MDL-58220 auth_oauth2: Linked logins only 4U

You can only manage your own linked logins - never anyone elses.
moodle · Apr 6, 2017 · 340659c · 340659c
1 parent 427fa27
commit 340659c
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/auth/oauth2/lib.php b/auth/oauth2/lib.php
@@ -38,9 +38,10 @@ function auth_oauth2_extend_navigation_user_settings(navigation_node $useraccoun
                                                      context_user $context,
                                                      stdClass $course,
                                                      context_course $coursecontext) {
+    global $USER;
 
     if (!\core\session\manager::is_loggedinas()) {
-        if (has_capability('auth/oauth2:managelinkedlogins', $context)) {
+        if (has_capability('auth/oauth2:managelinkedlogins', $context) && $user->id == $USER->id) {
 
             $parent = $useraccount->parent->find('useraccount', navigation_node::TYPE_CONTAINER);
             $parent->add(get_string('linkedlogins', 'auth_oauth2'), new moodle_url('/auth/oauth2/linkedlogins.php'));