MDL-15768 - further capability check in mod/data portfolio export

diff --git a/mod/data/export.php b/mod/data/export.php
index 9ba42f6f12da90389d4a972bbc5b5fb2c4d59d2f..b63630cc07901402d7c174ac3c7f1c2e7eb152da 100644 (file)
--- a/mod/data/export.php
+++ b/mod/data/export.php
@@ -49,7 +49,7 @@ foreach ($fieldrecords as $fieldrecord) {
     $fields[]= data_get_field($fieldrecord, $data);
 }
 
-$mform = new mod_data_export_form('export.php?d='.$data->id, $fields);
+$mform = new mod_data_export_form('export.php?d='.$data->id, $fields, $cm);
 
 if($mform->is_cancelled()) {
     redirect('view.php?d='.$data->id);

diff --git a/mod/data/export_form.php b/mod/data/export_form.php
index a7641c32397a2b98615f40fe28279ec964dfcfa2..75e6f9c9a845f59579d2ba42bd271bfc5c4bb879 100644 (file)
--- a/mod/data/export_form.php
+++ b/mod/data/export_form.php
@@ -8,10 +8,13 @@ require_once($CFG->libdir . '/csvlib.class.php');
 
 class mod_data_export_form extends moodleform {
     var $_datafields = array();
+    var $_cm;
+
      // @param string $url: the url to post to
      // @param array $datafields: objects in this database
-    function mod_data_export_form($url, $datafields) {
+    function mod_data_export_form($url, $datafields, $cm) {
         $this->_datafields = $datafields;
+        $this->_cm = $cm;
         parent::moodleform($url);
     }
 
@@ -53,7 +56,7 @@ class mod_data_export_form extends moodleform {
         }
         $this->add_checkbox_controller(1, null, null, 1);
         require_once($CFG->libdir . '/portfoliolib.php');
-        if (true) { // @todo penny replace with permissions check
+        if (has_capability('mod/data:exportallentries', get_context_instance(CONTEXT_MODULE, $this->_cm->id))) {
             if ($portfoliooptions = portfolio_instance_select(
                 portfolio_instances(),
                 call_user_func(array('data_portfolio_caller', 'supported_formats')),