From f77412b119ab7a4860125f05dcf08b01e2325c64 Mon Sep 17 00:00:00 2001 From: Paul Holden Date: Fri, 1 May 2020 09:00:41 +0100 Subject: [PATCH] MDL-68084 blocks: check capability before getting content. Some blocks (e.g. Calendar) load additional JS modules when returning content. We need to make sure they aren't asked to generate content unless the user can actually view the block, or the expected content required by the JS will not exist in the DOM and can cause exceptions. --- blocks/moodleblock.class.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/blocks/moodleblock.class.php b/blocks/moodleblock.class.php index b09adad042f..281fdf58b89 100644 --- a/blocks/moodleblock.class.php +++ b/blocks/moodleblock.class.php @@ -221,6 +221,11 @@ class block_base { public function get_content_for_output($output) { global $CFG; + // We can exit early if the current user doesn't have the capability to view the block. + if (!has_capability('moodle/block:view', $this->context)) { + return null; + } + $bc = new block_contents($this->html_attributes()); $bc->attributes['data-block'] = $this->name(); $bc->blockinstanceid = $this->instance->id;