From 97009b73cf2ebf3a0eea157e99bc7c4647dfe3e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Dagef=C3=B6rde?= Date: Thu, 24 May 2018 16:15:09 +0200 Subject: [PATCH] MDL-62544 privacy: Allow data requests on behalf of a user by admin/DPO --- admin/tool/dataprivacy/createdatarequest.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/admin/tool/dataprivacy/createdatarequest.php b/admin/tool/dataprivacy/createdatarequest.php index cd7f575ea7a..0a0f43619e6 100644 --- a/admin/tool/dataprivacy/createdatarequest.php +++ b/admin/tool/dataprivacy/createdatarequest.php @@ -53,7 +53,8 @@ if ($manage) { $PAGE->set_context($context); // If contactdataprotectionofficer is disabled, send the user back to the profile page, or the privacy policy page. -if (!\tool_dataprivacy\api::can_contact_dpo()) { +// That is, unless you have sufficient capabilities to perform this on behalf of a user. +if (!$manage && !\tool_dataprivacy\api::can_contact_dpo()) { redirect($returnurl, get_string('contactdpoviaprivacypolicy', 'tool_dataprivacy'), \core\output\notification::NOTIFY_ERROR); }