From 5c91f31d2e89c3ee3226bc12847baa52003ec17d Mon Sep 17 00:00:00 2001
From: Andrew Nicols <andrew@nicols.co.uk>
Date: Mon, 10 Aug 2020 10:08:17 +0800
Subject: [PATCH] MDL-68974 blocks: Check permission before generating content

---
 calendar/lib.php | 3 +++
 lib/blocklib.php | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/calendar/lib.php b/calendar/lib.php
index 541f1b2142c..9195b28a69f 100644
--- a/calendar/lib.php
+++ b/calendar/lib.php
@@ -1281,6 +1281,9 @@ class calendar_information {
      * @param string|null $view preference view options (eg: day, month, upcoming)
      */
     public function add_sidecalendar_blocks(core_calendar_renderer $renderer, $showfilters=false, $view=null) {
+        if (!has_capability('moodle/block:view', $this->context) ) {
+            return;
+        }
         if ($showfilters) {
             $filters = new block_contents();
             $filters->content = $renderer->event_filter();
diff --git a/lib/blocklib.php b/lib/blocklib.php
index 60a3335127e..0ca45594e05 100644
--- a/lib/blocklib.php
+++ b/lib/blocklib.php
@@ -1225,6 +1225,12 @@ class block_manager {
      */
     public function ensure_content_created($region, $output) {
         $this->ensure_instances_exist($region);
+
+        if (!has_capability('moodle/block:view', $this->page->context) ) {
+            $this->visibleblockcontent[$region] = [];
+            return;
+        }
+
         if (!array_key_exists($region, $this->visibleblockcontent)) {
             $contents = array();
             if (array_key_exists($region, $this->extracontent)) {