From e8c35867b7a431c9bb7bc0886d6821ddebc51286 Mon Sep 17 00:00:00 2001
From: Gordon Bateson <gordon@kanazawa-gu.ac.jp>
Date: Mon, 9 Nov 2009 01:26:36 +0000
Subject: [PATCH] ensure user has_capability('mod/hotpot:attempt', $module)
 when viewing a HotPot or submitting results

---
 mod/hotpot/attempt.php | 2 ++
 mod/hotpot/view.php    | 1 +
 2 files changed, 3 insertions(+)

diff --git a/mod/hotpot/attempt.php b/mod/hotpot/attempt.php
index 1c7ed7fc485..b6ced1c3bae 100644
--- a/mod/hotpot/attempt.php
+++ b/mod/hotpot/attempt.php
@@ -23,6 +23,8 @@
 
     // make sure this user is enrolled in this course
     require_login($course->id);
+    $context = get_context_instance(CONTEXT_MODULE, $cm->id);
+    require_capability('mod/hotpot:attempt', $context);
 
     $next_url = "$CFG->wwwroot/course/view.php?id=$course->id";
     $time = time();
diff --git a/mod/hotpot/view.php b/mod/hotpot/view.php
index fdff2425bb2..a9711996b83 100644
--- a/mod/hotpot/view.php
+++ b/mod/hotpot/view.php
@@ -36,6 +36,7 @@
         }
         require_login($course->id);
         $context = get_context_instance(CONTEXT_MODULE, $cm->id);
+        require_capability('mod/hotpot:attempt', $context);
     }
     // set nextpage (for error messages)
     $nextpage = "$CFG->wwwroot/course/view.php?id=$course->id";