From 1978e7205d31b786383aefb3d3ac3c7b0e58c20c Mon Sep 17 00:00:00 2001
From: Juan Leyva <juanleyvadelgado@gmail.com>
Date: Wed, 14 Nov 2018 16:53:34 +0100
Subject: [PATCH] MDL-63832 assign: Check current user can view submission

---
 mod/assign/externallib.php            |  5 +++-
 mod/assign/tests/externallib_test.php | 37 ++++++++++++++-------------
 2 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/mod/assign/externallib.php b/mod/assign/externallib.php
index 7de404c33bd..0c3b4bd02f9 100644
--- a/mod/assign/externallib.php
+++ b/mod/assign/externallib.php
@@ -771,7 +771,10 @@ class mod_assign_external extends external_api {
                         'plugins' => self::get_plugins_data($assign, $submissionplugins, $submissionrecord),
                         'gradingstatus' => $assign->get_grading_status($submissionrecord->userid)
                     );
-                    $submissions[] = $submission;
+
+                    if ($assign->can_view_submission($submissionrecord->userid)) {
+                        $submissions[] = $submission;
+                    }
                 }
             } else {
                 $warnings[] = array(
diff --git a/mod/assign/tests/externallib_test.php b/mod/assign/tests/externallib_test.php
index 49a13ac4778..6fa4ba1d694 100644
--- a/mod/assign/tests/externallib_test.php
+++ b/mod/assign/tests/externallib_test.php
@@ -373,6 +373,7 @@ class mod_assign_external_testcase extends externallib_advanced_testcase {
         // Create a student with an online text submission.
         // First attempt.
         $student = self::getDataGenerator()->create_user();
+        $teacher = self::getDataGenerator()->create_user();
         $submission = new stdClass();
         $submission->assignment = $assign1->id;
         $submission->userid = $student->id;
@@ -402,32 +403,32 @@ class mod_assign_external_testcase extends externallib_advanced_testcase {
         $onlinetextsubmission->assignment = $assign1->id;
         $DB->insert_record('assignsubmission_onlinetext', $onlinetextsubmission);
 
-        // Create manual enrolment record.
-        $manualenroldata['enrol'] = 'manual';
-        $manualenroldata['status'] = 0;
-        $manualenroldata['courseid'] = $course1->id;
-        $enrolid = $DB->insert_record('enrol', $manualenroldata);
-
-        // Create a teacher and give them capabilities.
-        $context = context_course::instance($course1->id);
-        $roleid = $this->assignUserCapability('moodle/course:viewparticipants', $context->id, 3);
-        $context = context_module::instance($assign1->cmid);
-        $this->assignUserCapability('mod/assign:grade', $context->id, $roleid);
-
-        // Create the teacher's enrolment record.
-        $userenrolmentdata['status'] = 0;
-        $userenrolmentdata['enrolid'] = $enrolid;
-        $userenrolmentdata['userid'] = $USER->id;
-        $DB->insert_record('user_enrolments', $userenrolmentdata);
+        // Enrol the teacher in the course.
+        $teacherrole = $DB->get_record('role', array('shortname' => 'editingteacher'));
+        $this->getDataGenerator()->enrol_user($teacher->id, $course1->id, $teacherrole->id);
+        $this->setUser($teacher);
 
         $assignmentids[] = $assign1->id;
         $result = mod_assign_external::get_submissions($assignmentids);
         $result = external_api::clean_returnvalue(mod_assign_external::get_submissions_returns(), $result);
 
-        // Check the online text submission is returned.
+        // Check the online text submission is NOT returned because the student is not yet enrolled in the course.
         $this->assertEquals(1, count($result['assignments']));
         $assignment = $result['assignments'][0];
         $this->assertEquals($assign1->id, $assignment['assignmentid']);
+        $this->assertEquals(0, count($assignment['submissions']));
+
+        // Enrol the student in the course.
+        $studentrole = $DB->get_record('role', array('shortname' => 'student'));
+        $this->getDataGenerator()->enrol_user($student->id, $course1->id, $studentrole->id);
+
+        $result = mod_assign_external::get_submissions($assignmentids);
+        $result = external_api::clean_returnvalue(mod_assign_external::get_submissions_returns(), $result);
+
+        $this->assertEquals(1, count($result['assignments']));
+        $assignment = $result['assignments'][0];
+        $this->assertEquals($assign1->id, $assignment['assignmentid']);
+        // Now, we get the submission because the user is enrolled.
         $this->assertEquals(1, count($assignment['submissions']));
         $submission = $assignment['submissions'][0];
         $this->assertEquals($sid, $submission['id']);