mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-01-18 05:58:34 +01:00
Code Issues Projects Releases Wiki Activity

MDL-82386 block_rss_client: user access checks for feed edit/delete.

Browse Source
This commit is contained in:
Paul Holden 2024-07-04 13:31:18 +01:00 committed by Jenkins
parent 75bffe9d96
commit 453dfc4f94
2 changed files with 26 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
blocks/rss_client/editfeed.php
View File

@ -180,7 +180,18 @@ $PAGE->set_pagelayout('admin');
if ($rssid) {
$isadding = false;
$rssrecord = $DB->get_record('block_rss_client', array('id' => $rssid), '*', MUST_EXIST);
if ($managesharedfeeds) {
$select = 'id = :id AND (userid = :userid OR shared = 1)';
} else {
$select = 'id = :id AND userid = :userid';
}
$rssrecord = $DB->get_record_select('block_rss_client', $select, [
'id' => $rssid,
'userid' => $USER->id,
], '*', MUST_EXIST);
} else {
$isadding = true;
$rssrecord = new stdClass;

21
blocks/rss_client/managefeeds.php
View File

@ -61,20 +61,27 @@ if ($returnurl) {
$baseurl = new moodle_url('/blocks/rss_client/managefeeds.php', $urlparams);
$PAGE->set_url($baseurl);
if ($managesharedfeeds) {
$select = '(userid = :userid OR shared = 1)';
} else {
$select = 'userid = :userid';
}
// Process any actions
if ($deleterssid && confirm_sesskey()) {
$DB->delete_records('block_rss_client', array('id'=>$deleterssid));
$deleterssid = $DB->get_field_select('block_rss_client', 'id', "id = :id AND {$select}", [
'id' => $deleterssid,
'userid' => $USER->id
], MUST_EXIST);
$DB->delete_records('block_rss_client', ['id' => $deleterssid]);
redirect($PAGE->url, get_string('feeddeleted', 'block_rss_client'));
}
// Display the list of feeds.
if ($managesharedfeeds) {
$select = '(userid = ' . $USER->id . ' OR shared = 1)';
} else {
$select = 'userid = ' . $USER->id;
}
$feeds = $DB->get_records_select('block_rss_client', $select, null, $DB->sql_order_by_text('title'));
$feeds = $DB->get_records_select('block_rss_client', $select, ['userid' => $USER->id], $DB->sql_order_by_text('title'));
$strmanage = get_string('managefeeds', 'block_rss_client');