From e8d84901ca36c9448d6a428783036e7b3ba2c5d9 Mon Sep 17 00:00:00 2001
From: Alexandru Elisei <alexandru.elisei@gmail.com>
Date: Sun, 14 Aug 2016 15:03:23 +0300
Subject: [PATCH] MDL-55423 accesslib: Prevent get_role_users() false debugging
 messages

---
 lib/accesslib.php            | 21 +++++++++++++++++++--
 lib/tests/accesslib_test.php | 16 ++++++++++++++++
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/lib/accesslib.php b/lib/accesslib.php
index a2c4eb81c17..19033df02f0 100644
--- a/lib/accesslib.php
+++ b/lib/accesslib.php
@@ -4208,15 +4208,32 @@ function get_role_users($roleid, context $context, $parent = false, $fields = ''
     // Adding the fields from $sort that are not present in $fields.
     $sortarray = preg_split('/,\s*/', $sort);
     $fieldsarray = preg_split('/,\s*/', $fields);
+
+    // Discarding aliases from the fields.
+    $fieldnames = array();
+    foreach ($fieldsarray as $key => $field) {
+        list($fieldnames[$key]) = explode(' ', $field);
+    }
+
     $addedfields = array();
     foreach ($sortarray as $sortfield) {
         // Throw away any additional arguments to the sort (e.g. ASC/DESC).
-        list ($sortfield) = explode(' ', $sortfield);
-        if (!in_array($sortfield, $fieldsarray)) {
+        list($sortfield) = explode(' ', $sortfield);
+        list($tableprefix) = explode('.', $sortfield);
+        $fieldpresent = false;
+        foreach ($fieldnames as $fieldname) {
+            if ($fieldname === $sortfield || $fieldname === $tableprefix.'.*') {
+                $fieldpresent = true;
+                break;
+            }
+        }
+
+        if (!$fieldpresent) {
             $fieldsarray[] = $sortfield;
             $addedfields[] = $sortfield;
         }
     }
+
     $fields = implode(', ', $fieldsarray);
     if (!empty($addedfields)) {
         $addedfields = implode(', ', $addedfields);
diff --git a/lib/tests/accesslib_test.php b/lib/tests/accesslib_test.php
index e3a2f995d2c..04686f6d703 100644
--- a/lib/tests/accesslib_test.php
+++ b/lib/tests/accesslib_test.php
@@ -1453,6 +1453,22 @@ class core_accesslib_testcase extends advanced_testcase {
         $this->assertObjectHasAttribute('lastname', $users[$user3->id]);
         $this->assertObjectHasAttribute('firstname', $users[$user3->id]);
 
+        $users = get_role_users($teacherrole->id, $coursecontext, false, 'u.*');
+        $this->assertDebuggingNotCalled();
+        $this->assertCount(2, $users);
+
+        $users = get_role_users($teacherrole->id, $coursecontext, false, 'u.id AS id_alias');
+        $this->assertDebuggingCalled('get_role_users() adding u.lastname, u.firstname to the query result because they were required by $sort but missing in $fields');
+        $this->assertCount(2, $users);
+        $this->assertArrayHasKey($user1->id, $users);
+        $this->assertObjectHasAttribute('id_alias', $users[$user1->id]);
+        $this->assertObjectHasAttribute('lastname', $users[$user1->id]);
+        $this->assertObjectHasAttribute('firstname', $users[$user1->id]);
+        $this->assertArrayHasKey($user3->id, $users);
+        $this->assertObjectHasAttribute('id_alias', $users[$user3->id]);
+        $this->assertObjectHasAttribute('lastname', $users[$user3->id]);
+        $this->assertObjectHasAttribute('firstname', $users[$user3->id]);
+
         $users = get_role_users($teacherrole->id, $coursecontext, false, 'u.id, u.email, u.idnumber', 'u.idnumber', null, $group->id);
         $this->assertCount(1, $users);
         $this->assertArrayHasKey($user3->id, $users);