CVE-2014-7846: Moodle does not consider the moodle/tag:edit capability before adding a tag

The vulnerability stems from the lack of a capability check in tag_autocomplete.php. The original code only checked general authentication (require_login) but omitted require_capability('moodle/tag:edit'), allowing unauthorized tag additions. The commit diff shows the addition of this capability check and other security hardening (e.g., input validation via PARAM_TAG). The primary vulnerable code path is the procedural flow in tag_autocomplete.php, which handled the AJAX request without proper authorization. No specific named functions are directly vulnerable, but the script's entry point is the critical point of failure.