MDL-23302 Credit to Aparup. New cap moodle/user:manageownfiles to control private user files area

blocks/private_files/block_private_files.php

@@ -60,7 +60,9 @@ class block_private_files extends block_base {
 
             $renderer = $this->page->get_renderer('block_private_files');
             $this->content->text = $renderer->private_files_tree();
+            if (has_capability('moodle/user:manageownfiles', $this->context)) {
                 $this->content->text .= $OUTPUT->single_button(new moodle_url('/user/filesedit.php'), get_string('myfilesmanage'), 'get');
+            }
             $this->content->footer = '';
 
         }

lang/en/role.php

@@ -353,6 +353,7 @@ $string['user:editprofile'] = 'Edit user profile';
 $string['user:loginas'] = 'Login as other users';
 $string['user:manageblocks'] = 'Manage blocks on user profile of other users';
 $string['user:manageownblocks'] = 'Manage blocks on own public user profile';
+$string['user:manageownfiles'] = 'Manage files on own private file areas';
 $string['user:managesyspages'] = 'Configure default page layout for public user profiles';
 $string['user:readuserblogs'] = 'See all user blogs';
 $string['user:readuserposts'] = 'See all user posts';

lib/db/access.php

@@ -522,7 +522,19 @@ $capabilities = array(
         'captype' => 'write',
         'contextlevel' => CONTEXT_SYSTEM,
         'archetypes' => array(
-            'user' => CAP_ALLOW,
+            'user' => CAP_ALLOW
+        )
+    ),
+
+    // can the user manage their own files?
+    'moodle/user:manageownfiles' => array(
+
+        'riskbitmap' => RISK_SPAM | RISK_PERSONAL,
+
+        'captype' => 'write',
+        'contextlevel' => CONTEXT_SYSTEM,
+        'archetypes' => array(
+            'user' => CAP_ALLOW
         )
     ),
 

user/filesedit.php

@@ -31,9 +31,9 @@ require_login();
 if (isguestuser()) {
     die();
 }
-//TODO: add capability check here!
-
 $context = get_context_instance(CONTEXT_USER, $USER->id);
+require_capability('moodle/user:manageownfiles', $context);
+
 $title = get_string('myfiles');
 $struser = get_string('user');