online user block MDL-15325 Online Users Block didn't perform capability check when displaying messaging icon, merged from 19

2009-01-08 07:40:01 +00:00
parent 4413941fee
commit 593bebe099
1 changed files with 1 additions and 0 deletions
@@ -153,6 +153,7 @@ class block_online_users extends block_base {
                    $this->content->text .= $user->fullname.'</a></div>';
                }
                if (!empty($USER->id) and ($USER->id != $user->id) and !empty($CFG->messaging) and
+                    has_capability('moodle/site:sendmessage', $context) and
                    !isguest() and $user->username != 'guest') {  // Only when logged in and messaging active etc
                    $this->content->text .= '<div class="message"><a title="'.get_string('messageselectadd').'" href="'.$CFG->wwwroot.'/message/discussion.php?id='.$user->id.'" onclick="this.target=\'message_'.$user->id.'\';return openpopup(\'/message/discussion.php?id='.$user->id.'\', \'message_'.$user->id.'\', \'menubar=0,location=0,scrollbars,status,resizable,width=400,height=500\', 0);">'
                        .'<img class="iconsmall" src="'.$CFG->pixpath.'/t/message.gif" alt="'. get_string('messageselectadd') .'" /></a></div>';