Forum/MDL-14558: Prevent users from subscribing or getting subscribed to forums where subscriptions are not allowed.

mod/forum/index.php

@@ -132,7 +132,7 @@
             }
             if (!forum_is_forcesubscribed($forum)) {
                 $subscribed = forum_is_subscribed($USER->id, $forum);
-                if ($subscribe && !$subscribed && $cansub) {
+                if ((has_capability('moodle/course:manageactivities', $coursecontext, $USER->id) || $forum->forcesubscribe != FORUM_DISALLOWSUBSCRIBE) && $subscribe && !$subscribed && $cansub) {
                     forum_subscribe($USER->id, $forumid);
                 } else if (!$subscribe && $subscribed) {
                     forum_unsubscribe($USER->id, $forumid);

mod/forum/lib.php

@@ -4065,31 +4065,52 @@ function forum_unsubscribe($userid, $forumid) {
  * Given a new post, subscribes or unsubscribes as appropriate.
  * Returns some text which describes what happened.
  */
-function forum_post_subscription($post) {
+function forum_post_subscription($post, $forum) {
 
     global $USER;
-
-    $subscribed=forum_is_subscribed($USER->id, $post->forum);
-    if ((isset($post->subscribe) && $post->subscribe && $subscribed)
-        || (!$post->subscribe && !$subscribed)) {
+    
+    $action = '';
+    $subscribed = forum_is_subscribed($USER->id, $forum);
+    
+    if ($forum->forcesubscribe == FORUM_FORCESUBSCRIBE) { // database ignored
         return "";
-    }
 
-    if (!$forum = get_record("forum", "id", $post->forum)) {
-        return "";
+    } elseif (($forum->forcesubscribe == FORUM_DISALLOWSUBSCRIBE)
+        && !has_capability('moodle/course:manageactivities', $coursecontext, $USER->id)) {
+        if ($subscribed) {
+            $action = 'unsubscribe'; // sanity check, following MDL-14558
+        } else {
+            return "";
+        }
+
+    } else { // go with the user's choice
+        if (isset($post->subscribe)) {
+            // no change
+            if ((!empty($post->subscribe) && $subscribed)
+                || (empty($post->subscribe) && !$subscribed)) {
+                return "";
+
+            } elseif (!empty($post->subscribe) && !$subscribed) {
+                $action = 'subscribe';
+
+            } elseif (empty($post->subscribe) && $subscribed) {
+                $action = 'unsubscribe';
+            }
+        }
     }
 
     $info = new object();
     $info->name  = fullname($USER);
     $info->forum = format_string($forum->name);
 
-    if (!empty($post->subscribe)) {
-        forum_subscribe($USER->id, $post->forum);
-        return "<p>".get_string("nowsubscribed", "forum", $info)."</p>";
+    switch ($action) {
+        case 'subscribe':
+            forum_subscribe($USER->id, $post->forum);
+            return "<p>".get_string("nowsubscribed", "forum", $info)."</p>";
+        case 'unsubscribe':
+            forum_unsubscribe($USER->id, $post->forum);
+            return "<p>".get_string("nownotsubscribed", "forum", $info)."</p>";
     }
-
-    forum_unsubscribe($USER->id, $post->forum);
-    return "<p>".get_string("nownotsubscribed", "forum", $info)."</p>";
 }
 
 /**

mod/forum/post.php

@@ -501,7 +501,7 @@
             }
             $message .= '<br />'.get_string("postupdated", "forum");
 
-            if ($subscribemessage = forum_post_subscription($fromform)) {
+            if ($subscribemessage = forum_post_subscription($fromform, $forum)) {
                 $timemessage = 4;
             }
             if ($forum->type == 'single') {
@@ -532,7 +532,7 @@
                     $timemessage = 4;
                 }
 
-                if ($subscribemessage = forum_post_subscription($fromform)) {
+                if ($subscribemessage = forum_post_subscription($fromform, $forum)) {
                     $timemessage = 4;
                 }
 
@@ -601,7 +601,7 @@
                     $message .= '<p>'.get_string("postaddedtimeleft", "forum", format_time($CFG->maxeditingtime)) . '</p>';
                 }
 
-                if ($subscribemessage = forum_post_subscription($discussion)) {
+                if ($subscribemessage = forum_post_subscription($discussion, $forum)) {
                     $timemessage = 4;
                 }