From 8164c8f419ddc7606bdfadcbdbb7e6e4372ba57b Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Fri, 21 Jul 2023 17:06:34 +0100
Subject: [PATCH] MDL-78792 message: access checks in processor fragment
 callback.

---
 message/lib.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/message/lib.php b/message/lib.php
index b3cb81d7785..2344265be28 100644
--- a/message/lib.php
+++ b/message/lib.php
@@ -685,6 +685,10 @@ function message_output_fragment_processor_settings($args = []) {
     $userid = $args['userid'];
 
     $user = core_user::get_user($userid, '*', MUST_EXIST);
+    if (!core_message_can_edit_message_profile($user)) {
+        throw new moodle_exception('Cannot edit message profile');
+    }
+
     $processor = get_message_processor($type);
     $providers = message_get_providers_for_user($userid);
     $processorwrapper = new stdClass();