From 5c45ea0c6bf2fdf4dddfaef9fc5ff12e6b426a3f Mon Sep 17 00:00:00 2001
From: Andrew Davis <andrew@moodle.com>
Date: Mon, 3 Mar 2014 12:15:54 +0800
Subject: [PATCH] MDL-44082 mod_chat: added a security check for users already
 in the chat activity

---
 mod/chat/chat_ajax.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mod/chat/chat_ajax.php b/mod/chat/chat_ajax.php
index 7f56c05422f..85dc3d3502b 100644
--- a/mod/chat/chat_ajax.php
+++ b/mod/chat/chat_ajax.php
@@ -52,6 +52,11 @@ if (!isloggedin()) {
 $PAGE->set_cm($cm, $course, $chat);
 $PAGE->set_url('/mod/chat/chat_ajax.php', array('chat_sid'=>$chat_sid));
 
+require_login($course, false, $cm);
+
+$context = context_module::instance($cm->id);
+require_capability('mod/chat:chat', $context);
+
 ob_start();
 header('Expires: Sun, 28 Dec 1997 09:32:45 GMT');
 header('Last-Modified: '.gmdate('D, d M Y H:i:s').' GMT');