mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-04-14 04:52:36 +02:00
Code Issues Projects Releases Wiki Activity

MDL-43877 blocks: Files from blocks in my/ were accessible to the world

Browse Source
This commit is contained in:
Frederic Massart 2014-03-20 16:14:03 +08:00 committed by Dan Poltawski
parent 5140fac5da
commit b04bf988ef
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
blocks/html/lib.php
View File

@ -32,7 +32,7 @@
* @todo MDL-36050 improve capability check on stick blocks, so we can check user capability before sending images.
*/
function block_html_pluginfile($course, $birecord_or_cm, $context, $filearea, $args, $forcedownload, array $options=array()) {
global $DB, $CFG;
global $DB, $CFG, $USER;
if ($context->contextlevel != CONTEXT_BLOCK) {
send_file_not_found();
@ -52,8 +52,11 @@ function block_html_pluginfile($course, $birecord_or_cm, $context, $filearea, $a
if (!$category->visible) {
require_capability('moodle/category:viewhiddencategories', $parentcontext);
}
} else if ($parentcontext->contextlevel === CONTEXT_USER && $parentcontext->instanceid != $USER->id) {
// The block is in the context of a user, it is only visible to the user who it belongs to.
send_file_not_found();
}
// At this point there is no way to check SYSTEM or USER context, so ignoring it.
// At this point there is no way to check SYSTEM context, so ignoring it.
}
if ($filearea !== 'content') {