From 6d153e67b43440ce6722d725499db3d857395e02 Mon Sep 17 00:00:00 2001
From: jerome mouneyrac <jerome@moodle.com>
Date: Fri, 5 Nov 2010 06:55:43 +0000
Subject: [PATCH] webservice MDL-18655 add new capability
 moodle/user:viewalldetails allowing to see all user information. This
 capability is set up copying the current moodle/user:update assignations

---
 lang/en/role.php                           |  1 +
 lib/db/access.php                          | 10 ++++++++++
 lib/filebrowser/file_info_context_user.php |  8 ++++++--
 user/externallib.php                       | 11 ++++-------
 user/profile/lib.php                       |  6 ++++--
 5 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/lang/en/role.php b/lang/en/role.php
index f992ba1dd31..372be9ed0f0 100644
--- a/lang/en/role.php
+++ b/lang/en/role.php
@@ -357,6 +357,7 @@ $string['user:managesyspages'] = 'Configure default page layout for public user
 $string['user:readuserblogs'] = 'See all user blogs';
 $string['user:readuserposts'] = 'See all user posts';
 $string['user:update'] = 'Update user profiles';
+$string['user:viewalldetails'] = 'View user full information';
 $string['user:viewdetails'] = 'View user profiles';
 $string['user:viewhiddendetails'] = 'View hidden details of users';
 $string['user:viewuseractivitiesreport'] = 'See user activity reports';
diff --git a/lib/db/access.php b/lib/db/access.php
index bab8d9e477b..f9e60eaf632 100644
--- a/lib/db/access.php
+++ b/lib/db/access.php
@@ -471,6 +471,16 @@ $capabilities = array(
         )
     ),
 
+    'moodle/user:viewalldetails' => array(
+        'riskbitmask' => RISK_PERSONAL,
+        'captype' => 'read',
+        'contextlevel' => CONTEXT_USER,
+        'archetypes' => array(
+            'manager' => CAP_ALLOW
+        ),
+        'clonepermissionsfrom' => 'moodle/user:update'
+    ),
+
     'moodle/user:viewhiddendetails' => array(
 
         'riskbitmask' => RISK_PERSONAL,
diff --git a/lib/filebrowser/file_info_context_user.php b/lib/filebrowser/file_info_context_user.php
index 6ba756ea4bc..a75efed1a26 100644
--- a/lib/filebrowser/file_info_context_user.php
+++ b/lib/filebrowser/file_info_context_user.php
@@ -113,7 +113,10 @@ class file_info_context_user extends file_info {
     protected function get_area_user_profile($itemid, $filepath, $filename) {
         global $CFG;
 
-        if (!has_capability('moodle/user:update', $this->context)) {
+        $readaccess = has_capability('moodle/user:update', $this->context);
+        $writeaccess = has_capability('moodle/user:viewalldetails', $this->context);
+
+        if (!$readaccess and !$writeaccess) {
             // the idea here is that only admins should be able to list/modify files in user profile, the rest has to use profile page
             return null;
         }
@@ -137,7 +140,8 @@ class file_info_context_user extends file_info {
             }
         }
         $urlbase = $CFG->wwwroot.'/pluginfile.php';
-        return new file_info_stored($this->browser, $this->context, $storedfile, $urlbase, get_string('areauserprofile', 'repository'), false, true, true, false);
+        return new file_info_stored($this->browser, $this->context, $storedfile, $urlbase, 
+                get_string('areauserprofile', 'repository'), false, $readaccess, $writeaccess, false);
     }
 
     protected function get_area_user_draft($itemid, $filepath, $filename) {
diff --git a/user/externallib.php b/user/externallib.php
index ea60acc214f..4ada03987fb 100644
--- a/user/externallib.php
+++ b/user/externallib.php
@@ -321,9 +321,6 @@ class moodle_user_external extends external_api {
             }
         }
 
-
-
-
         $transaction->allow_commit();
 
         return null;
@@ -363,10 +360,6 @@ class moodle_user_external extends external_api {
         //they are "user" related
         require_once($CFG->dirroot . "/user/profile/lib.php");
 
-        $context = get_context_instance(CONTEXT_SYSTEM);
-        require_capability('moodle/user:viewdetails', $context);
-        self::validate_context($context);
-
         $params = self::validate_parameters(self::get_users_by_id_parameters(),
                 array('userids'=>$userids));
 
@@ -377,6 +370,10 @@ class moodle_user_external extends external_api {
         $result = array();
         foreach ($users as $user) {
 
+            $context = get_context_instance(CONTEXT_USER, $user->id);
+            require_capability('moodle/user:viewalldetails', $context);
+            self::validate_context($context);
+
             if (empty($user->deleted)) {
 
                 $userarray = array();
diff --git a/user/profile/lib.php b/user/profile/lib.php
index 3df14c2dd4f..d83271a49dc 100644
--- a/user/profile/lib.php
+++ b/user/profile/lib.php
@@ -267,10 +267,12 @@ class profile_field_base {
                 if ($this->userid == $USER->id) {
                     return true;
                 } else {
-                    return has_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM));
+                    return has_capability('moodle/user:viewalldetails',
+                            get_context_instance(CONTEXT_USER, $this->userid));
                 }
             default:
-                return has_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM));
+                return has_capability('moodle/user:viewalldetails',
+                        get_context_instance(CONTEXT_USER, $this->userid));
         }
     }