MDL-33741 file_info: check capability when serving file in coursecat description

2016-08-01 09:16:59 +08:00
parent 2a9c12ce0b
commit d6a24b5794
1 changed files with 8 additions and 0 deletions
@@ -4303,6 +4303,14 @@ function file_pluginfile($relativepath, $forcedownload, $preview = null) {
                require_login();
            }

+            // Check if user can view this category.
+            if (!has_capability('moodle/category:viewhiddencategories', $context)) {
+                $coursecatvisible = $DB->get_field('course_categories', 'visible', array('id' => $context->instanceid));
+                if (!$coursecatvisible) {
+                    send_file_not_found();
+                }
+            }
+
            $filename = array_pop($args);
            $filepath = $args ? '/'.implode('/', $args).'/' : '/';
            if (!$file = $fs->get_file($context->id, 'coursecat', 'description', 0, $filepath, $filename) or $file->is_directory()) {