MDL-39990 wiki: more detailed validation of view/edit access

mod/wiki/admin.php

@@ -55,6 +55,9 @@ if (!$wiki = wiki_get_wiki($subwiki->wikiid)) {
 
 require_login($course, true, $cm);
 
+if (!wiki_user_can_view($subwiki, $wiki)) {
+    print_error('cannotviewpage', 'wiki');
+}
 
 $context = context_module::instance($cm->id);
 require_capability('mod/wiki:managewiki', $context);

mod/wiki/comments.php

@@ -59,6 +59,10 @@ $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST)
 
 require_login($course, true, $cm);
 
+if (!wiki_user_can_view($subwiki, $wiki)) {
+    print_error('cannotviewpage', 'wiki');
+}
+
 add_to_log($course->id, 'wiki', 'comments', "comments.php?pageid=".$pageid, $pageid, $cm->id);
 
 /// Print the page header

mod/wiki/create_form.php

@@ -77,6 +77,7 @@ class mod_wiki_create_form extends moodleform {
                 $groupname = $groupinfo[$groupid];
                 $mform->addElement('static', 'groupdesciption', get_string('group'), $groupname);
                 $mform->addElement('hidden', 'groupinfo', $groupid);
+                $mform->setType('groupinfo', PARAM_INT);
             }
         }
 

mod/wiki/diff.php

@@ -68,6 +68,10 @@ if ($compare >= $comparewith) {
 
 require_login($course, true, $cm);
 
+if (!wiki_user_can_view($subwiki, $wiki)) {
+    print_error('cannotviewpage', 'wiki');
+}
+
 $wikipage = new page_wiki_diff($wiki, $subwiki, $cm);
 
 $wikipage->set_page($page);

mod/wiki/edit.php

@@ -75,7 +75,10 @@ if (!empty($section) && !$sectioncontent = wiki_get_section_page($page, $section
 require_login($course, true, $cm);
 
 $context = context_module::instance($cm->id);
-require_capability('mod/wiki:editpage', $context);
+
+if (!wiki_user_can_edit($subwiki)) {
+    print_error('cannoteditpage', 'wiki');
+}
 
 if ($option == get_string('save', 'wiki')) {
     if (!confirm_sesskey()) {

mod/wiki/editcomments.php

@@ -54,6 +54,10 @@ if (!$wiki = wiki_get_wiki($subwiki->wikiid)) {
 }
 require_login($course, true, $cm);
 
+if (!wiki_user_can_view($subwiki, $wiki)) {
+    print_error('cannotviewpage', 'wiki');
+}
+
 $editcomments = new page_wiki_editcomment($wiki, $subwiki, $cm);
 $comment = new stdClass();
 if ($action == 'edit') {

mod/wiki/files.php

@@ -78,7 +78,11 @@ $context = context_module::instance($cm->id);
 
 $PAGE->set_url('/mod/wiki/files.php', array('pageid'=>$pageid));
 require_login($course, true, $cm);
-$PAGE->set_context($context);
+
+if (!wiki_user_can_view($subwiki, $wiki)) {
+    print_error('cannotviewfiles', 'wiki');
+}
+
 $PAGE->set_title(get_string('wikifiles', 'wiki'));
 $PAGE->set_heading($course->fullname);
 $PAGE->navbar->add(format_string(get_string('wikifiles', 'wiki')));
@@ -95,12 +99,8 @@ echo $renderer->tabs($page, $tabitems, $options);
 
 
 echo $OUTPUT->box_start('generalbox');
-if (has_capability('mod/wiki:viewpage', $context)) {
 echo $renderer->wiki_print_subwiki_selector($PAGE->activityrecord, $subwiki, $page, 'files');
 echo $renderer->wiki_files_tree($context, $subwiki);
-} else {
-    echo $OUTPUT->notification(get_string('cannotviewfiles', 'wiki'));
-}
 echo $OUTPUT->box_end();
 
 if (has_capability('mod/wiki:managefiles', $context)) {

mod/wiki/filesedit.php

@@ -53,6 +53,10 @@ $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST)
 $context = context_module::instance($cm->id);
 
 require_login($course, true, $cm);
+
+if (!wiki_user_can_view($subwiki, $wiki)) {
+    print_error('cannotviewpage', 'wiki');
+}
 require_capability('mod/wiki:managefiles', $context);
 
 if (empty($returnurl)) {

mod/wiki/history.php

@@ -59,8 +59,11 @@ if (!$cm = get_coursemodule_from_instance('wiki', $wiki->id)) {
 $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
 
 require_login($course, true, $cm);
-$context = context_module::instance($cm->id);
+
-require_capability('mod/wiki:viewpage', $context);
+if (!wiki_user_can_view($subwiki, $wiki)) {
+    print_error('cannotviewpage', 'wiki');
+}
+
 add_to_log($course->id, 'wiki', 'history', "history.php?pageid=".$pageid, $pageid, $cm->id);
 
 /// Print the page header

mod/wiki/lib.php

@@ -280,7 +280,7 @@ function wiki_print_recent_activity($course, $viewfullnames, $timestart) {
     global $CFG, $DB, $OUTPUT;
 
     $usernamefields = get_all_user_name_fields(true, 'u');
-    $sql = "SELECT p.*, w.id as wikiid, sw.groupid, $usernamefields
+    $sql = "SELECT p.id, p.timemodified, p.subwikiid, sw.wikiid, w.wikimode, sw.userid, sw.groupid, $usernamefields
             FROM {wiki_pages} p
                 JOIN {wiki_subwikis} sw ON sw.id = p.subwikiid
                 JOIN {wiki} w ON w.id = sw.wikiid
@@ -290,48 +290,25 @@ function wiki_print_recent_activity($course, $viewfullnames, $timestart) {
     if (!$pages = $DB->get_records_sql($sql, array($timestart, $course->id))) {
         return false;
     }
-    $modinfo = get_fast_modinfo($course);
+    require_once($CFG->dirroot . "/mod/wiki/locallib.php");
 
     $wikis = array();
 
     $modinfo = get_fast_modinfo($course);
 
+    $subwikivisible = array();
     foreach ($pages as $page) {
-        if (!isset($modinfo->instances['wiki'][$page->wikiid])) {
+        if (!isset($subwikivisible[$page->subwikiid])) {
-            // not visible
+            $subwiki = (object)array('id' => $page->subwikiid, 'wikiid' => $page->wikiid,
-            continue;
+                'groupid' => $page->groupid, 'userid' => $page->userid);
-        }
+            $wiki = (object)array('id' => $page->wikiid, 'course' => $course->id, 'wikimode' => $page->wikimode);
-        $cm = $modinfo->instances['wiki'][$page->wikiid];
+            $subwikivisible[$page->subwikiid] = wiki_user_can_view($subwiki, $wiki);
-        if (!$cm->uservisible) {
-            continue;
-        }
-        $context = context_module::instance($cm->id);
-
-        if (!has_capability('mod/wiki:viewpage', $context)) {
-            continue;
-        }
-
-        $groupmode = groups_get_activity_groupmode($cm, $course);
-
-        if ($groupmode) {
-            if ($groupmode == SEPARATEGROUPS and !has_capability('mod/wiki:managewiki', $context)) {
-                // separate mode
-                if (isguestuser()) {
-                    // shortcut
-                    continue;
-                }
-
-                if (is_null($modinfo->groups)) {
-                    $modinfo->groups = groups_get_user_groups($course->id); // load all my groups and cache it in modinfo
-                    }
-
-                if (!in_array($page->groupid, $modinfo->groups[0])) {
-                    continue;
-                }
-            }
         }
+        if ($subwikivisible[$page->subwikiid]) {
             $wikis[] = $page;
         }
+    }
+    unset($subwikivisible);
     unset($pages);
 
     if (!$wikis) {

mod/wiki/locallib.php

@@ -719,13 +719,27 @@ function wiki_parser_get_token($markup, $name) {
 /**
  * Checks if current user can view a subwiki
  *
- * @param $subwiki
+ * @param stdClass $subwiki usually record from {wiki_subwikis}. Must contain fields 'wikiid', 'groupid', 'userid'.
+ *     If it also contains fields 'course' and 'groupmode' from table {wiki} it will save extra DB query.
+ * @param stdClass $wiki optional wiki object if known
+ * @return bool
  */
-function wiki_user_can_view($subwiki) {
+function wiki_user_can_view($subwiki, $wiki = null) {
     global $USER;
 
+    if (empty($wiki) || $wiki->id != $subwiki->wikiid) {
         $wiki = wiki_get_wiki($subwiki->wikiid);
-    $cm = get_coursemodule_from_instance('wiki', $wiki->id);
+    }
+    $modinfo = get_fast_modinfo($wiki->course);
+    if (!isset($modinfo->instances['wiki'][$subwiki->wikiid])) {
+        // Module does not exist.
+        return false;
+    }
+    $cm = $modinfo->instances['wiki'][$subwiki->wikiid];
+    if (!$cm->uservisible) {
+        // The whole module is not visible to the current user.
+        return false;
+    }
     $context = context_module::instance($cm->id);
 
     // Working depending on activity groupmode
@@ -767,7 +781,7 @@ function wiki_user_can_view($subwiki) {
         //      Each person owns a wiki.
         if ($wiki->wikimode == 'collaborative' || $wiki->wikimode == 'individual') {
             // Only members of subwiki group could view that wiki
-            if (groups_is_member($subwiki->groupid)) {
+            if (in_array($subwiki->groupid, $modinfo->get_groups($cm->groupingid))) {
                 // Only view capability needed
                 return has_capability('mod/wiki:viewpage', $context);
 

mod/wiki/lock.php

@@ -68,8 +68,9 @@ if (!empty($section) && !$sectioncontent = wiki_get_section_page($page, $section
 
 require_login($course, false, $cm);
 
-$context = context_module::instance($cm->id);
+if (!wiki_user_can_edit($subwiki)) {
-require_capability('mod/wiki:editpage', $context);
+    print_error('cannoteditpage', 'wiki');
+}
 
 $wikipage = new page_wiki_lock($wiki, $subwiki, $cm);
 $wikipage->set_page($page);

mod/wiki/map.php

@@ -54,8 +54,10 @@ if (!$wiki = wiki_get_wiki($subwiki->wikiid)) {
 }
 
 require_login($course, true, $cm);
-$context = context_module::instance($cm->id);
+
-require_capability('mod/wiki:viewpage', $context);
+if (!wiki_user_can_view($subwiki, $wiki)) {
+    print_error('cannotviewpage', 'wiki');
+}
 
 $wikipage = new page_wiki_map($wiki, $subwiki, $cm);
 add_to_log($course->id, "wiki", "map", "map.php?pageid=".$pageid, $pageid, $cm->id);

mod/wiki/overridelocks.php

@@ -64,13 +64,14 @@ if (!empty($section) && !$sectioncontent = wiki_get_section_page($page, $section
 
 require_login($course, true, $cm);
 
+require_sesskey();
+
+if (!wiki_user_can_view($subwiki, $wiki)) {
+    print_error('cannotviewpage', 'wiki');
+}
 $context = context_module::instance($cm->id);
 require_capability('mod/wiki:overridelock', $context);
 
-if (!confirm_sesskey()) {
-    print_error(get_string('invalidsesskey', 'wiki'));
-}
-
 $wikipage = new page_wiki_overridelocks($wiki, $subwiki, $cm);
 $wikipage->set_page($page);
 

mod/wiki/prettyview.php

@@ -53,8 +53,9 @@ if (!$wiki = wiki_get_wiki($subwiki->wikiid)) {
 
 require_login($course, true, $cm);
 
-$context = context_module::instance($cm->id);
+if (!wiki_user_can_view($subwiki, $wiki)) {
-require_capability('mod/wiki:viewpage', $context);
+    print_error('cannotviewpage', 'wiki');
+}
 
 $wikipage = new page_wiki_prettyview($wiki, $subwiki, $cm);
 

mod/wiki/restoreversion.php

@@ -60,6 +60,10 @@ $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST)
 
 require_login($course, true, $cm);
 
+if (!wiki_user_can_view($subwiki)) {
+    print_error('cannotviewpage', 'wiki');
+}
+
 if ($confirm) {
     if (!confirm_sesskey()) {
         print_error(get_string('invalidsesskey', 'wiki'));

mod/wiki/search.php

@@ -45,12 +45,16 @@ if (!$gid = groups_get_activity_group($cm)) {
     $gid = 0;
 }
 if (!$subwiki = wiki_get_subwiki_by_group($cm->instance, $gid)) {
-    return false;
+    print_error('incorrectsubwikiid', 'wiki');
 }
 if (!$wiki = wiki_get_wiki($subwiki->wikiid)) {
     print_error('incorrectwikiid', 'wiki');
 }
 
+if (!wiki_user_can_view($subwiki, $wiki)) {
+    print_error('cannotviewfiles', 'wiki');
+}
+
 $wikipage = new page_wiki_search($wiki, $subwiki, $cm);
 
 $wikipage->set_search_string($search, $searchcontent);

mod/wiki/view.php

@@ -271,8 +271,9 @@ if ($id) {
     print_error('incorrectparameters');
 }
 
-$context = context_module::instance($cm->id);
+if (!wiki_user_can_view($subwiki, $wiki)) {
-require_capability('mod/wiki:viewpage', $context);
+    print_error('cannotviewpage', 'wiki');
+}
 
 // Update 'viewed' state if required by completion system
 require_once($CFG->libdir . '/completionlib.php');
@@ -288,6 +289,7 @@ $wikipage = new page_wiki_view($wiki, $subwiki, $cm);
 $wikipage->set_gid($currentgroup);
 $wikipage->set_page($page);
 
+$context = context_module::instance($cm->id);
 if($pageid) {
     add_to_log($course->id, 'wiki', 'view', "view.php?pageid=".$pageid, $pageid, $cm->id);
 } else if($id) {

mod/wiki/viewversion.php

@@ -60,6 +60,10 @@ $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST)
 
 require_login($course, true, $cm);
 
+if (!wiki_user_can_view($subwiki, $wiki)) {
+    print_error('cannotviewpage', 'wiki');
+}
+
 $wikipage = new page_wiki_viewversion($wiki, $subwiki, $cm);
 
 $wikipage->set_page($page);