L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-58259 mod_forum: Check create attachment cap in forum_add_attachment

Browse Source 
We should add the permission check there because this function is used
indirectly by the external API that is not checking for this capability.
This commit is contained in:
Juan Leyva
2017-05-05 10:28:11 +08:00
committed by Jun Pataleta
parent fbc15bb977
commit 609a10739d
1 changed files with 42 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/forum/externallib.php
+42 -32
View File
@@ -780,12 +780,30 @@ class mod_forum_external extends external_api {
require_once($CFG->dirroot . "/mod/forum/lib.php");
$params = self::validate_parameters(self::add_discussion_post_parameters(),
array(
'postid' => $postid,
'subject' => $subject,
'message' => $message,
'options' => $options
));
array(
'postid' => $postid,
'subject' => $subject,
'message' => $message,
'options' => $options
)
);
$warnings = array();
if (!$parent = forum_get_post_full($params['postid'])) {
throw new moodle_exception('invalidparentpostid', 'forum');
}
if (!$discussion = $DB->get_record("forum_discussions", array("id" => $parent->discussion))) {
throw new moodle_exception('notpartofdiscussion', 'forum');
}
// Request and permission validation.
$forum = $DB->get_record('forum', array('id' => $discussion->forum), '*', MUST_EXIST);
list($course, $cm) = get_course_and_cm_from_instance($forum, 'forum');
$context = context_module::instance($cm->id);
self::validate_context($context);
// Validate options.
$options = array(
'discussionsubscribe' => true,
@@ -803,6 +821,10 @@ class mod_forum_external extends external_api {
break;
case 'attachmentsid':
$value = clean_param($option['value'], PARAM_INT);
// Ensure that the user has permissions to create attachments.
if (!has_capability('mod/forum:createattachment', $context)) {
$value = 0;
}
break;
default:
throw new moodle_exception('errorinvalidparam', 'webservice', '', $name);
@@ -810,23 +832,6 @@ class mod_forum_external extends external_api {
$options[$name] = $value;
}
$warnings = array();
if (!$parent = forum_get_post_full($params['postid'])) {
throw new moodle_exception('invalidparentpostid', 'forum');
}
if (!$discussion = $DB->get_record("forum_discussions", array("id" => $parent->discussion))) {
throw new moodle_exception('notpartofdiscussion', 'forum');
}
// Request and permission validation.
$forum = $DB->get_record('forum', array('id' => $discussion->forum), '*', MUST_EXIST);
list($course, $cm) = get_course_and_cm_from_instance($forum, 'forum');
$context = context_module::instance($cm->id);
self::validate_context($context);
if (!forum_user_can_post($forum, $discussion, $USER, $cm, $course, $context)) {
throw new moodle_exception('nopostforum', 'forum');
}
@@ -955,6 +960,16 @@ class mod_forum_external extends external_api {
'groupid' => $groupid,
'options' => $options
));
$warnings = array();
// Request and permission validation.
$forum = $DB->get_record('forum', array('id' => $params['forumid']), '*', MUST_EXIST);
list($course, $cm) = get_course_and_cm_from_instance($forum, 'forum');
$context = context_module::instance($cm->id);
self::validate_context($context);
// Validate options.
$options = array(
'discussionsubscribe' => true,
@@ -976,6 +991,10 @@ class mod_forum_external extends external_api {
break;
case 'attachmentsid':
$value = clean_param($option['value'], PARAM_INT);
// Ensure that the user has permissions to create attachments.
if (!has_capability('mod/forum:createattachment', $context)) {
$value = 0;
}
break;
default:
throw new moodle_exception('errorinvalidparam', 'webservice', '', $name);
@@ -983,15 +1002,6 @@ class mod_forum_external extends external_api {
$options[$name] = $value;
}
$warnings = array();
// Request and permission validation.
$forum = $DB->get_record('forum', array('id' => $params['forumid']), '*', MUST_EXIST);
list($course, $cm) = get_course_and_cm_from_instance($forum, 'forum');
$context = context_module::instance($cm->id);
self::validate_context($context);
// Normalize group.
if (!groups_get_activity_groupmode($cm)) {
// Groups not supported, force to -1.