MDL-38655: mod_assign: Use correct ordering on cap checks for submiss…

…ion downloads
fladi · Oct 3, 2013 · c447c03 · c447c03
1 parent d45e65c
commit c447c03
Showing 1 changed file with 7 additions and 10 deletions.
diff --git a/mod/assign/locallib.php b/mod/assign/locallib.php
@@ -3203,12 +3203,12 @@ protected function is_graded($userid) {
     public function can_view_group_submission($groupid) {
         global $USER;
 
-        if (!is_enrolled($this->get_course_context(), $USER->id)) {
-            return false;
-        }
         if (has_capability('mod/assign:grade', $this->context)) {
             return true;
         }
+        if (!is_enrolled($this->get_course_context(), $USER->id)) {
+            return false;
+        }
         $members = $this->get_submission_group_members($groupid, true);
         foreach ($members as $member) {
             if ($member->id == $USER->id) {
@@ -3227,19 +3227,16 @@ public function can_view_group_submission($groupid) {
     public function can_view_submission($userid) {
         global $USER;
 
-        if (is_siteadmin()) {
-            return true;
-        }
-        if (!is_enrolled($this->get_course_context(), $userid)) {
+        if (!$this->is_active_user($userid) && !has_capability('moodle/course:viewsuspendedusers', $this->context)) {
             return false;
         }
-        if ($userid == $USER->id && has_capability('mod/assign:submit', $this->context)) {
+        if (has_capability('mod/assign:grade', $this->context)) {
             return true;
         }
-        if (!$this->is_active_user($userid) && !has_capability('moodle/course:viewsuspendedusers', $this->context)) {
+        if (!is_enrolled($this->get_course_context(), $userid)) {
             return false;
         }
-        if (has_capability('mod/assign:grade', $this->context)) {
+        if ($userid == $USER->id && has_capability('mod/assign:submit', $this->context)) {
             return true;
         }
         return false;