diff --git a/mod/lti/ajax.php b/mod/lti/ajax.php
index ab75cd3e678..c8cebdcee8f 100644
--- a/mod/lti/ajax.php
+++ b/mod/lti/ajax.php
@@ -24,11 +24,13 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  * @author     Chris Scribner
  */
+define('AJAX_SCRIPT', true);
 
 require_once(dirname(__FILE__) . "/../../config.php");
 require_once($CFG->dirroot . '/mod/lti/locallib.php');
 
 $courseid = required_param('course', PARAM_INT);
+$context = context_course::instance($courseid);
 
 require_login($courseid, false);
 
@@ -41,15 +43,18 @@ switch ($action) {
         $toolurl = required_param('toolurl', PARAM_RAW);
         $toolid = optional_param('toolid', 0, PARAM_INT);
 
-        if(empty($toolid) && !empty($toolurl)){
+        require_capability('moodle/course:manageactivities', $context);
+        require_capability('mod/lti:addinstance', $context);
+
+        if (empty($toolid) && !empty($toolurl)) {
             $tool = lti_get_tool_by_url_match($toolurl, $courseid);
 
             if(!empty($tool)){
                 $toolid = $tool->id;
 
                 $response->toolid = $tool->id;
-                $response->toolname = htmlspecialchars($tool->name);
-                $response->tooldomain = htmlspecialchars($tool->tooldomain);
+                $response->toolname = s($tool->name);
+                $response->tooldomain = s($tool->tooldomain);
             }
         } else {
             $response->toolid = $toolid;
@@ -66,14 +71,19 @@ switch ($action) {
             ';
 
             $privacyconfigs = $DB->get_records_sql($query, array('typeid' => $toolid));
-            foreach($privacyconfigs as $config){
+            $success = count($privacyconfigs) > 0;
+            foreach ($privacyconfigs as $config) {
                 $configname = $config->name;
                 $response->$configname = $config->value;
             }
+            if (!$success) {
+                $response->error = s(get_string('tool_config_not_found', 'mod_lti'));
+            }
         }
+
         break;
 }
-
+echo $OUTPUT->header();
 echo json_encode($response);
 
 die;