Hello,
I noticed that some files, like view.php, and others are missing the capabilities validation.
The require_login($course, false, $cm); validates only the enrollment in a course, but not the access and permissions on a specific course module.
Please revisit the plugin and improve security with the capability validation.
As an example, this is a simple capability validation on the mod/page activity:
https://github.com/moodle/moodle/blob/9addea9f0ace94e228329a93df80afaa76fee3e0/mod/page/view.php#L52
Hello,
I noticed that some files, like view.php, and others are missing the capabilities validation.
The require_login($course, false, $cm); validates only the enrollment in a course, but not the access and permissions on a specific course module.
Please revisit the plugin and improve security with the capability validation.
As an example, this is a simple capability validation on the mod/page activity:
https://github.com/moodle/moodle/blob/9addea9f0ace94e228329a93df80afaa76fee3e0/mod/page/view.php#L52