MDL-56565 navigation: fix for cap checks in nav and context header

Fix to:
- Make sure we properly check both user and course contexts in
the load_for_user function in navigation lib and user the
user_can_view_profile function for same-course access checks.
- Use user_can_view_profile in the renderer's context_header to
properly decide whether a user can view another user's picture
and messaging options in the page header.

lib/navigationlib.php

@@ -2168,12 +2168,27 @@ class global_navigation extends navigation_node {
         }
         // Add a branch for the current user.
         // Only reveal user details if $user is the current user, or a user to which the current user has access.
-        if ($USER->id != $user->id && !has_capability('moodle/user:viewdetails', $coursecontext)) {
-            $usernode = $usersnode->add(get_string('user'));
-        } else {
+        $viewprofile = true;
+        if (!$iscurrentuser) {
+            require_once($CFG->dirroot . '/user/lib.php');
+            if ($this->page->context->contextlevel == CONTEXT_USER && !has_capability('moodle/user:viewdetails', $usercontext) ) {
+                $viewprofile = false;
+            } else if ($this->page->context->contextlevel != CONTEXT_USER && !user_can_view_profile($user, $course, $usercontext)) {
+                $viewprofile = false;
+            }
+            if (!$viewprofile) {
+                $viewprofile = user_can_view_profile($user, null, $usercontext);
+            }
+        }
+
+        // Now, conditionally add the user node.
+        if ($viewprofile) {
             $canseefullname = has_capability('moodle/site:viewfullnames', $coursecontext);
             $usernode = $usersnode->add(fullname($user, $canseefullname), $userviewurl, self::TYPE_USER, null, 'user' . $user->id);
+        } else {
+            $usernode = $usersnode->add(get_string('user'));
         }
+
         if ($this->page->context->contextlevel == CONTEXT_USER && $user->id == $this->page->context->instanceid) {
             $usernode->make_active();
         }

lib/outputrenderers.php

@@ -4137,6 +4137,7 @@ EOD;
      */
     public function context_header($headerinfo = null, $headinglevel = 1) {
         global $DB, $USER, $CFG;
+        require_once($CFG->dirroot . '/user/lib.php');
         $context = $this->page->context;
         $heading = null;
         $imagedata = null;
@@ -4162,7 +4163,7 @@ EOD;
 
             // Only provide user information if the user is the current user, or a user which the current user can view.
             $canviewdetails = false;
-            if ($user->id == $USER->id || has_capability('moodle/user:viewdetails', $this->page->context)) {
+            if ($user->id == $USER->id || user_can_view_profile($user)) {
                 $canviewdetails = true;
             }