From dc03f9d4c964e31ff73689b34a01f22cd4c4b28c Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Fri, 26 Jul 2024 17:18:25 +0100
Subject: [PATCH] MDL-82611 mod_assign: capability check before exporting grade
 link.

---
 mod/assign/classes/output/actionmenu.php      | 22 ++++++++-----------
 .../templates/submission_actionmenu.mustache  |  2 ++
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/mod/assign/classes/output/actionmenu.php b/mod/assign/classes/output/actionmenu.php
index 23dca8a0957..1f99921c277 100644
--- a/mod/assign/classes/output/actionmenu.php
+++ b/mod/assign/classes/output/actionmenu.php
@@ -14,14 +14,6 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
-/**
- * Output the actionbar for this activity.
- *
- * @package   mod_assign
- * @copyright 2021 Adrian Greeve <adrian@moodle.com>
- * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
- */
-
 namespace mod_assign\output;
 
 use templatable;
@@ -56,10 +48,14 @@ class actionmenu implements templatable, renderable {
      * @return array Data to be used for a template.
      */
     public function export_for_template(\renderer_base $output): array {
-        return [
-            'submissionlink' => (new moodle_url('/mod/assign/view.php', ['id' => $this->cmid, 'action' => 'grading']))->out(false),
-            'gradelink' => (new moodle_url('/mod/assign/view.php', ['id' => $this->cmid, 'action' => 'grader']))->out(false)
-        ];
-    }
+        $submissionlink = new moodle_url('/mod/assign/view.php', ['id' => $this->cmid, 'action' => 'grading']);
+        $return = ['submissionlink' => $submissionlink->out(false)];
 
+        if (has_capability('mod/assign:grade', \context_module::instance($this->cmid))) {
+            $gradelink = new moodle_url('/mod/assign/view.php', ['id' => $this->cmid, 'action' => 'grader']);
+            $return['gradelink'] = $gradelink->out(false);
+        }
+
+        return $return;
+    }
 }
diff --git a/mod/assign/templates/submission_actionmenu.mustache b/mod/assign/templates/submission_actionmenu.mustache
index af806579a34..66c7b552cb6 100644
--- a/mod/assign/templates/submission_actionmenu.mustache
+++ b/mod/assign/templates/submission_actionmenu.mustache
@@ -37,8 +37,10 @@
         <div class="navitem">
             <a class="btn btn-secondary mr-1" href="{{submissionlink}}">{{#str}}viewgrading, mod_assign{{/str}}</a>
         </div>
+        {{#gradelink}}
         <div class="navitem">
             <a class="btn btn-primary" href="{{gradelink}}">{{#str}}gradeverb, core{{/str}}</a>
         </div>
+        {{/gradelink}}
     </div>
 </div>