ensure user has_capability('mod/hotpot:attempt', $module) when viewing a HotPot or submitting results

mod/hotpot/attempt.php

@@ -23,6 +23,8 @@
 
     // make sure this user is enrolled in this course
     require_login($course->id);
+    $context = get_context_instance(CONTEXT_MODULE, $cm->id);
+    require_capability('mod/hotpot:attempt', $context);
 
     $next_url = "$CFG->wwwroot/course/view.php?id=$course->id";
     $time = time();

mod/hotpot/view.php

@@ -36,6 +36,7 @@
         }
         require_login($course->id);
         $context = get_context_instance(CONTEXT_MODULE, $cm->id);
+        require_capability('mod/hotpot:attempt', $context);
     }
     // set nextpage (for error messages)
     $nextpage = "$CFG->wwwroot/course/view.php?id=$course->id";