Make sure teachers can't upload videos into arbitrary series.

By only accepting the series param if on $courseid==$SITE->id.
Opencast-Moodle · Mar 14, 2024 · 1ced42b · 1ced42b
1 parent 02eaf59
commit 1ced42b
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/addvideo.php b/addvideo.php
@@ -35,7 +35,11 @@
 require_once($CFG->dirroot . '/repository/lib.php');
 
 $courseid = required_param('courseid', PARAM_INT);
-$series = optional_param('series', null, PARAM_ALPHANUMEXT);
+if ($courseid == $SITE->id) {
+    $series = optional_param('series', null, PARAM_ALPHANUMEXT);
+} else {
+    $series = null;
+}
 $ocinstanceid = optional_param('ocinstanceid', settings_api::get_default_ocinstance()->id, PARAM_INT);
 
 $baseurlparams = [