L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-14589: adding a few more checks to file served from user_profile. More needed.

Browse Source
This commit is contained in:
scyrma
2008-09-05 09:48:51 +00:00
parent 00c32c5430
commit fc7fac62df
1 changed files with 38 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
userfile.php
+38 -13
View File
@@ -3,11 +3,6 @@
require_once('config.php');
require_once('lib/filelib.php');
require_login();
if (isguestuser()) {
print_error('noguest');
}
// disable moodle specific debug messages
disable_debugging();
@@ -36,24 +31,54 @@
print_error('invalidarguments');
}
$userid = $context->instanceid;
if ($USER->id != $userid) {
print_error('invaliduserid');
}
switch ($filearea) {
case 'user_private':
$userid = $context->instanceid;
if ($USER->id != $userid) {
print_error('invaliduserid');
}
// fallthrough
case 'user_profile':
if (!empty($CFG->forceloginforprofiles)) {
require_login();
if (isguestuser()) {
print_error('noguest');
}
$user = $DB->get_record("user", array("id"=>$userid));
$usercontext = get_context_instance(CONTEXT_USER, $user->id);
if (!isteacherinanycourse()
and !isteacherinanycourse($user->id)
and !has_capability('moodle/user:viewdetails', $usercontext)) {
print_error('usernotavailable');
}
//TODO: find a way to get $coursecontext .. or equivalent check.
//if (!has_capability('moodle/user:viewdetails', $coursecontext) &&
// !has_capability('moodle/user:viewdetails', $usercontext)) {
// print_error('cannotviewprofile');
//}
//if (!has_capability('moodle/course:view', $coursecontext, $user->id, false)) {
// print_error('notenrolledprofile');
//}
//if (groups_get_course_groupmode($course) == SEPARATEGROUPS and !has_capability('moodle/site:accessallgroups', $coursecontext)) {
// print_error('groupnotamember');
//}
}
$itemid = 0;
$forcedownload = true;
break;
case 'user_private':
require_login();
if (isguestuser()) {
print_error('noguest');
}
$itemid = 0;
$forcedownload = true;
break;
default:
send_file_not_found();
}
$relativepath = '/'.implode('/', $args);
$fs = get_file_storage();
$fullpath = $context->id.$filearea.$itemid.$relativepath;