fix for Moodle 1.8 and 1.9 to allow students to access hidden hotpots which form part of a hotpot chain - see http://moodle.org/mod/forum/discuss.php?d=91861. In Moodle 1.8 and later the "require_login" function (lib/moodlelib.php) is stricter than in earlier versions of Moodle and checks a module's visibility and groupings access. From Moodle 2.0 on, this HotPot module does not need this fix.

mod/hotpot/attempt.php

@@ -27,6 +27,11 @@
     $next_url = "$CFG->wwwroot/course/view.php?id=$course->id";
     $time = time();
 
+    // check user can access this hotpot activity
+    if (!hotpot_is_visible($cm)) {
+        error(get_string("activityiscurrentlyhidden"), $next_url);
+    }
+
     // update attempt record fields using incoming data
     $attempt->score = optional_param('mark', NULL, PARAM_INT);
     $attempt->status = optional_param('status', NULL, PARAM_INT);

mod/hotpot/lib.php

@@ -431,15 +431,27 @@ function hotpot_get_chain(&$cm) {
 
     return $found ? $chain : false;
 }
+
 function hotpot_is_visible(&$cm) {
-    if (!isset($cm->sectionvisible)) {
-        if ($section = get_record('course_sections', 'id', $cm->section)) {
-            $cm->sectionvisible = $section->visible;
-        } else {
-            error('Course module record contains invalid section');
-        }
+    global $CFG, $COURSE;
+
+    // check if user can view hidden activities
+    if (isset($COURSE->context)) {
+        $coursecontext = &$COURSE->context;
+    } else {
+        $coursecontext = get_context_instance(CONTEXT_COURSE, $cm->course);
+    }
+    if (has_capability('moodle/course:viewhiddenactivities', $coursecontext)) {
+        return true; // user can view hidden activities
     }
 
+    if (!isset($cm->sectionvisible)) {
+        if (! $section = get_record('course_sections', 'id', $cm->section)) {
+            error('Course module record contains invalid section');
+        }
+        $cm->sectionvisible = $section->visible;
+    }
+ 
     if (empty($cm->sectionvisible)) {
         $visible = HOTPOT_NO;
     } else {

mod/hotpot/report.php

@@ -40,6 +40,11 @@
 
     require_login($course->id);
 
+    // check user can access this hotpot activity
+    if (!hotpot_is_visible($cm)) {
+        error(get_string("activityiscurrentlyhidden"));
+    }
+
     // get report mode
     if (has_capability('mod/hotpot:viewreport',$modulecontext)) {
         $mode = optional_param('mode', 'overview', PARAM_ALPHA);

mod/hotpot/review.php

@@ -34,6 +34,12 @@
     
     $context = get_context_instance(CONTEXT_MODULE, $cm->id);
     require_login($course->id);
+
+    // check user can access this hotpot activity
+    if (!hotpot_is_visible($cm)) {
+        error(get_string("activityiscurrentlyhidden"));
+    }
+
     if (!has_capability('mod/hotpot:viewreport',$context)) {
         if (!$hotpot->review) {
             error(get_string("noreview", "quiz"));