From f50ea0419e8c7fb21176b403cd62b7ac0a5b5cd7 Mon Sep 17 00:00:00 2001 From: Gordon Bateson Date: Mon, 9 Nov 2009 01:27:21 +0000 Subject: [PATCH] ensure user has_capability('mod/hotpot:attempt', $module) when viewing a HotPot or submitting results --- mod/hotpot/attempt.php | 4 +++- mod/hotpot/view.php | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/mod/hotpot/attempt.php b/mod/hotpot/attempt.php index 344a577070d..3b7e1a9bb91 100644 --- a/mod/hotpot/attempt.php +++ b/mod/hotpot/attempt.php @@ -21,8 +21,10 @@ error("Course Module ID is incorrect"); } - // make sure this user is enrolled in this course + // make sure this user is enrolled in this course and can access this HotPot require_login($course); + $context = get_context_instance(CONTEXT_MODULE, $cm->id); + require_capability('mod/hotpot:attempt', $context); $next_url = "$CFG->wwwroot/course/view.php?id=$course->id"; $time = time(); diff --git a/mod/hotpot/view.php b/mod/hotpot/view.php index 52a1f44cbb3..f3110da542b 100644 --- a/mod/hotpot/view.php +++ b/mod/hotpot/view.php @@ -34,8 +34,10 @@ } } + // make sure this user is enrolled in this course and can access this HotPot require_login($course); $context = get_context_instance(CONTEXT_MODULE, $cm->id); + require_capability('mod/hotpot:attempt', $context); } // set nextpage (for error messages) $nextpage = "$CFG->wwwroot/course/view.php?id=$course->id";