From bb6a65da428fc94fc24824cb794a9f6596b8e945 Mon Sep 17 00:00:00 2001 From: Paul Holden Date: Tue, 17 Sep 2024 10:02:20 +0100 Subject: [PATCH] MDL-83180 reportbuilder: correct access check for viewing schedules. --- .../classes/local/systemreports/report_schedules.php | 5 ++++- reportbuilder/classes/system_report.php | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/reportbuilder/classes/local/systemreports/report_schedules.php b/reportbuilder/classes/local/systemreports/report_schedules.php index b25b564c193..94c448b5c38 100644 --- a/reportbuilder/classes/local/systemreports/report_schedules.php +++ b/reportbuilder/classes/local/systemreports/report_schedules.php @@ -91,7 +91,10 @@ class report_schedules extends system_report { * @return bool */ protected function can_view(): bool { - return permission::can_view_reports_list(); + $reportid = $this->get_parameter('reportid', 0, PARAM_INT); + $report = report::get_record(['id' => $reportid], MUST_EXIST); + + return permission::can_edit_report($report); } /** diff --git a/reportbuilder/classes/system_report.php b/reportbuilder/classes/system_report.php index 80cae63640d..b72c495e6f9 100644 --- a/reportbuilder/classes/system_report.php +++ b/reportbuilder/classes/system_report.php @@ -71,6 +71,8 @@ abstract class system_report extends base { * This is necessary to implement independently of the page that would typically embed the report because * subsequent pages are requested via AJAX requests, and access should be validated each time * + * Report parameters should also be considered when implementing this method + * * @return bool */ abstract protected function can_view(): bool; @@ -201,6 +203,8 @@ abstract class system_report extends base { /** * Return specific report parameter * + * Capability/permission checks relating to parameters retrieved here should also be considered in your {@see can_view} method + * * @param string $param * @param mixed $default * @param string $type