MDL-72123 message: Hide add to contacts button if user not allowed

lib/classes/output/core_renderer.php

@@ -4158,6 +4158,7 @@ EOD;
                     ];
 
                     if ($USER->id != $user->id) {
+                        $cancreatecontact = \core_message\api::can_create_contact($USER->id, $user->id);
                         $iscontact = \core_message\api::is_contact($USER->id, $user->id);
                         $isrequested = \core_message\api::get_contact_requests_between_users($USER->id, $user->id);
                         $contacturlaction = '';
@@ -4170,6 +4171,9 @@ EOD;
                         // If the user is not a contact.
                         if (!$iscontact) {
                             if ($isrequested) {
+                                // Set it to true if a request has been sent.
+                                $cancreatecontact = true;
+
                                 // We just need the first request.
                                 $requests = array_shift($isrequested);
                                 if ($requests->userid == $USER->id) {
@@ -4195,7 +4199,8 @@ EOD;
                             $contacturlaction = 'removecontact';
                             $contactimage = 't/removecontact';
                         }
-                        $userbuttons['togglecontact'] = [
+                        if ($cancreatecontact) {
+                            $userbuttons['togglecontact'] = [
                                 'buttontype' => 'togglecontact',
                                 'title' => get_string($contacttitle, 'message'),
                                 'url' => new moodle_url('/message/index.php', [
@@ -4208,6 +4213,7 @@ EOD;
                                 'linkattributes' => $linkattributes,
                                 'page' => $this->page,
                             ];
+                        }
                     }
                 }
             } else {

message/amd/src/message_drawer_view_conversation.js

@@ -193,7 +193,8 @@ function(
             canmessage: null,
             canmessageevenifblocked: null,
             requirescontact: null,
-            contactrequests: []
+            contactrequests: [],
+            cancreatecontact: null,
         };
     };
 

message/amd/src/message_drawer_view_conversation_patcher.js

@@ -425,7 +425,8 @@ function(
                     showonlinestatus: newOtherUser.showonlinestatus,
                     isonline: newOtherUser.isonline,
                     isblocked: newOtherUser.isblocked,
-                    iscontact: newOtherUser.iscontact
+                    iscontact: newOtherUser.iscontact,
+                    cancreatecontact: newOtherUser.cancreatecontact,
                 }
             };
         }

message/amd/src/message_drawer_view_conversation_state_manager.js

@@ -91,7 +91,8 @@ define(['jquery'], function($) {
                 canmessage: member.canmessage,
                 canmessageevenifblocked: member.canmessageevenifblocked,
                 requirescontact: member.requirescontact,
-                contactrequests: member.contactrequests || []
+                contactrequests: member.contactrequests || [],
+                cancreatecontact: member.cancreatecontact,
             };
         });
     };

message/classes/helper.php

@@ -480,6 +480,9 @@ class helper {
             // Set contact and blocked status indicators.
             $data->iscontact = ($member->contactid) ? true : false;
 
+            // Set permission to create a contact request.
+            $data->cancreatecontact = api::can_create_contact($referenceuserid, $member->id);
+
             // We don't want that a user has been blocked if they can message the user anyways.
             $canmessageifblocked = api::can_send_message($referenceuserid, $member->id, true);
             $data->isblocked = ($member->blockedid && !$canmessageifblocked) ? true : false;

message/externallib.php

@@ -1069,6 +1069,7 @@ class core_message_external extends external_api {
                 'If the user can still message even if they get blocked'),
             'canmessage' => new external_value(PARAM_BOOL, 'If the user can be messaged'),
             'requirescontact' => new external_value(PARAM_BOOL, 'If the user requires to be contacts'),
+            'cancreatecontact' => new external_value(PARAM_BOOL, 'Is the user permitted to add a contact'),
         ];
 
         $result['contactrequests'] = new external_multiple_structure(

message/templates/message_drawer_view_contact_body_content.mustache

@@ -82,6 +82,7 @@
         >
             {{#str}}removefromyourcontacts, message{{/str}}
         </button>
+        {{#cancreatecontact}}
         <button
             type="button"
             class="btn btn-primary {{#iscontact}}hidden{{/iscontact}}"
@@ -92,5 +93,6 @@
         >
             {{#str}}addtoyourcontacts, message{{/str}}
         </button>
+        {{/cancreatecontact}}
     </div>
 </div>

message/templates/message_drawer_view_conversation_header_content_type_private.mustache

@@ -115,9 +115,11 @@
             <a class="dropdown-item" href="#" data-action="request-delete-conversation" role="menuitem">
                 {{#str}} deleteconversation, core_message {{/str}}
             </a>
+            {{#cancreatecontact}}
             <a class="dropdown-item {{#iscontact}}hidden{{/iscontact}}" href="#" data-action="request-add-contact" role="menuitem">
                 {{#str}} addtoyourcontacts, core_message {{/str}}
             </a>
+            {{/cancreatecontact}}
             <a class="dropdown-item {{^iscontact}}hidden{{/iscontact}}" href="#" data-action="request-remove-contact"
             role="menuitem">
                 {{#str}} removefromyourcontacts, core_message {{/str}}

message/tests/behat/message_admin_settings.feature

@@ -20,7 +20,7 @@ Feature: Message admin settings
     And I navigate to "Users > Accounts > Browse list of users" in site administration
     And I should see "User One"
     And I follow "User One"
-    And "Add to contacts" "link" should exist
+    And "Message" "link" should exist
     And I am on "Course 1" course homepage
     And I navigate to course participants
     And the "With selected users..." select box should contain "Send a message"
@@ -33,7 +33,7 @@ Feature: Message admin settings
     And I navigate to "Users > Accounts > Browse list of users" in site administration
     And I should see "User One"
     And I follow "User One"
-    And "Add to contacts" "link" should not exist
+    And "Message" "link" should not exist
     And I am on "Course 1" course homepage
     And I navigate to course participants
     And the "With selected users..." select box should not contain "Send a message"

message/tests/behat/message_drawer_manage_contacts.feature

@@ -110,3 +110,23 @@ Feature: Manage contacts
     And I click on "Remove" "button"
     And I go back in "view-conversation" message drawer
     And I should see "No contacts" in the "//*[@data-region='empty-message-container']" "xpath_element"
+
+  Scenario: Prevent sending a 'contact request' if user access is not permitted
+    Given the following config values are set as admin:
+      | messagingallusers | 0 |
+    When I am on the "student1" "user > profile" page logged in as admin
+    Then I should not see "Add to contacts"
+    And I click on "Message" "link"
+    And I click on "Conversation actions menu" "button"
+    And I should not see "Add to contacts"
+    And I click on "User info" "link"
+    And I should not see "Add to contacts"
+
+  Scenario: Disabling messagingallusers preserves the contact request sent status
+    Given I am on the "student1" "user > profile" page logged in as admin
+    And I click on "Add to contacts" "link"
+    And I should see "Contact request sent"
+    And the following config values are set as admin:
+      | messagingallusers | 0 |
+    When I reload the page
+    Then I should see "Contact request sent"

theme/boost/classes/output/core_renderer.php

@@ -128,6 +128,7 @@ class core_renderer extends \core_renderer {
                     );
 
                     if ($USER->id != $user->id) {
+                        $cancreatecontact = \core_message\api::can_create_contact($USER->id, $user->id);
                         $iscontact = \core_message\api::is_contact($USER->id, $user->id);
                         $isrequested = \core_message\api::get_contact_requests_between_users($USER->id, $user->id);
                         $contacturlaction = '';
@@ -140,6 +141,9 @@ class core_renderer extends \core_renderer {
                         // If the user is not a contact.
                         if (!$iscontact) {
                             if ($isrequested) {
+                                // Set it to true if a request has been sent.
+                                $cancreatecontact = true;
+
                                 // We just need the first request.
                                 $requests = array_shift($isrequested);
                                 if ($requests->userid == $USER->id) {
@@ -165,7 +169,8 @@ class core_renderer extends \core_renderer {
                             $contacturlaction = 'removecontact';
                             $contactimage = 't/removecontact';
                         }
-                        $userbuttons['togglecontact'] = array(
+                        if ($cancreatecontact) {
+                            $userbuttons['togglecontact'] = array(
                                 'buttontype' => 'togglecontact',
                                 'title' => get_string($contacttitle, 'message'),
                                 'url' => new moodle_url('/message/index.php', array(
@@ -178,6 +183,7 @@ class core_renderer extends \core_renderer {
                                 'linkattributes' => $linkattributes,
                                 'page' => $this->page
                             );
+                        }
                     }
 
                     $this->page->requires->string_for_js('changesmadereallygoaway', 'moodle');