Proyectos de Subversion Moodle

Rev

Rev 1 | Mostrar el archivo completo | | | Autoría | Ultima modificación | Ver Log |

Rev 1 Rev 1441
Línea 30... Línea 30...
30 
 * @param array $options additional options affecting the file serving
 30 
 * @param array $options additional options affecting the file serving
31 
 * @return bool
 31 
 * @return bool
32 
 * @todo MDL-36050 improve capability check on stick blocks, so we can check user capability before sending images.
 32 
 * @todo MDL-36050 improve capability check on stick blocks, so we can check user capability before sending images.
33 
 */
 33 
 */
34 
function block_html_pluginfile($course, $birecord_or_cm, $context, $filearea, $args, $forcedownload, array $options=array()) {
 34 
function block_html_pluginfile($course, $birecord_or_cm, $context, $filearea, $args, $forcedownload, array $options=array()) {
35 
    global $DB, $CFG, $USER;
 35 
    global $CFG;
- 
 
 36 
 
- 
 
 37 
    require_once("{$CFG->dirroot}/user/lib.php");
Línea 36... Línea 38...
36 
 
 38 
 
37 
    if ($context->contextlevel != CONTEXT_BLOCK) {
 39 
    if ($context->contextlevel != CONTEXT_BLOCK) {
38 
        send_file_not_found();
 40 
        send_file_not_found();
Línea 49... Línea 51...
49 
        if ($parentcontext->contextlevel === CONTEXT_COURSECAT) {
 51 
        if ($parentcontext->contextlevel === CONTEXT_COURSECAT) {
50 
            // Check if category is visible and user can view this category.
 52 
            // Check if category is visible and user can view this category.
51 
            if (!core_course_category::get($parentcontext->instanceid, IGNORE_MISSING)) {
 53 
            if (!core_course_category::get($parentcontext->instanceid, IGNORE_MISSING)) {
52 
                send_file_not_found();
 54 
                send_file_not_found();
53 
            }
 55 
            }
54 
        } else if ($parentcontext->contextlevel === CONTEXT_USER && $parentcontext->instanceid != $USER->id) {
 56 
        } else if ($parentcontext->contextlevel === CONTEXT_USER) {
- 
 
 57 
            $user = core_user::get_user($parentcontext->instanceid, '*', MUST_EXIST);
55 
            // The block is in the context of a user, it is only visible to the user who it belongs to.
 58 
            $extracaps = block_method_result('html', 'get_extra_capabilities');
- 
 
 59 
            if (!user_can_view_profile($user, null, $parentcontext) || !has_any_capability($extracaps, $context)) {
56 
            send_file_not_found();
 60 
                send_file_not_found();
- 
 
 61 
            }
57 
        }
 62 
        }
58 
        // At this point there is no way to check SYSTEM context, so ignoring it.
 63 
        // At this point there is no way to check SYSTEM context, so ignoring it.
59 
    }
 64 
    }
Línea 60... Línea 65...
60 
 
 65