From 71bc139d637eb0da1497a0eed801fe2f03f4dd69 Mon Sep 17 00:00:00 2001
From: Andrew Nicols <andrew@nicols.co.uk>
Date: Fri, 24 Oct 2014 08:08:56 +0800
Subject: [PATCH] MDL-47802 mod_forum: Check for required subscription
 capabilities

Users must be able to both view, and manage their subscription in order to
subscribe or be subscribed to a discussion.
---
 mod/forum/discuss.php        | 5 ++++-
 mod/forum/subscribe_ajax.php | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/mod/forum/discuss.php b/mod/forum/discuss.php
index e6ccfe6477b..8729682d925 100644
--- a/mod/forum/discuss.php
+++ b/mod/forum/discuss.php
@@ -137,7 +137,10 @@
         $newdiscussion->forum = $forumto->id;
         foreach ($subscriptionchanges as $userid => $preference) {
             if ($preference === \mod_forum\subscriptions::FORUM_DISCUSSION_SUBSCRIBED) {
-                \mod_forum\subscriptions::subscribe_user_to_discussion($userid, $newdiscussion, $destinationctx);
+                // Users must have viewdiscussion to a discussion.
+                if (has_capability('mod/forum:viewdiscussion', $destinationctx, $userid)) {
+                    \mod_forum\subscriptions::subscribe_user_to_discussion($userid, $newdiscussion, $destinationctx);
+                }
             } else {
                 \mod_forum\subscriptions::unsubscribe_user_from_discussion($userid, $newdiscussion, $destinationctx);
             }
diff --git a/mod/forum/subscribe_ajax.php b/mod/forum/subscribe_ajax.php
index d2a867a3255..171595b2e36 100644
--- a/mod/forum/subscribe_ajax.php
+++ b/mod/forum/subscribe_ajax.php
@@ -37,6 +37,7 @@ $cm             = get_coursemodule_from_instance('forum', $forum->id, $course->i
 $context        = context_module::instance($cm->id);
 
 require_login($course, false, $cm);
+require_capability('mod/forum:viewdiscussion', $context);
 
 $return = new stdClass();