From 08f4e03f534397d31ebecdcdb0775e9b80cdb7d2 Mon Sep 17 00:00:00 2001
From: moodler <moodler>
Date: Tue, 13 Feb 2007 08:30:25 +0000
Subject: [PATCH] FIxes so that no-one can "login as" users who have
 "doanything".   MDL-8411

---
 course/loginas.php     | 3 +++
 lang/en_utf8/error.php | 1 +
 lib/weblib.php         | 3 ++-
 user/view.php          | 3 ++-
 4 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/course/loginas.php b/course/loginas.php
index 11f99b0b303..7fd8e2f135a 100644
--- a/course/loginas.php
+++ b/course/loginas.php
@@ -53,6 +53,9 @@
         if (!has_capability('moodle/course:view', $context, $userid, false)) {
             error('This user is not in this course!');
         }
+        if (has_capability('moodle/site:doanything', $context, $userid, false)) {
+            print_error('nologinas');
+        }
     }
 
 /// User must have permissions
diff --git a/lang/en_utf8/error.php b/lang/en_utf8/error.php
index 0322320ca3b..bd3875644b7 100644
--- a/lang/en_utf8/error.php
+++ b/lang/en_utf8/error.php
@@ -46,6 +46,7 @@ $string['modulerequirementsnotmet'] = 'Module \"$a->modulename\" ($a->modulevers
 $string['mustbeteacher'] = 'You must be a teacher to look at this page';
 $string['nocontext'] = 'Sorry, but that course is not a valid context';
 $string['noinstances'] = 'There are no instances of $a in this course!';
+$string['nologinas'] = 'You are not allowed to login as that user';
 $string['nonmeaningfulcontent'] = 'Non meaningful content';
 $string['noparticipatorycms'] = 'Sorry, but you have no participatory course modules to report on.';
 $string['nopermissions'] = 'Sorry, but you do not currently have permissions to do that ($a)';
diff --git a/lib/weblib.php b/lib/weblib.php
index 8f61143bd6e..c28334119a4 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -3178,7 +3178,8 @@ has_capability('moodle/course:viewhiddenuserfields', $context)) {
     if (has_capability('moodle/role:assign', $context, NULL)) {  // Includes admins
         $output .= '<a href="'. $CFG->wwwroot .'/course/unenrol.php?id='. $course->id .'&amp;user='. $user->id .'">'. $string->unenrol .'</a><br />';
     }
-    if ($USER->id != $user->id && has_capability('moodle/user:loginas', $context))  {
+    if ($USER->id != $user->id && has_capability('moodle/user:loginas', $context) &&
+                                ! has_capability('moodle/site:doanything', $context, $user->id, false)) {
         $output .= '<a href="'. $CFG->wwwroot .'/course/loginas.php?id='. $course->id .'&amp;user='. $user->id .'">'. $string->loginas .'</a><br />';
     }
     $output .= '<a href="'. $CFG->wwwroot .'/user/view.php?id='. $user->id .'&amp;course='. $course->id .'">'. $string->fullprofile .'...</a>';
diff --git a/user/view.php b/user/view.php
index 395c6e5b637..644ebc7d040 100644
--- a/user/view.php
+++ b/user/view.php
@@ -372,7 +372,8 @@
         }
     }
 
-    if ($USER->id != $user->id  && has_capability('moodle/user:loginas', $coursecontext))  {
+    if ($USER->id != $user->id  && has_capability('moodle/user:loginas', $coursecontext) &&
+                                 ! has_capability('moodle/site:doanything', $coursecontext, $user->id, false)) {
         echo '<td nowrap="nowrap"><form action="'.$CFG->wwwroot.'/course/loginas.php" method="get">';
         echo '<input type="hidden" name="id" value="'.$course->id.'" />';
         echo '<input type="hidden" name="user" value="'.$user->id.'" />';