From 4dfef5e9efac2a372df752e3e345c5c83b55895c Mon Sep 17 00:00:00 2001
From: Juan Leyva <juanleyvadelgado@gmail.com>
Date: Wed, 1 Apr 2015 10:56:16 +0200
Subject: [PATCH] MDL-49453 webservices: Validate section number (exists and
 visibility)

---
 course/externallib.php | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/course/externallib.php b/course/externallib.php
index 8dc73284313..4f47c13f6b1 100644
--- a/course/externallib.php
+++ b/course/externallib.php
@@ -2087,6 +2087,18 @@ class core_course_external extends external_api {
         $context = context_course::instance($course->id);
         self::validate_context($context);
 
+        if (!empty($params['sectionnumber'])) {
+
+            // Get section details and check it exists.
+            $modinfo = get_fast_modinfo($course);
+            $coursesection = $modinfo->get_section_info($params['sectionnumber'], MUST_EXIST);
+
+            // Check user is allowed to see it.
+            if (!$coursesection->uservisible) {
+                require_capability('moodle/course:viewhiddensections', $context);
+            }
+        }
+
         course_view($context, $params['sectionnumber']);
 
         $result = array();