Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-10903

Wrong capability checked in get_all_instances_in_course in datalib

    XMLWordPrintable

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Fixed
    • 1.8.2
    • 1.8.3, 1.9
    • Roles / Access
    • None
    • MOODLE_18_STABLE
    • MOODLE_18_STABLE, MOODLE_19_STABLE

    Description

      When a teacher clicks on the Quiz link in the Activities block, quizzes in hidden sections do not display.

      mod/quiz/index.php calls `get_all_instances_in_course("quiz", $course)` at HEAD line 42.

      in lib/datalib.php both functions get_all_instances_in_course() and get_all_instances_in_courses() call `has_capability('moodle/course:viewhiddencourses', get_context_instance(CONTEXT_COURSE, $course->id), $userid)` at HEAD lines 1257 and 1321 when $includeinvisible is not passed as true.

      Teachers with moodle/course:viewhiddenactivities or moodle/course:viewhiddensections should be eligible to see the quizzes regardless of the moodle/course:viewhiddencourses permission, so perhaps the get_all_instances_in_course() call needs to pass the user and includeinvisible flag or the permissions check in the lib/datalib.php functions should be changed to one of these other permissions.

      Attachments

        Activity

          People

            timhunt Tim Hunt
            bluenovember Clinton Graham
            Nobody Nobody
            David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:
              11/Oct/07