L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-79541 core_grades: Hidden user fields check for search.

Browse Source 
If some user profile fields are hidden on some grade reports
users without permission were able to see those.
This commit is contained in:
Ilya Tregubov
2024-08-02 01:40:24 +00:00
committed by Jenkins
parent 7f450dcea3
commit 1fd2f0364c
2 changed files with 25 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
grade/classes/external/get_enrolled_users_for_search_widget.php
Vendored
+6 -1
View File
@@ -95,6 +95,9 @@ class get_enrolled_users_for_search_widget extends external_api {
$users = [];
$userfieldsapi = \core_user\fields::for_identity($coursecontext, false)->with_userpic();
$extrauserfields = $userfieldsapi->get_required_fields([\core_user\fields::PURPOSE_IDENTITY]);
while ($userdata = $gui->next_user()) {
$guiuser = $userdata->user;
$user = new \stdClass();
@@ -104,7 +107,9 @@ class get_enrolled_users_for_search_widget extends external_api {
$userpicture = new \user_picture($guiuser);
$userpicture->size = 1;
$user->profileimage = $userpicture->get_url($PAGE)->out(false);
$user->email = $guiuser->email;
foreach ($extrauserfields as $field) {
$user->$field = $userdata->user->$field ?? null;
}
$user->active = false; // @TODO MDL-76246
$users[] = $user;
grade/report/user/tests/behat/usersearch.feature
+19
View File
@@ -28,3 +28,22 @@ Feature: Within the User report, a teacher can search for users.
And I confirm "Student 2" in "user" search within the gradebook widget exists
And I confirm "Student 32" in "user" search within the gradebook widget exists
And I confirm "Student 1" in "user" search within the gradebook widget does not exist
Scenario: A teacher can only search for fields that he allowed to see
Given the following "permission overrides" exist:
| capability | permission | role | contextlevel | reference |
| moodle/course:viewhiddenuserfields | Prohibit | editingteacher | System | |
And the following config values are set as admin:
| hiddenuserfields | email |
And I am on the "Course 1" "grades > User report > View" page logged in as "teacher1"
When I click on ".search-widget[data-searchtype='user']" "css_element"
And I set the field "Search users" to "Student"
And I confirm "Student 1" in "user" search within the gradebook widget exists
And I confirm "Student 2" in "user" search within the gradebook widget exists
And I confirm "Student 32" in "user" search within the gradebook widget exists
# Email is not shown in results.
And I confirm "Student" in "user" search within the gradebook widget exists
And I confirm "example.com" in "user" search within the gradebook widget does not exist
# Email is not searchable.
And I set the field "Search users" to "student5@example.com"
And I confirm "0 results found" in "user" search within the gradebook widget exists