search

erudisiya / moodle-local_delegate

1 stars 0 forks source link

in approve/decline/delete.php files, courseid is a required param but not passed to require_login. #10

Open danmarsden opened 7 months ago

danmarsden commented 7 months ago

When you are displaying a page that sits within a course, you should pass the $courseid to the require_login call - the approve/decline/delete files all have a required_param that seems to include the courseid, so you should pass that into the require login call:

eg: 

$id = required_param('id', PARAM_INT);
$courseid = required_param('courseid', PARAM_INT);
require_login($courseid);
danmarsden commented 7 months ago

in fact - this is also the case for a few of your other files like details.php edit.php and list.php

erudisiya commented 7 months ago

fixed for all pages. thanks for this great recommendation.