moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-06 01:16:44 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-59172 user: user_can_view_profile() now checks viewalldetails cap

Browse source
This commit is contained in:
Jake Dallimore 2017-08-01 14:53:33 +08:00
parent 8146b1f06d
commit 4d068a6708
4 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
user/lib.php
View file

@ -1143,7 +1143,7 @@ function user_can_view_profile($user, $course = null, $usercontext = null) {
$usercontext = context_user::instance($user->id);
}
// Number 3.
if (has_capability('moodle/user:viewdetails', $usercontext)) {
if (has_capability('moodle/user:viewdetails', $usercontext) || has_capability('moodle/user:viewalldetails', $usercontext)) {
return true;
}

9
user/tests/userlib_test.php
View file

@ -576,6 +576,15 @@ class core_userliblib_testcase extends advanced_testcase {
$this->setUser($user5);
$this->assertTrue(user_can_view_profile($user4));
// Test the user:viewalldetails cap check using the course creator role which, by default, can't see student profiles.
$this->setUser($user7);
$this->assertFalse(user_can_view_profile($user4));
assign_capability('moodle/user:viewalldetails', CAP_ALLOW, $coursecreatorrole->id, context_system::instance()->id, true);
reload_all_capabilities();
$this->assertTrue(user_can_view_profile($user4));
unassign_capability('moodle/user:viewalldetails', $coursecreatorrole->id, $coursecontext->id);
reload_all_capabilities();
$CFG->coursecontact = null;
// Visitor (Not a guest user, userid=0).