From 6de45d2c9f7dd7b24210ab0310c296366a82986a Mon Sep 17 00:00:00 2001 From: Paul Holden Date: Mon, 11 Sep 2023 12:30:33 +0100 Subject: [PATCH] MDL-79310 mod_forum: ensure only visible users can be exported. --- mod/forum/export.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mod/forum/export.php b/mod/forum/export.php index 2b446ed1edf..fcd5f355204 100644 --- a/mod/forum/export.php +++ b/mod/forum/export.php @@ -190,6 +190,10 @@ if (!$PAGE->has_secondary_navigation()) { } // It is possible that the following fields have been provided in the URL. +$userids = array_filter($userids, static function(int $userid) use ($course, $cm): bool { + $user = core_user::get_user($userid, '*', MUST_EXIST); + return $cm->effectivegroupmode != SEPARATEGROUPS || user_can_view_profile($user, $course); +}); $form->set_data(['useridsselected' => $userids, 'discussionids' => $discussionids, 'from' => $from, 'to' => $to]); $form->display();