diff --git a/course/lib.php b/course/lib.php
index 126835cb8b2..8bbdbfeb4ad 100644
--- a/course/lib.php
+++ b/course/lib.php
@@ -955,8 +955,12 @@ function print_log_graph($course, $userid=0, $type="course.png", $date=0) {
     if (empty($CFG->gdversion)) {
         echo "(".get_string("gdneed").")";
     } else {
-        echo '<img src="'.$CFG->wwwroot.'/course/report/log/graph.php?id='.$course->id.
-             '&amp;user='.$userid.'&amp;type='.$type.'&amp;date='.$date.'" alt="" />';
+        // MDL-10818, do not display broken graph when user has no permission to view graph
+        if (has_capability('moodle/site:viewreports', get_context_instance(CONTEXT_COURSE, $course->id)) ||
+            ($course->showreports and $USER->id == $userid)) {
+            echo '<img src="'.$CFG->wwwroot.'/course/report/log/graph.php?id='.$course->id.
+                 '&amp;user='.$userid.'&amp;type='.$type.'&amp;date='.$date.'" alt="" />';
+        }
     }
 }
 
diff --git a/course/user.php b/course/user.php
index 277302be74b..bdca74b0d42 100644
--- a/course/user.php
+++ b/course/user.php
@@ -141,7 +141,8 @@
             }
 
             // MDL-10818, do not display broken graph when user has no permission to view graph
-            if (has_capability('moodle/site:viewreports', get_context_instance(CONTEXT_COURSE, $id))) {
+            if (has_capability('moodle/site:viewreports', get_context_instance(CONTEXT_COURSE, $id)) ||
+                ($course->showreports and $USER->id == $user->id)) {
                 echo '<center><img src="'.$CFG->wwwroot.'/course/report/stats/graph.php?mode='.STATS_MODE_DETAILED.'&course='.$course->id.'&time='.$time.'&report='.STATS_REPORT_USER_VIEW.'&userid='.$user->id.'" alt="'.get_string('statisticsgraph').'" /></center>';
             }