MDL-9168 nested site policy when forcelogin enabled; merged from MOODLE_18_STABLE

diff --git a/file.php b/file.php
index 3191ac715c8fc967d0262b3332f22ae869b80d3b..d047f9d96c115d044c29d4e80d4511932d881085 100644 (file)
--- a/file.php
+++ b/file.php
@@ -64,7 +64,13 @@
     } else if ($course->id != SITEID) {
         require_login($course->id);
     } else if ($CFG->forcelogin) {
-        require_login();
+        if (!empty($CFG->sitepolicy)
+            and ($CFG->sitepolicy == $CFG->wwwroot.'/file.php'.$relativepath
+                 or $CFG->sitepolicy == $CFG->wwwroot.'/file.php?file='.$relativepath)) {
+            //do not require login for policy file
+        } else {
+            require_login();
+        }
     }
 
     // security: only editing teachers can access backups