From 38d13c23f10d0f4d4993bcf498536a8fa54c790f Mon Sep 17 00:00:00 2001
From: Rajesh Taneja <rajesh@moodle.com>
Date: Wed, 23 May 2012 13:14:02 +0800
Subject: [PATCH] MDL-32155 blocks: User can't access file, if block is hidden
 or doesn't have block:view capability

---
 pluginfile.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pluginfile.php b/pluginfile.php
index e6c8a439e997f..00dcc7d7a108f 100644
--- a/pluginfile.php
+++ b/pluginfile.php
@@ -732,6 +732,12 @@
             // somebody tries to gain illegal access, cm type must match the component!
             send_file_not_found();
         }
+
+        $bprecord = $DB->get_record('block_positions', array('blockinstanceid' => $context->instanceid), 'visible');
+        // User can't access file, if block is hidden or doesn't have block:view capability
+        if (($bprecord && !$bprecord->visible) || !has_capability('moodle/block:view', $context)) {
+                send_file_not_found();
+        }
     } else {
         $birecord = null;
     }