MDL-15768 - set userobject in the caller before checking permissions.

diff --git a/portfolio/add.php b/portfolio/add.php
index 927d2a0bfa7bb10ad33370bc1a478c891eb6ced8..545f382e52f7e338bff4fa666de45cbc17e333f5 100644 (file)
--- a/portfolio/add.php
+++ b/portfolio/add.php
@@ -80,10 +80,10 @@ if ($dataid) {
     }
     require_once($CFG->dirroot . $callbackfile);
     $caller = new $callbackclass($callbackargs);
+    $caller->set('user', $USER);
     if (!$caller->check_permissions()) {
         print_error('nopermissions', 'portfolio', $caller->get_return_url());
     }
-    $caller->set('user', $USER);
 
     // for build navigation
     if (!$course = $caller->get('course')) {