From 0393514612a4eef673c2d13335abbf690a3808d1 Mon Sep 17 00:00:00 2001 From: Paul Holden Date: Mon, 17 Jan 2022 21:15:38 +0000 Subject: [PATCH] MDL-72012 mod_h5pactivity: respect user access when getting report. --- mod/h5pactivity/classes/local/manager.php | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/mod/h5pactivity/classes/local/manager.php b/mod/h5pactivity/classes/local/manager.php index 412aa2c346b..7522024ed22 100644 --- a/mod/h5pactivity/classes/local/manager.php +++ b/mod/h5pactivity/classes/local/manager.php @@ -451,7 +451,9 @@ class manager { * @return report|null available report (or null if no report available) */ public function get_report(int $userid = null, int $attemptid = null, $currentgroup = false): ?report { - global $USER; + global $USER, $CFG; + + require_once("{$CFG->dirroot}/user/lib.php"); // If tracking is disabled, no reports are available. if (!$this->instance->enabletracking) { @@ -470,6 +472,14 @@ class manager { if ($this->can_view_all_attempts()) { $user = core_user::get_user($userid); + + // Ensure user can view the attempt of specific userid, respecting access checks. + if ($user && $user->id != $USER->id) { + $course = get_course($this->coursemodule->course); + if ($this->coursemodule->effectivegroupmode == SEPARATEGROUPS && !user_can_view_profile($user, $course)) { + return null; + } + } } else if ($this->can_view_own_attempts()) { $user = core_user::get_user($USER->id); if ($userid && $user->id != $userid) {