From 96bf2d385fb503b72d317bcb22057a858faf2d04 Mon Sep 17 00:00:00 2001
From: mjollnir_ <mjollnir_>
Date: Thu, 20 Oct 2005 00:19:24 +0000
Subject: [PATCH] Fixing bug 4199: import course data should only allow you to
 import from a course that you're already a teacher in, unless you're at least
 a creator

---
 course/import.php | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/course/import.php b/course/import.php
index fa43072d047..d6d0e21b5ce 100644
--- a/course/import.php
+++ b/course/import.php
@@ -24,7 +24,15 @@ optional_variable($filename,0);
         error("You need to be a teacher or an admin to use this page");
     }
 
+    // if we're not a course creator , we can only import from our own courses.
+    if (iscreator()) {
+        $creator = true;
+    }
+
     if ($from = get_record("course","id",$fromcourse)) {
+        if (!isteacheredit($fromcourse)) {
+            error("You need to be a course creator, or a teacher in the course you are importing data from, as well");
+        }
         if (!empty($filename) && file_exists($CFG->dataroot.'/'.$filename) && !empty($SESSION->import_preferences)) {
             $restore = backup_to_restore_array($SESSION->import_preferences);
             $restore->restoreto = 1;
@@ -44,7 +52,9 @@ optional_variable($filename,0);
     print_header("$course->fullname: $strimport", "$course->fullname: $strimport", "$course->shortname");
 
     $taught_courses = get_my_courses($USER->id,"visible DESC,sortorder ASC",0,1);
-    $cat_courses = get_courses($course->category);
+    if (!empty($creator)) {
+        $cat_courses = get_courses($course->category);
+    }
     print_heading(get_string("importdatafrom"));
 
     $options = array();
@@ -78,11 +88,14 @@ optional_variable($filename,0);
                                choose_from_menu($options,"fromcourse","","choose","","0",true),
                                $submit);
     }
-    $table->data[] = array($fm.'<b>'.get_string('searchcourses').'</b>',
-                           '<input type="text" name="fromcoursesearch" />',
-                           '<input type="submit" value="'.get_string('searchcourses').'" />');
 
-    if (!empty($fromcoursesearch)) {
+    if (!empty($creator)) {
+        $table->data[] = array($fm.'<b>'.get_string('searchcourses').'</b>',
+                               '<input type="text" name="fromcoursesearch" />',
+                               '<input type="submit" value="'.get_string('searchcourses').'" />');
+    }
+
+    if (!empty($fromcoursesearch) && !empty($creator)) {
         $totalcount = 0;
         $courses = get_courses_search(explode(" ",$fromcoursesearch),"fullname ASC",$page,50,$totalcount);
         if (is_array($courses) and count($courses) > 0) {