Skip to content

Commit

Permalink
MDL-49821 webservice: Add active user checks in external functions
Browse files Browse the repository at this point in the history
  • Loading branch information
@jleyva
jleyva committed Sep 25, 2015
1 parent 3961ebf commit 4485f7c
Show file tree
Hide file tree
Showing 7 changed files with 27 additions and 45 deletions.
7 changes: 5 additions & 2 deletions completion/classes/external.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,8 @@ public static function get_activities_completion_status($courseid, $userid) {
$params = self::validate_parameters(self::get_activities_completion_status_parameters(), $arrayparams);

$course = get_course($params['courseid']);
$user = core_user::get_user($params['userid'], 'id', MUST_EXIST);
$user = core_user::get_user($params['userid'], '*', MUST_EXIST);
core_user::require_active_user($user);

$context = context_course::instance($course->id);
self::validate_context($context);
Expand Down Expand Up @@ -270,7 +271,9 @@ public static function get_course_completion_status($courseid, $userid) {
$params = self::validate_parameters(self::get_course_completion_status_parameters(), $arrayparams);

$course = get_course($params['courseid']);
$user = core_user::get_user($params['userid'], 'id', MUST_EXIST);
$user = core_user::get_user($params['userid'], '*', MUST_EXIST);
core_user::require_active_user($user);

$context = context_course::instance($course->id);
self::validate_context($context);

Expand Down
9 changes: 2 additions & 7 deletions grade/report/user/externallib.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ public static function get_grades_table($courseid, $userid = 0) {
require_capability('moodle/grade:viewall', $context);
} else {
$user = core_user::get_user($userid, '*', MUST_EXIST);
core_user::require_active_user($user);
}

$access = false;
Expand Down Expand Up @@ -301,13 +302,7 @@ public static function view_grade_report($courseid, $userid = 0) {
$userid = $USER->id;
} else {
$user = core_user::get_user($userid, '*', MUST_EXIST);
if ($user->deleted) {
throw new moodle_exception('userdeleted');
}
if (isguestuser($user)) {
// Can not view profile of guest - thre is nothing to see there.
throw new moodle_exception('invaliduserid');
}
core_user::require_active_user($user);
}

$access = false;
Expand Down
12 changes: 4 additions & 8 deletions group/externallib.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1224,7 +1224,8 @@ public static function get_course_user_groups($courseid, $userid, $groupingid =

// Validate course and user. get_course throws an exception if the course does not exists.
$course = get_course($courseid);
$user = core_user::get_user($userid, 'id', MUST_EXIST);
$user = core_user::get_user($userid, '*', MUST_EXIST);
core_user::require_active_user($user);

// Security checks.
$context = context_course::instance($course->id);
Expand Down Expand Up @@ -1348,13 +1349,8 @@ public static function get_activity_allowed_groups($cmid, $userid = 0) {
$userid = $USER->id;
}

$user = core_user::get_user($userid, 'id, deleted', MUST_EXIST);
if ($user->deleted) {
throw new moodle_exception('userdeleted');
}
if (isguestuser($user)) {
throw new moodle_exception('invaliduserid');
}
$user = core_user::get_user($userid, '*', MUST_EXIST);
core_user::require_active_user($user);

// Check if we have permissions for retrieve the information.
if ($user->id != $USER->id) {
Expand Down
3 changes: 2 additions & 1 deletion message/externallib.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -885,7 +885,8 @@ public static function get_blocked_users($userid) {
throw new moodle_exception('disabled', 'message');
}

$user = core_user::get_user($userid, 'id', MUST_EXIST);
$user = core_user::get_user($userid, '*', MUST_EXIST);
core_user::require_active_user($user);

// Check if we have permissions for retrieve the information.
if ($userid != $USER->id and !has_capability('moodle/site:readallmessages', $context)) {
Expand Down
18 changes: 9 additions & 9 deletions mod/scorm/classes/external.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -147,18 +147,18 @@ public static function get_scorm_attempt_count($scormid, $userid, $ignoremissing
$context = context_module::instance($cm->id);
self::validate_context($context);

// Validate the user obtaining the context, it will fail if the user doesn't exists or have been deleted.
context_user::instance($params['userid']);
$user = core_user::get_user($params['userid'], '*', MUST_EXIST);
core_user::require_active_user($user);

// Extra checks so only users with permissions can view other users attempts.
if ($USER->id != $params['userid']) {
if ($USER->id != $user->id) {
require_capability('mod/scorm:viewreport', $context);
}

// If the SCORM is not open this function will throw exceptions.
scorm_require_available($scorm);

$attemptscount = scorm_get_attempt_count($params['userid'], $scorm, false, $params['ignoremissingcompletion']);
$attemptscount = scorm_get_attempt_count($user->id, $scorm, false, $params['ignoremissingcompletion']);

$result = array();
$result['attemptscount'] = $attemptscount;
Expand Down Expand Up @@ -536,21 +536,21 @@ public static function get_scorm_sco_tracks($scoid, $userid, $attempt = 0) {
$context = context_module::instance($cm->id);
self::validate_context($context);

// Validate the user obtaining the context, it will fail if the user doesn't exists or have been deleted.
context_user::instance($params['userid']);
$user = core_user::get_user($params['userid'], '*', MUST_EXIST);
core_user::require_active_user($user);

// Extra checks so only users with permissions can view other users attempts.
if ($USER->id != $params['userid']) {
if ($USER->id != $user->id) {
require_capability('mod/scorm:viewreport', $context);
}

scorm_require_available($scorm, true, $context);

if (empty($params['attempt'])) {
$params['attempt'] = scorm_get_last_attempt($scorm->id, $params['userid']);
$params['attempt'] = scorm_get_last_attempt($scorm->id, $user->id);
}

if ($scormtracks = scorm_get_tracks($sco->id, $params['userid'], $params['attempt'])) {
if ($scormtracks = scorm_get_tracks($sco->id, $user->id, $params['attempt'])) {
foreach ($scormtracks as $element => $value) {
$tracks[] = array(
'element' => $element,
Expand Down
14 changes: 4 additions & 10 deletions notes/externallib.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -526,7 +526,8 @@ public static function get_course_notes($courseid, $userid = 0) {
}
$user = null;
if (!empty($params['userid'])) {
$user = core_user::get_user($params['userid'], 'id', MUST_EXIST);
$user = core_user::get_user($params['userid'], '*', MUST_EXIST);
core_user::require_active_user($user);
}

$course = get_course($params['courseid']);
Expand Down Expand Up @@ -680,15 +681,8 @@ public static function view_notes($courseid, $userid = 0) {
require_capability('moodle/notes:view', $context);

if (!empty($params['userid'])) {
$user = core_user::get_user($params['userid'], 'id, deleted', MUST_EXIST);

if ($user->deleted) {
throw new moodle_exception('userdeleted');
}

if (isguestuser($user)) {
throw new moodle_exception('invaliduserid');
}
$user = core_user::get_user($params['userid'], '*', MUST_EXIST);
core_user::require_active_user($user);

if ($course->id != SITEID and !is_enrolled($context, $user, '', true)) {
throw new moodle_exception('notenrolledprofile');
Expand Down
9 changes: 1 addition & 8 deletions user/externallib.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1389,14 +1389,7 @@ public static function view_user_profile($userid, $courseid = 0) {

$course = get_course($params['courseid']);
$user = core_user::get_user($params['userid'], '*', MUST_EXIST);

if ($user->deleted) {
throw new moodle_exception('userdeleted');
}
if (isguestuser($user)) {
// Can not view profile of guest - thre is nothing to see there.
throw new moodle_exception('invaliduserid');
}
core_user::require_active_user($user);

if ($course->id == SITEID) {
$coursecontext = context_system::instance();;
Expand Down

0 comments on commit 4485f7c

Please sign in to comment.