L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-28350 prevent bogus role assignment via externallib

Browse Source
This commit is contained in:
Petr Skoda
2011-07-15 12:23:34 +02:00
parent ecb8829273
commit d20f655d59
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
enrol/externallib.php
+13 -1
View File
@@ -121,7 +121,7 @@ class moodle_enrol_external extends external_api {
$profilimgurlsmall = moodle_url::make_pluginfile_url($enrolleduser->usercontextid, 'user', 'icon', NULL, '/', 'f2');
$resultuser = array(
'courseid' => $enrolleduser->courseid,
'userid' => $enrolleduser->userid,
'userid' => $enrolleduser->userid,
'fullname' => fullname($enrolleduser),
'profileimgurl' => $profilimgurl->out(false),
'profileimgurlsmall' => $profilimgurlsmall->out(false)
@@ -271,6 +271,12 @@ class moodle_enrol_external extends external_api {
self::validate_context($context);
require_capability('moodle/role:assign', $context);
// throw an exception if user is not able to assign the role in this context
$roles = get_assignable_roles($context, ROLENAME_SHORT);
if (!key_exists($assignment['roleid'], $roles)) {
throw new invalid_parameter_exception('Can not assign roleid='.$assignment['roleid'].' in contextid='.$assignment['contextid']);
}
role_assign($assignment['roleid'], $assignment['userid'], $assignment['contextid']);
}
@@ -327,6 +333,12 @@ class moodle_enrol_external extends external_api {
self::validate_context($context);
require_capability('moodle/role:assign', $context);
// throw an exception if user is not able to unassign the role in this context
$roles = get_assignable_roles($context, ROLENAME_SHORT);
if (!key_exists($unassignment['roleid'], $roles)) {
throw new invalid_parameter_exception('Can not unassign roleid='.$unassignment['roleid'].' in contextid='.$unassignment['contextid']);
}
role_unassign($unassignment['roleid'], $unassignment['userid'], $unassignment['contextid']);
}