From 2cc2001bef1fb1b06f9847638c0934f9c7ae4ba1 Mon Sep 17 00:00:00 2001 From: Damyon Wiese Date: Wed, 12 Jul 2017 14:47:11 +0800 Subject: [PATCH] MDL-59365 enrol: Teachers can see other users on the site In order to enrol new users into a course, you need to see users who are not in the current course. --- enrol/externallib.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/enrol/externallib.php b/enrol/externallib.php index 224f4347f8c..ab0f6990dcc 100644 --- a/enrol/externallib.php +++ b/enrol/externallib.php @@ -453,7 +453,11 @@ class core_enrol_external extends external_api { $results = array(); foreach ($users['users'] as $id => $user) { - if ($userdetails = user_get_user_details($user)) { + // Note: We pass the course here to validate that the current user can at least view user details in this course. + // The user we are looking at is not in this course yet though - but we only fetch the minimal set of + // user records, and the user has been validated to have course:enrolreview in this course. Otherwise + // there is no way to find users who aren't in the course in order to enrol them. + if ($userdetails = user_get_user_details($user, $course)) { $results[] = $userdetails; } }