MDL-20385 better access control checks for frontpage activities; merged from MOODLE_1...

diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index 013273660e1728e2df17cb7ad9c609eb04086cfa..e281cad95c855377fccb4777e96d931d624c93dc 100644 (file)
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -2368,9 +2368,18 @@ function require_course_login($courseorid, $autologinguest=true, $cm=null, $setw
 
     } else if ((is_object($courseorid) and $courseorid->id == SITEID)
           or (!is_object($courseorid) and $courseorid == SITEID)) {
-        //login for SITE not required
-        user_accesstime_log(SITEID);
-        return;
+              //login for SITE not required
+        if ($cm and empty($cm->visible)) {
+            // hidden activities are not accessible without login
+            require_login($courseorid, $autologinguest, $cm, $setwantsurltome);
+        } else if ($cm and !empty($CFG->enablegroupings) and $cm->groupmembersonly) {
+            // not-logged-in users do not have any group membership
+            require_login($courseorid, $autologinguest, $cm, $setwantsurltome);
+        } else {
+            //TODO: verify conditional activities here
+            user_accesstime_log(SITEID);
+            return;
+        }
 
     } else {
         // course login always required