diff --git a/mod/assign/overridedelete.php b/mod/assign/overridedelete.php index 69d280010ed..b96999a9be9 100644 --- a/mod/assign/overridedelete.php +++ b/mod/assign/overridedelete.php @@ -44,6 +44,16 @@ require_login($course, false, $cm); // Check the user has the required capabilities to modify an override. require_capability('mod/assign:manageoverrides', $context); +if ($override->groupid) { + if (!groups_group_visible($override->groupid, $course, $cm)) { + print_error('invalidoverrideid', 'assign'); + } +} else { + if (!groups_user_groups_visible($course, $override->userid, $cm)) { + print_error('invalidoverrideid', 'assign'); + } +} + $url = new moodle_url('/mod/assign/overridedelete.php', array('id' => $override->id)); $confirmurl = new moodle_url($url, array('id' => $override->id, 'confirm' => 1)); $cancelurl = new moodle_url('/mod/assign/overrides.php', array('cmid' => $cm->id)); diff --git a/mod/assign/overrideedit.php b/mod/assign/overrideedit.php index fd5ca49dba0..9928e8baba5 100644 --- a/mod/assign/overrideedit.php +++ b/mod/assign/overrideedit.php @@ -76,6 +76,16 @@ require_capability('mod/assign:manageoverrides', $context); if ($overrideid) { // Editing an override. $data = clone $override; + + if ($override->groupid) { + if (!groups_group_visible($override->groupid, $course, $cm)) { + print_error('invalidoverrideid', 'assign'); + } + } else { + if (!groups_user_groups_visible($course, $override->userid, $cm)) { + print_error('invalidoverrideid', 'assign'); + } + } } else { // Creating a new override. $data = new stdClass();