MDL-28350 prevent bogus role assignment via externallib

2011-07-15 12:30:20 +02:00
parent c015236f00
commit 4b9cb37191
1 changed files with 12 additions and 0 deletions
@@ -175,6 +175,12 @@ class moodle_enrol_external extends external_api {
            self::validate_context($context);
            require_capability('moodle/role:assign', $context);

+            // throw an exception if user is not able to assign the role in this context
+            $roles = get_assignable_roles($context, ROLENAME_SHORT);
+            if (!key_exists($assignment['roleid'], $roles)) {
+                throw new invalid_parameter_exception('Can not assign roleid='.$assignment['roleid'].' in contextid='.$assignment['contextid']);
+            }
+
            role_assign($assignment['roleid'], $assignment['userid'], $assignment['contextid']);
        }

@@ -231,6 +237,12 @@ class moodle_enrol_external extends external_api {
            self::validate_context($context);
            require_capability('moodle/role:assign', $context);

+            // throw an exception if user is not able to unassign the role in this context
+            $roles = get_assignable_roles($context, ROLENAME_SHORT);
+            if (!key_exists($unassignment['roleid'], $roles)) {
+                throw new invalid_parameter_exception('Can not unassign roleid='.$unassignment['roleid'].' in contextid='.$unassignment['contextid']);
+            }
+
            role_unassign($unassignment['roleid'], $unassignment['userid'], $unassignment['contextid']);
        }