[MDL-33383] Not enrolled users can be subscribed to forum - Moodle Tracker

XML

Word

Printable

Testing Instructions:
Hide

Testing difficulty: moderate

Login as admin

Write down the IDs of two users (not the admin user)

Enrol one of this user in a course

Create a forum with optional subscription

Visit the following URL (/mod/forum/subscribe.php?id=&sesskey=&user=) making sure you:

Update the id variable with your forum id

Update the sesskey with yours

Set the user variable to the user id of the enrolled user

The following page confirms that the user has been subscribed

Now visit the same URL but change the user id with the one of the user that is not enrolled in the course

An error occurs preventing the user to be subscribed
Show
Testing difficulty: moderate Login as admin Write down the IDs of two users (not the admin user) Enrol one of this user in a course Create a forum with optional subscription Visit the following URL (/mod/forum/subscribe.php?id=&sesskey=&user=) making sure you: Update the id variable with your forum id Update the sesskey with yours Set the user variable to the user id of the enrolled user The following page confirms that the user has been subscribed Now visit the same URL but change the user id with the one of the user that is not enrolled in the course An error occurs preventing the user to be subscribed
Affected Branches:
MOODLE_21_STABLE, MOODLE_22_STABLE

When subscribing a user to a forum, the permissions to subscribe to the forum are tested against the current user, not the target one.

Before fixing, following the test instructions will fail at step 5 because the admin user is not enrolled in the course.

See mod/forum/subscribe.php:83 and linked issue.

has been marked as being related by

MDL-36460 Forced/Auto forums list all potential subscribers and ignore completion/availability info

Testing discovered

MDL-33194 Can't subscribe other user to forum

Participants:: Frédéric Massart, Luca Bösch, Michael de Raadt, Rajesh Taneja

Component watchers:: Andrew Nicols, Dongsheng Cai, Huong Nguyen, Jun Pataleta, Michael Hawkins, Shamim Rezaie, Simey Lameze