From b04bf988ef47f8fa65dd08ce936ecb774d5d76bd Mon Sep 17 00:00:00 2001
From: Frederic Massart <fred@moodle.com>
Date: Thu, 20 Mar 2014 16:14:03 +0800
Subject: [PATCH] MDL-43877 blocks: Files from blocks in my/ were accessible to
 the world

---
 blocks/html/lib.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/blocks/html/lib.php b/blocks/html/lib.php
index 5c9327a4684..531a32a5dbf 100644
--- a/blocks/html/lib.php
+++ b/blocks/html/lib.php
@@ -32,7 +32,7 @@
  * @todo MDL-36050 improve capability check on stick blocks, so we can check user capability before sending images.
  */
 function block_html_pluginfile($course, $birecord_or_cm, $context, $filearea, $args, $forcedownload, array $options=array()) {
-    global $DB, $CFG;
+    global $DB, $CFG, $USER;
 
     if ($context->contextlevel != CONTEXT_BLOCK) {
         send_file_not_found();
@@ -52,8 +52,11 @@ function block_html_pluginfile($course, $birecord_or_cm, $context, $filearea, $a
             if (!$category->visible) {
                 require_capability('moodle/category:viewhiddencategories', $parentcontext);
             }
+        } else if ($parentcontext->contextlevel === CONTEXT_USER && $parentcontext->instanceid != $USER->id) {
+            // The block is in the context of a user, it is only visible to the user who it belongs to.
+            send_file_not_found();
         }
-        // At this point there is no way to check SYSTEM or USER context, so ignoring it.
+        // At this point there is no way to check SYSTEM context, so ignoring it.
     }
 
     if ($filearea !== 'content') {