SC 289, small, but non-exploitable hole in backup permissions checking.

2006-08-13 20:25:46 +00:00
parent 6c05439a08
commit 915db857b8
1 changed files with 8 additions and 8 deletions
@@ -17,13 +17,7 @@

    if (!empty($id)) {
        if (!isteacheredit($id)) {
-            if (empty($to)) {
-                error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
-            } else {
-                if (!isteacheredit($to)) {
-                    error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
-                }
-            }
+            error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
        }
    } else {
        if (!isadmin()) {
@@ -31,6 +25,12 @@
        }
    }

+    if (!empty($to)) {
+        if (!isteacheredit($to)) {
+            error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
+        }
+    }
+
    //Check site
    if (!$site = get_site()) {
        error("Site not found!");
@@ -128,7 +128,7 @@
    }
    print_simple_box_end();

-    //Print footer  
+    //Print footer
    print_footer();

 ?>