From aebe4af80642f111d07b6d91991bd78c8f75358b Mon Sep 17 00:00:00 2001
From: Dongsheng Cai <unoter@gmail.com>
Date: Fri, 9 Jul 2010 06:13:47 +0000
Subject: [PATCH] MDL-22991, repository recent plugin, verify file ownership
 before copy to draft area

---
 lang/en/repository.php    | 1 +
 repository/recent/lib.php | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/lang/en/repository.php b/lang/en/repository.php
index 07181de6885..6ad9b63347c 100644
--- a/lang/en/repository.php
+++ b/lang/en/repository.php
@@ -84,6 +84,7 @@ $string['enter'] = 'Enter';
 $string['entername'] = 'Please enter folder name';
 $string['enternewname'] = 'Please enter the new file name';
 $string['error'] = 'An unknown error occurred!';
+$string['errornotyourfile'] = 'You cannot pick file which is not added by your';
 $string['existingrepository'] = 'This repository already exists';
 $string['federatedsearch'] = 'Federated search';
 $string['filename'] = 'Filename';
diff --git a/repository/recent/lib.php b/repository/recent/lib.php
index 53ee42b0afa..e3e1fede7f9 100755
--- a/repository/recent/lib.php
+++ b/repository/recent/lib.php
@@ -182,6 +182,9 @@ class repository_recent extends repository {
         // To get 'recent' plugin working, we need to use lower level file_stoarge class to bypass the
         // capability check, we will use a better workaround to improve it.
         if ($stored_file = $fs->get_file($contextid, $component, $filearea, $fileitemid, $filepath, $filename)) {
+            if ($USER->id != $stored_file->get_userid()) {
+                throw new moodle_exception('errornotyourfile', 'repository');
+            }
             $file_record = array('contextid'=>$user_context->id, 'component'=>'user', 'filearea'=>'draft',
                 'itemid'=>$new_itemid, 'filepath'=>$new_filepath, 'filename'=>$new_filename);
             if ($file = $fs->get_file($user_context->id, 'user', 'draft', $new_itemid, $new_filepath, $new_filename)) {