MDL-31834 message: fixed up some not quite correct usage of moodle/site:readallmessages

message/index.php

@@ -115,8 +115,14 @@ if (!empty($user2id)) {
 }
 unset($user2id);
 
-//the current user isnt involved in this discussion at all
-if ($user1->id != $USER->id && (!empty($user2) && $user2->id != $USER->id) && !has_capability('moodle/site:readallmessages', $context)) {
+// Is the user involved in the conversation?
+// Do they have the ability to read other user's conversations?
+// There will always be a $user1
+// but $user2 may be null. For example, if viewing $user1's recent conversations
+if ($user1->id != $USER->id
+    && (empty($user2) || $user2->id != $USER->id)
+    && !has_capability('moodle/site:readallmessages', $context)){
+
     print_error('accessdenied','admin');
 }
 

message/lib.php

@@ -1528,6 +1528,11 @@ function message_search($searchterms, $fromme=true, $tome=true, $courseid='none'
 ///
     global $CFG, $USER, $DB;
 
+    // If user is searching all messages check they are allowed to before doing anything else
+    if ($courseid == SITEID && !has_capability('moodle/site:readallmessages', get_context_instance(CONTEXT_SYSTEM))) {
+        print_error('accessdenied','admin');
+    }
+
     /// If no userid sent then assume current user
     if ($userid == 0) $userid = $USER->id;