From 3d34aa5c29d915cd599c68b0eadc5328022ce7a2 Mon Sep 17 00:00:00 2001 From: Sara Arjona Date: Thu, 3 May 2018 13:52:39 +0200 Subject: [PATCH] MDL-62062 tool_policy: Avoid access to consent page after agreeding Once the policies have been accepted, only users with permission to revoke them will be able to access again to the user consent page. --- admin/tool/policy/classes/output/page_agreedocs.php | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/admin/tool/policy/classes/output/page_agreedocs.php b/admin/tool/policy/classes/output/page_agreedocs.php index 278e97ba91c..6fb53308ada 100644 --- a/admin/tool/policy/classes/output/page_agreedocs.php +++ b/admin/tool/policy/classes/output/page_agreedocs.php @@ -237,13 +237,13 @@ class page_agreedocs implements renderable, templatable { * Redirect to $SESSION->wantsurl if defined or to $CFG->wwwroot if not. */ protected function redirect_to_previous_url() { - global $SESSION, $CFG; + global $SESSION; if (!empty($SESSION->wantsurl)) { $returnurl = $SESSION->wantsurl; unset($SESSION->wantsurl); } else { - $returnurl = $CFG->wwwroot.'/'; + $returnurl = (new moodle_url('/admin/tool/policy/user.php'))->out(); } redirect($returnurl); @@ -278,7 +278,9 @@ class page_agreedocs implements renderable, templatable { // and $SESSION->wantsurl is defined, redirect to the return page. $hasagreedsignupuser = empty($USER->id) && $this->signupuserpolicyagreed; $hasagreedloggeduser = $USER->id == $userid && !empty($USER->policyagreed); - if (!is_siteadmin() && ($hasagreedsignupuser || ($hasagreedloggeduser && !empty($SESSION->wantsurl)))) { + $canrevoke = api::can_revoke_policies($USER->id); + if (!is_siteadmin() && ($hasagreedsignupuser || + ($hasagreedloggeduser && !$canrevoke))) { $this->redirect_to_previous_url(); }