David Mudrák authored Aug 29, 2017 and David Monllaó committed Sep 07, 2017

We can't really control the direct web access to directories in dirroot,
that is part of the server setup. So we at least warn admins as they may
not realize the risks of having directories like vendor or node_modules
exposed.

Credit goes to Petr Škoda for mentioning the PHPUnit issue CVE-2017-9841
to me.

Jake Dallimore authored Aug 29, 2017 and David Monllaó committed Sep 07, 2017

Make sure to check that $user in enrolled in $course before checking
whether the current user has capabilities in that course, and make sure
that we don't check user context caps when handling a specific course.

Juan Leyva authored Jul 05, 2017 and David Monllaó committed Sep 07, 2017

The course object passed as parameter to extend_navigation_user
callback contained only a few parameters, some parameters like
showgrades or showreports were missing.
The callback should receive a full course object.

Juan Leyva authored May 02, 2017 and David Monllaó committed Sep 07, 2017

Teachers were able to see any student report even with forced separated
groups and capability moodle/course:accessallgroups off.

jun authored Sep 05, 2017 and David Monllaó committed Sep 07, 2017

Merge branch 'm34_MDL-59635_Properly_Escape_Column_Names_Reserved_Words_Proof' of https://github.com/scara/moodle