Skip to content

Commit

Permalink
fix: use correct course-id for capability check;
Browse files Browse the repository at this point in the history
  • Loading branch information
@ernst-metaventis
ernst-metaventis committed Jun 16, 2020
1 parent d516bd1 commit a562012
Show file tree
Hide file tree
Showing 8 changed files with 35 additions and 20 deletions.
2 changes: 1 addition & 1 deletion delete.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@
require_login();
require_sesskey();

$coursecontext = context_course::instance($COURSE->id);
$coursecontext = context_course::instance($_GET['courseid']);
if (!has_capability('atto/edusharing:visible', $coursecontext)) {
trigger_error(get_string('error_deleting_capability', 'editor_edusharing'), E_USER_WARNING);
header('', true, 500);
Expand Down
11 changes: 7 additions & 4 deletions fetch.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,15 +28,18 @@

require_login();

$coursecontext = context_course::instance($COURSE->id);
if (!has_capability('atto/edusharing:visible', $coursecontext)) {
$jsonstr = file_get_contents('php://input');
$jsonobj = json_decode($jsonstr, true);

$coursecontext = context_course::instance($jsonobj['courseid']);
if (!has_capability('moodle/course:update', $coursecontext)) {
trigger_error(get_string('error_fetching_capability', 'editor_edusharing'), E_USER_WARNING);
error_log('error_fetching_capability');
header('', true, 500);
exit();
}

$jsonstr = file_get_contents('php://input');
$jsonobj = json_decode($jsonstr, true);


switch ($jsonobj['useCase']) {
case 'getTicket':
Expand Down
2 changes: 1 addition & 1 deletion insert.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@
require_login();
require_sesskey();

$coursecontext = context_course::instance($COURSE->id);
$coursecontext = context_course::instance($_GET['courseid']);
if (!has_capability('atto/edusharing:visible', $coursecontext)) {
trigger_error(get_string('error_insert_capability', 'editor_edusharing'), E_USER_WARNING);
header('', true, 500);
Expand Down
2 changes: 1 addition & 1 deletion version.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@

defined('MOODLE_INTERNAL') || die();

$plugin->version = 2020061502; // The current plugin version (Date: YYYYMMDDXX).
$plugin->version = 2020061603; // The current plugin version (Date: YYYYMMDDXX).
$plugin->requires = 2013110500; // Requires this Moodle version.
$plugin->component = 'atto_edusharing'; // Full name of the plugin (used for diagnostics).
$plugin->maturity = MATURITY_STABLE;
Expand Down
12 changes: 8 additions & 4 deletions yui/build/moodle-atto_edusharing-button/moodle-atto_edusharing-button-debug.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -502,6 +502,7 @@ Y.namespace('M.atto_edusharing').Button = Y.Base.create('button', Y.M.editor_att

var fetchUrl = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/fetch.php';
var repoUrl = this.get('repourl');
var courseid = this.get('courseid');

// Fetch ticket
fetch(fetchUrl, {
Expand All @@ -512,7 +513,8 @@ Y.namespace('M.atto_edusharing').Button = Y.Base.create('button', Y.M.editor_att
'Accept': 'application/json' // Expected data sent back
},
body: JSON.stringify({
useCase: 'getTicket'
useCase: 'getTicket',
courseid: courseid
})
})
.then(function(response) {
Expand Down Expand Up @@ -759,9 +761,10 @@ edusharingObject.prototype.importNode = function importNode(searchParams) {
* @return bool
*/
edusharingObject.prototype.link = function link(node) {
// Helper-url.

var helper_url = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/insert.php?sesskey=' + M.cfg.sesskey;
// Helper-url.
var helper_url = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/insert.php?sesskey=' +
M.cfg.sesskey + '&courseid=' + this.course;

// Bind object for context.
var object = this;
Expand Down Expand Up @@ -826,7 +829,8 @@ edusharingObject.prototype.link = function link(node) {
*/
edusharingObject.prototype.unlink = function unlink(node) {
// Tell moodle about deleted object.
var helper_url = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/delete.php?sesskey=' + M.cfg.sesskey;
var helper_url = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/delete.php?sesskey=' + M.cfg.sesskey +
'&courseid=' + this.course;

// Bind object for context.
var object = this;
Expand Down
2 changes: 1 addition & 1 deletion yui/build/moodle-atto_edusharing-button/moodle-atto_edusharing-button-min.js
View file

Large diffs are not rendered by default.

12 changes: 8 additions & 4 deletions yui/build/moodle-atto_edusharing-button/moodle-atto_edusharing-button.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -502,6 +502,7 @@ Y.namespace('M.atto_edusharing').Button = Y.Base.create('button', Y.M.editor_att

var fetchUrl = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/fetch.php';
var repoUrl = this.get('repourl');
var courseid = this.get('courseid');

// Fetch ticket
fetch(fetchUrl, {
Expand All @@ -512,7 +513,8 @@ Y.namespace('M.atto_edusharing').Button = Y.Base.create('button', Y.M.editor_att
'Accept': 'application/json' // Expected data sent back
},
body: JSON.stringify({
useCase: 'getTicket'
useCase: 'getTicket',
courseid: courseid
})
})
.then(function(response) {
Expand Down Expand Up @@ -759,9 +761,10 @@ edusharingObject.prototype.importNode = function importNode(searchParams) {
* @return bool
*/
edusharingObject.prototype.link = function link(node) {
// Helper-url.

var helper_url = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/insert.php?sesskey=' + M.cfg.sesskey;
// Helper-url.
var helper_url = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/insert.php?sesskey=' +
M.cfg.sesskey + '&courseid=' + this.course;

// Bind object for context.
var object = this;
Expand Down Expand Up @@ -826,7 +829,8 @@ edusharingObject.prototype.link = function link(node) {
*/
edusharingObject.prototype.unlink = function unlink(node) {
// Tell moodle about deleted object.
var helper_url = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/delete.php?sesskey=' + M.cfg.sesskey;
var helper_url = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/delete.php?sesskey=' + M.cfg.sesskey +
'&courseid=' + this.course;

// Bind object for context.
var object = this;
Expand Down
12 changes: 8 additions & 4 deletions yui/src/button/js/button.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -500,6 +500,7 @@ Y.namespace('M.atto_edusharing').Button = Y.Base.create('button', Y.M.editor_att

var fetchUrl = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/fetch.php';
var repoUrl = this.get('repourl');
var courseid = this.get('courseid');

// Fetch ticket
fetch(fetchUrl, {
Expand All @@ -510,7 +511,8 @@ Y.namespace('M.atto_edusharing').Button = Y.Base.create('button', Y.M.editor_att
'Accept': 'application/json' // Expected data sent back
},
body: JSON.stringify({
useCase: 'getTicket'
useCase: 'getTicket',
courseid: courseid
})
})
.then(function(response) {
Expand Down Expand Up @@ -757,9 +759,10 @@ edusharingObject.prototype.importNode = function importNode(searchParams) {
* @return bool
*/
edusharingObject.prototype.link = function link(node) {
// Helper-url.

var helper_url = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/insert.php?sesskey=' + M.cfg.sesskey;
// Helper-url.
var helper_url = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/insert.php?sesskey=' +
M.cfg.sesskey + '&courseid=' + this.course;

// Bind object for context.
var object = this;
Expand Down Expand Up @@ -824,7 +827,8 @@ edusharingObject.prototype.link = function link(node) {
*/
edusharingObject.prototype.unlink = function unlink(node) {
// Tell moodle about deleted object.
var helper_url = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/delete.php?sesskey=' + M.cfg.sesskey;
var helper_url = M.cfg.wwwroot + '/lib/editor/atto/plugins/edusharing/delete.php?sesskey=' + M.cfg.sesskey +
'&courseid=' + this.course;

// Bind object for context.
var object = this;
Expand Down

0 comments on commit a562012

Please sign in to comment.