diff --git a/password.php b/password.php
index 11f2724..041d618 100644
--- a/password.php
+++ b/password.php
@@ -1,5 +1,4 @@
 <?php
-
 // This file is part of Moodle - http://moodle.org/
 //
 // Moodle is free software: you can redistribute it and/or modify
@@ -32,8 +31,10 @@ $session = required_param('session', PARAM_INT);
 $session = $DB->get_record('attendance_sessions', array('id' => $session), '*', MUST_EXIST);
 
 $cm = get_coursemodule_from_instance('attendance', $session->attendanceid);
+require_login($cm->course, $cm);
+
 $context = context_module::instance($cm->id);
-$capabilities = array('mod/attendance:manageattendances', 'mod/attendance:takeattendances','mod/attendance:changeattendances');
+$capabilities = array('mod/attendance:manageattendances', 'mod/attendance:takeattendances', 'mod/attendance:changeattendances');
 if (!has_any_capability($capabilities, $context)) {
     exit;
 }
diff --git a/password_ajax.php b/password_ajax.php
index 47bb82a..4faf694 100644
--- a/password_ajax.php
+++ b/password_ajax.php
@@ -1,5 +1,4 @@
 <?php
-
 // This file is part of Moodle - http://moodle.org/
 //
 // Moodle is free software: you can redistribute it and/or modify
@@ -32,8 +31,10 @@ $session = required_param('session', PARAM_INT);
 $session = $DB->get_record('attendance_sessions', array('id' => $session), '*', MUST_EXIST);
 
 $cm = get_coursemodule_from_instance('attendance', $session->attendanceid);
+require_login($cm->course, $cm);
+
 $context = context_module::instance($cm->id);
-$capabilities = array('mod/attendance:manageattendances', 'mod/attendance:takeattendances','mod/attendance:changeattendances');
+$capabilities = array('mod/attendance:manageattendances', 'mod/attendance:takeattendances', 'mod/attendance:changeattendances');
 if (!has_any_capability($capabilities, $context)) {
     exit;
 }