MDL-68974 blocks: Check permission before generating content

moodle · Sep 8, 2020 · 5c91f31 · 5c91f31
1 parent cb72d84
commit 5c91f31
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/calendar/lib.php b/calendar/lib.php
@@ -1281,6 +1281,9 @@ public function timestamp_tomorrow() {
      * @param string|null $view preference view options (eg: day, month, upcoming)
      */
     public function add_sidecalendar_blocks(core_calendar_renderer $renderer, $showfilters=false, $view=null) {
+        if (!has_capability('moodle/block:view', $this->context) ) {
+            return;
+        }
         if ($showfilters) {
             $filters = new block_contents();
             $filters->content = $renderer->event_filter();

diff --git a/lib/blocklib.php b/lib/blocklib.php
@@ -1225,6 +1225,12 @@ protected function ensure_instances_exist($region) {
      */
     public function ensure_content_created($region, $output) {
         $this->ensure_instances_exist($region);
+
+        if (!has_capability('moodle/block:view', $this->page->context) ) {
+            $this->visibleblockcontent[$region] = [];
+            return;
+        }
+
         if (!array_key_exists($region, $this->visibleblockcontent)) {
             $contents = array();
             if (array_key_exists($region, $this->extracontent)) {