L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-37852 repository: Re-inforced checks to manage repository instances

Browse Source
This commit is contained in:
Frederic Massart
2013-03-07 14:32:44 +08:00
committed by Damyon Wiese
parent c65e7fcbc8
commit bd6581935d
1 changed files with 18 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
repository/manage_instances.php
+18 -24
View File
@@ -118,6 +118,22 @@ if (isset($type)) {
}
}
// We have an instance when we are going to edit, or delete. Several checks need to be done!
if (!empty($instance)) {
// The context passed MUST match the context of the repository. And as both have to be
// similar, this also ensures that the context is either a user one, or a course one.
if ($instance->instance->contextid != $context->id) {
print_error('invalidcontext');
}
if ($instance->readonly) {
// Cannot edit, or delete a readonly instance.
throw new repository_exception('readonlyinstance', 'repository');
} else if (!$instance->can_be_edited_by_user()) {
// The user has to have the right to edit the instance.
throw new repository_exception('nopermissiontoaccess', 'repository');
}
}
/// Create navigation links
if (!empty($course)) {
$PAGE->navbar->add($pagename);
@@ -129,30 +145,14 @@ if (!empty($course)) {
$PAGE->navbar->add($strrepos);
}
$title = $pagename;
/// Display page header
$PAGE->set_title($title);
// Display page header.
$PAGE->set_title($pagename);
$PAGE->set_heading($fullname);
echo $OUTPUT->header();
if ($context->contextlevel == CONTEXT_USER) {
if ( !$course = $DB->get_record('course', array('id'=>$usercourseid))) {
print_error('invalidcourseid');
}
}
$return = true;
if (!empty($edit) || !empty($new)) {
if (!empty($edit)) {
$instance = repository::get_instance($edit);
//if you try to edit an instance set as readonly, display an error message
if ($instance->readonly) {
throw new repository_exception('readonlyinstance', 'repository');
} else if (!$instance->can_be_edited_by_user()) {
throw new repository_exception('nopermissiontoaccess', 'repository');
}
$instancetype = repository::get_type_by_id($instance->options['typeid']);
$classname = 'repository_' . $instancetype->get_typename();
$configs = $instance->get_instance_option_names();
@@ -203,12 +203,6 @@ if (!empty($edit) || !empty($new)) {
$return = false;
}
} else if (!empty($delete)) {
// echo $OUTPUT->header();
$instance = repository::get_instance($delete);
//if you try to delete an instance set as readonly, display an error message
if ($instance->readonly) {
throw new repository_exception('readonlyinstance', 'repository');
}
if ($sure) {
if (!confirm_sesskey()) {
print_error('confirmsesskeybad', '', $baseurl);