L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-30787 fix use of module and section edit capabilities

Browse Source
This commit is contained in:
Petr Skoda
2011-12-18 13:55:31 +01:00
parent acb3bf8ac1
commit 4d199d6b33
9 changed files with 173 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
course/mod.php
+51 -61
View File
@@ -26,8 +26,6 @@
require("../config.php");
require_once("lib.php");
require_login();
$sectionreturn = optional_param('sr', '', PARAM_INT);
$add = optional_param('add', '', PARAM_ALPHA);
$type = optional_param('type', '', PARAM_ALPHA);
@@ -66,6 +64,8 @@ if ($groupmode !== '') {
}
$PAGE->set_url($url);
require_login();
//check if we are adding / editing a module that has new forms using formslib
if (!empty($add)) {
$id = required_param('id', PARAM_INT);
@@ -76,9 +76,7 @@ if (!empty($add)) {
redirect("$CFG->wwwroot/course/modedit.php?add=$add&type=$type&course=$id&section=$section&return=$returntomod");
} else if (!empty($update)) {
if (!$cm = get_coursemodule_from_id('', $update, 0, true)) {
print_error('invalidcoursemodule');
}
$cm = get_coursemodule_from_id('', $update, 0, true, MUST_EXIST);
$returntomod = optional_param('return', 0, PARAM_BOOL);
redirect("$CFG->wwwroot/course/modedit.php?update=$update&return=$returntomod");
@@ -86,7 +84,7 @@ if (!empty($add)) {
$cm = get_coursemodule_from_id('', $duplicate, 0, true, MUST_EXIST);
$course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
require_login($course->id);
require_login($course, false, $cm);
$coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
$modcontext = get_context_instance(CONTEXT_MODULE, $cm->id);
require_capability('moodle/course:manageactivities', $coursecontext);
@@ -119,17 +117,13 @@ if (!empty($add)) {
}
} else if (!empty($delete)) {
if (!$cm = get_coursemodule_from_id('', $delete, 0, true)) {
print_error('invalidcoursemodule');
}
$cm = get_coursemodule_from_id('', $delete, 0, true, MUST_EXIST);
$course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
if (!$course = $DB->get_record('course', array('id'=>$cm->course))) {
print_error('invalidcourseid');
}
require_login($course->id); // needed to setup proper $COURSE
$context = get_context_instance(CONTEXT_COURSE, $course->id);
require_login($course, false, $cm);
$coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
$modcontext = get_context_instance(CONTEXT_MODULE, $cm->id);
require_capability('moodle/course:manageactivities', $context);
require_capability('moodle/course:manageactivities', $modcontext);
$return = "$CFG->wwwroot/course/view.php?id=$cm->course#section-$cm->sectionnum";
@@ -203,9 +197,13 @@ if (!empty($add)) {
if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) {
if (!$cm = get_coursemodule_from_id('', $USER->activitycopy, 0, true)) {
print_error('invalidcoursemodule');
}
$cm = get_coursemodule_from_id('', $USER->activitycopy, 0, true, MUST_EXIST);
$course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
require_login($course, false, $cm);
$coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
$modcontext = get_context_instance(CONTEXT_MODULE, $cm->id);
require_capability('moodle/course:manageactivities', $modcontext);
if (!empty($movetosection)) {
if (!$section = $DB->get_record('course_sections', array('id'=>$movetosection, 'course'=>$cm->course))) {
@@ -222,10 +220,6 @@ if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) {
}
}
require_login($section->course); // needed to setup proper $COURSE
$context = get_context_instance(CONTEXT_COURSE, $section->course);
require_capability('moodle/course:manageactivities', $context);
if (!ismoving($section->course)) {
print_error('needcopy', '', "view.php?id=$section->course");
}
@@ -246,13 +240,14 @@ if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) {
} else if (!empty($indent) and confirm_sesskey()) {
$id = required_param('id', PARAM_INT);
if (!$cm = get_coursemodule_from_id('', $id, 0, true)) {
print_error('invalidcoursemodule');
}
require_login($cm->course); // needed to setup proper $COURSE
$context = get_context_instance(CONTEXT_COURSE, $cm->course);
require_capability('moodle/course:manageactivities', $context);
$cm = get_coursemodule_from_id('', $id, 0, true, MUST_EXIST);
$course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
require_login($course, false, $cm);
$coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
$modcontext = get_context_instance(CONTEXT_MODULE, $cm->id);
require_capability('moodle/course:manageactivities', $modcontext);
$cm->indent += $indent;
@@ -271,13 +266,13 @@ if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) {
}
} else if (!empty($hide) and confirm_sesskey()) {
if (!$cm = get_coursemodule_from_id('', $hide, 0, true)) {
print_error('invalidcoursemodule');
}
$cm = get_coursemodule_from_id('', $hide, 0, true, MUST_EXIST);
$course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
require_login($cm->course); // needed to setup proper $COURSE
$context = get_context_instance(CONTEXT_MODULE, $cm->id);
require_capability('moodle/course:activityvisibility', $context);
require_login($course, false, $cm);
$coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
$modcontext = get_context_instance(CONTEXT_MODULE, $cm->id);
require_capability('moodle/course:activityvisibility', $modcontext);
set_coursemodule_visible($cm->id, 0);
@@ -290,21 +285,17 @@ if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) {
}
} else if (!empty($show) and confirm_sesskey()) {
if (!$cm = get_coursemodule_from_id('', $show, 0, true)) {
print_error('invalidcoursemodule');
}
$cm = get_coursemodule_from_id('', $show, 0, true, MUST_EXIST);
$course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
require_login($cm->course); // needed to setup proper $COURSE
$context = get_context_instance(CONTEXT_COURSE, $cm->course);
require_capability('moodle/course:activityvisibility', $context);
require_login($course, false, $cm);
$coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
$modcontext = get_context_instance(CONTEXT_MODULE, $cm->id);
require_capability('moodle/course:activityvisibility', $modcontext);
if (!$section = $DB->get_record('course_sections', array('id'=>$cm->section))) {
print_error('sectionnotexist');
}
$section = $DB->get_record('course_sections', array('id'=>$cm->section), '*', MUST_EXIST);
if (!$module = $DB->get_record('modules', array('id'=>$cm->module))) {
print_error('moduledoesnotexist');
}
$module = $DB->get_record('modules', array('id'=>$cm->module), '*', MUST_EXIST);
if ($module->visible and ($section->visible or (SITEID == $cm->course))) {
set_coursemodule_visible($cm->id, 1);
@@ -319,13 +310,14 @@ if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) {
} else if ($groupmode > -1 and confirm_sesskey()) {
$id = required_param('id', PARAM_INT);
if (!$cm = get_coursemodule_from_id('', $id, 0, true)) {
print_error('invalidcoursemodule');
}
require_login($cm->course); // needed to setup proper $COURSE
$context = get_context_instance(CONTEXT_MODULE, $cm->id);
require_capability('moodle/course:manageactivities', $context);
$cm = get_coursemodule_from_id('', $id, 0, true, MUST_EXIST);
$course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
require_login($course, false, $cm);
$coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
$modcontext = get_context_instance(CONTEXT_MODULE, $cm->id);
require_capability('moodle/course:manageactivities', $modcontext);
set_coursemodule_groupmode($cm->id, $groupmode);
@@ -338,17 +330,15 @@ if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) {
}
} else if (!empty($copy) and confirm_sesskey()) { // value = course module
if (!$cm = get_coursemodule_from_id('', $copy, 0, true)) {
print_error('invalidcoursemodule');
}
$cm = get_coursemodule_from_id('', $copy, 0, true, MUST_EXIST);
$course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
require_login($cm->course); // needed to setup proper $COURSE
$context = get_context_instance(CONTEXT_COURSE, $cm->course);
require_capability('moodle/course:manageactivities', $context);
require_login($course, false, $cm);
$coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
$modcontext = get_context_instance(CONTEXT_MODULE, $cm->id);
require_capability('moodle/course:manageactivities', $modcontext);
if (!$section = $DB->get_record('course_sections', array('id'=>$cm->section))) {
print_error('sectionnotexist');
}
$section = $DB->get_record('course_sections', array('id'=>$cm->section), '*', MUST_EXIST);
$USER->activitycopy = $copy;
$USER->activitycopycourse = $cm->course;