MDL-78871 gradereport_grader: capability check getting report users.

moodle · Aug 10, 2023 · ff75f4c · ff75f4c
1 parent 769e915
commit ff75f4c
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/grade/report/grader/classes/external/get_users_in_report.php b/grade/report/grader/classes/external/get_users_in_report.php
@@ -75,6 +75,8 @@ public static function execute(int $courseid): array {
         $context = context_course::instance($courseid);
         self::validate_context($context);
 
+        require_capability('gradereport/grader:view', $context);
+
         // Return tracking object.
         $gpr = new \grade_plugin_return(
             [