please review Moodle's security guidelines

[danmarsden]

https://docs.moodle.org/dev/Security#Summary_of_the_guidelines

I can see some cases where you are using a !has_capability and then throwing an error with a hard-coded english langauge string. It might be better to replace those with require_capability calls.
make sure you review all your php code to see that require_login and a capabiltiy check are made before doing any other work - I saw a few that didn't appear to be checking a capability correctly.