L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-60550 user: Add more restrictions in keyword searches

Browse Source 
Original patch provided by Tim Schroeder.
This commit is contained in:
Sara Arjona
2017-10-31 11:55:28 +13:00
committed by Jun Pataleta
parent 0b42937599
commit 54bb01439e
1 changed files with 30 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
user/index.php
+30 -3
View File
@@ -455,10 +455,37 @@ if ($wheres) {
$totalcount = $DB->count_records_sql("SELECT COUNT(u.id) $from $where", $params);
if (!empty($search)) {
$conditions = array();
// Search by fullname.
$fullname = $DB->sql_fullname('u.firstname', 'u.lastname');
$wheres[] = "(". $DB->sql_like($fullname, ':search1', false, false) .
" OR ". $DB->sql_like('email', ':search2', false, false) .
" OR ". $DB->sql_like('idnumber', ':search3', false, false) .") ";
$conditions[] = $DB->sql_like($fullname, ':search1', false, false);
// Search by email.
$email = $DB->sql_like('email', ':search2', false, false);
if (!in_array('email', $extrafields)) {
// Prevent users who hide their email address from being found by others
// who aren't allowed to see hidden email addresses.
$email = "(". $email ." AND (" .
"u.maildisplay <> :maildisplayhide " .
"OR u.id = :userid1". // User can always find himself.
"))";
$params['maildisplayhide'] = 0; // maildisplay=0 is hidden to everybody.
$params['userid1'] = $USER->id;
}
$conditions[] = $email;
// Search by idnumber.
$idnumber = $DB->sql_like('idnumber', ':search3', false, false);
if (!in_array('idnumber', $extrafields)) {
// Users who aren't allowed to see idnumbers should at most find themselves
// when searching for an idnumber.
$idnumber = "(". $idnumber . " AND u.id = :userid2)";
$params['userid2'] = $USER->id;
}
$conditions[] = $idnumber;
$wheres[] = "(". implode(" OR ", $conditions) .") ";
$params['search1'] = "%$search%";
$params['search2'] = "%$search%";
$params['search3'] = "%$search%";