MDL-15516 prvent access to deleted profiles and other user areas

diff --git a/blog/index.php b/blog/index.php
index 88b66c2d0783a1c1f70f2464b370905d99a1e1bf..da23b2feaa7ea1d24b07a8962728ac863b297905 100755 (executable)
--- a/blog/index.php
+++ b/blog/index.php
@@ -122,6 +122,13 @@ switch ($filtertype) {
         if (!$user = $DB->get_record('user', array('id'=>$filterselect))) {
             print_error('invaliduserid');
         }
+        if ($user->deleted) {
+            print_header();
+            print_heading(get_string('userdeleted'));
+            print_footer();
+            die;
+        }
+
         if ($USER->id == $filterselect) {
             if (!has_capability('moodle/blog:create', $sitecontext)
               and !has_capability('moodle/blog:view', $sitecontext)) {

diff --git a/course/user.php b/course/user.php
index 56ffa6703d956d36a1828b8fc24a94fbd27f0148..ee52a3b7d7ff3ebf54b4a3f113f4bbe004294be0 100644 (file)
--- a/course/user.php
+++ b/course/user.php
@@ -21,9 +21,16 @@
         print_error('invaliduserid', 'error');
     }
 
-    //require_login($course);
+    require_login();
     $COURSE = clone($course);
 
+    if ($user->deleted) {
+        print_header();
+        print_heading(get_string('userdeleted'));
+        print_footer();
+        die;
+    }
+
     $coursecontext = get_context_instance(CONTEXT_COURSE, $id);
     $personalcontext = get_context_instance(CONTEXT_USER, $user->id);
 

diff --git a/message/discussion.php b/message/discussion.php
index aa844950844963382080e9c2646028ba5812f779..025d0a62e666377b6590903e27a1a0d290b597e8 100644 (file)
--- a/message/discussion.php
+++ b/message/discussion.php
@@ -22,6 +22,13 @@
         print_error('invaliduserid');
     }
 
+    if ($user->deleted) {
+        print_header();
+        print_heading(get_string('userdeleted'));
+        print_footer();
+        die;
+    }
+
 /// Check if frame&jsless mode selected
     if (!get_user_preferences('message_noframesjs', 0) and !$noframesjs) {
 

diff --git a/mod/forum/user.php b/mod/forum/user.php
index 6d93d01572359789140af577a9ae1cfbec9181d3..68b4faf43861db5e7ba1584de450d06e2ae1a9bd 100644 (file)
--- a/mod/forum/user.php
+++ b/mod/forum/user.php
@@ -33,6 +33,13 @@
         require_course_login($course);
     }
 
+    if ($user->deleted) {
+        print_header();
+        print_heading(get_string('userdeleted'));
+        print_footer($course);
+        die;
+    }
+
     add_to_log($course->id, "forum", "user report",
             "user.php?course=$course->id&id=$user->id&mode=$mode", "$user->id");
 

diff --git a/notes/index.php b/notes/index.php
index 5f93610cbff15e5379b4b1dd7ff9e2da3e169196..2ebb6734238c35214e0eccbaa6565538b141298f 100644 (file)
--- a/notes/index.php
+++ b/notes/index.php
@@ -37,6 +37,14 @@
         }
         $filtertype = 'user';
         $filterselect = $user->id;
+
+        if ($user->deleted) {
+            print_header();
+            print_heading(get_string('userdeleted'));
+            print_footer();
+            die;
+        }
+
     } else {
         $filtertype = 'course';
         $filterselect = $course->id;

diff --git a/user/edit.php b/user/edit.php
index 2298e7963ab18b700f3c5b42ca253c51dc35db2d..79814bc4cff57eac20d16080b73e261d00097e83 100644 (file)
--- a/user/edit.php
+++ b/user/edit.php
@@ -89,6 +89,13 @@
         }
     }
 
+    if ($user->deleted) {
+        print_header();
+        print_heading(get_string('userdeleted'));
+        print_footer($course);
+        die;
+    }
+
     //load user preferences
     useredit_load_preferences($user);
 

diff --git a/user/editadvanced.php b/user/editadvanced.php
index 8d3f88ebae14b6007cc9e08bfade499f448949ee..562568ccd0292e77df420e523e0a149d3d0af82d 100644 (file)
--- a/user/editadvanced.php
+++ b/user/editadvanced.php
@@ -52,6 +52,13 @@
         print_error('guestnoeditprofileother');
     }
 
+    if ($user->deleted) {
+        print_header();
+        print_heading(get_string('userdeleted'));
+        print_footer($course);
+        die;
+    }
+
     //load user preferences
     useredit_load_preferences($user);
 

diff --git a/user/view.php b/user/view.php
index 6aee0643e58c0d88d6cd25be0249f835f96c7ad1..2c8c3c9fcdb4c2564e258a4dcf5bf360f78d3fd2 100644 (file)
--- a/user/view.php
+++ b/user/view.php
@@ -142,6 +142,10 @@
 
     if ($user->deleted) {
         print_heading(get_string('userdeleted'));
+        if (!has_capability('moodle/user:update', $coursecontext)) {
+            print_footer($course);
+            die;
+        }
     }
 
 /// OK, security out the way, now we are showing the user
@@ -171,7 +175,9 @@
 
     $currenttab = 'profile';
     $showroles = 1;
-    include('tabs.php');
+    if (!$user->deleted) {
+        include('tabs.php');
+    }
 
     if (is_mnet_remote_user($user)) {
         $sql = "
@@ -458,7 +464,7 @@
         }
     }
 
-    if ($USER->id != $user->id  && empty($USER->realuser) && has_capability('moodle/user:loginas', $coursecontext) &&
+    if (!$user->deleted and $USER->id != $user->id  && empty($USER->realuser) && has_capability('moodle/user:loginas', $coursecontext) &&
                                  ! has_capability('moodle/site:doanything', $coursecontext, $user->id, false)) {
         echo '<form action="'.$CFG->wwwroot.'/course/loginas.php" method="get">';
         echo '<div>';
@@ -470,7 +476,7 @@
         echo '</form>';
     }
 
-    if (!empty($CFG->messaging) and !isguest() and has_capability('moodle/site:sendmessage', get_context_instance(CONTEXT_SYSTEM))) {
+    if (!$user->deleted and !empty($CFG->messaging) and !isguest() and has_capability('moodle/site:sendmessage', get_context_instance(CONTEXT_SYSTEM))) {
         if (!empty($USER->id) and ($USER->id == $user->id)) {
             if ($countmessages = $DB->count_records('message', array('useridto'=>$user->id))) {
                 $messagebuttonname = get_string("messages", "message")."($countmessages)";