From 006b2a2642c358e115e320d92076bfccd173e3aa Mon Sep 17 00:00:00 2001
From: Vincent Schneider <22986332+cli-ish@users.noreply.github.com>
Date: Tue, 13 May 2025 17:50:14 +0200
Subject: [PATCH] MDL-84518 course: improved course visibility state handling

---
 course/renderer.php | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/course/renderer.php b/course/renderer.php
index 47992ebd192..8c20c9258a2 100644
--- a/course/renderer.php
+++ b/course/renderer.php
@@ -1156,7 +1156,14 @@ class core_course_renderer extends plugin_renderer_base {
             // This is a request for the course information.
             $courseid = required_param('courseid', PARAM_INT);
 
-            $course = $DB->get_record('course', array('id' => $courseid), '*', MUST_EXIST);
+            $course = $DB->get_record('course', ['id' => $courseid], '*', IGNORE_MISSING);
+            if ($course === false) {
+                throw new \moodle_exception('invalidcourseid');
+            }
+            $coursecontext = context_course::instance($course->id, MUST_EXIST);
+            if ($course->visible == 0 && !has_capability('moodle/course:viewhiddencourses', $coursecontext)) {
+                throw new \moodle_exception('invalidcourseid');
+            }
 
             $chelper = new coursecat_helper();
             $chelper->set_show_courses(self::COURSECAT_SHOW_COURSES_EXPANDED);