MDL-49902 forum: Add missing capability check in mod_forum_view_forum
authorJuan Leyva <juanleyvadelgado@gmail.com>
Thu, 16 Apr 2015 19:31:22 +0000 (21:31 +0200)
committerJuan Leyva <juanleyvadelgado@gmail.com>
Thu, 16 Apr 2015 20:07:11 +0000 (22:07 +0200)
mod/forum/externallib.php

index 6f2823a..19fb309 100644 (file)
@@ -848,6 +848,8 @@ class mod_forum_external extends external_api {
         $context = context_module::instance($cm->id);
         self::validate_context($context);
 
+        require_capability('mod/forum:viewdiscussion', $context, null, true, 'noviewdiscussionspermission', 'forum');
+
         // Call the forum/lib API.
         forum_view($forum, $course, $cm, $context);
 
@@ -912,6 +914,8 @@ class mod_forum_external extends external_api {
         $modcontext = context_module::instance($cm->id);
         self::validate_context($modcontext);
 
+        require_capability('mod/forum:viewdiscussion', $modcontext, null, true, 'noviewdiscussionspermission', 'forum');
+
         // Call the forum/lib API.
         forum_discussion_view($modcontext, $forum, $discussion);