diff --git a/course/externallib.php b/course/externallib.php
index da480bbe24a..62148282aba 100644
--- a/course/externallib.php
+++ b/course/externallib.php
@@ -2135,7 +2135,11 @@ class core_course_external extends external_api {
                                                         (search, modulelist (only admins), blocklist (only admins), tagid)'),
                 'criteriavalue' => new external_value(PARAM_RAW, 'criteria value'),
                 'page'          => new external_value(PARAM_INT, 'page number (0 based)', VALUE_DEFAULT, 0),
-                'perpage'       => new external_value(PARAM_INT, 'items per page', VALUE_DEFAULT, 0)
+                'perpage'       => new external_value(PARAM_INT, 'items per page', VALUE_DEFAULT, 0),
+                'requiredcapabilities' => new external_multiple_structure(
+                    new external_value(PARAM_CAPABILITY, 'Capability string used to filter courses by permission'),
+                    VALUE_OPTIONAL
+                )
             )
         );
     }
@@ -2147,11 +2151,16 @@ class core_course_external extends external_api {
      * @param string $criteriavalue Criteria value
      * @param int $page             Page number (for pagination)
      * @param int $perpage          Items per page
+     * @param array $requiredcapabilities Optional list of required capabilities (used to filter the list).
      * @return array of course objects and warnings
      * @since Moodle 3.0
      * @throws moodle_exception
      */
-    public static function search_courses($criterianame, $criteriavalue, $page=0, $perpage=0) {
+    public static function search_courses($criterianame,
+                                          $criteriavalue,
+                                          $page=0,
+                                          $perpage=0,
+                                          $requiredcapabilities=array()) {
         global $CFG;
         require_once($CFG->libdir . '/coursecatlib.php');
 
@@ -2161,7 +2170,8 @@ class core_course_external extends external_api {
             'criterianame'  => $criterianame,
             'criteriavalue' => $criteriavalue,
             'page'          => $page,
-            'perpage'       => $perpage
+            'perpage'       => $perpage,
+            'requiredcapabilities' => $requiredcapabilities
         );
         $params = self::validate_parameters(self::search_courses_parameters(), $parameters);
 
@@ -2194,8 +2204,8 @@ class core_course_external extends external_api {
         }
 
         // Search the courses.
-        $courses = coursecat::search_courses($searchcriteria, $options);
-        $totalcount = coursecat::search_courses_count($searchcriteria);
+        $courses = coursecat::search_courses($searchcriteria, $options, $params['requiredcapabilities']);
+        $totalcount = coursecat::search_courses_count($searchcriteria, $options, $params['requiredcapabilities']);
 
         $finalcourses = array();
         $categoriescache = array();
@@ -2244,10 +2254,12 @@ class core_course_external extends external_api {
             list($summary, $summaryformat) =
                 external_format_text($course->summary, $course->summaryformat, $coursecontext->id, 'course', 'summary', null);
 
+            $displayname = get_course_display_name_for_list($course);
             $coursereturns = array();
             $coursereturns['id']                = $course->id;
-            $coursereturns['fullname']          = $course->get_formatted_fullname();
-            $coursereturns['shortname']         = $course->get_formatted_shortname();
+            $coursereturns['fullname']          = external_format_string($course->fullname, $coursecontext->id);
+            $coursereturns['displayname']       = external_format_string($displayname, $coursecontext->id);
+            $coursereturns['shortname']         = external_format_string($course->shortname, $coursecontext->id);
             $coursereturns['categoryid']        = $course->category;
             $coursereturns['categoryname']      = $category->name;
             $coursereturns['summary']           = $summary;
@@ -2281,6 +2293,7 @@ class core_course_external extends external_api {
                         array(
                             'id' => new external_value(PARAM_INT, 'course id'),
                             'fullname' => new external_value(PARAM_TEXT, 'course full name'),
+                            'displayname' => new external_value(PARAM_TEXT, 'course display name'),
                             'shortname' => new external_value(PARAM_TEXT, 'course short name'),
                             'categoryid' => new external_value(PARAM_INT, 'category id'),
                             'categoryname' => new external_value(PARAM_TEXT, 'category name'),
diff --git a/lib/amd/build/form-autocomplete.min.js b/lib/amd/build/form-autocomplete.min.js
index 1adc2b0f5ea..9b1d49754bb 100644
--- a/lib/amd/build/form-autocomplete.min.js
+++ b/lib/amd/build/form-autocomplete.min.js
@@ -1 +1 @@
-define(["jquery","core/log","core/str","core/templates","core/notification"],function(a,b,c,d,e){var f={DOWN:40,ENTER:13,SPACE:32,ESCAPE:27,COMMA:188,UP:38},g=function(b,c){var d=a(document.getElementById(c.selectionId)),e=d.children("[aria-selected=true]").length;for(b%=e;0>b;)b+=e;var f=a(d.children("[aria-selected=true]").get(b)),g=c.selectionId+"-"+b;d.children().attr("data-active-selection",!1).attr("id",""),f.attr("data-active-selection",!0).attr("id",g),d.attr("aria-activedescendant",g)},h=function(b,c,f){var h=[],i=a(document.getElementById(c.selectionId)),j=i.attr("aria-activedescendant"),k=!1;j&&(k=a(document.getElementById(j)).attr("data-value")),f.children("option").each(function(b,c){a(c).prop("selected")&&h.push({label:a(c).html(),value:a(c).attr("value")})});var l=a.extend({items:h},b,c);d.render("core/form_autocomplete_selection",l).done(function(b){i.empty().append(a(b).html()),k!==!1&&i.children("[aria-selected=true]").each(function(b,d){a(d).attr("data-value")===k&&g(b,c)})}).fail(e.exception),f.change()},i=function(b,c,d,e){var f=a(d).attr("data-value");b.multiple&&e.children("option").each(function(b,c){a(c).attr("value")==f&&(a(c).prop("selected",!1),a(c).attr("data-iscustom")&&a(c).remove())}),h(b,c,e)},j=function(b,c){var d=a(document.getElementById(c.inputId)),e=a(document.getElementById(c.suggestionsId)),f=e.children("[aria-hidden=false]").length;for(b%=f;0>b;)b+=f;var g=a(e.children("[aria-hidden=false]").get(b)),h=a(e.children("[role=option]")).index(g),i=c.suggestionsId+"-"+h;e.children().attr("aria-selected",!1).attr("id",""),g.attr("aria-selected",!0).attr("id",i),d.attr("aria-activedescendant",i);var j=g.offset().top-e.offset().top+e.scrollTop()-e.height()/2;e.animate({scrollTop:j},100)},k=function(b){var c=a(document.getElementById(b.suggestionsId)),d=c.children("[aria-selected=true]"),e=c.children("[aria-hidden=false]").index(d);j(e+1,b)},l=function(b){var c=a(document.getElementById(b.selectionId)),d=c.children("[data-active-selection=true]");if(!d)return void g(0,b);var e=c.children("[aria-selected=true]").index(d);g(e-1,b)},m=function(b){var c=a(document.getElementById(b.selectionId)),d=c.children("[data-active-selection=true]");if(!d)return void g(0,b);var e=c.children("[aria-selected=true]").index(d);g(e+1,b)},n=function(b){var c=a(document.getElementById(b.suggestionsId)),d=c.children("[aria-selected=true]"),e=c.children("[aria-hidden=false]").index(d);j(e-1,b)},o=function(b){var c=a(document.getElementById(b.inputId)),d=a(document.getElementById(b.suggestionsId));c.attr("aria-expanded",!1).attr("aria-activedescendant",b.selectionId),d.hide().attr("aria-hidden",!0)},p=function(b,f,g,h){var i=a(document.getElementById(f.inputId)),k=a(document.getElementById(f.suggestionsId)),l=!1,m=[];h.children("option").each(function(b,c){a(c).prop("selected")!==!0&&(m[m.length]={label:c.innerHTML,value:a(c).attr("value")})});var n=f.caseSensitive?g:g.toLocaleLowerCase(),o=a.extend({options:m},b,f);d.render("core/form_autocomplete_suggestions",o).done(function(d){k.replaceWith(d),k=a(document.getElementById(f.suggestionsId)),k.show().attr("aria-hidden",!1),k.children().each(function(c,d){d=a(d),b.caseSensitive&&d.text().indexOf(n)>-1||!b.caseSensitive&&d.text().toLocaleLowerCase().indexOf(n)>-1?(d.show().attr("aria-hidden",!1),l=!0):d.hide().attr("aria-hidden",!0)}),i.attr("aria-expanded",!0),l?b.tags||j(0,f):c.get_string("nosuggestions","form").done(function(a){k.html(a)})}).fail(e.exception)},q=function(b,c,d){var e=a(document.getElementById(c.inputId)),f=e.val(),g=f.split(","),i=!1;a.each(g,function(c,e){if(e=e.trim(),""!==e&&(b.multiple||d.children("option").prop("selected",!1),d.children("option").each(function(b,c){a(c).attr("value")==e&&(i=!0,a(c).prop("selected",!0))}),!i)){var f=a("<option>");f.append(e),f.attr("value",e),d.append(f),f.prop("selected",!0),f.attr("data-iscustom",!0)}}),h(b,c,d),e.val(""),o(c)},r=function(b,c,d){var e=a(document.getElementById(c.inputId)),f=a(document.getElementById(c.suggestionsId)),g=f.children("[aria-selected=true]").attr("data-value");b.multiple||d.children("option").prop("selected",!1),d.children("option").each(function(b,c){a(c).attr("value")==g&&a(c).prop("selected",!0)}),h(b,c,d),e.val(""),o(c)},s=function(b,c,d,f,g){var h=a(b.currentTarget).val();g.transport(c.selector,h,function(b){var e=g.processResults(c.selector,b),h=[];f.children("option").each(function(b,c){c=a(c),c.prop("selected")?h.push(c.attr("value")):c.remove()}),a.each(e,function(b,c){if(-1===h.indexOf(c.value)){var d=a("<option>");d.append(c.label),d.attr("value",c.value),f.append(d)}}),p(c,d,"",f)},e.exception)},t=function(b,c,d){var e=a(document.getElementById(c.inputId));if(e.on("keydown",function(g){switch(g.keyCode){case f.DOWN:return b.showSuggestions?("true"===e.attr("aria-expanded")?k(c):!e.val()&&b.ajax?require([b.ajax],function(a){s(g,b,c,d,a)}):p(b,c,e.val(),d),g.preventDefault(),!1):!0;case f.COMMA:return b.tags&&q(b,c,d),g.preventDefault(),!1;case f.UP:return n(c),g.preventDefault(),!1;case f.ENTER:var h=a(document.getElementById(c.suggestionsId));return"true"===e.attr("aria-expanded")&&h.children("[aria-selected=true]").length>0?r(b,c,d):b.tags&&q(b,c,d),g.preventDefault(),!1;case f.ESCAPE:return"true"===e.attr("aria-expanded")&&o(c),g.preventDefault(),!1}return!0}),e.on("behat:set-value",function(){b.tags&&q(b,c,d)}),e.on("blur",function(){window.setTimeout(function(){var f=a(document.activeElement);f.attr("id")!=e.attr("id")&&(b.tags&&q(b,c,d),o(c))},500)}),b.showSuggestions){var g=a(document.getElementById(c.downArrowId));g.on("click",function(){e.focus(),p(b,c,e.val(),d)})}var h=a(document.getElementById(c.suggestionsId));h.parent().on("click","[role=option]",function(e){var f=a(e.currentTarget).closest("[role=option]"),g=a(document.getElementById(c.suggestionsId)),h=g.children("[aria-hidden=false]").index(f);j(h,c),r(b,c,d)});var t=a(document.getElementById(c.selectionId));t.on("click","[role=listitem]",function(e){var f=a(e.currentTarget);i(b,c,f,d)}),t.on("keydown",function(e){switch(e.keyCode){case f.DOWN:return m(c),e.preventDefault(),!1;case f.UP:return l(c),e.preventDefault(),!1;case f.SPACE:case f.ENTER:var g=a(document.getElementById(c.selectionId)).children("[data-active-selection=true]");return g&&(i(b,c,g,d),e.preventDefault()),!1}return!0}),b.showSuggestions&&e.on("input",function(e){var f=a(e.currentTarget).val(),g=a(e.currentTarget).data("last-value");g!==f&&p(b,c,f,d),a(e.currentTarget).data("last-value",f)})};return{enhance:function(c,e,f,g,i,j){var k={selector:c,tags:!1,ajax:!1,placeholder:g,caseSensitive:!1,showSuggestions:!0};"undefined"!=typeof e&&(k.tags=e),"undefined"!=typeof f&&(k.ajax=f),"undefined"!=typeof i&&(k.caseSensitive=i),"undefined"!=typeof j&&(k.showSuggestions=j);var l=a(c);if(!l)return b.debug("Selector not found: "+c),!1;l.hide().attr("aria-hidden",!0);var m={selectId:l.attr("id"),inputId:"form_autocomplete_input-"+a.now(),suggestionsId:"form_autocomplete_suggestions-"+a.now(),selectionId:"form_autocomplete_selection-"+a.now(),downArrowId:"form_autocomplete_downarrow-"+a.now()};k.multiple=l.attr("multiple");var n=a("[for="+m.selectId+"]"),o=[];l.children("option").each(function(b,c){o[b]={label:c.innerHTML,value:a(c).attr("value")}});var p=a.extend({},k,m);p.options=o,p.items=[];var q=d.render("core/form_autocomplete_input",p),r=d.render("core/form_autocomplete_suggestions",p),u=d.render("core/form_autocomplete_selection",p);a.when(q,r,u).done(function(b,c,d){l.after(c),l.after(b),l.after(d),n.attr("for",m.inputId),t(k,m,l);var e=a(document.getElementById(m.inputId)),f=a(document.getElementById(m.suggestionsId));f.hide().attr("aria-hidden",!0),k.ajax&&require([k.ajax],function(b){var c=function(a){s(a,k,m,l,b)};e.on("input keypress",c);var d=a(document.getElementById(m.downArrowId));d.on("click",c)}),h(k,m,l)})}}});
\ No newline at end of file
+define(["jquery","core/log","core/str","core/templates","core/notification"],function(a,b,c,d,e){var f={DOWN:40,ENTER:13,SPACE:32,ESCAPE:27,COMMA:188,UP:38},g=function(b,c){var d=a(document.getElementById(c.selectionId)),e=d.children("[aria-selected=true]").length;for(b%=e;0>b;)b+=e;var f=a(d.children("[aria-selected=true]").get(b)),g=c.selectionId+"-"+b;d.children().attr("data-active-selection",!1).attr("id",""),f.attr("data-active-selection",!0).attr("id",g),d.attr("aria-activedescendant",g)},h=function(b,c,f){var h=[],i=a(document.getElementById(c.selectionId)),j=i.attr("aria-activedescendant"),k=!1;j&&(k=a(document.getElementById(j)).attr("data-value")),f.children("option").each(function(b,c){a(c).prop("selected")&&h.push({label:a(c).html(),value:a(c).attr("value")})});var l=a.extend({items:h},b,c);d.render("core/form_autocomplete_selection",l).done(function(b){i.empty().append(a(b).html()),k!==!1&&i.children("[aria-selected=true]").each(function(b,d){a(d).attr("data-value")===k&&g(b,c)})}).fail(e.exception),f.change()},i=function(b,c,d,e){var f=a(d).attr("data-value");b.multiple&&e.children("option").each(function(b,c){a(c).attr("value")==f&&(a(c).prop("selected",!1),a(c).attr("data-iscustom")&&a(c).remove())}),h(b,c,e)},j=function(b,c){var d=a(document.getElementById(c.inputId)),e=a(document.getElementById(c.suggestionsId)),f=e.children("[aria-hidden=false]").length;for(b%=f;0>b;)b+=f;var g=a(e.children("[aria-hidden=false]").get(b)),h=a(e.children("[role=option]")).index(g),i=c.suggestionsId+"-"+h;e.children().attr("aria-selected",!1).attr("id",""),g.attr("aria-selected",!0).attr("id",i),d.attr("aria-activedescendant",i);var j=g.offset().top-e.offset().top+e.scrollTop()-e.height()/2;e.animate({scrollTop:j},100)},k=function(b){var c=a(document.getElementById(b.suggestionsId)),d=c.children("[aria-selected=true]"),e=c.children("[aria-hidden=false]").index(d);j(e+1,b)},l=function(b){var c=a(document.getElementById(b.selectionId)),d=c.children("[data-active-selection=true]");if(!d)return void g(0,b);var e=c.children("[aria-selected=true]").index(d);g(e-1,b)},m=function(b){var c=a(document.getElementById(b.selectionId)),d=c.children("[data-active-selection=true]");if(!d)return void g(0,b);var e=c.children("[aria-selected=true]").index(d);g(e+1,b)},n=function(b){var c=a(document.getElementById(b.suggestionsId)),d=c.children("[aria-selected=true]"),e=c.children("[aria-hidden=false]").index(d);j(e-1,b)},o=function(b){var c=a(document.getElementById(b.inputId)),d=a(document.getElementById(b.suggestionsId));c.attr("aria-expanded",!1).attr("aria-activedescendant",b.selectionId),d.hide().attr("aria-hidden",!0)},p=function(b,f,g,h){var i=a(document.getElementById(f.inputId)),k=a(document.getElementById(f.suggestionsId)),l=!1,m=[];h.children("option").each(function(b,c){a(c).prop("selected")!==!0&&(m[m.length]={label:c.innerHTML,value:a(c).attr("value")})});var n=f.caseSensitive?g:g.toLocaleLowerCase(),o=a.extend({options:m},b,f);d.render("core/form_autocomplete_suggestions",o).done(function(d){k.replaceWith(d),k=a(document.getElementById(f.suggestionsId)),k.show().attr("aria-hidden",!1),k.children().each(function(c,d){d=a(d),b.caseSensitive&&d.text().indexOf(n)>-1||!b.caseSensitive&&d.text().toLocaleLowerCase().indexOf(n)>-1?(d.show().attr("aria-hidden",!1),l=!0):d.hide().attr("aria-hidden",!0)}),i.attr("aria-expanded",!0),l?b.tags||j(0,f):c.get_string("nosuggestions","form").done(function(a){k.html(a)})}).fail(e.exception)},q=function(b,c,d){var e=a(document.getElementById(c.inputId)),f=e.val(),g=f.split(","),i=!1;a.each(g,function(c,e){if(e=e.trim(),""!==e&&(b.multiple||d.children("option").prop("selected",!1),d.children("option").each(function(b,c){a(c).attr("value")==e&&(i=!0,a(c).prop("selected",!0))}),!i)){var f=a("<option>");f.append(e),f.attr("value",e),d.append(f),f.prop("selected",!0),f.attr("data-iscustom",!0)}}),h(b,c,d),e.val(""),o(c)},r=function(b,c,d){var e=a(document.getElementById(c.inputId)),f=a(document.getElementById(c.suggestionsId)),g=f.children("[aria-selected=true]").attr("data-value");b.multiple||d.children("option").prop("selected",!1),d.children("option").each(function(b,c){a(c).attr("value")==g&&a(c).prop("selected",!0)}),h(b,c,d),e.val(""),o(c)},s=function(b,c,d,f,g){var h=a(b.currentTarget).val();g.transport(c.selector,h,function(b){var e=g.processResults(c.selector,b),h=[];f.children("option").each(function(b,c){c=a(c),c.prop("selected")?h.push(c.attr("value")):c.remove()}),a.each(e,function(b,c){if(-1===h.indexOf(c.value)){var d=a("<option>");d.append(c.label),d.attr("value",c.value),f.append(d)}}),p(c,d,"",f)},e.exception)},t=function(b,c,d){var e=a(document.getElementById(c.inputId));if(e.on("keydown",function(g){switch(g.keyCode){case f.DOWN:return b.showSuggestions?("true"===e.attr("aria-expanded")?k(c):!e.val()&&b.ajax?require([b.ajax],function(a){s(g,b,c,d,a)}):p(b,c,e.val(),d),g.preventDefault(),!1):!0;case f.COMMA:return b.tags&&q(b,c,d),g.preventDefault(),!1;case f.UP:return n(c),g.preventDefault(),!1;case f.ENTER:var h=a(document.getElementById(c.suggestionsId));return"true"===e.attr("aria-expanded")&&h.children("[aria-selected=true]").length>0?r(b,c,d):b.tags&&q(b,c,d),g.preventDefault(),!1;case f.ESCAPE:return"true"===e.attr("aria-expanded")&&o(c),g.preventDefault(),!1}return!0}),e.on("behat:set-value",function(){b.tags&&q(b,c,d)}),e.on("blur",function(){window.setTimeout(function(){var f=a(document.activeElement);f.attr("id")!=e.attr("id")&&(b.tags&&q(b,c,d),o(c))},500)}),b.showSuggestions){var g=a(document.getElementById(c.downArrowId));g.on("click",function(){e.focus(),p(b,c,e.val(),d)})}var h=a(document.getElementById(c.suggestionsId));h.parent().on("click","[role=option]",function(e){var f=a(e.currentTarget).closest("[role=option]"),g=a(document.getElementById(c.suggestionsId)),h=g.children("[aria-hidden=false]").index(f);j(h,c),r(b,c,d)});var t=a(document.getElementById(c.selectionId));t.on("click","[role=listitem]",function(e){var f=a(e.currentTarget);i(b,c,f,d)}),t.on("keydown",function(e){switch(e.keyCode){case f.DOWN:return m(c),e.preventDefault(),!1;case f.UP:return l(c),e.preventDefault(),!1;case f.SPACE:case f.ENTER:var g=a(document.getElementById(c.selectionId)).children("[data-active-selection=true]");return g&&(i(b,c,g,d),e.preventDefault()),!1}return!0}),b.showSuggestions&&e.on("input",function(e){var f=a(e.currentTarget).val(),g=a(e.currentTarget).data("last-value");g!==f&&p(b,c,f,d),a(e.currentTarget).data("last-value",f)})};return{enhance:function(c,e,f,g,i,j){var k={selector:c,tags:!1,ajax:!1,placeholder:g,caseSensitive:!1,showSuggestions:!0};"undefined"!=typeof e&&(k.tags=e),"undefined"!=typeof f&&(k.ajax=f),"undefined"!=typeof i&&(k.caseSensitive=i),"undefined"!=typeof j&&(k.showSuggestions=j);var l=a(c);if(!l)return b.debug("Selector not found: "+c),!1;l.hide().attr("aria-hidden",!0);var m={selectId:l.attr("id"),inputId:"form_autocomplete_input-"+a.now(),suggestionsId:"form_autocomplete_suggestions-"+a.now(),selectionId:"form_autocomplete_selection-"+a.now(),downArrowId:"form_autocomplete_downarrow-"+a.now()};k.multiple=l.attr("multiple");var n=a("[for="+m.selectId+"]"),o=[];l.children("option").each(function(b,c){o[b]={label:c.innerHTML,value:a(c).attr("value")}});var p=a.extend({},k,m);p.options=o,p.items=[];var q=d.render("core/form_autocomplete_input",p),r=d.render("core/form_autocomplete_suggestions",p),u=d.render("core/form_autocomplete_selection",p);a.when(q,r,u).done(function(b,c,d){l.after(c),l.after(b),l.after(d),n.attr("for",m.inputId),t(k,m,l);var e=a(document.getElementById(m.inputId)),f=a(document.getElementById(m.suggestionsId));f.hide().attr("aria-hidden",!0),k.ajax&&require([k.ajax],function(b){var c=null,d=function(a){s(a,k,m,l,b)},f=function(a){null!==c&&(window.clearTimeout(c),c=null),c=window.setTimeout(d.bind(this,a),300)};e.on("input keypress",f);var g=a(document.getElementById(m.downArrowId));g.on("click",d)}),h(k,m,l)})}}});
\ No newline at end of file
diff --git a/lib/amd/build/form-course-selector.min.js b/lib/amd/build/form-course-selector.min.js
new file mode 100644
index 00000000000..6eaaee6838a
--- /dev/null
+++ b/lib/amd/build/form-course-selector.min.js
@@ -0,0 +1 @@
+define(["core/ajax","jquery"],function(a,b){return{processResults:function(a,c){var d=[],e=0,f=String(b(a).data("exclude")).split(",");for(e=0;e<c.courses.length;e++)-1===f.indexOf(String(c.courses[e].id))&&d.push({value:c.courses[e].id,label:c.courses[e].displayname});return d},transport:function(c,d,e,f){var g=b(c).data("requiredcapabilities");g=""!==g.trim()?g.split(","):[];var h=null;"undefined"==typeof d&&(d="");var i={criterianame:"search",criteriavalue:d,page:0,perpage:100,requiredcapabilities:g};return h=a.call([{methodname:"core_course_search_courses",args:i}]),h[0].done(e),h[0].fail(f),h}}});
\ No newline at end of file
diff --git a/lib/amd/src/form-autocomplete.js b/lib/amd/src/form-autocomplete.js
index 24d32c417a4..7a727c3b391 100644
--- a/lib/amd/src/form-autocomplete.js
+++ b/lib/amd/src/form-autocomplete.js
@@ -747,11 +747,22 @@ define(['jquery', 'core/log', 'core/str', 'core/templates', 'core/notification']
                 // If this field uses ajax, set it up.
                 if (options.ajax) {
                     require([options.ajax], function(ajaxHandler) {
+                        var throttleTimeout = null;
                         var handler = function(e) {
                             updateAjax(e, options, state, originalSelect, ajaxHandler);
                         };
+
+                        // For input events, we do not want to trigger many, many updates.
+                        var throttledHandler = function(e) {
+                            if (throttleTimeout !== null) {
+                                window.clearTimeout(throttleTimeout);
+                                throttleTimeout = null;
+                            }
+                            throttleTimeout = window.setTimeout(handler.bind(this, e), 300);
+                        };
                         // Trigger an ajax update after the text field value changes.
-                        inputElement.on("input keypress", handler);
+                        inputElement.on("input keypress", throttledHandler);
+
                         var arrowElement = $(document.getElementById(state.downArrowId));
                         arrowElement.on("click", handler);
                     });
diff --git a/lib/amd/src/form-course-selector.js b/lib/amd/src/form-course-selector.js
new file mode 100644
index 00000000000..2bf7aed4db0
--- /dev/null
+++ b/lib/amd/src/form-course-selector.js
@@ -0,0 +1,76 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Course selector adaptor for auto-complete form element.
+ *
+ * @module     core/form-course-selector
+ * @class      form-course-selector
+ * @package    core
+ * @copyright  2016 Damyon Wiese <damyon@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @since      3.1
+ */
+define(['core/ajax', 'jquery'], function(ajax, $) {
+
+    return /** @alias module:core/form-course-selector */ {
+        // Public variables and functions.
+        processResults: function(selector, data) {
+            // Mangle the results into an array of objects.
+            var results = [], i = 0;
+            var excludelist = String($(selector).data('exclude')).split(',');
+
+            for (i = 0; i < data.courses.length; i++) {
+                if (excludelist.indexOf(String(data.courses[i].id)) === -1) {
+                    results.push({ value: data.courses[i].id, label: data.courses[i].displayname });
+                }
+            }
+            return results;
+        },
+
+        transport: function(selector, query, success, failure) {
+            // Parse some data-attributes from the form element.
+            var requiredcapabilities = $(selector).data('requiredcapabilities');
+            if (requiredcapabilities.trim() !== "") {
+                requiredcapabilities = requiredcapabilities.split(',');
+            } else {
+                requiredcapabilities = [];
+            }
+            // Build the query.
+            var promise = null;
+
+            if (typeof query === "undefined") {
+                query = '';
+            }
+
+            var searchargs = {
+                criterianame: 'search',
+                criteriavalue: query,
+                page: 0,
+                perpage: 100,
+                requiredcapabilities: requiredcapabilities
+            };
+            // Go go go!
+            promise = ajax.call([{
+                methodname: 'core_course_search_courses', args: searchargs
+            }]);
+
+            promise[0].done(success);
+            promise[0].fail(failure);
+
+            return promise;
+        }
+    };
+});
diff --git a/lib/coursecatlib.php b/lib/coursecatlib.php
index fc8811f8b54..fb6a4eded14 100644
--- a/lib/coursecatlib.php
+++ b/lib/coursecatlib.php
@@ -1276,16 +1276,19 @@ class coursecat implements renderable, cacheable_object, IteratorAggregate {
      *     - tagid - id of tag
      * @param array $options display options, same as in get_courses() except 'recursive' is ignored -
      *                       search is always category-independent
+     * @param array $requiredcapabilites List of capabilities required to see return course.
      * @return course_in_list[]
      */
-    public static function search_courses($search, $options = array()) {
+    public static function search_courses($search, $options = array(), $requiredcapabilities = array()) {
         global $DB;
         $offset = !empty($options['offset']) ? $options['offset'] : 0;
         $limit = !empty($options['limit']) ? $options['limit'] : null;
         $sortfields = !empty($options['sort']) ? $options['sort'] : array('sortorder' => 1);
 
         $coursecatcache = cache::make('core', 'coursecat');
-        $cachekey = 's-'. serialize($search + array('sort' => $sortfields));
+        $cachekey = 's-'. serialize(
+            $search + array('sort' => $sortfields) + array('requiredcapabilities' => $requiredcapabilities)
+        );
         $cntcachekey = 'scnt-'. serialize($search);
 
         $ids = $coursecatcache->get($cachekey);
@@ -1315,11 +1318,16 @@ class coursecat implements renderable, cacheable_object, IteratorAggregate {
         $preloadcoursecontacts = !empty($options['coursecontacts']);
         unset($options['coursecontacts']);
 
-        if (!empty($search['search'])) {
+        // Empty search string will return all results.
+        if (!isset($search['search'])) {
+            $search['search'] = '';
+        }
+
+        if (empty($search['blocklist']) && empty($search['modulelist']) && empty($search['tagid'])) {
             // Search courses that have specified words in their names/summaries.
             $searchterms = preg_split('|\s+|', trim($search['search']), 0, PREG_SPLIT_NO_EMPTY);
-            $searchterms = array_filter($searchterms, create_function('$v', 'return strlen($v) > 1;'));
-            $courselist = get_courses_search($searchterms, 'c.sortorder ASC', 0, 9999999, $totalcount);
+
+            $courselist = get_courses_search($searchterms, 'c.sortorder ASC', 0, 9999999, $totalcount, $requiredcapabilities);
             self::sort_records($courselist, $sortfields);
             $coursecatcache->set($cachekey, array_keys($courselist));
             $coursecatcache->set($cntcachekey, $totalcount);
@@ -1365,6 +1373,15 @@ class coursecat implements renderable, cacheable_object, IteratorAggregate {
                 return array();
             }
             $courselist = self::get_course_records($where, $params, $options, true);
+            if (!empty($requiredcapabilities)) {
+                foreach ($courselist as $key => $course) {
+                    context_helper::preload_from_record($course);
+                    $coursecontext = context_course::instance($course->id);
+                    if (!has_all_capabilities($requiredcapabilities, $coursecontext)) {
+                        unset($courselist[$key]);
+                    }
+                }
+            }
             self::sort_records($courselist, $sortfields);
             $coursecatcache->set($cachekey, array_keys($courselist));
             $coursecatcache->set($cntcachekey, count($courselist));
@@ -1397,11 +1414,12 @@ class coursecat implements renderable, cacheable_object, IteratorAggregate {
      * @param array $search search criteria, see method search_courses() for more details
      * @param array $options display options. They do not affect the result but
      *     the 'sort' property is used in cache key for storing list of course ids
+     * @param array $requiredcapabilites List of capabilities required to see return course.
      * @return int
      */
-    public static function search_courses_count($search, $options = array()) {
+    public static function search_courses_count($search, $options = array(), $requiredcapabilities = array()) {
         $coursecatcache = cache::make('core', 'coursecat');
-        $cntcachekey = 'scnt-'. serialize($search);
+        $cntcachekey = 'scnt-'. serialize($search) . serialize($requiredcapabilities);
         if (($cnt = $coursecatcache->get($cntcachekey)) === false) {
             // Cached value not found. Retrieve ALL courses and return their count.
             unset($options['offset']);
@@ -1409,7 +1427,7 @@ class coursecat implements renderable, cacheable_object, IteratorAggregate {
             unset($options['summary']);
             unset($options['coursecontacts']);
             $options['idonly'] = true;
-            $courses = self::search_courses($search, $options);
+            $courses = self::search_courses($search, $options, $requiredcapabilities);
             $cnt = count($courses);
         }
         return $cnt;
diff --git a/lib/datalib.php b/lib/datalib.php
index 334253be9c8..4301c535cad 100644
--- a/lib/datalib.php
+++ b/lib/datalib.php
@@ -741,9 +741,11 @@ function get_courses_page($categoryid="all", $sort="c.sortorder ASC", $fields="c
  * @param int $page The page number to get
  * @param int $recordsperpage The number of records per page
  * @param int $totalcount Passed in by reference.
+ * @param array $requiredcapabilities Extra list of capabilities used to filter courses
  * @return object {@link $COURSE} records
  */
-function get_courses_search($searchterms, $sort, $page, $recordsperpage, &$totalcount) {
+function get_courses_search($searchterms, $sort, $page, $recordsperpage, &$totalcount,
+                            $requiredcapabilities = array()) {
     global $CFG, $DB;
 
     if ($DB->sql_regex_supported()) {
@@ -798,8 +800,7 @@ function get_courses_search($searchterms, $sort, $page, $recordsperpage, &$total
     }
 
     if (empty($searchcond)) {
-        $totalcount = 0;
-        return array();
+        $searchcond = array('1 = 1');
     }
 
     $searchcond = implode(" AND ", $searchcond);
@@ -823,11 +824,14 @@ function get_courses_search($searchterms, $sort, $page, $recordsperpage, &$total
 
     $rs = $DB->get_recordset_sql($sql, $params);
     foreach($rs as $course) {
-        if (!$course->visible) {
-            // preload contexts only for hidden courses or courses we need to return
-            context_helper::preload_from_record($course);
-            $coursecontext = context_course::instance($course->id);
-            if (!has_capability('moodle/course:viewhiddencourses', $coursecontext)) {
+        // Preload contexts only for hidden courses or courses we need to return.
+        context_helper::preload_from_record($course);
+        $coursecontext = context_course::instance($course->id);
+        if (!$course->visible && !has_capability('moodle/course:viewhiddencourses', $coursecontext)) {
+            continue;
+        }
+        if (!empty($requiredcapabilities)) {
+            if (!has_all_capabilities($requiredcapabilities, $coursecontext)) {
                 continue;
             }
         }
diff --git a/lib/db/services.php b/lib/db/services.php
index 7d65f862bd6..5137a7bf51a 100644
--- a/lib/db/services.php
+++ b/lib/db/services.php
@@ -669,6 +669,7 @@ $functions = array(
         'description' => 'Return course details',
         'type'        => 'read',
         'capabilities'=> 'moodle/course:view,moodle/course:update,moodle/course:viewhiddencourses',
+        'ajax'        => true,
     ),
 
     'core_course_search_courses' => array(
@@ -678,6 +679,7 @@ $functions = array(
         'description'   => 'Search courses by (name, module, block, tag)',
         'type'          => 'read',
         'capabilities'  => '',
+        'ajax'          => true,
     ),
 
     'moodle_course_create_courses' => array(
diff --git a/lib/form/course.php b/lib/form/course.php
new file mode 100644
index 00000000000..9121447209e
--- /dev/null
+++ b/lib/form/course.php
@@ -0,0 +1,142 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+
+/**
+ * Course selector field.
+ *
+ * Allows auto-complete ajax searching for courses and can restrict by enrolment, permissions, viewhidden...
+ *
+ * @package   core_form
+ * @copyright 2015 Damyon Wiese <damyon@moodle.com>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+global $CFG;
+require_once($CFG->libdir . '/form/autocomplete.php');
+
+/**
+ * Form field type for choosing a course.
+ *
+ * Allows auto-complete ajax searching for courses and can restrict by enrolment, permissions, viewhidden...
+ *
+ * @package   core_form
+ * @copyright 2015 Damyon Wiese <damyon@moodle.com>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class MoodleQuickForm_course extends MoodleQuickForm_autocomplete {
+
+    /**
+     * @var array $exclude Exclude a list of courses from the list (e.g. the current course).
+     */
+    protected $exclude = array();
+
+    /**
+     * @var boolean $allowmultiple Allow selecting more than one course.
+     */
+    protected $multiple = false;
+
+    /**
+     * @var array $requiredcapabilities Array of extra capabilities to check at the course context.
+     */
+    protected $requiredcapabilities = array();
+
+    /**
+     * Constructor
+     *
+     * @param string $elementname Element name
+     * @param mixed $elementlabel Label(s) for an element
+     * @param array $options Options to control the element's display
+     *                       Valid options are:
+     *                       'multiple' - boolean multi select
+     *                       'exclude' - array or int, list of course ids to never show
+     *                       'requiredcapabilities' - array of capabilities. Uses ANY to combine them.
+     */
+    public function __construct($elementname = null, $elementlabel = null, $options = array()) {
+        if (isset($options['multiple'])) {
+            $this->multiple = $options['multiple'];
+        }
+        if (isset($options['exclude'])) {
+            $this->exclude = $options['exclude'];
+            if (!is_array($this->exclude)) {
+                $this->exclude = array($this->exclude);
+            }
+        }
+        if (isset($options['requiredcapabilities'])) {
+            $this->requiredcapabilities = $options['requiredcapabilities'];
+        }
+
+        $validattributes = array(
+            'ajax' => 'core/form-course-selector',
+            'data-requiredcapabilities' => implode(',', $this->requiredcapabilities),
+            'data-exclude' => implode(',', $this->exclude)
+        );
+        if ($this->multiple) {
+            $validattributes['multiple'] = 'multiple';
+        }
+
+        parent::__construct($elementname, $elementlabel, array(), $validattributes);
+    }
+
+    /**
+     * Set the value of this element. If values can be added or are unknown, we will
+     * make sure they exist in the options array.
+     * @param string|array $value The value to set.
+     * @return boolean
+     */
+    public function setValue($value) {
+        global $DB;
+        $values = (array) $value;
+        $coursestofetch = array();
+
+        foreach ($values as $onevalue) {
+            if ((!$this->optionExists($onevalue)) &&
+                    ($onevalue !== '_qf__force_multiselect_submission')) {
+                array_push($coursestofetch, $onevalue);
+            }
+        }
+
+        if (empty($coursestofetch)) {
+            return $this->setSelected(array());
+        }
+
+        // There is no API function to load a list of course from a list of ids.
+        $ctxselect = context_helper::get_preload_record_columns_sql('ctx');
+        $fields = array('c.id', 'c.category', 'c.sortorder',
+                        'c.shortname', 'c.fullname', 'c.idnumber',
+                        'c.startdate', 'c.visible', 'c.cacherev');
+        list($whereclause, $params) = $DB->get_in_or_equal($coursestofetch, SQL_PARAMS_NAMED, 'id');
+
+        $sql = "SELECT ". join(',', $fields). ", $ctxselect
+                FROM {course} c
+                JOIN {context} ctx ON c.id = ctx.instanceid AND ctx.contextlevel = :contextcourse
+                WHERE c.id ". $whereclause." ORDER BY c.sortorder";
+        $list = $DB->get_records_sql($sql, array('contextcourse' => CONTEXT_COURSE) + $params);
+
+        $coursestoselect = array();
+        foreach ($list as $course) {
+            context_helper::preload_from_record($course);
+            // Make sure we can see the course.
+            if (!$course->visible && !has_capability('moodle/course:viewhiddencourses', context_course::instance($course->id))) {
+                continue;
+            }
+            $label = get_course_display_name_for_list($course);
+            $this->addOption($label, $course->id);
+            array_push($coursestoselect, $course->id);
+        }
+        return $this->setSelected($coursestoselect);
+    }
+}
diff --git a/lib/formslib.php b/lib/formslib.php
index e0639a24315..6307a4cb361 100644
--- a/lib/formslib.php
+++ b/lib/formslib.php
@@ -2995,6 +2995,7 @@ MoodleQuickForm::registerElementType('advcheckbox', "$CFG->libdir/form/advcheckb
 MoodleQuickForm::registerElementType('autocomplete', "$CFG->libdir/form/autocomplete.php", 'MoodleQuickForm_autocomplete');
 MoodleQuickForm::registerElementType('button', "$CFG->libdir/form/button.php", 'MoodleQuickForm_button');
 MoodleQuickForm::registerElementType('cancel', "$CFG->libdir/form/cancel.php", 'MoodleQuickForm_cancel');
+MoodleQuickForm::registerElementType('course', "$CFG->libdir/form/course.php", 'MoodleQuickForm_course');
 MoodleQuickForm::registerElementType('searchableselector', "$CFG->libdir/form/searchableselector.php", 'MoodleQuickForm_searchableselector');
 MoodleQuickForm::registerElementType('checkbox', "$CFG->libdir/form/checkbox.php", 'MoodleQuickForm_checkbox');
 MoodleQuickForm::registerElementType('date_selector', "$CFG->libdir/form/dateselector.php", 'MoodleQuickForm_date_selector');
diff --git a/lib/upgrade.txt b/lib/upgrade.txt
index d23f70200b5..6b87dd12234 100644
--- a/lib/upgrade.txt
+++ b/lib/upgrade.txt
@@ -3,6 +3,11 @@ information provided here is intended especially for developers.
 
 === 3.1 ===
 
+* Webservice function core_course_search_courses now returns results when the search string
+  is less than 2 chars long.
+* Webservice function core_course_search_courses accepts a new parameter 'requiredcapabilities' to filter the results
+  by the capabilities of the current user.
+* New mform element 'course' handles thousands of courses with good performance and usability.
 * The redirect() function will now redirect immediately if output has not
   already started. Messages will be displayed on the subsequent page using
   session notifications. The type of message output can be configured using the