Fixes so that no-one can "login as" users with "doanything" MDL-8411

diff --git a/course/loginas.php b/course/loginas.php
index 11f99b0b3033f1e3dbf430c9a7445793149d0597..7fd8e2f135aac11404373619f98ddb510c5b16a7 100644 (file)
--- a/course/loginas.php
+++ b/course/loginas.php
@@ -53,6 +53,9 @@
         if (!has_capability('moodle/course:view', $context, $userid, false)) {
             error('This user is not in this course!');
         }
+        if (has_capability('moodle/site:doanything', $context, $userid, false)) {
+            print_error('nologinas');
+        }
     }
 
 /// User must have permissions

diff --git a/lang/en_utf8/error.php b/lang/en_utf8/error.php
index 756ef9a61a0bdd213ab1d48d994b781e57a362a8..9425c8d511bd2f15424a9f16951ea9893a7536a0 100644 (file)
--- a/lang/en_utf8/error.php
+++ b/lang/en_utf8/error.php
@@ -46,6 +46,7 @@ $string['modulerequirementsnotmet'] = 'Module \"$a->modulename\" ($a->modulevers
 $string['mustbeteacher'] = 'You must be a teacher to look at this page';
 $string['nocontext'] = 'Sorry, but that course is not a valid context';
 $string['noinstances'] = 'There are no instances of $a in this course!';
+$string['nologinas'] = 'You are not allowed to login as that user';
 $string['nonmeaningfulcontent'] = 'Non meaningful content';
 $string['noparticipatorycms'] = 'Sorry, but you have no participatory course modules to report on.';
 $string['nopermissions'] = 'Sorry, but you do not currently have permissions to do that ($a)';

diff --git a/lib/weblib.php b/lib/weblib.php
index a282f3a520231dbc3ce9f8f95b5dd76fbbf9f2a4..a8a2f832fa49e6c0b100966afc2ac26800ec5b22 100644 (file)
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -3199,7 +3199,8 @@ has_capability('moodle/course:viewhiddenuserfields', $context)) {
     if (has_capability('moodle/role:assign', $context, NULL)) {  // Includes admins
         $output .= '<a href="'. $CFG->wwwroot .'/course/unenrol.php?id='. $course->id .'&amp;user='. $user->id .'">'. $string->unenrol .'</a><br />';
     }
-    if ($USER->id != $user->id && has_capability('moodle/user:loginas', $context))  {
+    if ($USER->id != $user->id && has_capability('moodle/user:loginas', $context) &&
+                                 ! has_capability('moodle/site:doanything', $context, $user->id, false)) {
         $output .= '<a href="'. $CFG->wwwroot .'/course/loginas.php?id='. $course->id .'&amp;user='. $user->id .'">'. $string->loginas .'</a><br />';
     }
     $output .= '<a href="'. $CFG->wwwroot .'/user/view.php?id='. $user->id .'&amp;course='. $course->id .'">'. $string->fullprofile .'...</a>';

diff --git a/user/view.php b/user/view.php
index 1907f82ba2d62c45655ae08c2b622b951259a18c..42976165c36bba53f804e1f33ed9ec2810faecfc 100644 (file)
--- a/user/view.php
+++ b/user/view.php
@@ -397,7 +397,8 @@
         }
     }
 
-    if ($USER->id != $user->id  && has_capability('moodle/user:loginas', $coursecontext))  {
+    if ($USER->id != $user->id  && has_capability('moodle/user:loginas', $coursecontext) &&
+                                 ! has_capability('moodle/site:doanything', $coursecontext, $user->id, false)) {
         echo '<form action="'.$CFG->wwwroot.'/course/loginas.php" method="get">';
         echo "<fieldset class='invisiblefieldset'>";
         echo '<input type="hidden" name="id" value="'.$course->id.'" />';