From e00435478780373ebdd5cbc1ebbe7da046c5e02e Mon Sep 17 00:00:00 2001 From: Frederic Massart Date: Wed, 20 Mar 2013 12:39:33 +0800 Subject: [PATCH] MDL-38452 repositories: User logged in as have access to non-private repositories --- repository/lib.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/repository/lib.php b/repository/lib.php index 9d59b2dec8d..d59a7c00ff7 100644 --- a/repository/lib.php +++ b/repository/lib.php @@ -652,7 +652,14 @@ abstract class repository { // Prevent access to private repositories when logged in as. if (session_is_loggedinas()) { - $can = false; + $allowed = array('coursefiles', 'equella', 'filesystem', 'flickr_public', 'local', 'merlot', 'recent', + 's3', 'upload', 'url', 'user', 'webdav', 'wikimedia', 'youtube'); + // Are only accessible the repositories which do not contain private data (any data + // that is not part of Moodle, "Private files" is not considered "Pivate"). And if they + // do not contain private data, then it should not be a user instance, which is private by definition. + if (!in_array($this->type, $allowed) || $repocontext->contextlevel == CONTEXT_USER) { + $can = false; + } } // We are going to ensure that the current context was legit, and reliable to check