Some better security when database is hidden

diff --git a/mod/data/add.php b/mod/data/add.php
index d79ae3b90792961747fa7aaa5fca681cd1f86446..2d39753bcf25fc59e0f2234c316cae5e33725d4d 100755 (executable)
--- a/mod/data/add.php
+++ b/mod/data/add.php
@@ -56,14 +56,20 @@
     }
     
     require_course_login($course, false, $cm);
+
+/// If it's hidden then it's don't show anything.  :)
+    if (empty($cm->visible) and !isteacher($course->id)) {
+        notice(get_string("activityiscurrentlyhidden"));
+    }
     
+/// Can't use this if there are no fields
     if (isteacher($course->id)) {
         if (!record_exists('data_fields','dataid',$data->id)) {      // Brand new database!
             redirect($CFG->wwwroot.'/mod/data/field.php?d='.$data->id);  // Redirect to field entry
         }
     }
 
-    ///checking for participants
+/// Check access for participants
     if ((!isteacher($course->id)) && $data->participants == DATA_TEACHERS_ONLY) {
         error (get_string('noaccess','data'));
     }

diff --git a/mod/data/field.php b/mod/data/field.php
index 54695f588ebe672686d1a115f1e0061d0c70be8b..1b8cdafc871b67dc07e18bff94d9713f1ac06aac 100755 (executable)
--- a/mod/data/field.php
+++ b/mod/data/field.php
@@ -25,7 +25,6 @@
     require_once('../../config.php');
     require_once('lib.php');
 
-    require_login();
     
     $id             = optional_param('id', 0, PARAM_INT);            // course module id
     $d              = optional_param('d', 0, PARAM_INT);             // database id
@@ -64,6 +63,8 @@
         }
     }
 
+    require_course_login($course, true, $cm);
+
     if (!isteacheredit($course->id)){
         error(get_string('noaccess','data'));
     }

diff --git a/mod/data/templates.php b/mod/data/templates.php
index 7c3568f5016d16114c53786fae85ee9618f0424d..5b1231e8083a75da527ef8fb13f39e363e627c7a 100755 (executable)
--- a/mod/data/templates.php
+++ b/mod/data/templates.php
@@ -55,6 +55,8 @@
         }
     }
 
+    require_course_login($course, true, $cm);
+
     if (!isteacheredit($course->id)){
         error(get_string('noaccess','data'));
     }

diff --git a/mod/data/view.php b/mod/data/view.php
index 5d6a9f4f3a7db866a781ccff8583d0cbbb088b52..6d6c7366b005f1f58290b19a297741648728b2c3 100755 (executable)
--- a/mod/data/view.php
+++ b/mod/data/view.php
@@ -81,8 +81,15 @@
         $record = NULL;
     }
 
+
     require_course_login($course, true, $cm);
 
+
+/// If it's hidden then it's don't show anything.  :)
+    if (empty($cm->visible) and !isteacher($course->id)) {
+        notice(get_string("activityiscurrentlyhidden"));
+    }
+
 /// If we have an empty Database then redirect because this page is useless without data
     if (isteacher($course->id)) {
         if (!record_exists('data_fields','dataid',$data->id)) {      // Brand new database!