From 48e03792ca8faa2d781f9ef74606f3b3f0d3baec Mon Sep 17 00:00:00 2001
From: Andrew Davis <andrew@moodle.com>
Date: Thu, 1 Mar 2012 13:53:48 +0700
Subject: [PATCH] MDL-31834 message: fixed up some not quite correct usage of
 moodle/site:readallmessages

---
 message/index.php | 10 ++++++++--
 message/lib.php   |  5 +++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/message/index.php b/message/index.php
index 03995db3bb0..85c114e62c6 100644
--- a/message/index.php
+++ b/message/index.php
@@ -115,8 +115,14 @@ if (!empty($user2id)) {
 }
 unset($user2id);
 
-//the current user isnt involved in this discussion at all
-if ($user1->id != $USER->id && (!empty($user2) && $user2->id != $USER->id) && !has_capability('moodle/site:readallmessages', $context)) {
+// Is the user involved in the conversation?
+// Do they have the ability to read other user's conversations?
+// There will always be a $user1
+// but $user2 may be null. For example, if viewing $user1's recent conversations
+if ($user1->id != $USER->id
+    && (empty($user2) || $user2->id != $USER->id)
+    && !has_capability('moodle/site:readallmessages', $context)){
+
     print_error('accessdenied','admin');
 }
 
diff --git a/message/lib.php b/message/lib.php
index 50352263b1e..c3801e1fc0c 100644
--- a/message/lib.php
+++ b/message/lib.php
@@ -1528,6 +1528,11 @@ function message_search($searchterms, $fromme=true, $tome=true, $courseid='none'
 ///
     global $CFG, $USER, $DB;
 
+    // If user is searching all messages check they are allowed to before doing anything else
+    if ($courseid == SITEID && !has_capability('moodle/site:readallmessages', get_context_instance(CONTEXT_SYSTEM))) {
+        print_error('accessdenied','admin');
+    }
+
     /// If no userid sent then assume current user
     if ($userid == 0) $userid = $USER->id;