mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-01-17 21:49:15 +01:00
Code Issues Projects Releases Wiki Activity

When displaying users at site level:

Browse Source 
- teachers can see everyone
  - everyone can see teachers

but everyone else is prevented from seeing users.  This is regardless
of the forceloginforprofiles setting and is designed to stop mass collection
of user names by browsing through all user names.
This commit is contained in:
moodler 2004-08-12 06:57:53 +00:00
parent 7da0830c40
commit f5ecf2e91a
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
lang/en/error.php
View File

@ -14,5 +14,6 @@ $string['restricteduser'] = 'Sorry, but your current account \"$a\" is restricte
$string['unknowncourse'] = 'Unknown course named \"$a\"';
$string['usernotaddederror'] = 'User \"$a\" not added - unknown error';
$string['usernotaddedregistered'] = 'User \"$a\" not added - already registered';
$string['usernotavailable'] = 'The details of this user are not available to you.';
?>

14
user/view.php
View File

@ -52,6 +52,18 @@
}
}
if (!$course->category) { // To reduce possibility of "browsing" userbase at site level
if (!isteacher() and !isteacher(0, $user->id) ) { // Teachers can browse and be browsed at site level
print_header("$personalprofile: ", "$personalprofile: ",
"<a href=\"index.php?id=$course->id\">$participants</a>",
"", "", true, "&nbsp;", navmenu($course));
print_heading(get_string('usernotavailable', 'error'));
print_footer($course);
die;
}
}
if ($course->category) {
print_header("$personalprofile: $fullname", "$personalprofile: $fullname",
"<a href=\"../course/view.php?id=$course->id\">$course->shortname</a> ->
@ -63,7 +75,7 @@
}
if ($course->category and ! isguest() ) {
if ($course->category and ! isguest() ) { // Need to have access to a course to see that info
if (!isstudent($course->id, $user->id) && !isteacher($course->id, $user->id)) {
print_heading(get_string("notenrolled", "", $fullname));
print_footer($course);