MDL-20798 fixed missing access control for module intros

diff --git a/pluginfile.php b/pluginfile.php
index f1e9f771b4821467194d998dfe03949598d51e47..17332e1036b61ae296a5f1d12a71240c620ecc2d 100644 (file)
--- a/pluginfile.php
+++ b/pluginfile.php
@@ -461,6 +461,11 @@ if ($context->contextlevel == CONTEXT_SYSTEM) {
         if (!plugin_supports('mod', $modname, FEATURE_MOD_INTRO, true)) {
             send_file_not_found();
         }
+        if (!$cm = get_coursemodule_from_instance($modname, $cminfo->instance, $course->id)) {
+            send_file_not_found();
+        }
+        require_course_login($course, true, $cm);
+
         if (!$cminfo->uservisible) {
             send_file_not_found();
         }