MDL-32155 blocks: User can't access file, if block is hidden or doesn't have block:view capability

2012-05-23 13:14:02 +08:00
parent 2ddb941b0a
commit 38d13c23f1
1 changed files with 6 additions and 0 deletions
@@ -732,6 +732,12 @@ if ($component === 'blog') {
            // somebody tries to gain illegal access, cm type must match the component!
            send_file_not_found();
        }
+
+        $bprecord = $DB->get_record('block_positions', array('blockinstanceid' => $context->instanceid), 'visible');
+        // User can't access file, if block is hidden or doesn't have block:view capability
+        if (($bprecord && !$bprecord->visible) || !has_capability('moodle/block:view', $context)) {
+                send_file_not_found();
+        }
    } else {
        $birecord = null;
    }