-
Bug
-
Resolution: Fixed
-
Minor
-
4.0
-
MOODLE_400_STABLE
-
MOODLE_400_STABLE
-
Small one, the permission checks for editing reports when manipulating report audiences are in the wrong place: https://github.com/moodle/moodle/blob/efda17d3b025228da28b7d62366eb11a09fd668e/reportbuilder/classes/form/audience.php#L122-L124 (should be in check_access_for_dynamic_submission())
This means they are only checked when the dynamic form is submitted, which means the current form configuration can be requested if a user is able to guess and/or enumerate report/audience IDs leading to disclosure of information a user shouldn't have access to