mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-01-17 21:49:15 +01:00
Code Issues Projects Releases Wiki Activity

MDL-37852 repository: Prevent undesired access to repositories settings

Browse Source
This commit is contained in:
Frederic Massart 2013-02-27 08:43:17 +08:00 committed by Eloy Lafuente (stronk7)
parent 6fe3986dec
commit 89a9d21a15
3 changed files with 46 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
repository/lib.php
View File

@ -1498,12 +1498,12 @@ abstract class repository {
$pluginstr = get_string('plugin', 'repository');
$settingsstr = get_string('settings');
$deletestr = get_string('delete');
//retrieve list of instances. In administration context we want to display all
//instances of a type, even if this type is not visible. In course/user context we
//want to display only visible instances, but for every type types. The repository::get_instances()
//third parameter displays only visible type.
// Retrieve list of instances. In administration context we want to display all
// instances of a type, even if this type is not visible. In course/user context we
// want to display only visible instances, but for every type types. The repository::get_instances()
// third parameter displays only visible type.
$params = array();
$params['context'] = array($context, get_system_context());
$params['context'] = array($context);
$params['currentcontext'] = $context;
$params['onlyvisible'] = !$admin;
$params['type'] = $typename;
@ -1805,6 +1805,41 @@ abstract class repository {
return false;
}
/**
* Can the instance be edited by the current user?
*
* The property $readonly must not be used within this method because
* it only controls if the options from self::get_instance_option_names()
* can be edited.
*
* @return bool true if the user can edit the instance.
* @since 2.5
*/
public final function can_be_edited_by_user() {
global $USER;
// We need to be able to explore the repository.
try {
$this->check_capability();
} catch (repository_exception $e) {
return false;
}
$repocontext = context::instance_by_id($this->instance->contextid);
if ($repocontext->contextlevel == CONTEXT_USER && $repocontext->instanceid != $USER->id) {
// If the context of this instance is a user context, we need to be this user.
return false;
} else if ($repocontext->contextlevel == CONTEXT_MODULE && !has_capability('moodle/course:update', $repocontext)) {
// We need to have permissions on the course to edit the instance.
return false;
} else if ($repocontext->contextlevel == CONTEXT_SYSTEM && !has_capability('moodle/site:config', $repocontext)) {
// Do not meet the requirements for the context system.
return false;
}
return true;
}
/**
* Return the name of this instance, can be overridden.
*

3
repository/manage_instances.php
View File

@ -146,9 +146,12 @@ $return = true;
if (!empty($edit) || !empty($new)) {
if (!empty($edit)) {
$instance = repository::get_instance($edit);
//if you try to edit an instance set as readonly, display an error message
if ($instance->readonly) {
throw new repository_exception('readonlyinstance', 'repository');
} else if (!$instance->can_be_edited_by_user()) {
throw new repository_exception('nopermissiontoaccess', 'repository');
}
$instancetype = repository::get_type_by_id($instance->options['typeid']);
$classname = 'repository_' . $instancetype->get_typename();

3
repository/upgrade.txt
View File

@ -13,6 +13,9 @@ http://docs.moodle.org/dev/Repository_API
* get_typename() returns the type of repository: dropbox, googledocs, etc...
* can_be_edited_by_user() encapsulates all the tests to make sure that the current user
has the rights to edit the instance of this repository.
=== 2.4 ===
* copy_to_area() can receive a new parameter called $areamaxbytes which controls the maximum