From 86bc0ae4b90d7dd378be5d10500878229808e91c Mon Sep 17 00:00:00 2001
From: Nathan Nguyen <nathannguyen@catalyst-au.net>
Date: Thu, 6 Jun 2019 17:02:20 +1000
Subject: [PATCH] MDL-65797 mod_assign:  limit users to list of participants

Limit assign override union to list of participants in a course instead of users of the whole site.
---
 mod/assign/gradingtable.php | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/mod/assign/gradingtable.php b/mod/assign/gradingtable.php
index 3da5f7ac587..75a659f91e5 100644
--- a/mod/assign/gradingtable.php
+++ b/mod/assign/gradingtable.php
@@ -176,6 +176,14 @@ class assign_grading_table extends table_sql implements renderable {
             $params['assignmentid8'] = (int)$this->assignment->get_instance()->id;
             $params['assignmentid9'] = (int)$this->assignment->get_instance()->id;
 
+            list($userwhere1, $userparams1) = $DB->get_in_or_equal($users, SQL_PARAMS_NAMED, 'priorityuser');
+            list($userwhere2, $userparams2) = $DB->get_in_or_equal($users, SQL_PARAMS_NAMED, 'effectiveuser');
+
+            $userwhere1 = "WHERE u.id {$userwhere1}";
+            $userwhere2 = "WHERE u.id {$userwhere2}";
+            $params = array_merge($params, $userparams1);
+            $params = array_merge($params, $userparams2);
+
             $fields .= ', priority.priority, ';
             $fields .= 'effective.allowsubmissionsfromdate, ';
             $fields .= 'effective.duedate, ';
@@ -184,7 +192,7 @@ class assign_grading_table extends table_sql implements renderable {
             $from .= ' LEFT JOIN (
                SELECT merged.userid, min(merged.priority) priority FROM (
                   ( SELECT u.id as userid, 9999999 AS priority
-                      FROM {user} u
+                      FROM {user} u '.$userwhere1.'
                   )
                   UNION
                   ( SELECT uo.userid, 0 AS priority
@@ -210,6 +218,7 @@ class assign_grading_table extends table_sql implements renderable {
                       a.cutoffdate
                  FROM {user} u
                  JOIN {assign} a ON a.id = :assignmentid7
+                 '.$userwhere2.'
               )
               UNION
               (SELECT 0 AS priority,
@@ -243,12 +252,12 @@ class assign_grading_table extends table_sql implements renderable {
             $fields .= ', um.id as recordid ';
         }
 
-        $userparams = array();
+        $userparams3 = array();
         $userindex = 0;
 
-        list($userwhere, $userparams) = $DB->get_in_or_equal($users, SQL_PARAMS_NAMED, 'user');
-        $where = 'u.id ' . $userwhere;
-        $params = array_merge($params, $userparams);
+        list($userwhere3, $userparams3) = $DB->get_in_or_equal($users, SQL_PARAMS_NAMED, 'user');
+        $where = 'u.id ' . $userwhere3;
+        $params = array_merge($params, $userparams3);
 
         // The filters do not make sense when there are no submissions, so do not apply them.
         if ($this->assignment->is_any_submission_plugin_enabled()) {