From 98329e1d717c663889f6ca8a9f7e67c17cf4eaa2 Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Tue, 1 Apr 2025 14:54:19 +0100
Subject: [PATCH] MDL-85037 block_html: correct access checks for plugin file
 serving.

---
 blocks/html/lib.php | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/blocks/html/lib.php b/blocks/html/lib.php
index cdd2e8b4c41..f49ba21015c 100644
--- a/blocks/html/lib.php
+++ b/blocks/html/lib.php
@@ -32,7 +32,9 @@
  * @todo MDL-36050 improve capability check on stick blocks, so we can check user capability before sending images.
  */
 function block_html_pluginfile($course, $birecord_or_cm, $context, $filearea, $args, $forcedownload, array $options=array()) {
-    global $DB, $CFG, $USER;
+    global $CFG;
+
+    require_once("{$CFG->dirroot}/user/lib.php");
 
     if ($context->contextlevel != CONTEXT_BLOCK) {
         send_file_not_found();
@@ -51,9 +53,12 @@ function block_html_pluginfile($course, $birecord_or_cm, $context, $filearea, $a
             if (!core_course_category::get($parentcontext->instanceid, IGNORE_MISSING)) {
                 send_file_not_found();
             }
-        } else if ($parentcontext->contextlevel === CONTEXT_USER && $parentcontext->instanceid != $USER->id) {
-            // The block is in the context of a user, it is only visible to the user who it belongs to.
-            send_file_not_found();
+        } else if ($parentcontext->contextlevel === CONTEXT_USER) {
+            $user = core_user::get_user($parentcontext->instanceid, '*', MUST_EXIST);
+            $extracaps = block_method_result('html', 'get_extra_capabilities');
+            if (!user_can_view_profile($user, null, $parentcontext) || !has_any_capability($extracaps, $context)) {
+                send_file_not_found();
+            }
         }
         // At this point there is no way to check SYSTEM context, so ignoring it.
     }