MDL-19882 Add missing require_login-s before require_capability.

admin/uploaduser.php

@@ -27,6 +27,7 @@ if (function_exists('apache_child_terminate')) {
     @apache_child_terminate();
 }
 
+require_login();
 admin_externalpage_setup('uploadusers');
 require_capability('moodle/site:uploadusers', get_context_instance(CONTEXT_SYSTEM));
 

admin/user/user_bulk_confirm.php

@@ -8,6 +8,7 @@ require_once($CFG->libdir.'/adminlib.php');
 
 $confirm = optional_param('confirm', 0, PARAM_BOOL);
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM));
 

admin/user/user_bulk_delete.php

@@ -8,6 +8,7 @@ require_once($CFG->libdir.'/adminlib.php');
 
 $confirm = optional_param('confirm', 0, PARAM_BOOL);
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/user:delete', get_context_instance(CONTEXT_SYSTEM));
 

admin/user/user_bulk_download.php

@@ -8,6 +8,7 @@ require_once($CFG->libdir.'/adminlib.php');
 
 $format = optional_param('format', '', PARAM_ALPHA);
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM));
 

admin/user/user_bulk_enrol.php

@@ -8,6 +8,7 @@ $processed = optional_param('processed', '', PARAM_CLEAN);
 $sort = optional_param('sort', 'fullname', PARAM_ALPHA); //Sort by full name
 $dir  = optional_param('dir', 'asc', PARAM_ALPHA);       //Order to sort (ASC)
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/user:delete', get_context_instance(CONTEXT_SYSTEM));
 $return = $CFG->wwwroot.'/'.$CFG->admin.'/user/user_bulk.php';

admin/user/user_bulk_message.php

@@ -7,6 +7,7 @@ require_once('user_message_form.php');
 $msg     = optional_param('msg', '', PARAM_CLEAN);
 $confirm = optional_param('confirm', 0, PARAM_BOOL);
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/site:readallmessages', get_context_instance(CONTEXT_SYSTEM));
 

course/category.php

@@ -17,10 +17,6 @@
     $moveto = optional_param('moveto', 0, PARAM_INT);
     $resort = optional_param('resort', 0, PARAM_BOOL);
 
-    if ($CFG->forcelogin) {
-        require_login();
-    }
-
     if (!$site = get_site()) {
         print_error('siteisnotdefined', 'debug');
     }
@@ -33,21 +29,25 @@
     $context = $PAGE->context;
     $category = $PAGE->category;
 
-    if (!$category->visible) {
-        require_capability('moodle/category:viewhiddencategories', $context);
-    }
-
     if (update_category_button($category->id)) {
         if ($categoryedit !== -1) {
             $USER->editing = $categoryedit;
         }
-        $editingon = $PAGE->user_is_editing();
+        require_login();
         $navbaritem = update_category_button($category->id); // Must call this again after updating the state.
+        $editingon = $PAGE->user_is_editing();
     } else {
+        if ($CFG->forcelogin) {
+            require_login();
+        }
         $navbaritem = print_course_search('', true, 'navbar');
         $editingon = false;
     }
 
+    if (!$category->visible) {
+        require_capability('moodle/category:viewhiddencategories', $context);
+    }
+
     // Process any category actions.
     if (has_capability('moodle/category:manage', $context)) {
         /// Resort the category if requested

course/index.php

@@ -14,10 +14,6 @@
     $moveup   = optional_param('moveup',0,PARAM_INT);
     $movedown = optional_param('movedown',0,PARAM_INT);
 
-    if ($CFG->forcelogin) {
-        require_login();
-    }
-
     if (!$site = get_site()) {
         print_error('siteisnotdefined', 'debug');
     }
@@ -31,8 +27,12 @@
         if ($categoryedit !== -1) {
             $USER->editing = $categoryedit;
         }
+        require_login();
         $adminediting = $PAGE->user_is_editing();
     } else {
+        if ($CFG->forcelogin) {
+            require_login();
+        }
         $adminediting = false;
     }
 

enrol/mnet/allowed_courses.php

@@ -19,6 +19,7 @@ $removecategory = optional_param('removecategory', 0, PARAM_BOOL);
 $addcourse      = optional_param('addcourse', 0, PARAM_BOOL);
 $removecourse   = optional_param('removecourse', 0, PARAM_BOOL);
 
+require_login();
 $sitecontext = get_context_instance(CONTEXT_SYSTEM);
 $sesskey = sesskey();
 $formerror = array();

login/change_password.php

@@ -26,6 +26,7 @@
 
     // do not require change own password cap if change forced
     if (!get_user_preferences('auth_forcepasswordchange', false)) {
+        require_login();
         require_capability('moodle/user:changeownpassword', $systemcontext);
     }
 

mnet/testclient.php

@@ -18,6 +18,7 @@ if ($CFG->mnet_dispatcher_mode === 'off') {
 }
 
 // Site admins only, thanks.
+require_login();
 $context = get_context_instance(CONTEXT_SYSTEM);
 require_capability('moodle/site:config', $context);