From d20f655d59cd486fd9b3a26ad353af13daafd1d3 Mon Sep 17 00:00:00 2001
From: Petr Skoda <commits@skodak.org>
Date: Fri, 15 Jul 2011 12:23:34 +0200
Subject: [PATCH] MDL-28350 prevent bogus role assignment via externallib

---
 enrol/externallib.php | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/enrol/externallib.php b/enrol/externallib.php
index 9813ef51788..b11271c7312 100644
--- a/enrol/externallib.php
+++ b/enrol/externallib.php
@@ -121,7 +121,7 @@ class moodle_enrol_external extends external_api {
             $profilimgurlsmall = moodle_url::make_pluginfile_url($enrolleduser->usercontextid, 'user', 'icon', NULL, '/', 'f2');
             $resultuser = array(
                 'courseid' => $enrolleduser->courseid,
-                'userid' => $enrolleduser->userid, 
+                'userid' => $enrolleduser->userid,
                 'fullname' => fullname($enrolleduser),
                 'profileimgurl' => $profilimgurl->out(false),
                 'profileimgurlsmall' => $profilimgurlsmall->out(false)
@@ -271,6 +271,12 @@ class moodle_enrol_external extends external_api {
             self::validate_context($context);
             require_capability('moodle/role:assign', $context);
 
+            // throw an exception if user is not able to assign the role in this context
+            $roles = get_assignable_roles($context, ROLENAME_SHORT);
+            if (!key_exists($assignment['roleid'], $roles)) {
+                throw new invalid_parameter_exception('Can not assign roleid='.$assignment['roleid'].' in contextid='.$assignment['contextid']);
+            }
+
             role_assign($assignment['roleid'], $assignment['userid'], $assignment['contextid']);
         }
 
@@ -327,6 +333,12 @@ class moodle_enrol_external extends external_api {
             self::validate_context($context);
             require_capability('moodle/role:assign', $context);
 
+            // throw an exception if user is not able to unassign the role in this context
+            $roles = get_assignable_roles($context, ROLENAME_SHORT);
+            if (!key_exists($unassignment['roleid'], $roles)) {
+                throw new invalid_parameter_exception('Can not unassign roleid='.$unassignment['roleid'].' in contextid='.$unassignment['contextid']);
+            }
+
             role_unassign($unassignment['roleid'], $unassignment['userid'], $unassignment['contextid']);
         }