From 54bb01439e84da58fb97ccf673eaca49b9c47ba6 Mon Sep 17 00:00:00 2001
From: Sara Arjona <sara@moodle.com>
Date: Mon, 30 Oct 2017 08:30:11 +0100
Subject: [PATCH] MDL-60550 user: Add more restrictions in keyword searches

Original patch provided by Tim Schroeder.
---
 user/index.php | 33 ++++++++++++++++++++++++++++++---
 1 file changed, 30 insertions(+), 3 deletions(-)

diff --git a/user/index.php b/user/index.php
index 7cc2fd763a0..f4bb80bd598 100644
--- a/user/index.php
+++ b/user/index.php
@@ -455,10 +455,37 @@ if ($wheres) {
 $totalcount = $DB->count_records_sql("SELECT COUNT(u.id) $from $where", $params);
 
 if (!empty($search)) {
+    $conditions = array();
+
+    // Search by fullname.
     $fullname = $DB->sql_fullname('u.firstname', 'u.lastname');
-    $wheres[] = "(". $DB->sql_like($fullname, ':search1', false, false) .
-                " OR ". $DB->sql_like('email', ':search2', false, false) .
-                " OR ". $DB->sql_like('idnumber', ':search3', false, false) .") ";
+    $conditions[] = $DB->sql_like($fullname, ':search1', false, false);
+
+    // Search by email.
+    $email = $DB->sql_like('email', ':search2', false, false);
+    if (!in_array('email', $extrafields)) {
+        // Prevent users who hide their email address from being found by others
+        // who aren't allowed to see hidden email addresses.
+        $email = "(". $email ." AND (" .
+                "u.maildisplay <> :maildisplayhide " .
+                "OR u.id = :userid1". // User can always find himself.
+                "))";
+        $params['maildisplayhide'] = 0; // maildisplay=0 is hidden to everybody.
+        $params['userid1'] = $USER->id;
+    }
+    $conditions[] = $email;
+
+    // Search by idnumber.
+    $idnumber = $DB->sql_like('idnumber', ':search3', false, false);
+    if (!in_array('idnumber', $extrafields)) {
+        // Users who aren't allowed to see idnumbers should at most find themselves
+        // when searching for an idnumber.
+        $idnumber = "(". $idnumber . " AND u.id = :userid2)";
+        $params['userid2'] = $USER->id;
+    }
+    $conditions[] = $idnumber;
+
+    $wheres[] = "(". implode(" OR ", $conditions) .") ";
     $params['search1'] = "%$search%";
     $params['search2'] = "%$search%";
     $params['search3'] = "%$search%";