-
Bug
-
Resolution: Fixed
-
Critical
-
4.0
-
MOODLE_400_STABLE
-
MOODLE_400_STABLE
-
MDL-73758-master -
This method seems to have been broken in MDL-72578. The offending code is pretty obvious and causes the method to return 'true' in cases where the config setting 'enableavailability' is enabled (the site default). What this means is that when access restrictions are enabled, this method says "Yep, available to all", and this breaks any calling code. It should only be returning true when access restrictions are NOT enabled.
I found this because the mod/lti member service code uses availability to know which members to return (those having access to a specific module context) - and this is consequently broken, resulting in a return of all members and potential access concerns. There are likely other places too.