From 56b431c2f63d2ede2d5bb951bb032e03ae5ad5e7 Mon Sep 17 00:00:00 2001 From: Paul Holden Date: Fri, 1 May 2020 09:00:41 +0100 Subject: [PATCH] MDL-68084 blocks: check capability before getting content. Some blocks (e.g. Calendar) load additional JS modules when returning content. We need to make sure they aren't asked to generate content unless the user can actually view the block, or the expected content required by the JS will not exist in the DOM and can cause exceptions. --- blocks/moodleblock.class.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/blocks/moodleblock.class.php b/blocks/moodleblock.class.php index dd45eeda343..873434b9b37 100644 --- a/blocks/moodleblock.class.php +++ b/blocks/moodleblock.class.php @@ -221,6 +221,11 @@ class block_base { public function get_content_for_output($output) { global $CFG; + // We can exit early if the current user doesn't have the capability to view the block. + if (!has_capability('moodle/block:view', $this->context)) { + return null; + } + $bc = new block_contents($this->html_attributes()); $bc->attributes['data-block'] = $this->name(); $bc->blockinstanceid = $this->instance->id;