MDL-37411 Notes: unset courseid and userid when updating the note to prevent accidental changes. Thank you Sam Hemelryk for suggesting an alternative solution.

2013-03-06 09:35:42 +13:00
parent 88906d068d
commit 6a9235c998
1 changed files with 6 additions and 0 deletions
@@ -70,6 +70,12 @@ if ($noteform->is_cancelled()) {

 /// if data was submitted and validated, then save it to database
 if ($note = $noteform->get_data()){
+    if ($noteid) {
+        // A noteid has been used, we don't allow editing of course or user so
+        // lets unset them to be sure we never change that by accident.
+        unset($note->courseid);
+        unset($note->userid);
+    }
    note_save($note);
    // redirect to notes list that contains this note
    redirect($CFG->wwwroot . '/notes/index.php?course=' . $note->courseid . '&amp;user=' . $note->userid);