search

chikako0219 / sharedpanel

Plugin for Moodle
2 stars 2 forks source link

missing authentication and capability checks #3

Closed danmarsden closed 6 years ago

danmarsden commented 7 years ago

A number of your files make changes to data but do not check to see if the user is logged in or if they have the appropriate moodle capabilities to perform the tasks.

please check all files and ensure that you call require_login and also some form of has_capability check when performing actions.

for example: https://github.com/chikako0219/sharedpanel/blob/master/cardxy/index.php https://github.com/chikako0219/sharedpanel/blob/master/camera/cameraupload.php

takayuki-fuwa commented 7 years ago

Add require_login.

https://github.com/chikako0219/sharedpanel/commit/1344d5774c86c1cb10be3697d5a986f199555e1c

takayuki-fuwa commented 6 years ago

camera/com.php don't have check with has_capability. Because com.php allows to post guest users who has old cell phone in Japan.