From 8e34d8e85b971a01459797799c0696cfeaae9cc0 Mon Sep 17 00:00:00 2001
From: John Okely <john@moodle.com>
Date: Wed, 29 Oct 2014 10:50:25 +0800
Subject: [PATCH] MDL-47921 mod_lti: Add access control to mod/lti/launch.php

---
 mod/lti/launch.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mod/lti/launch.php b/mod/lti/launch.php
index fced3b41170..9ac6343a4ec 100644
--- a/mod/lti/launch.php
+++ b/mod/lti/launch.php
@@ -57,7 +57,10 @@ $cm = get_coursemodule_from_id('lti', $id, 0, false, MUST_EXIST);
 $lti = $DB->get_record('lti', array('id' => $cm->instance), '*', MUST_EXIST);
 $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
 
-require_login($course);
+$context = context_module::instance($cm->id);
+
+require_login($course, true, $cm);
+require_capability('mod/lti:view', $context);
 
 add_to_log($course->id, "lti", "launch", "launch.php?id=$cm->id", "$lti->id");