diff --git a/user/profile.php b/user/profile.php
index 907d986d2ad..03b028d5d80 100644
--- a/user/profile.php
+++ b/user/profile.php
@@ -198,6 +198,10 @@ profile_view($user, $usercontext);
echo $OUTPUT->header();
echo '
';
+$hiddenfields = [];
+if (!has_capability('moodle/user:viewhiddendetails', $usercontext)) {
+ $hiddenfields = array_flip(explode(',', $CFG->hiddenuserfields));
+}
if ($user->description && !isset($hiddenfields['description'])) {
echo '
';
if (!empty($CFG->profilesforenrolledusersonly) && !$currentuser &&
diff --git a/user/tests/behat/hidden_user_fields.feature b/user/tests/behat/hidden_user_fields.feature
new file mode 100644
index 00000000000..2ec8cbc26ae
--- /dev/null
+++ b/user/tests/behat/hidden_user_fields.feature
@@ -0,0 +1,55 @@
+@core @core_user
+Feature: Hidden user fields behavior
+ In order to hide private information of users
+ As an admin
+ I can set Hide user fields setting
+
+ Background:
+ Given the following "users" exist:
+ | username | firstname | lastname | email | description | city |
+ | user | Profile | User | user@example.com | This is me | Donostia |
+ | student | Student | User | student@example.com | | |
+ | teacher | Teacher | User | teacher@example.com | | |
+ And the following "courses" exist:
+ | fullname | shortname | format |
+ | Course 1 | C1 | topics |
+ And the following "course enrolments" exist:
+ | user | course | role |
+ | user | C1 | student |
+ | student | C1 | student |
+ | teacher | C1 | editingteacher |
+ And the following config values are set as admin:
+ | hiddenuserfields | description,email |
+
+ Scenario Outline: Hidden user fields on course context profile based on role permission
+ Given I log in as "
"
+ And I am on "Course 1" course homepage
+ And I navigate to course participants
+ And I should see "Profile User"
+ When I click on "Profile User" "link"
+ Then I "This is me"
+ And I "user@example.com"
+ And I should see "Donostia"
+
+ Examples:
+ | user | expected |
+ | student | should not see |
+ | teacher | should see |
+ | admin | should see |
+
+ Scenario Outline: Hidden user fields on system context profile based on role permission
+ Given I log in as ""
+ And I am on "Course 1" course homepage
+ And I navigate to course participants
+ And I should see "Profile User"
+ When I click on "Profile User" "link"
+ And I click on "Full profile" "link"
+ Then I "This is me"
+ And I "user@example.com"
+ And I should see "Donostia"
+
+ Examples:
+ | user | expected |
+ | student | should not see |
+ | teacher | should not see |
+ | admin | should see |
diff --git a/user/view.php b/user/view.php
index 921a28c309d..eadb4506bf4 100644
--- a/user/view.php
+++ b/user/view.php
@@ -193,6 +193,10 @@ if ($user->deleted) {
// Trigger a user profile viewed event.
profile_view($user, $coursecontext, $course);
+$hiddenfields = [];
+if (!has_capability('moodle/user:viewhiddendetails', $coursecontext)) {
+ $hiddenfields = array_flip(explode(',', $CFG->hiddenuserfields));
+}
if ($user->description && !isset($hiddenfields['description'])) {
echo '';
if (!empty($CFG->profilesforenrolledusersonly) && !$DB->record_exists('role_assignments', array('userid' => $id))) {