Skip to content

Commit e40e36d

Browse files
committed
Security: Announcement: add verification if user is subscribed to course or subscribed to group to send response -refs BT#21329
1 parent 8f00c94 commit e40e36d

File tree

1 file changed

+11
-2
lines changed

1 file changed

+11
-2
lines changed

main/inc/ajax/announcement.ajax.php

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
$courseId = api_get_course_int_id();
1515
$groupId = api_get_group_id();
1616
$sessionId = api_get_session_id();
17+
$currentUserId = api_get_user_id();
1718

1819
$isTutor = false;
1920
if (!empty($groupId)) {
@@ -26,9 +27,13 @@
2627

2728
switch ($action) {
2829
case 'preview':
30+
$userInCourse = false;
31+
if (CourseManager::is_user_subscribed_in_course($currentUserId, CourseManager::get_course_code_from_course_id($courseId), $sessionId)) {
32+
$userInCourse = true;
33+
}
2934
$allowToEdit = (
3035
api_is_allowed_to_edit(false, true) ||
31-
(api_get_course_setting('allow_user_edit_announcement') && !api_is_anonymous()) ||
36+
(api_get_course_setting('allow_user_edit_announcement') && !api_is_anonymous() && $userInCourse) ||
3237
($sessionId && api_is_coach() && api_get_configuration_value('allow_coach_to_edit_announcements'))
3338
);
3439

@@ -47,7 +52,11 @@
4752

4853
// Last chance ... students can send announcements.
4954
if ($groupProperties['announcements_state'] == GroupManager::TOOL_PRIVATE_BETWEEN_USERS) {
50-
$allowToEdit = true;
55+
// check if user is a group member to give access
56+
$groupInfo = GroupManager::get_group_properties($groupId);
57+
if (array_key_exists($currentUserId,GroupManager::get_subscribed_users($groupInfo))) {
58+
$allowToEdit = true;
59+
}
5160
}
5261
}
5362

0 commit comments

Comments
 (0)