object * @param string $component component diff --git a/mod/data/lib.php b/mod/data/lib.php index c23094b11ef..3b3b2a7f5b5 100644 --- a/mod/data/lib.php +++ b/mod/data/lib.php @@ -2833,7 +2833,7 @@ function data_get_file_areas($course, $cm, $context) { * @return file_info_stored file_info_stored instance or null if not found */ function data_get_file_info($browser, $areas, $course, $cm, $context, $filearea, $itemid, $filepath, $filename) { - global $CFG, $DB; + global $CFG, $DB, $USER; if ($context->contextlevel != CONTEXT_MODULE) { return null; @@ -2843,10 +2843,6 @@ function data_get_file_info($browser, $areas, $course, $cm, $context, $filearea, return null; } - if (!has_capability('moodle/course:managefiles', $context)) { - return null; - } - if (is_null($itemid)) { require_once($CFG->dirroot.'/mod/data/locallib.php'); return new data_file_info_container($browser, $course, $cm, $context, $areas, $filearea); @@ -2895,6 +2891,13 @@ function data_get_file_info($browser, $areas, $course, $cm, $context, $filearea, if (!($storedfile = $fs->get_file($context->id, 'mod_data', $filearea, $itemid, $filepath, $filename))) { return null; } + + // Checks to see if the user can manage files or is the owner. + // TODO MDL-33805 - Do not use userid here and move the capability check above. + if (!has_capability('moodle/course:managefiles', $context) && $storedfile->get_userid() != $USER->id) { + return null; + } + $urlbase = $CFG->wwwroot.'/pluginfile.php'; return new file_info_stored($browser, $context, $storedfile, $urlbase, $itemid, true, true, false, false); diff --git a/mod/forum/lib.php b/mod/forum/lib.php index 0bb2bfc6302..1f704993a51 100644 --- a/mod/forum/lib.php +++ b/mod/forum/lib.php @@ -4068,7 +4068,7 @@ function forum_get_file_areas($course, $cm, $context) { * @return file_info instance or null if not found */ function forum_get_file_info($browser, $areas, $course, $cm, $context, $filearea, $itemid, $filepath, $filename) { - global $CFG, $DB; + global $CFG, $DB, $USER; if ($context->contextlevel != CONTEXT_MODULE) { return null; @@ -4079,11 +4079,6 @@ function forum_get_file_info($browser, $areas, $course, $cm, $context, $filearea return null; } - // this is enforced by {@link file_info_context_course} currently - if (!has_capability('moodle/course:managefiles', $context)) { - return null; - } - // Note that forum_user_can_see_post() additionally allows access for parent roles // and it explicitly checks qanda forum type, too. One day, when we stop requiring // course:managefiles, we will need to extend this. @@ -4115,6 +4110,11 @@ function forum_get_file_info($browser, $areas, $course, $cm, $context, $filearea return null; } + // Checks to see if the user can manage files or is the owner. + // TODO MDL-33805 - Do not use userid here and move the capability check above. + if (!has_capability('moodle/course:managefiles', $context) && $storedfile->get_userid() != $USER->id) { + return null; + } // Make sure groups allow this user to see this file if ($discussion->groupid > 0) { $groupmode = groups_get_activity_groupmode($cm, $course); diff --git a/mod/glossary/lib.php b/mod/glossary/lib.php index 0a05ec70ade..251df99c0be 100644 --- a/mod/glossary/lib.php +++ b/mod/glossary/lib.php @@ -1621,7 +1621,7 @@ function glossary_get_file_areas($course, $cm, $context) { * @return file_info_stored file_info_stored instance or null if not found */ function glossary_get_file_info($browser, $areas, $course, $cm, $context, $filearea, $itemid, $filepath, $filename) { - global $CFG, $DB; + global $CFG, $DB, $USER; if ($context->contextlevel != CONTEXT_MODULE) { return null; @@ -1631,10 +1631,6 @@ function glossary_get_file_info($browser, $areas, $course, $cm, $context, $filea return null; } - if (!has_capability('moodle/course:managefiles', $context)) { - return null; - } - if (is_null($itemid)) { require_once($CFG->dirroot.'/mod/glossary/locallib.php'); return new glossary_file_info_container($browser, $course, $cm, $context, $areas, $filearea); @@ -1670,6 +1666,13 @@ function glossary_get_file_info($browser, $areas, $course, $cm, $context, $filea if (!($storedfile = $fs->get_file($filecontext->id, 'mod_glossary', $filearea, $itemid, $filepath, $filename))) { return null; } + + // Checks to see if the user can manage files or is the owner. + // TODO MDL-33805 - Do not use userid here and move the capability check above. + if (!has_capability('moodle/course:managefiles', $context) && $storedfile->get_userid() != $USER->id) { + return null; + } + $urlbase = $CFG->wwwroot.'/pluginfile.php'; return new file_info_stored($browser, $filecontext, $storedfile, $urlbase, s($entry->concept), true, true, false, false); diff --git a/mod/workshop/lib.php b/mod/workshop/lib.php index 97e91f5d21a..1508b5ba551 100644 --- a/mod/workshop/lib.php +++ b/mod/workshop/lib.php @@ -1310,11 +1310,6 @@ function workshop_get_file_info($browser, $areas, $course, $cm, $context, $filea /** @var array internal cache for author names */ static $submissionauthors = array(); - // this is enforced by {@link file_info_context_course} currently - if (!has_capability('moodle/course:managefiles', $context)) { - return null; - } - $fs = get_file_storage(); if ($filearea === 'submission_content' or $filearea === 'submission_attachment') { @@ -1363,6 +1358,12 @@ function workshop_get_file_info($browser, $areas, $course, $cm, $context, $filea } } + // Checks to see if the user can manage files or is the owner. + // TODO MDL-33805 - Do not use userid here and move the capability check above. + if (!has_capability('moodle/course:managefiles', $context) && $storedfile->get_userid() != $USER->id) { + return null; + } + // let us display the author's name instead of itemid (submission id) if (isset($submissionauthors[$itemid])) {