From 866d5c02f3ffe341bccd2f531edae2ee5ab646a6 Mon Sep 17 00:00:00 2001 From: Stevani Andolo Date: Thu, 14 Nov 2024 16:57:49 +0800 Subject: [PATCH] MDL-72704 message: Fix fetching of conversation member info --- message/externallib.php | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/message/externallib.php b/message/externallib.php index eb4c84a4a5f..a0729dd7782 100644 --- a/message/externallib.php +++ b/message/externallib.php @@ -3395,7 +3395,7 @@ class core_message_external extends external_api { bool $includecontactrequests = false, bool $includeprivacyinfo = false ) { - global $CFG, $USER; + global $CFG, $USER, $DB; // All the business logic checks that really shouldn't be in here. if (empty($CFG->messaging)) { @@ -3415,9 +3415,19 @@ class core_message_external extends external_api { throw new moodle_exception('You do not have permission to perform this action.'); } + // Filter the user IDs, removing the IDs of the users that the current user cannot view. + require_once($CFG->dirroot . '/user/lib.php'); + $userfieldsapi = \core_user\fields::for_userpic()->including('username', 'deleted'); + $userfields = $userfieldsapi->get_sql('', false, '', '', false)->selects; + $users = $DB->get_records_list('user', 'id', $userids, '', $userfields, 0, 100); + $filteredids = array_filter($params['userids'], function($userid) use ($users) { + $targetuser = $users[$userid]; + return user_can_view_profile($targetuser); + }); + return \core_message\helper::get_member_info( $params['referenceuserid'], - $params['userids'], + $filteredids ?? [], $params['includecontactrequests'], $params['includeprivacyinfo'] );