MDL-17727 do not allow access to feeds from hidden courses or activitites - security improvement, in 2.0 this will be rewritten

2008-12-29 20:06:54 +00:00
parent d100f76f6e
commit e2cf6b91da
1 changed files with 2 additions and 2 deletions
@@ -89,8 +89,8 @@
        }
    }

-    //Check for "security" if the course is hidden or the activity is hidden
-    if (!$isblog and (!$course->visible || !$cm->visible) && (!has_capability('moodle/course:viewhiddenactivities', $context))) {
+    //Do not allow acesss to hidden courses or activities because we can not trust user id - this will be improved in 2.0
+    if (!$isblog and (!$course->visible || !$cm->visible)) {
        rss_not_found();
    }