Security: Announcement: fix verification if user is subscribed to course -refs BT#21329

NicoDucou · NicoDucou · commit 7baea1c2a5d1 · 2024-09-06T14:31:04.000+02:00
diff --git a/main/inc/ajax/announcement.ajax.php b/main/inc/ajax/announcement.ajax.php
@@ -28,7 +28,7 @@
 switch ($action) {
     case 'preview':
         $userInCourse = false;
-        if (CourseManager::is_user_subscribed_in_course($currentUserId, CourseManager::get_course_code_from_course_id($courseId), $sessionId)) {
+        if ($courseId != 0 && CourseManager::is_user_subscribed_in_course($currentUserId, CourseManager::get_course_code_from_course_id($courseId), $sessionId)) {
             $userInCourse = true;
         }
         $allowToEdit = (

Original file line number	Diff line number	Diff line change
`@@ -28,7 +28,7 @@`
`28`	`28`	`switch ($action) {`
`29`	`29`	`case 'preview':`
`30`	`30`	`$userInCourse = false;`
`31`		`- if (CourseManager::is_user_subscribed_in_course($currentUserId, CourseManager::get_course_code_from_course_id($courseId), $sessionId)) {`
	`31`	`+ if ($courseId != 0 && CourseManager::is_user_subscribed_in_course($currentUserId, CourseManager::get_course_code_from_course_id($courseId), $sessionId)) {`
`32`	`32`	`$userInCourse = true;`
`33`	`33`	`}`
`34`	`34`	`$allowToEdit = (`