diff --git a/message/index.php b/message/index.php index 85c114e62c6..a695b27fd0d 100644 --- a/message/index.php +++ b/message/index.php @@ -117,12 +117,7 @@ unset($user2id); // Is the user involved in the conversation? // Do they have the ability to read other user's conversations? -// There will always be a $user1 -// but $user2 may be null. For example, if viewing $user1's recent conversations -if ($user1->id != $USER->id - && (empty($user2) || $user2->id != $USER->id) - && !has_capability('moodle/site:readallmessages', $context)){ - +if (!message_current_user_is_involved($user1, $user2) && !has_capability('moodle/site:readallmessages', $context)) { print_error('accessdenied','admin'); } diff --git a/message/lib.php b/message/lib.php index 7e80811fa11..3becd45629d 100644 --- a/message/lib.php +++ b/message/lib.php @@ -2391,3 +2391,25 @@ function translate_message_default_setting($plugindefault, $processorname) { function message_page_type_list($pagetype, $parentcontext, $currentcontext) { return array('messages-*'=>get_string('page-message-x', 'message')); } + +/** + * Is $USER one of the supplied users? + * + * $user2 will be null if viewing a user's recent conversations + * + * @param stdClass the first user + * @param stdClass the second user or null + * @return bool True if the current user is one of either $user1 or $user2 + */ +function message_current_user_is_involved($user1, $user2) { + global $USER; + + if (empty($user1->id) || (!empty($user2) && empty($user2->id))) { + throw new coding_exception('Invalid user object detected. Missing id.'); + } + + if ($user1->id != $USER->id && (empty($user2) || $user2->id != $USER->id)) { + return false; + } + return true; +}