L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-62790 course: cap check in core_course_get_categories

Browse Source
This commit is contained in:
Marina Glancy
2018-07-03 12:04:37 +08:00
committed by Andrew Nicols
parent af89e5a896
commit d5a8d310e0
2 changed files with 6 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
course/externallib.php
+2 -6
View File
@@ -1592,9 +1592,7 @@ class core_course_external extends external_api {
break;
case 'visible':
if (has_capability('moodle/category:manage', $context)
or has_capability('moodle/category:viewhiddencategories',
context_system::instance())) {
if (has_capability('moodle/category:viewhiddencategories', $context)) {
$value = clean_param($crit['value'], PARAM_INT);
$conditions[$key] = $value;
$wheres[] = $key . " = :" . $key;
@@ -1704,9 +1702,7 @@ class core_course_external extends external_api {
if (!isset($excludedcats[$category->id])) {
// Final check to see if the category is visible to the user.
if ($category->visible
or has_capability('moodle/category:viewhiddencategories', context_system::instance())
or has_capability('moodle/category:manage', $context)) {
if ($category->visible or has_capability('moodle/category:viewhiddencategories', $context)) {
$categoryinfo = array();
$categoryinfo['id'] = $category->id;
course/tests/externallib_test.php
+4 -3
View File
@@ -201,6 +201,7 @@ class core_course_externallib_testcase extends externallib_advanced_testcase {
// Set the required capabilities by the external function.
$context = context_system::instance();
$roleid = $this->assignUserCapability('moodle/category:manage', $context->id);
$this->assignUserCapability('moodle/category:viewhiddencategories', $context->id, $roleid);
// Retrieve category1 + sub-categories except not visible ones
$categories = core_course_external::get_categories(array(
@@ -278,10 +279,10 @@ class core_course_externallib_testcase extends externallib_advanced_testcase {
$this->assertEquals($DB->count_records('course_categories'), count($categories));
$this->unassignUserCapability('moodle/category:manage', $context->id, $roleid);
$this->unassignUserCapability('moodle/category:viewhiddencategories', $context->id, $roleid);
// Ensure maxdepthcategory is 2 and retrieve all categories without category:manage capability. It should retrieve all
// visible categories as well.
// Ensure maxdepthcategory is 2 and retrieve all categories without category:viewhiddencategories capability.
// It should retrieve all visible categories as well.
set_config('maxcategorydepth', 2);
$categories = core_course_external::get_categories();