L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-85037 block_html: correct access checks for plugin file serving.

Browse Source
This commit is contained in:
Paul Holden
2025-07-04 08:55:58 +08:00
parent c36274a15a
commit 98329e1d71
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
blocks/html/lib.php
+9 -4
View File
@@ -32,7 +32,9 @@
* @todo MDL-36050 improve capability check on stick blocks, so we can check user capability before sending images.
*/
function block_html_pluginfile($course, $birecord_or_cm, $context, $filearea, $args, $forcedownload, array $options=array()) {
global $DB, $CFG, $USER;
global $CFG;
require_once("{$CFG->dirroot}/user/lib.php");
if ($context->contextlevel != CONTEXT_BLOCK) {
send_file_not_found();
@@ -51,9 +53,12 @@ function block_html_pluginfile($course, $birecord_or_cm, $context, $filearea, $a
if (!core_course_category::get($parentcontext->instanceid, IGNORE_MISSING)) {
send_file_not_found();
}
} else if ($parentcontext->contextlevel === CONTEXT_USER && $parentcontext->instanceid != $USER->id) {
// The block is in the context of a user, it is only visible to the user who it belongs to.
send_file_not_found();
} else if ($parentcontext->contextlevel === CONTEXT_USER) {
$user = core_user::get_user($parentcontext->instanceid, '*', MUST_EXIST);
$extracaps = block_method_result('html', 'get_extra_capabilities');
if (!user_can_view_profile($user, null, $parentcontext) || !has_any_capability($extracaps, $context)) {
send_file_not_found();
}
}
// At this point there is no way to check SYSTEM context, so ignoring it.
}