Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-35699

Visible content in a hidden section is accessible

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Fix
    • Icon: Minor Minor
    • None
    • 2.3.2
    • Course
    • MOODLE_23_STABLE

      Visible modules in a hidden section are accessible by students (users without moodle/course:viewhiddensections capability).

      Related to MDL-35568, when you drag and drop content into a hidden section the content isn't initially hidden.

      However, you can also edit content in a hidden section to be visible.

      The fix that we just deployed in production is to edit obtain_dynamic_data in lib/modinfolib.php to add in the following check after the main if/else block:

              // check parent section visible as well
              if (!isset($parentsection)) {
                  // might have been queried earlier
                  $parentsection = $this->modinfo->get_section_info($this->sectionnum);            
              }
              if (!$parentsection->visible) {
                  // Do not store info from section here, as that is already
                  // presented from the section (if appropriate) - just change
                  // the flag
                  $this->available = false;
              }               
      

      But the thing is that the course modules are shown as visible, but really aren't by students.

      Maybe an event trigger to respond to mod_created/mod_updated events and check the module's parent section. If not visible, then set that module's visibility to that as well?

            moodle.com Moodle HQ
            rex Rex Lorenzo
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved:

                Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.