From 4d068a67086fae29fd9fa2e99c8bfe7796c48f9c Mon Sep 17 00:00:00 2001
From: Jake Dallimore <jake@moodle.com>
Date: Tue, 1 Aug 2017 14:53:33 +0800
Subject: [PATCH] MDL-59172 user: user_can_view_profile() now checks
 viewalldetails cap

---
 lib/upgrade.txt             | 1 +
 mod/forum/user.php          | 3 +--
 user/lib.php                | 2 +-
 user/tests/userlib_test.php | 9 +++++++++
 4 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/lib/upgrade.txt b/lib/upgrade.txt
index bf81ed52863..77e180ad5ba 100644
--- a/lib/upgrade.txt
+++ b/lib/upgrade.txt
@@ -41,6 +41,7 @@ information provided here is intended especially for developers.
 * New optional parameter 'closeSuggestionsOnSelect' for the enhance() function for form-autocomplete. Setting this to true will
   close the suggestions popup immediately after an option has been selected. If not specified, it defaults to true for single-select
   elements and false for multiple-select elements.
+* user_can_view_profile() now also checks the moodle/user:viewalldetails capability.
 
 === 3.3.1 ===
 
diff --git a/mod/forum/user.php b/mod/forum/user.php
index 5922e55098a..b3c7f179009 100644
--- a/mod/forum/user.php
+++ b/mod/forum/user.php
@@ -135,8 +135,7 @@ if (empty($result->posts)) {
     // In either case we need to decide whether we can show personal information
     // about the requested user to the current user so we will execute some checks
 
-    // TODO - Remove extra cap check once MDL-59172 is resolved.
-    $canviewuser = user_can_view_profile($user, null, $usercontext) || has_capability('moodle/user:viewalldetails', $usercontext);
+    $canviewuser = user_can_view_profile($user, null, $usercontext);
 
     // Prepare the page title
     $pagetitle = get_string('noposts', 'mod_forum');
diff --git a/user/lib.php b/user/lib.php
index 83044f23c74..b8b4a63044c 100644
--- a/user/lib.php
+++ b/user/lib.php
@@ -1143,7 +1143,7 @@ function user_can_view_profile($user, $course = null, $usercontext = null) {
         $usercontext = context_user::instance($user->id);
     }
     // Number 3.
-    if (has_capability('moodle/user:viewdetails', $usercontext)) {
+    if (has_capability('moodle/user:viewdetails', $usercontext) || has_capability('moodle/user:viewalldetails', $usercontext)) {
         return true;
     }
 
diff --git a/user/tests/userlib_test.php b/user/tests/userlib_test.php
index 0683cba17cc..3e88074f81a 100644
--- a/user/tests/userlib_test.php
+++ b/user/tests/userlib_test.php
@@ -576,6 +576,15 @@ class core_userliblib_testcase extends advanced_testcase {
         $this->setUser($user5);
         $this->assertTrue(user_can_view_profile($user4));
 
+        // Test the user:viewalldetails cap check using the course creator role which, by default, can't see student profiles.
+        $this->setUser($user7);
+        $this->assertFalse(user_can_view_profile($user4));
+        assign_capability('moodle/user:viewalldetails', CAP_ALLOW, $coursecreatorrole->id, context_system::instance()->id, true);
+        reload_all_capabilities();
+        $this->assertTrue(user_can_view_profile($user4));
+        unassign_capability('moodle/user:viewalldetails', $coursecreatorrole->id, $coursecontext->id);
+        reload_all_capabilities();
+
         $CFG->coursecontact = null;
 
         // Visitor (Not a guest user, userid=0).