ensure user has_capability('mod/hotpot:attempt', $module) when viewin…

…g a HotPot or submitting results
mudrd8mz · Nov 9, 2009 · f50ea04 · f50ea04
1 parent 9218ade
commit f50ea04
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/mod/hotpot/attempt.php b/mod/hotpot/attempt.php
@@ -21,8 +21,10 @@
         error("Course Module ID is incorrect");
     }
 
-    // make sure this user is enrolled in this course
+    // make sure this user is enrolled in this course and can access this HotPot
     require_login($course);
+    $context = get_context_instance(CONTEXT_MODULE, $cm->id);
+    require_capability('mod/hotpot:attempt', $context);
 
     $next_url = "$CFG->wwwroot/course/view.php?id=$course->id";
     $time = time();

diff --git a/mod/hotpot/view.php b/mod/hotpot/view.php
@@ -34,8 +34,10 @@
             }
 
         }
+        // make sure this user is enrolled in this course and can access this HotPot
         require_login($course);
         $context = get_context_instance(CONTEXT_MODULE, $cm->id);
+        require_capability('mod/hotpot:attempt', $context);
     }
     // set nextpage (for error messages)
     $nextpage = "$CFG->wwwroot/course/view.php?id=$course->id";