From bbb5b1aeaa9c8ee34413e425c8666a2319a7997c Mon Sep 17 00:00:00 2001
From: skodak <skodak>
Date: Thu, 1 Oct 2009 09:57:02 +0000
Subject: [PATCH] MDL-20385 better access control checks for frontpage
 activities

---
 lib/moodlelib.php | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index cd576e080ef..b023d351065 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -2191,9 +2191,17 @@ function require_course_login($courseorid, $autologinguest=true, $cm=null, $setw
 
     } else if ((is_object($courseorid) and $courseorid->id == SITEID)
           or (!is_object($courseorid) and $courseorid == SITEID)) {
-        //login for SITE not required
-        user_accesstime_log(SITEID);
-        return;
+              //login for SITE not required
+        if ($cm and empty($cm->visible)) {
+            // hidden activities are not accessible without login
+            require_login($courseorid, $autologinguest, $cm, $setwantsurltome);
+        } else if ($cm and !empty($CFG->enablegroupings) and $cm->groupmembersonly) {
+            // not-logged-in users do not have any group membership
+            require_login($courseorid, $autologinguest, $cm, $setwantsurltome);
+        } else {
+            user_accesstime_log(SITEID);
+            return;
+        }
 
     } else {
         // course login always required