MDL-19882 Add missing require_login-s before require_capability.

diff --git a/admin/uploaduser.php b/admin/uploaduser.php
index af7290c120ed38c80b0ed69db2f95cfbdf1f44f2..07baf3c95922b001ac0c8691009540a9aaae3f9e 100755 (executable)
--- a/admin/uploaduser.php
+++ b/admin/uploaduser.php
@@ -27,6 +27,7 @@ if (function_exists('apache_child_terminate')) {
     @apache_child_terminate();
 }
 
+require_login();
 admin_externalpage_setup('uploadusers');
 require_capability('moodle/site:uploadusers', get_context_instance(CONTEXT_SYSTEM));
 

diff --git a/admin/user/user_bulk_confirm.php b/admin/user/user_bulk_confirm.php
index df433f7d1b5267606b0de3f8a6bf5bcf81914f54..2935ad4adfc4b5298fd92767b867e20b5adefb84 100755 (executable)
--- a/admin/user/user_bulk_confirm.php
+++ b/admin/user/user_bulk_confirm.php
@@ -8,6 +8,7 @@ require_once($CFG->libdir.'/adminlib.php');
 
 $confirm = optional_param('confirm', 0, PARAM_BOOL);
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM));
 

diff --git a/admin/user/user_bulk_delete.php b/admin/user/user_bulk_delete.php
index 8278f8307e522505a0b584597ae61d772bb8ada0..099d288676cf993d303533774d345153ab51c414 100755 (executable)
--- a/admin/user/user_bulk_delete.php
+++ b/admin/user/user_bulk_delete.php
@@ -8,6 +8,7 @@ require_once($CFG->libdir.'/adminlib.php');
 
 $confirm = optional_param('confirm', 0, PARAM_BOOL);
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/user:delete', get_context_instance(CONTEXT_SYSTEM));
 

diff --git a/admin/user/user_bulk_download.php b/admin/user/user_bulk_download.php
index 96a59bee800bf48ab8f393f3cd15d805d5e461fa..34cbe3ccaa75b9bfd38010a9176c6ff3a983413d 100755 (executable)
--- a/admin/user/user_bulk_download.php
+++ b/admin/user/user_bulk_download.php
@@ -8,6 +8,7 @@ require_once($CFG->libdir.'/adminlib.php');
 
 $format = optional_param('format', '', PARAM_ALPHA);
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM));
 

diff --git a/admin/user/user_bulk_enrol.php b/admin/user/user_bulk_enrol.php
index 0bee217204e549a57a0719cb815e5296874fb358..36c5a84061b278483c05a7b0490c83050aed1dd9 100644 (file)
--- a/admin/user/user_bulk_enrol.php
+++ b/admin/user/user_bulk_enrol.php
@@ -8,6 +8,7 @@ $processed = optional_param('processed', '', PARAM_CLEAN);
 $sort = optional_param('sort', 'fullname', PARAM_ALPHA); //Sort by full name
 $dir  = optional_param('dir', 'asc', PARAM_ALPHA);       //Order to sort (ASC)
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/user:delete', get_context_instance(CONTEXT_SYSTEM));
 $return = $CFG->wwwroot.'/'.$CFG->admin.'/user/user_bulk.php';

diff --git a/admin/user/user_bulk_message.php b/admin/user/user_bulk_message.php
index 4c7f2d54c36ab8d96df4bc08d5922d054b7e74a7..3b9b2d0a2274cd193b9bccfd6503db821271319e 100755 (executable)
--- a/admin/user/user_bulk_message.php
+++ b/admin/user/user_bulk_message.php
@@ -7,6 +7,7 @@ require_once('user_message_form.php');
 $msg     = optional_param('msg', '', PARAM_CLEAN);
 $confirm = optional_param('confirm', 0, PARAM_BOOL);
 
+require_login();
 admin_externalpage_setup('userbulk');
 require_capability('moodle/site:readallmessages', get_context_instance(CONTEXT_SYSTEM));
 

diff --git a/course/category.php b/course/category.php
index b61310710b61babe79974c80a5de7b4a1634f2e4..ba3848e7dea4850eaf7e6a20444353548a3cac69 100644 (file)
--- a/course/category.php
+++ b/course/category.php
@@ -17,10 +17,6 @@
     $moveto = optional_param('moveto', 0, PARAM_INT);
     $resort = optional_param('resort', 0, PARAM_BOOL);
 
-    if ($CFG->forcelogin) {
-        require_login();
-    }
-
     if (!$site = get_site()) {
         print_error('siteisnotdefined', 'debug');
     }
@@ -33,21 +29,25 @@
     $context = $PAGE->context;
     $category = $PAGE->category;
 
-    if (!$category->visible) {
-        require_capability('moodle/category:viewhiddencategories', $context);
-    }
-
     if (update_category_button($category->id)) {
         if ($categoryedit !== -1) {
             $USER->editing = $categoryedit;
         }
-        $editingon = $PAGE->user_is_editing();
+        require_login();
         $navbaritem = update_category_button($category->id); // Must call this again after updating the state.
+        $editingon = $PAGE->user_is_editing();
     } else {
+        if ($CFG->forcelogin) {
+            require_login();
+        }
         $navbaritem = print_course_search('', true, 'navbar');
         $editingon = false;
     }
 
+    if (!$category->visible) {
+        require_capability('moodle/category:viewhiddencategories', $context);
+    }
+
     // Process any category actions.
     if (has_capability('moodle/category:manage', $context)) {
         /// Resort the category if requested

diff --git a/course/index.php b/course/index.php
index c1e28068e2b84d8f0cf4919d3a1cb56b6f2193f1..be6ecb9014e6255ee1b6f122a0b0dd400554f247 100644 (file)
--- a/course/index.php
+++ b/course/index.php
@@ -14,10 +14,6 @@
     $moveup   = optional_param('moveup',0,PARAM_INT);
     $movedown = optional_param('movedown',0,PARAM_INT);
 
-    if ($CFG->forcelogin) {
-        require_login();
-    }
-
     if (!$site = get_site()) {
         print_error('siteisnotdefined', 'debug');
     }
@@ -31,8 +27,12 @@
         if ($categoryedit !== -1) {
             $USER->editing = $categoryedit;
         }
+        require_login();
         $adminediting = $PAGE->user_is_editing();
     } else {
+        if ($CFG->forcelogin) {
+            require_login();
+        }
         $adminediting = false;
     }
 

diff --git a/enrol/mnet/allowed_courses.php b/enrol/mnet/allowed_courses.php
index 144aac42ae4d12add761b677072b0d099ce7f850..aa264bc65d7c05cb10933823e1836ba8fd63a947 100644 (file)
--- a/enrol/mnet/allowed_courses.php
+++ b/enrol/mnet/allowed_courses.php
@@ -19,6 +19,7 @@ $removecategory = optional_param('removecategory', 0, PARAM_BOOL);
 $addcourse      = optional_param('addcourse', 0, PARAM_BOOL);
 $removecourse   = optional_param('removecourse', 0, PARAM_BOOL);
 
+require_login();
 $sitecontext = get_context_instance(CONTEXT_SYSTEM);
 $sesskey = sesskey();
 $formerror = array();

diff --git a/login/change_password.php b/login/change_password.php
index 577593694256debbc30e35bdfef8fb716f2d4aa7..f557a55e0c95b1d0a1da7e47034893c42833c2e2 100644 (file)
--- a/login/change_password.php
+++ b/login/change_password.php
@@ -26,6 +26,7 @@
 
     // do not require change own password cap if change forced
     if (!get_user_preferences('auth_forcepasswordchange', false)) {
+        require_login();
         require_capability('moodle/user:changeownpassword', $systemcontext);
     }
 

diff --git a/mnet/testclient.php b/mnet/testclient.php
index 9c0bb571214496d8534af1bc4cfd56a47110243c..95c810a45466f361e3077a7d9ceb441aceaf4292 100644 (file)
--- a/mnet/testclient.php
+++ b/mnet/testclient.php
@@ -18,6 +18,7 @@ if ($CFG->mnet_dispatcher_mode === 'off') {
 }
 
 // Site admins only, thanks.
+require_login();
 $context = get_context_instance(CONTEXT_SYSTEM);
 require_capability('moodle/site:config', $context);