MDL-78792 message: access checks in processor fragment callback.

mgleeson · Aug 10, 2023 · 0922737 · 0922737
1 parent 058b830
commit 0922737
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/message/lib.php b/message/lib.php
@@ -696,6 +696,10 @@ function message_output_fragment_processor_settings($args = []) {
     $userid = $args['userid'];
 
     $user = core_user::get_user($userid, '*', MUST_EXIST);
+    if (!core_message_can_edit_message_profile($user)) {
+        throw new moodle_exception('Cannot edit message profile');
+    }
+
     $processor = get_message_processor($type);
     $providers = message_get_providers_for_user($userid);
     $processorwrapper = new stdClass();