Validate access to teachers when show question - refs BT#11562

chamilo · Oct 4, 2016 · cbb5dff · cbb5dff
1 parent 260ea62
commit cbb5dff
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/main/inc/ajax/exercise.ajax.php b/main/inc/ajax/exercise.ajax.php
@@ -505,6 +505,13 @@
         echo 'ok';
         break;
     case 'show_question':
+        $isAllowedToEdit = api_is_allowed_to_edit(null, true, false, false);
+
+        if (!$isAllowedToEdit) {
+            api_not_allowed(true);
+            exit;
+        }
+
         $questionId = isset($_GET['question']) ? intval($_GET['question']) : 0;
         $exerciseId = isset($_REQUEST['exercise']) ? intval($_REQUEST['exercise']) : 0;