adding capabilities check

diff --git a/grade/export/lib.php b/grade/export/lib.php
index d241a79f133bb0f87022d0e08ef2e9c4224b27f2..94e2e869c32946c5f2cec3c413be21e225ab4956 100755 (executable)
--- a/grade/export/lib.php
+++ b/grade/export/lib.php
@@ -76,8 +76,8 @@ class grade_export {
         if (! $course = get_record("course", "id", $id)) {
             error("Course ID was incorrect");
         }
-        
-        require_capability('moodle/course:viewcoursegrades', get_context_instance(CONTEXT_COURSE, $id));
+        $context = get_context_instance(CONTEXT_COURSE, $id);
+        require_capability('moodle/course:viewcoursegrades', $context);
         
         $this->id = $id;
         $this->course = $course;
@@ -104,7 +104,7 @@ class grade_export {
         if ($currentgroup) {
             $this->students = get_group_students($currentgroup, "u.lastname ASC");
         } else {
-            $this->students = grade_get_course_students($course->id);
+            $this->students = get_role_users(@implode(',', $CFG->gradebookroles), $context);
         }
 
         if (!empty($this->students)) {

diff --git a/grade/export/ods/index.php b/grade/export/ods/index.php
index 070bbc52eb5ca4804e59a56391c9125a44bee937..c6aa5ec537426890c22b4fa8e1ef605cd8acd7f2 100755 (executable)
--- a/grade/export/ods/index.php
+++ b/grade/export/ods/index.php
@@ -26,6 +26,10 @@ require_once($CFG->dirroot.'/grade/export/lib.php');
 require_once('grade_export_ods.php');
 
 $id = required_param('id', PARAM_INT); // course id 
+
+require_login($id);
+require_capability('moodle/course:downloadallgrades', get_context_instance(CONTEXT_COURSE, $id));
+
 $course = get_record('course', 'id', $id);
 $feedback = optional_param('feedback', '', PARAM_ALPHA);   
 $strgrades = get_string('grades', 'grades');

diff --git a/grade/export/txt/index.php b/grade/export/txt/index.php
index 6617f91f236b9e078edf1425a8e7e63bc6db7712..47d461d03eed8ccf58f71c8f570e758e171a7178 100755 (executable)
--- a/grade/export/txt/index.php
+++ b/grade/export/txt/index.php
@@ -26,6 +26,10 @@ require_once($CFG->dirroot.'/grade/export/lib.php');
 require_once('grade_export_txt.php');
 
 $id = required_param('id', PARAM_INT); // course id
+
+require_login($id);
+require_capability('moodle/course:downloadallgrades', get_context_instance(CONTEXT_COURSE, $id));
+
 $feedback = optional_param('feedback', '', PARAM_ALPHA);
 $course = get_record('course', 'id', $id);
 $strgrades = get_string('grades', 'grades');

diff --git a/grade/export/xls/index.php b/grade/export/xls/index.php
index f23f6becf84d012964e2c5946a857e04b8de5f45..006d29c945742e7216bb0147c7fc336d6bcb801c 100755 (executable)
--- a/grade/export/xls/index.php
+++ b/grade/export/xls/index.php
@@ -26,6 +26,10 @@ require_once($CFG->dirroot.'/grade/export/lib.php');
 require_once('grade_export_xls.php');
 
 $id = required_param('id', PARAM_INT); // course id
+
+require_login($id);
+require_capability('moodle/course:downloadallgrades', get_context_instance(CONTEXT_COURSE, $id));
+
 $course = get_record('course', 'id', $id);
 $feedback = optional_param('feedback', '', PARAM_ALPHA);
 

diff --git a/grade/export/xml/index.php b/grade/export/xml/index.php
index b65f52e4f837e2241da701d88377f9487a909825..774045cb8f84474038ea1fafd5886bdca48bbb11 100755 (executable)
--- a/grade/export/xml/index.php
+++ b/grade/export/xml/index.php
@@ -25,7 +25,11 @@ require_once("../../../config.php");
 require_once($CFG->dirroot.'/grade/export/lib.php');
 require_once('grade_export_xml.php');
 
-$id = required_param('id', PARAM_INT); // course id    
+$id = required_param('id', PARAM_INT); // course id
+
+require_login($id);
+require_capability('moodle/course:downloadallgrades', get_context_instance(CONTEXT_COURSE, $id));
+
 $course = get_record('course', 'id', $id);
 $feedback = optional_param('feedback', '', PARAM_ALPHA);
     

diff --git a/grade/import/grade_import_form.php b/grade/import/grade_import_form.php
index bfbe68d0bd2f5c2dd0b97bc03fc34623c43a48ce..7f530473bcc2f5403d362531ddf62f9d5b6f7028 100755 (executable)
--- a/grade/import/grade_import_form.php
+++ b/grade/import/grade_import_form.php
@@ -50,7 +50,7 @@ class grade_import_mapping_form extends moodleform {
 
         if ($header) {
             foreach ($header as $i=>$h) {
-                $mapfromoptions[$i] = $h;
+                $mapfromoptions[$i] = s($h);
             }
         }
         $mform->addElement('select', 'mapfrom', get_string('mapfrom', 'grades'), $mapfromoptions);