Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-10903

Wrong capability checked in get_all_instances_in_course in datalib

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 1.8.2
    • Fix Version/s: 1.8.3, 1.9
    • Component/s: Roles / Access
    • Labels:
      None
    • Affected Branches:
      MOODLE_18_STABLE
    • Fixed Branches:
      MOODLE_18_STABLE, MOODLE_19_STABLE

      Description

      When a teacher clicks on the Quiz link in the Activities block, quizzes in hidden sections do not display.

      mod/quiz/index.php calls `get_all_instances_in_course("quiz", $course)` at HEAD line 42.

      in lib/datalib.php both functions get_all_instances_in_course() and get_all_instances_in_courses() call `has_capability('moodle/course:viewhiddencourses', get_context_instance(CONTEXT_COURSE, $course->id), $userid)` at HEAD lines 1257 and 1321 when $includeinvisible is not passed as true.

      Teachers with moodle/course:viewhiddenactivities or moodle/course:viewhiddensections should be eligible to see the quizzes regardless of the moodle/course:viewhiddencourses permission, so perhaps the get_all_instances_in_course() call needs to pass the user and includeinvisible flag or the permissions check in the lib/datalib.php functions should be changed to one of these other permissions.

        Attachments

          Activity

            People

            Assignee:
            timhunt Tim Hunt
            Reporter:
            bluenovember Clinton Graham
            Tester:
            Nobody
            Participants:
            Component watchers:
            Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Sara Arjona (@sarjona), Víctor Déniz Falcón
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Fix Release Date:
              11/Oct/07