MDL-47921 mod_lti: Add access control to mod/lti/launch.php

diff --git a/mod/lti/launch.php b/mod/lti/launch.php
index 580d88b..f6fd502 100644 (file)
--- a/mod/lti/launch.php
+++ b/mod/lti/launch.php
@@ -56,7 +56,10 @@ $cm = get_coursemodule_from_id('lti', $id, 0, false, MUST_EXIST);
 $lti = $DB->get_record('lti', array('id' => $cm->instance), '*', MUST_EXIST);
 $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
 
-require_login($course);
+$context = context_module::instance($cm->id);
+
+require_login($course, true, $cm);
+require_capability('mod/lti:view', $context);
 
 $lti->cmid = $cm->id;
 lti_view($lti);