L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

accesslib: MDL-18604 you should never be allowed to switch to a role with moodle/site:doanything.

Browse Source 
The SQL in get_assignable_roles_for_switchrole was wrong.
This commit is contained in:
tjhunt
2009-03-25 01:41:05 +00:00
parent 45f782d7c7
commit 9658298c2e
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/accesslib.php
+3 -1
View File
@@ -4262,7 +4262,9 @@ function get_assignable_roles_for_switchrole($context, $field='name', $rolenamed
{$CFG->prefix}role_capabilities rc
WHERE ra.userid = $USER->id AND ra.contextid IN ($contexts)
AND raa.roleid = ra.roleid AND r.id = raa.allowassign
AND r.id = rc.roleid AND rc.capability = 'moodle/course:view' AND rc.capability != 'moodle/site:doanything'
AND r.id = rc.roleid AND rc.capability = 'moodle/course:view'
AND NOT EXISTS (SELECT 1 FROM {$CFG->prefix}role_capabilities irc
WHERE irc.roleid = r.id AND irc.capability = 'moodle/site:doanything')
) inline_view
WHERE ro.id = inline_view.id
ORDER BY ro.sortorder ASC")) {