L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-86960 mod_data: Check user

Browse Source
This commit is contained in:
Stefan Hanauska
2025-12-03 13:37:52 +08:00
committed by Mihail Geshoski
parent bd0bd01074
commit adc49cf371
1 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/mod/data/lib.php
+14 -5
View File
@@ -1677,7 +1677,7 @@ function data_rating_validate($params) {
* @throws rating_exception
*/
function mod_data_rating_can_see_item_ratings($params) {
global $DB;
global $DB, $USER;
// Check the component is mod_data.
if (!isset($params['component']) || $params['component'] != 'mod_data') {
@@ -1693,7 +1693,7 @@ function mod_data_rating_can_see_item_ratings($params) {
throw new rating_exception('invaliditemid');
}
$datasql = "SELECT d.id as dataid, d.course, r.groupid
$datasql = "SELECT d.id as dataid, d.course, r.userid, r.groupid
FROM {data_records} r
JOIN {data} d ON r.dataid = d.id
WHERE r.id = :itemid";
@@ -1703,14 +1703,23 @@ function mod_data_rating_can_see_item_ratings($params) {
throw new rating_exception('invaliditemid');
}
$course = $DB->get_record('course', array('id' => $info->course), '*', MUST_EXIST);
$cm = get_coursemodule_from_instance('data', $info->dataid, $course->id, false, MUST_EXIST);
$context = context_module::instance($cm->id);
if (!empty($info->userid)) {
$ratingpermissions = data_rating_permissions($context->id, 'mod_data', 'entry');
$requiredpermission = ($info->userid != $USER->id) ? 'viewall' : 'view';
if (!$ratingpermissions[$requiredpermission]) {
return false;
}
}
// User can see ratings of all participants.
if ($info->groupid == 0) {
return true;
}
$course = $DB->get_record('course', array('id' => $info->course), '*', MUST_EXIST);
$cm = get_coursemodule_from_instance('data', $info->dataid, $course->id, false, MUST_EXIST);
// Make sure groups allow this user to see the item they're rating.
return groups_group_visible($info->groupid, $course, $cm);
}