From 2e77d5ec7b24861cd81af2e044e87c8a08d4fd8c Mon Sep 17 00:00:00 2001
From: Andrew Davis <andrew@moodle.com>
Date: Sun, 25 Jan 2015 21:25:14 +0100
Subject: [PATCH] MDL-48942 mod_survey: synced security checks in view.php and
 graph.php

---
 mod/survey/lang/en/survey.php |  1 +
 mod/survey/view.php           | 18 +++++++++++++-----
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/mod/survey/lang/en/survey.php b/mod/survey/lang/en/survey.php
index c7826ccca6d..6a011a9cfbd 100644
--- a/mod/survey/lang/en/survey.php
+++ b/mod/survey/lang/en/survey.php
@@ -242,6 +242,7 @@ $string['selectedquestions'] = 'Selected questions from a scale, all students';
 $string['summary'] = 'Summary';
 $string['survey:addinstance'] = 'Add a new survey';
 $string['surveycompleted'] = 'You\'ve completed this survey.  The graph below shows a summary of your results compared to the class averages.';
+$string['surveycompletednograph'] = 'You have completed this survey.';
 $string['survey:download'] = 'Download responses';
 $string['surveygraph'] = 'Survey graph';
 $string['surveyname'] = 'Survey name';
diff --git a/mod/survey/view.php b/mod/survey/view.php
index 0ba8cd4a587..8a522211857 100644
--- a/mod/survey/view.php
+++ b/mod/survey/view.php
@@ -107,11 +107,19 @@ $completion->set_module_viewed($cm);
         $numusers = survey_count_responses($survey->id, $currentgroup, $groupingid);
 
         if ($showscales) {
-            echo $OUTPUT->box(get_string("surveycompleted", "survey"));
-            echo $OUTPUT->box(get_string("peoplecompleted", "survey", $numusers));
-            echo '<div class="resultgraph">';
-            survey_print_graph("id=$cm->id&amp;sid=$USER->id&amp;group=$currentgroup&amp;type=student.png");
-            echo '</div>';
+            // Ensure that graph.php will allow the user to see the graph.
+            if (has_capability('mod/survey:readresponses', $context) || !$groupmode || groups_is_member($currentgroup)) {
+
+                echo $OUTPUT->box(get_string("surveycompleted", "survey"));
+                echo $OUTPUT->box(get_string("peoplecompleted", "survey", $numusers));
+
+                echo '<div class="resultgraph">';
+                survey_print_graph("id=$cm->id&amp;sid=$USER->id&amp;group=$currentgroup&amp;type=student.png");
+                echo '</div>';
+            } else {
+                echo $OUTPUT->box(get_string("surveycompletednograph", "survey"));
+                echo $OUTPUT->box(get_string("peoplecompleted", "survey", $numusers));
+            }
 
         } else {