From b2fa954d755bf34d27d40ecfe9c576a3e52302a0 Mon Sep 17 00:00:00 2001 From: Yuliya Bozhko Date: Tue, 28 Oct 2014 15:36:16 +1300 Subject: [PATCH] MDL-47190 Ensure badges cannot be awarded without a role Signed-off-by: Yuliya Bozhko --- badges/award.php | 8 ++++++++ badges/criteria/award_criteria_manual.php | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/badges/award.php b/badges/award.php index e288fe2da76..f60bf39c876 100644 --- a/badges/award.php +++ b/badges/award.php @@ -81,6 +81,14 @@ $output = $PAGE->get_renderer('core', 'badges'); // Roles that can award this badge. $acceptedroles = array_keys($badge->criteria[BADGE_CRITERIA_TYPE_MANUAL]->params); +if (empty($acceptedroles)) { + echo $OUTPUT->header(); + $return = html_writer::link(new moodle_url('recipients.php', array('id' => $badge->id)), $strrecipients); + echo $OUTPUT->notification(get_string('notacceptedrole', 'badges', $return)); + echo $OUTPUT->footer(); + die(); +} + if (count($acceptedroles) > 1) { // If there is more than one role that can award a badge, prompt user to make a selection. // If it is an admin, include all accepted roles, otherwise only the ones that current user has in this context. diff --git a/badges/criteria/award_criteria_manual.php b/badges/criteria/award_criteria_manual.php index 672c9f8b89c..38ff57f40be 100644 --- a/badges/criteria/award_criteria_manual.php +++ b/badges/criteria/award_criteria_manual.php @@ -147,6 +147,11 @@ class award_criteria_manual extends award_criteria { public function review($userid) { global $DB; + // Roles should always have a parameter. + if (empty($this->params)) { + return false; + } + $overall = false; foreach ($this->params as $param) { $crit = $DB->get_record('badge_manual_award', array('issuerrole' => $param['role'], 'recipientid' => $userid, 'badgeid' => $this->badgeid));