From 27723d2ec99b7cd6bf73e87cd7604fc36ee17735 Mon Sep 17 00:00:00 2001
From: Amaia Anabitarte <amaia@moodle.com>
Date: Thu, 24 Mar 2022 17:40:10 +0100
Subject: [PATCH] MDL-74318 core_user: Description field as hidden on profile

---
 user/profile.php                            |  4 ++
 user/tests/behat/hidden_user_fields.feature | 55 +++++++++++++++++++++
 user/view.php                               |  4 ++
 3 files changed, 63 insertions(+)
 create mode 100644 user/tests/behat/hidden_user_fields.feature

diff --git a/user/profile.php b/user/profile.php
index 907d986d2ad..03b028d5d80 100644
--- a/user/profile.php
+++ b/user/profile.php
@@ -198,6 +198,10 @@ profile_view($user, $usercontext);
 echo $OUTPUT->header();
 echo '<div class="userprofile">';
 
+$hiddenfields = [];
+if (!has_capability('moodle/user:viewhiddendetails', $usercontext)) {
+    $hiddenfields = array_flip(explode(',', $CFG->hiddenuserfields));
+}
 if ($user->description && !isset($hiddenfields['description'])) {
     echo '<div class="description">';
     if (!empty($CFG->profilesforenrolledusersonly) && !$currentuser &&
diff --git a/user/tests/behat/hidden_user_fields.feature b/user/tests/behat/hidden_user_fields.feature
new file mode 100644
index 00000000000..2ec8cbc26ae
--- /dev/null
+++ b/user/tests/behat/hidden_user_fields.feature
@@ -0,0 +1,55 @@
+@core @core_user
+Feature: Hidden user fields behavior
+  In order to hide private information of users
+  As an admin
+  I can set Hide user fields setting
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email               | description | city     |
+      | user     | Profile   | User     | user@example.com    | This is me  | Donostia |
+      | student  | Student   | User     | student@example.com |             |          |
+      | teacher  | Teacher   | User     | teacher@example.com |             |          |
+    And the following "courses" exist:
+      | fullname | shortname | format |
+      | Course 1 | C1        | topics |
+    And the following "course enrolments" exist:
+      | user    | course | role           |
+      | user    | C1     | student        |
+      | student | C1     | student        |
+      | teacher | C1     | editingteacher |
+    And the following config values are set as admin:
+      | hiddenuserfields | description,email |
+
+  Scenario Outline: Hidden user fields on course context profile based on role permission
+    Given I log in as "<user>"
+    And I am on "Course 1" course homepage
+    And I navigate to course participants
+    And I should see "Profile User"
+    When I click on "Profile User" "link"
+    Then I <expected> "This is me"
+    And I <expected> "user@example.com"
+    And I should see "Donostia"
+
+    Examples:
+      | user    | expected       |
+      | student | should not see |
+      | teacher | should see     |
+      | admin   | should see     |
+
+  Scenario Outline: Hidden user fields on system context profile based on role permission
+    Given I log in as "<user>"
+    And I am on "Course 1" course homepage
+    And I navigate to course participants
+    And I should see "Profile User"
+    When I click on "Profile User" "link"
+    And I click on "Full profile" "link"
+    Then I <expected> "This is me"
+    And I <expected> "user@example.com"
+    And I should see "Donostia"
+
+    Examples:
+      | user    | expected       |
+      | student | should not see |
+      | teacher | should not see |
+      | admin   | should see     |
diff --git a/user/view.php b/user/view.php
index 921a28c309d..eadb4506bf4 100644
--- a/user/view.php
+++ b/user/view.php
@@ -193,6 +193,10 @@ if ($user->deleted) {
 // Trigger a user profile viewed event.
 profile_view($user, $coursecontext, $course);
 
+$hiddenfields = [];
+if (!has_capability('moodle/user:viewhiddendetails', $coursecontext)) {
+    $hiddenfields = array_flip(explode(',', $CFG->hiddenuserfields));
+}
 if ($user->description && !isset($hiddenfields['description'])) {
     echo '<div class="description">';
     if (!empty($CFG->profilesforenrolledusersonly) && !$DB->record_exists('role_assignments', array('userid' => $id))) {