From 5b0902eb06e81598b13bf7f5da2dc385e1a601c3 Mon Sep 17 00:00:00 2001
From: Andrew Nicols <andrew@nicols.co.uk>
Date: Mon, 10 Aug 2020 10:08:17 +0800
Subject: [PATCH] MDL-68974 blocks: Check permission before generating content

---
 calendar/lib.php | 3 +++
 lib/blocklib.php | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/calendar/lib.php b/calendar/lib.php
index 8378d892598..3026ff5744e 100644
--- a/calendar/lib.php
+++ b/calendar/lib.php
@@ -1270,6 +1270,9 @@ class calendar_information {
      * @param string|null $view preference view options (eg: day, month, upcoming)
      */
     public function add_sidecalendar_blocks(core_calendar_renderer $renderer, $showfilters=false, $view=null) {
+        if (!has_capability('moodle/block:view', $this->context) ) {
+            return;
+        }
         if ($showfilters) {
             $filters = new block_contents();
             $filters->content = $renderer->event_filter();
diff --git a/lib/blocklib.php b/lib/blocklib.php
index db4d981aa3b..0dd3fb4b530 100644
--- a/lib/blocklib.php
+++ b/lib/blocklib.php
@@ -1260,6 +1260,12 @@ class block_manager {
      */
     public function ensure_content_created($region, $output) {
         $this->ensure_instances_exist($region);
+
+        if (!has_capability('moodle/block:view', $this->page->context) ) {
+            $this->visibleblockcontent[$region] = [];
+            return;
+        }
+
         if (!array_key_exists($region, $this->visibleblockcontent)) {
             $contents = array();
             if (array_key_exists($region, $this->extracontent)) {