Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ajax permissions check fail with "log in as" #463

Open
mattporritt opened this issue Aug 10, 2022 · 0 comments · Fixed by catalyst/moodle-mod_hvp#26 · May be fixed by #464
Open

Ajax permissions check fail with "log in as" #463

mattporritt opened this issue Aug 10, 2022 · 0 comments · Fixed by catalyst/moodle-mod_hvp#26 · May be fixed by #464

Comments

@mattporritt
Copy link

When a teacher/manager (not a site administrator) uses the Moodle "log in as" functionality to impersonate a student mod hvp activities do not appear. This is because the ajax call (http://moodle.local/mod/hvp/proxy_pluginfile.php/1/mod_hvp/cachedassets/4110b59c8092d59fd5d23b7ffc267b301637797d5.js for example) returns file not found.

This is because this capability check is failing: https://github.com/h5p/moodle-mod_hvp/blob/stable/lib.php#L268

It is failing because the non admin users is "logged in as" a student in the course context, and the context provided to the capability check is the top level system context.

This in then causing this to fail: https://github.com/moodle/moodle/blob/master/lib/accesslib.php#L528

However, as:

$options['cacheability'] = 'public';
$options['immutable'] = true;

is set, the problematic capability check can be removed.
Removing it fixes this issue

Notes:

  • This behaviour does not appear for site admins
  • This behaviour does not appear when swithcing to the student role
mattporritt pushed a commit to catalyst/moodle-mod_hvp that referenced this issue Aug 10, 2022
mattporritt pushed a commit to catalyst/moodle-mod_hvp that referenced this issue Aug 10, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant