MDL-76862 user: ensure user can only update own preferred start page.

This commit is contained in:
Paul Holden 2023-01-11 22:40:49 +00:00 committed by Jun Pataleta
parent 5eb91a54c3
commit f3c335b376

View File

@ -980,8 +980,9 @@ class core_user {
'default' => get_default_home_page(),
'choices' => $choices,
'permissioncallback' => function ($user, $preferencename) {
global $CFG;
return (!empty($CFG->defaulthomepage) && ($CFG->defaulthomepage == HOMEPAGE_USER));
global $CFG, $USER;
return $user->id == $USER->id &&
(!empty($CFG->defaulthomepage) && ($CFG->defaulthomepage == HOMEPAGE_USER));
}
];