Need to lock down the view/viewblocks.json.php response more

[Robert Lyon]

Currently it only checks if you can see the page

But if you give it block/artefact values you shouldn't see you get content back

We need to do the following checks
1) can user see the page? if so
2) is the block on the page? if so
3) can the user see the block content? (a peer might not be able to) if so
4) is the artefact part of the block?

Only then can we show the content in the modal

[Robert Lyon (robertl-9)]

To test - with current master

Log in as userA
1) Create a page with userA and put an image block on it and a peer block
2) Share it with userB as role 'peer'
3) View the page and click the 'Details' toggle
Copy the HTML code for the <a class="commentlink" ... </a> bit

Login as userB
1) Go to the page shared by userA
you should not see any way to view the image content
2) inspect page an insert somewhere the HTML snippet you got from before
3) in browser console type in
 activateModalLinks();
and hit return
4) Click on link you added and you see the content in the modal

[Mahara Bot (dev-mahara)]

Patch for "master" branch: https://reviews.mahara.org/10465

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/10465
Committed: https://git.mahara.org/mahara/mahara/commit/9ef9014abf2da8bb4978ad223ec82ca6bad0022b
Submitter: Cecilia Vela Gurovic (<email address hidden>)
Branch: master

commit 9ef9014abf2da8bb4978ad223ec82ca6bad0022b
Author: Robert Lyon <email address hidden>
Date: Wed Oct 23 12:20:42 2019 +1300

Bug 1849395: Doublecheck details values for modal

Before displaying content

behatnotneeded

Change-Id: Ibdd0b33d543f65cf619fc5a061b6f81350d1d94a
Signed-off-by: Robert Lyon <email address hidden>

[Mahara Bot (dev-mahara)]

Patch for "19.10_STABLE" branch: https://reviews.mahara.org/10477

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/10477
Committed: https://git.mahara.org/mahara/mahara/commit/49961c80bd209af7b728691b086a6e5b78e6f687
Submitter: Cecilia Vela Gurovic (<email address hidden>)
Branch: 19.10_STABLE

commit 49961c80bd209af7b728691b086a6e5b78e6f687
Author: Robert Lyon <email address hidden>
Date: Wed Oct 23 12:20:42 2019 +1300

Bug 1849395: Doublecheck details values for modal

Before displaying content

behatnotneeded

Change-Id: Ibdd0b33d543f65cf619fc5a061b6f81350d1d94a
Signed-off-by: Robert Lyon <email address hidden>
(cherry picked from commit 9ef9014abf2da8bb4978ad223ec82ca6bad0022b)