MDL-19882 Add missing require_login-s before require_capability.

NoelDeMartin · Jul 20, 2009 · ebff477 · ebff477
1 parent 9097fa2
commit ebff477
Show file tree

Hide file tree

Showing 11 changed files with 22 additions and 13 deletions.
diff --git a/admin/uploaduser.php b/admin/uploaduser.php
@@ -27,6 +27,7 @@
     @apache_child_terminate();
 }
 
+require_login();
 admin_externalpage_setup('uploadusers');
 require_capability('moodle/site:uploadusers', get_context_instance(CONTEXT_SYSTEM));
 

diff --git a/admin/user/user_bulk_confirm.php b/admin/user/user_bulk_confirm.php
@@ -8,6 +8,7 @@
 
 $confirm = optional_param('confirm', 0, PARAM_BOOL);
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM));
 

diff --git a/admin/user/user_bulk_delete.php b/admin/user/user_bulk_delete.php
@@ -8,6 +8,7 @@
 
 $confirm = optional_param('confirm', 0, PARAM_BOOL);
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/user:delete', get_context_instance(CONTEXT_SYSTEM));
 

diff --git a/admin/user/user_bulk_download.php b/admin/user/user_bulk_download.php
@@ -8,6 +8,7 @@
 
 $format = optional_param('format', '', PARAM_ALPHA);
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM));
 

diff --git a/admin/user/user_bulk_enrol.php b/admin/user/user_bulk_enrol.php
@@ -8,6 +8,7 @@
 $sort = optional_param('sort', 'fullname', PARAM_ALPHA); //Sort by full name
 $dir  = optional_param('dir', 'asc', PARAM_ALPHA);       //Order to sort (ASC)
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/user:delete', get_context_instance(CONTEXT_SYSTEM));
 $return = $CFG->wwwroot.'/'.$CFG->admin.'/user/user_bulk.php';

diff --git a/admin/user/user_bulk_message.php b/admin/user/user_bulk_message.php
@@ -7,6 +7,7 @@
 $msg     = optional_param('msg', '', PARAM_CLEAN);
 $confirm = optional_param('confirm', 0, PARAM_BOOL);
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/site:readallmessages', get_context_instance(CONTEXT_SYSTEM));
 

diff --git a/course/category.php b/course/category.php
@@ -17,10 +17,6 @@
     $moveto = optional_param('moveto', 0, PARAM_INT);
     $resort = optional_param('resort', 0, PARAM_BOOL);
 
-    if ($CFG->forcelogin) {
-        require_login();
-    }
-
     if (!$site = get_site()) {
         print_error('siteisnotdefined', 'debug');
     }
@@ -33,21 +29,25 @@
     $context = $PAGE->context;
     $category = $PAGE->category;
 
-    if (!$category->visible) {
-        require_capability('moodle/category:viewhiddencategories', $context);
-    }
-
     if (update_category_button($category->id)) {
         if ($categoryedit !== -1) {
             $USER->editing = $categoryedit;
         }
-        $editingon = $PAGE->user_is_editing();
+        require_login();
         $navbaritem = update_category_button($category->id); // Must call this again after updating the state.
+        $editingon = $PAGE->user_is_editing();
     } else {
+        if ($CFG->forcelogin) {
+            require_login();
+        }
         $navbaritem = print_course_search('', true, 'navbar');
         $editingon = false;
     }
 
+    if (!$category->visible) {
+        require_capability('moodle/category:viewhiddencategories', $context);
+    }
+
     // Process any category actions.
     if (has_capability('moodle/category:manage', $context)) {
         /// Resort the category if requested

diff --git a/course/index.php b/course/index.php
@@ -14,10 +14,6 @@
     $moveup   = optional_param('moveup',0,PARAM_INT);
     $movedown = optional_param('movedown',0,PARAM_INT);
 
-    if ($CFG->forcelogin) {
-        require_login();
-    }
-
     if (!$site = get_site()) {
         print_error('siteisnotdefined', 'debug');
     }
@@ -31,8 +27,12 @@
         if ($categoryedit !== -1) {
             $USER->editing = $categoryedit;
         }
+        require_login();
         $adminediting = $PAGE->user_is_editing();
     } else {
+        if ($CFG->forcelogin) {
+            require_login();
+        }
         $adminediting = false;
     }
 

diff --git a/enrol/mnet/allowed_courses.php b/enrol/mnet/allowed_courses.php
@@ -19,6 +19,7 @@
 $addcourse      = optional_param('addcourse', 0, PARAM_BOOL);
 $removecourse   = optional_param('removecourse', 0, PARAM_BOOL);
 
+require_login();
 $sitecontext = get_context_instance(CONTEXT_SYSTEM);
 $sesskey = sesskey();
 $formerror = array();

diff --git a/login/change_password.php b/login/change_password.php
@@ -26,6 +26,7 @@
 
     // do not require change own password cap if change forced
     if (!get_user_preferences('auth_forcepasswordchange', false)) {
+        require_login();
         require_capability('moodle/user:changeownpassword', $systemcontext);
     }
 

diff --git a/mnet/testclient.php b/mnet/testclient.php
@@ -18,6 +18,7 @@
 }
 
 // Site admins only, thanks.
+require_login();
 $context = get_context_instance(CONTEXT_SYSTEM);
 require_capability('moodle/site:config', $context);