MDL-34862 question preview: improve preview ownership check.
Users should only be able to access their own quetion preview. In the past, for reasons I can no longer remember, this was enforced using the session. It is much better to set the question_usage to belong to the user's context.
This commit is contained in:
@@ -63,7 +63,7 @@ class question_usage_by_activity {
|
||||
*/
|
||||
protected $preferredbehaviour = null;
|
||||
|
||||
/** @var object the context this usage belongs to. */
|
||||
/** @var context the context this usage belongs to. */
|
||||
protected $context;
|
||||
|
||||
/** @var string plugin name of the plugin this usage belongs to. */
|
||||
@@ -104,7 +104,7 @@ class question_usage_by_activity {
|
||||
return $this->preferredbehaviour;
|
||||
}
|
||||
|
||||
/** @return object the context this usage belongs to. */
|
||||
/** @return context the context this usage belongs to. */
|
||||
public function get_owning_context() {
|
||||
return $this->context;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user