ensure user has_capability('mod/hotpot:attempt', $module) when viewing a HotPot or...

diff --git a/mod/hotpot/attempt.php b/mod/hotpot/attempt.php
index 2dbfdacc3ea1f4d9e352cdac820ec304b9c6036f..fdbd7d05f42419b16acb5bc52c74e1cd0a16c335 100644 (file)
--- a/mod/hotpot/attempt.php
+++ b/mod/hotpot/attempt.php
@@ -26,6 +26,8 @@
 
     // make sure this user is enrolled in this course
     require_login($course, true, $cm);
+    $context = get_context_instance(CONTEXT_MODULE, $cm->id);
+    require_capability('mod/hotpot:attempt', $context);
 
     $next_url = "$CFG->wwwroot/course/view.php?id=$course->id";
     $time = time();

diff --git a/mod/hotpot/view.php b/mod/hotpot/view.php
index 2e935a28acba58a7c5613fe6ecd47aa654f14c24..c48b611591c6382e42cec341e674c9855709f4c3 100644 (file)
--- a/mod/hotpot/view.php
+++ b/mod/hotpot/view.php
@@ -39,6 +39,7 @@
         }
         require_login($course, true, $cm);
         $context = get_context_instance(CONTEXT_MODULE, $cm->id);
+        require_capability('mod/hotpot:attempt', $context);
     }
     // set nextpage (for error messages)
     $nextpage = "$CFG->wwwroot/course/view.php?id=$course->id";