From 919e0354121dff0eb1dcd5bc8c89d50811508d86 Mon Sep 17 00:00:00 2001
From: Felipe Carasso <felipe@carassonet.org>
Date: Thu, 30 Sep 2021 21:39:03 -0400
Subject: [PATCH] fix(ISSUE-45): blocks confirmation for unauthorized users

---
 auth.php    | 3 +++
 version.php | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/auth.php b/auth.php
index 72ffb4d..5ae350f 100644
--- a/auth.php
+++ b/auth.php
@@ -168,6 +168,9 @@ public function user_confirm($username, $confirmsecret) {
         $user = get_complete_user_data('username', $username);
 
         if (!empty($user)) {
+            require_login();
+            require_capability('moodle/user:update', context_system::instance());
+
             if ($user->confirmed) {
                 return AUTH_CONFIRM_ALREADY;
 
diff --git a/version.php b/version.php
index 420def5..05cba57 100644
--- a/version.php
+++ b/version.php
@@ -26,7 +26,7 @@
 
 defined('MOODLE_INTERNAL') || die;
 
-$plugin->version   = 2030061001;        // The current plugin version (Date: YY300610XX).
+$plugin->version   = 2030110100;        // The current plugin version (Date: YY301101XX).
 $plugin->requires  = 2017111300;        // Requires this Moodle version.
 $plugin->component = 'auth_emailadmin';      // Full name of the plugin (used for diagnostics).
 $plugin->maturity = MATURITY_STABLE;