MDL-47921 mod_lti: Add access control to mod/lti/launch.php

2014-11-04 09:09:26 +13:00
parent 40a0465823
commit c844af2569
1 changed files with 4 additions and 1 deletions
@@ -56,7 +56,10 @@ $cm = get_coursemodule_from_id('lti', $id, 0, false, MUST_EXIST);
 $lti = $DB->get_record('lti', array('id' => $cm->instance), '*', MUST_EXIST);
 $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);

-require_login($course);
+$context = context_module::instance($cm->id);
+
+require_login($course, true, $cm);
+require_capability('mod/lti:view', $context);

 $lti->cmid = $cm->id;
 lti_view($lti);