diff --git a/repository/manage_instances.php b/repository/manage_instances.php index 52dd71890c4..cda4b3cd2d2 100644 --- a/repository/manage_instances.php +++ b/repository/manage_instances.php @@ -118,6 +118,22 @@ if (isset($type)) { } } +// We have an instance when we are going to edit, or delete. Several checks need to be done! +if (!empty($instance)) { + // The context passed MUST match the context of the repository. And as both have to be + // similar, this also ensures that the context is either a user one, or a course one. + if ($instance->instance->contextid != $context->id) { + print_error('invalidcontext'); + } + if ($instance->readonly) { + // Cannot edit, or delete a readonly instance. + throw new repository_exception('readonlyinstance', 'repository'); + } else if (!$instance->can_be_edited_by_user()) { + // The user has to have the right to edit the instance. + throw new repository_exception('nopermissiontoaccess', 'repository'); + } +} + /// Create navigation links if (!empty($course)) { $PAGE->navbar->add($pagename); @@ -129,30 +145,14 @@ if (!empty($course)) { $PAGE->navbar->add($strrepos); } -$title = $pagename; - -/// Display page header -$PAGE->set_title($title); +// Display page header. +$PAGE->set_title($pagename); $PAGE->set_heading($fullname); echo $OUTPUT->header(); -if ($context->contextlevel == CONTEXT_USER) { - if ( !$course = $DB->get_record('course', array('id'=>$usercourseid))) { - print_error('invalidcourseid'); - } -} - $return = true; if (!empty($edit) || !empty($new)) { if (!empty($edit)) { - $instance = repository::get_instance($edit); - - //if you try to edit an instance set as readonly, display an error message - if ($instance->readonly) { - throw new repository_exception('readonlyinstance', 'repository'); - } else if (!$instance->can_be_edited_by_user()) { - throw new repository_exception('nopermissiontoaccess', 'repository'); - } $instancetype = repository::get_type_by_id($instance->options['typeid']); $classname = 'repository_' . $instancetype->get_typename(); $configs = $instance->get_instance_option_names(); @@ -203,12 +203,6 @@ if (!empty($edit) || !empty($new)) { $return = false; } } else if (!empty($delete)) { - // echo $OUTPUT->header(); - $instance = repository::get_instance($delete); - //if you try to delete an instance set as readonly, display an error message - if ($instance->readonly) { - throw new repository_exception('readonlyinstance', 'repository'); - } if ($sure) { if (!confirm_sesskey()) { print_error('confirmsesskeybad', '', $baseurl);