enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL. diff --git a/enrol/index.php b/enrol/index.php index 3cc5335..68a12fd 100644 (file) --- a/enrol/index.php +++ b/enrol/index.php @@ -41,6 +41,10 @@ if ($course->id == SITEID) { redirect("$CFG->wwwroot/"); } +if (!$course->visible && !has_capability('moodle/course:viewhiddencourses', context_course::instance($course->id))) { + print_error('coursehidden'); +} + $PAGE->set_course($course); $PAGE->set_pagelayout('course'); $PAGE->set_url('/enrol/index.php', array('id'=>$course->id));