From 28f37199f443a1e3a5719684500a4f3ebbf102f9 Mon Sep 17 00:00:00 2001 From: Ilya Tregubov Date: Tue, 5 Dec 2023 10:50:20 +0800 Subject: [PATCH] MDL-68652 core_grades: Only return allowed fields. Grade iterator should check user permissions. --- grade/lib.php | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/grade/lib.php b/grade/lib.php index eeb866386f1..d1786c3429f 100644 --- a/grade/lib.php +++ b/grade/lib.php @@ -183,7 +183,12 @@ class graded_users_iterator { } } - $userfields = 'u.*'; + $userfieldsapi = \core_user\fields::for_identity($coursecontext, false)->with_userpic(); + $userfields = $userfieldsapi->get_sql('u', false, '', '', false)->selects; + + // This need to be fixed - webservices in grade/report/user/classes/external/user.php don't check permission properly. + $userfields .= ', u.idnumber, u.institution, u.department'; + $customfieldssql = ''; if ($this->allowusercustomfields && !empty($CFG->grade_export_customprofilefields)) { $customfieldscount = 0; @@ -217,8 +222,7 @@ class graded_users_iterator { $this->users_rs = $DB->get_recordset_sql($users_sql, $params); if (!$this->onlyactive) { - $context = context_course::instance($this->course->id); - $this->suspendedusers = get_suspended_userids($context); + $this->suspendedusers = get_suspended_userids($coursecontext); } else { $this->suspendedusers = array(); }