search

gamoteca / moodle-mod_gamoteca

Other
0 stars 1 forks source link

webservices appear to be missing context and capability checks. #6

Closed danmarsden closed 7 months ago

danmarsden commented 2 years ago

looks like anyone can call the webservice functions and update data for any users in the site.

please ensure that you add context and appropriate capability checks, for example

$context = context_course::instance($group->courseid);
self::validate_context($context);
require_capability('moodle/course:managegroups', $context);

More information on the correct set up of a webservice is in the docs here: https://docs.moodle.org/dev/Adding_a_web_service_to_a_plugin

Tunyesz commented 2 years ago

Added validation and required capabilities #9