MDL-11881 - User with question permission but not mod/quiz:manage can get a nasty...

diff --git a/mod/quiz/tabs.php b/mod/quiz/tabs.php
index 1982698c39dae73252eb460ebdea8d10ef7c4d9e..835107ea8168fdf9416b55baaf76a684bd9ebc1c 100644 (file)
--- a/mod/quiz/tabs.php
+++ b/mod/quiz/tabs.php
@@ -37,7 +37,7 @@ if (has_capability('mod/quiz:viewreports', $context)) {
 if (has_capability('mod/quiz:preview', $context)) {
     $row[] = new tabobject('preview', "$CFG->wwwroot/mod/quiz/attempt.php?q=$quiz->id", get_string('preview', 'quiz'));
 }
-if ($contexts->have_one_edit_tab_cap('editq')) {
+if (has_capability('mod/quiz:manage', $context)) {
     $row[] = new tabobject('edit', "$CFG->wwwroot/mod/quiz/edit.php?cmid=$cm->id", get_string('edit'));
 }
 
@@ -82,7 +82,7 @@ if ($currenttab == 'edit' and isset($mode)) {
     $strquiz = get_string('modulename', 'quiz');
     $streditingquiz = get_string("editinga", "moodle", $strquiz);
 
-    if ($contexts->have_one_edit_tab_cap('editq')) {
+    if (has_capability('mod/quiz:manage', $context) && $contexts->have_one_edit_tab_cap('editq')) {
         $row[] = new tabobject('editq', "$CFG->wwwroot/mod/quiz/edit.php?".$thispageurl->get_query_string(), $strquiz, $streditingquiz);
     }
     questionbank_navigation_tabs($row, $contexts, $thispageurl->get_query_string());