Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-60626

get_calendar_event_by_id doesn't check user caps

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Blocker Blocker
    • 3.4
    • 3.4
    • Calendar
    • MOODLE_34_STABLE
    • MOODLE_34_STABLE
    • MDL-60626-master
    • Hide

      For each of the test cases below you must login as the type of user described and go to your calendar. Right click and inspect an event from your calendar and change the data-event-id attribute in the DOM. Then click on the event in the calendar to either load the event details modal, or see a permissions error to complete each test.

       

      Event type User type Expect Error
      Site event Guest User No
      Site event Admin User No
      Group event User not in group, but with moodle/calendar:manageentries capability on the course No
      Group event User in group No
      Group event User in the course, but not the group Yes
      Group event User not in the course or the group Yes
      Activity event User who can see the activity No
      Activity event User who cannot see the activity Yes
      Category event User who cannot see the category (it is hidden and they dont have moodle/category:viewhiddencategories) Yes
      Category event User who can see the category (it is hidden, but they do have moodle/category:viewhiddencategories) No
      Category event Any user (category is not hidden) No
      Course event A user enrolled in the course No
      Course event A user not enrolled in the course, but with moodle/calendar:manageentries on the course context No
      Course event A user not enrolled in the course and without moodle/calendar:manageentries on the course context Yes
      User event A user viewing one of their own events No
      User event A user who is not admin viewing someone elses personal event Yes
      User event An admin viewing someone elses personal event (there is no UI for this - but it has never been blocked before) No

       

      Some instructions on how to create events of different types are here:

      Site event

      1. Log in as admin
      2. Navigate to the calendar
      3. Click “new event” and change the type of event to “Site”
      4. Fill out the form and save the event

      Category event

      1. Log in as admin
      2. Navigate to the calendar
      3. Click “new event” and change the type of event to “Category”
      4. Fill out the form and save the event

      User event

      1. Log in as any user type
      2. Navigate to the calendar
      3. Click “new event” and change the type of event to “User” (this is the default)
      4. Fill out the form (you can add a description if you like) and save the event

      Activity event

      1. Log in as a teacher in a course
      2. Navigate to the course
      3. Create an assignment with a due date and "Online text" enabled.
      4. The event will appear in the students calendar (maybe teachers, depends on another issue).

      Course event

      1. Log in as a teacher in a course
      2. Navigate to the calendar
      3. Click “new event” and change the type of event to “Course”
      4. Choose a course
      5. Fill out the form (you can add a description if you like) and save the event

      Group event

      1. Log in as t1
      2. Create some groups in the course (From the participants page open the "cog" menu at the top left and choose "groups")
      3. Navigate to the calendar
      4. Click “new event” and change the type of event to “Group”, select one of the groups and fill out the form and save the event.

       

      Show
      For each of the test cases below you must login as the type of user described and go to your calendar. Right click and inspect an event from your calendar and change the data-event-id attribute in the DOM. Then click on the event in the calendar to either load the event details modal, or see a permissions error to complete each test.   Event type User type Expect Error Site event Guest User No Site event Admin User No Group event User not in group, but with moodle/calendar:manageentries capability on the course No Group event User in group No Group event User in the course, but not the group Yes Group event User not in the course or the group Yes Activity event User who can see the activity No Activity event User who cannot see the activity Yes Category event User who cannot see the category (it is hidden and they dont have moodle/category:viewhiddencategories) Yes Category event User who can see the category (it is hidden, but they do have moodle/category:viewhiddencategories) No Category event Any user (category is not hidden) No Course event A user enrolled in the course No Course event A user not enrolled in the course, but with moodle/calendar:manageentries on the course context No Course event A user not enrolled in the course and without moodle/calendar:manageentries on the course context Yes User event A user viewing one of their own events No User event A user who is not admin viewing someone elses personal event Yes User event An admin viewing someone elses personal event (there is no UI for this - but it has never been blocked before) No   Some instructions on how to create events of different types are here: Site event Log in as admin Navigate to the calendar Click “new event” and change the type of event to “Site” Fill out the form and save the event Category event Log in as admin Navigate to the calendar Click “new event” and change the type of event to “Category” Fill out the form and save the event User event Log in as any user type Navigate to the calendar Click “new event” and change the type of event to “User” (this is the default) Fill out the form (you can add a description if you like) and save the event Activity event Log in as a teacher in a course Navigate to the course Create an assignment with a due date and "Online text" enabled. The event will appear in the students calendar (maybe teachers, depends on another issue). Course event Log in as a teacher in a course Navigate to the calendar Click “new event” and change the type of event to “Course” Choose a course Fill out the form (you can add a description if you like) and save the event Group event Log in as t1 Create some groups in the course (From the participants page open the "cog" menu at the top left and choose "groups") Navigate to the calendar Click “new event” and change the type of event to “Group”, select one of the groups and fill out the form and save the event.  

      Replication instructions

      1. Open the calendar as admin
      2. Add a user event for your user
      3. Check the DB and find the ID of that event
      4. Log out, log in as a different user
      5. Add an event for that user too
      6. Open the calendar month view
      7. Open dev tools, and find the DOMNode for the event you just added
      8. Find the "data-event-id="????" attribute and swap the ID for the one from the database
      9. Click on the link

      Expected

      You are shown an access denied message

      Actual

      You get to sneak a peek at their event

            damyon Damyon Wiese
            dobedobedoh Andrew Lyons
            Ryan Wyllie Ryan Wyllie
            Andrew Lyons Andrew Lyons
            Sara Arjona (@sarjona) Sara Arjona (@sarjona)
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved:

                Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.