MDL-61115: mod_lesson: Check if the teacher can access the override

moodle · Jul 3, 2019 · 5e9dd95 · 5e9dd95
1 parent 1aa9422
commit 5e9dd95
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/mod/lesson/overridedelete.php b/mod/lesson/overridedelete.php
@@ -49,6 +49,16 @@
 // Check the user has the required capabilities to modify an override.
 require_capability('mod/lesson:manageoverrides', $context);
 
+if ($override->groupid) {
+    if (!groups_group_visible($override->groupid, $course, $cm)) {
+        print_error('invalidoverrideid', 'lesson');
+    }
+} else {
+    if (!groups_user_groups_visible($course, $override->userid, $cm)) {
+        print_error('invalidoverrideid', 'lesson');
+    }
+}
+
 $url = new moodle_url('/mod/lesson/overridedelete.php', array('id' => $override->id));
 $confirmurl = new moodle_url($url, array('id' => $override->id, 'confirm' => 1));
 $cancelurl = new moodle_url('/mod/lesson/overrides.php', array('cmid' => $cm->id));

diff --git a/mod/lesson/overrideedit.php b/mod/lesson/overrideedit.php
@@ -76,6 +76,16 @@
 if ($overrideid) {
     // Editing an override.
     $data = clone $override;
+
+    if ($override->groupid) {
+        if (!groups_group_visible($override->groupid, $course, $cm)) {
+            print_error('invalidoverrideid', 'lesson');
+        }
+    } else {
+        if (!groups_user_groups_visible($course, $override->userid, $cm)) {
+            print_error('invalidoverrideid', 'lesson');
+        }
+    }
 } else {
     // Creating a new override.
     $data = new stdClass();