MDL-37411 Notes: unset courseid and userid when updating the note to …

…prevent accidental changes. Thank you Sam Hemelryk for suggesting an alternative solution.

notes/edit.php

@@ -70,6 +70,12 @@
 
 /// if data was submitted and validated, then save it to database
 if ($note = $noteform->get_data()){
+    if ($noteid) {
+        // A noteid has been used, we don't allow editing of course or user so
+        // lets unset them to be sure we never change that by accident.
+        unset($note->courseid);
+        unset($note->userid);
+    }
     note_save($note);
     // redirect to notes list that contains this note
     redirect($CFG->wwwroot . '/notes/index.php?course=' . $note->courseid . '&user=' . $note->userid);