From e38099e42d0861436a92b10b0a4502ebe13636af Mon Sep 17 00:00:00 2001
From: tjhunt <tjhunt>
Date: Wed, 13 Aug 2008 07:05:27 +0000
Subject: [PATCH] MDL-15819 - Review the RISK_XXX flags on all quiz and
 question capabilites.

---
 lib/db/access.php      | 13 ++++---------
 mod/quiz/db/access.php | 14 +++++---------
 2 files changed, 9 insertions(+), 18 deletions(-)

diff --git a/lib/db/access.php b/lib/db/access.php
index 8a7e75be250c3..7bdaa2e9f7894 100644
--- a/lib/db/access.php
+++ b/lib/db/access.php
@@ -1,4 +1,4 @@
-<?php
+<?php  // $Id$
 //
 // Capability definitions for Moodle core.
 //
@@ -778,9 +778,7 @@
     ),
 
     'moodle/question:import' => array(
-
-        'riskbitmask' => RISK_XSS,
-
+        'riskbitmask' => RISK_SPAM | RISK_XSS,
         'captype' => 'write',
         'contextlevel' => CONTEXT_COURSE,
         'legacy' => array(
@@ -791,7 +789,6 @@
     ),
 
     'moodle/question:export' => array(
-
         'captype' => 'read',
         'contextlevel' => CONTEXT_COURSE,
         'legacy' => array(
@@ -802,7 +799,7 @@
     ),
 
     'moodle/question:managecategory' => array(
-
+        'riskbitmask' => RISK_SPAM | RISK_XSS,
         'captype' => 'write',
         'contextlevel' => CONTEXT_COURSE,
         'legacy' => array(
@@ -812,9 +809,7 @@
     ),
 
     'moodle/question:manage' => array(
-
-        'riskbitmask' => RISK_XSS,
-
+        'riskbitmask' => RISK_SPAM | RISK_XSS,
         'captype' => 'write',
         'contextlevel' => CONTEXT_COURSE,
         'legacy' => array(
diff --git a/mod/quiz/db/access.php b/mod/quiz/db/access.php
index aecc9d9ee97df..a539c6a175ab3 100644
--- a/mod/quiz/db/access.php
+++ b/mod/quiz/db/access.php
@@ -1,4 +1,4 @@
-<?php // $Id$
+<?php  // $Id$
 /**
  * Capability definitions for the quiz module.
  *
@@ -9,7 +9,6 @@
     // Ability to see that the quiz exists, and the basic information
     // about it, for example the start date and time limit.
     'mod/quiz:view' => array(
-
         'captype' => 'read',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -23,7 +22,6 @@
 
     // Ability to do the quiz as a 'student'.
     'mod/quiz:attempt' => array(
-
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -33,7 +31,7 @@
 
     // Edit the quiz settings, add and remove questions.
     'mod/quiz:manage' => array(
-
+        'riskbitmask' => RISK_SPAM,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -44,7 +42,6 @@
 
     // Preview the quiz.
     'mod/quiz:preview' => array(
-
         'captype' => 'write', // Only just a write.
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -56,7 +53,7 @@
 
     // Manually grade and comment on student attempts at a question.
     'mod/quiz:grade' => array(
-
+        'riskbitmask' => RISK_SPAM | RISK_XSS,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -68,7 +65,7 @@
 
     // View the quiz reports.
     'mod/quiz:viewreports' => array(
-
+        'riskbitmask' => RISK_PERSONAL,
         'captype' => 'read',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -80,7 +77,7 @@
 
     // Delete attempts using the overview report.
     'mod/quiz:deleteattempts' => array(
-
+        'riskbitmask' => RISK_DATALOSS,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -89,5 +86,4 @@
         )
     )
 );
-
 ?>