From 76aea854f6877cc5accb288bc6ac60bc55d30788 Mon Sep 17 00:00:00 2001
From: Simey Lameze <simey@moodle.com>
Date: Fri, 14 Nov 2014 16:11:11 +0800
Subject: [PATCH] MDL-48017 core_calendar: add context validation to
 get_calendar_events

---
 calendar/externallib.php | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/calendar/externallib.php b/calendar/externallib.php
index 902693d865a..8fdae9b759d 100644
--- a/calendar/externallib.php
+++ b/calendar/externallib.php
@@ -173,13 +173,19 @@ class core_calendar_external extends external_api {
 
         // Let us findout courses that we can return events from.
         if (!$hassystemcap) {
-            $courses = enrol_get_my_courses();
-            $courses = array_keys($courses);
             foreach ($params['events']['courseids'] as $id) {
-                if (in_array($id, $courses)) {
+               try {
+                    $context = context_course::instance($id);
+                    self::validate_context($context);
                     $funcparam['courses'][] = $id;
-                } else {
-                    $warnings[] = array('item' => $id, 'warningcode' => 'nopermissions', 'message' => 'you do not have permissions to access this course');
+                } catch (Exception $e) {
+                    $warnings[] = array(
+                        'item' => 'course',
+                        'itemid' => $id,
+                        'warningcode' => 'nopermissions',
+                        'message' => 'No access rights in course context '.$e->getMessage().$e->getTraceAsString()
+                    );
+                    continue;
                 }
             }
         } else {