L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

If we are updating an entry, compare current session user with

Browse Source 
existing entry user to avoid some potential problems if secureforms=off
Perhaps too much security? Anyway thanks to skodak

(Bug 1823)
(http://moodle.org/bugs/bug.php?op=show&bugid=1823)
This commit is contained in:
stronk7
2004-08-28 23:20:39 +00:00
parent c2716331a4
commit bbbfb3193b
1 changed files with 21 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/glossary/edit.php
+21 -7
View File
@@ -88,6 +88,20 @@ if ( $confirm ) {
}
if ($e) {
//We are updating an entry, so we compare current session user with
//existing entry user to avoid some potential problems if secureforms=off
//Perhaps too much security? Anyway thanks to skodak (Bug 1823)
$old = get_record('glossary_entries', 'id', $e);
$ineditperiod = ((time() - $old->timecreated < $CFG->maxeditingtime) || $glossary->editalways);
if ( (!$ineditperiod || $USER->id != $old->userid) and !isteacher($course->id) and $e) {
if ( $USER->id != $old->userid ) {
error("You can't edit other people's entries!");
} elseif (!$ineditperiod) {
error("You can't edit this. Time expired!");
}
die;
}
$newentry->id = $e;
$permissiongranted = 1;
@@ -261,13 +275,13 @@ print_header_simple(strip_tags("$glossary->name"), "",
$ineditperiod = ((time() - $newentry->timecreated < $CFG->maxeditingtime) || $glossary->editalways);
if ( (!$ineditperiod || $USER->id != $newentry->userid) and !isteacher($course->id) and $e) {
if ( $USER->id != $newentry->userid ) {
error("You can't edit other people's entries!");
} elseif (!$ineditperiod) {
error("You can't edit this. Time expired!");
}
die;
}
if ( $USER->id != $newentry->userid ) {
error("You can't edit other people's entries!");
} elseif (!$ineditperiod) {
error("You can't edit this. Time expired!");
}
die;
}
echo '<p align="center"><font size="3"><b>' . stripslashes_safe($glossary->name);
echo '</b></font></p>';