moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-06 17:36:38 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-62790 course: cap check in core_course_get_categories

Browse source
This commit is contained in:
Marina Glancy 2018-06-25 14:54:59 +08:00 • committed by Andrew Nicols
parent 25a592ff5f
commit d80533be40
2 changed files with 6 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

8
course/externallib.php
View file

@ -1600,9 +1600,7 @@ class core_course_external extends external_api {
break; break;
case 'visible': case 'visible':
if (has_capability('moodle/category:manage', $context) if (has_capability('moodle/category:viewhiddencategories', $context)) {
or has_capability('moodle/category:viewhiddencategories',
context_system::instance())) {
$value = clean_param($crit['value'], PARAM_INT); $value = clean_param($crit['value'], PARAM_INT);
$conditions[$key] = $value; $conditions[$key] = $value;
$wheres[] = $key . " = :" . $key; $wheres[] = $key . " = :" . $key;
@ -1712,9 +1710,7 @@ class core_course_external extends external_api {
if (!isset($excludedcats[$category->id])) { if (!isset($excludedcats[$category->id])) {
// Final check to see if the category is visible to the user. // Final check to see if the category is visible to the user.
if ($category->visible if ($category->visible or has_capability('moodle/category:viewhiddencategories', $context)) {
or has_capability('moodle/category:viewhiddencategories', context_system::instance())
or has_capability('moodle/category:manage', $context)) {
$categoryinfo = array(); $categoryinfo = array();
$categoryinfo['id'] = $category->id; $categoryinfo['id'] = $category->id;

7
course/tests/externallib_test.php
View file

@ -201,6 +201,7 @@ class core_course_externallib_testcase extends externallib_advanced_testcase {
// Set the required capabilities by the external function. // Set the required capabilities by the external function.
$context = context_system::instance(); $context = context_system::instance();
$roleid = $this->assignUserCapability('moodle/category:manage', $context->id); $roleid = $this->assignUserCapability('moodle/category:manage', $context->id);
$this->assignUserCapability('moodle/category:viewhiddencategories', $context->id, $roleid);
// Retrieve category1 + sub-categories except not visible ones // Retrieve category1 + sub-categories except not visible ones
$categories = core_course_external::get_categories(array( $categories = core_course_external::get_categories(array(
@ -278,10 +279,10 @@ class core_course_externallib_testcase extends externallib_advanced_testcase {
$this->assertEquals($DB->count_records('course_categories'), count($categories)); $this->assertEquals($DB->count_records('course_categories'), count($categories));
$this->unassignUserCapability('moodle/category:manage', $context->id, $roleid); $this->unassignUserCapability('moodle/category:viewhiddencategories', $context->id, $roleid);
// Ensure maxdepthcategory is 2 and retrieve all categories without category:manage capability. It should retrieve all // Ensure maxdepthcategory is 2 and retrieve all categories without category:viewhiddencategories capability.
// visible categories as well. // It should retrieve all visible categories as well.
set_config('maxcategorydepth', 2); set_config('maxcategorydepth', 2);
$categories = core_course_external::get_categories(); $categories = core_course_external::get_categories();