MDL-59409 admin: check access to every setting in category

2017-07-04 10:03:42 +08:00
parent 35d1b3da7a
commit dacac4d10b
2 changed files with 9 additions and 5 deletions
@@ -7821,21 +7821,25 @@ function admin_find_write_settings($node, $data) {
    }

    if ($node instanceof admin_category) {
-        $entries = array_keys($node->children);
-        foreach ($entries as $entry) {
-            $return = array_merge($return, admin_find_write_settings($node->children[$entry], $data));
+        if ($node->check_access()) {
+            $entries = array_keys($node->children);
+            foreach ($entries as $entry) {
+                $return = array_merge($return, admin_find_write_settings($node->children[$entry], $data));
+            }
        }

    } else if ($node instanceof admin_settingpage) {
+        if ($node->check_access()) {
            foreach ($node->settings as $setting) {
                $fullname = $setting->get_full_name();
                if (array_key_exists($fullname, $data)) {
                    $return[$fullname] = $setting;
                }
            }
-
        }

+    }
+
    return $return;
 }