L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-68652 core_grades: Only return allowed fields.

Browse Source 
Grade iterator should check user permissions.
This commit is contained in:
Ilya Tregubov
2023-12-07 09:13:26 +08:00
parent 5ad9b4ae57
commit 28f37199f4
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
grade/lib.php
+7 -3
View File
@@ -183,7 +183,12 @@ class graded_users_iterator {
}
}
$userfields = 'u.*';
$userfieldsapi = \core_user\fields::for_identity($coursecontext, false)->with_userpic();
$userfields = $userfieldsapi->get_sql('u', false, '', '', false)->selects;
// This need to be fixed - webservices in grade/report/user/classes/external/user.php don't check permission properly.
$userfields .= ', u.idnumber, u.institution, u.department';
$customfieldssql = '';
if ($this->allowusercustomfields && !empty($CFG->grade_export_customprofilefields)) {
$customfieldscount = 0;
@@ -217,8 +222,7 @@ class graded_users_iterator {
$this->users_rs = $DB->get_recordset_sql($users_sql, $params);
if (!$this->onlyactive) {
$context = context_course::instance($this->course->id);
$this->suspendedusers = get_suspended_userids($context);
$this->suspendedusers = get_suspended_userids($coursecontext);
} else {
$this->suspendedusers = array();
}