From a027e6dfdcc309840b4cf3690e1a8d760e23c26a Mon Sep 17 00:00:00 2001
From: Shamim Rezaie <shamim@moodle.com>
Date: Fri, 7 Sep 2018 14:55:28 +1000
Subject: [PATCH] MDL-63138 mod_folder: Check if the module is visible to the
 user

---
 mod/folder/lib.php            |  5 ++++
 mod/folder/tests/lib_test.php | 54 +++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+)

diff --git a/mod/folder/lib.php b/mod/folder/lib.php
index 87c280eecff..13d878ffc1e 100644
--- a/mod/folder/lib.php
+++ b/mod/folder/lib.php
@@ -802,6 +802,11 @@ function mod_folder_core_calendar_provide_event_action(calendar_event $event,
 
     $cm = get_fast_modinfo($event->courseid, $userid)->instances['folder'][$event->instance];
 
+    if (!$cm->uservisible) {
+        // The module is not visible to the user for any reason.
+        return null;
+    }
+
     $completion = new \completion_info($cm->get_course());
 
     $completiondata = $completion->get_data($cm, false, $userid);
diff --git a/mod/folder/tests/lib_test.php b/mod/folder/tests/lib_test.php
index a4d4eace709..5a42f632fcc 100644
--- a/mod/folder/tests/lib_test.php
+++ b/mod/folder/tests/lib_test.php
@@ -118,6 +118,60 @@ class mod_folder_lib_testcase extends advanced_testcase {
         $this->assertTrue($actionevent->is_actionable());
     }
 
+    public function test_folder_core_calendar_provide_event_action_for_non_user() {
+        global $CFG;
+
+        // Create a course.
+        $course = $this->getDataGenerator()->create_course();
+
+        // Create the activity.
+        $folder = $this->getDataGenerator()->create_module('folder', array('course' => $course->id));
+
+        // Create a calendar event.
+        $event = $this->create_action_event($course->id, $folder->id,
+                \core_completion\api::COMPLETION_EVENT_TYPE_DATE_COMPLETION_EXPECTED);
+
+        // Now, log out.
+        $CFG->forcelogin = true; // We don't want to be logged in as guest, as guest users might still have some capabilities.
+        $this->setUser();
+
+        // Create an action factory.
+        $factory = new \core_calendar\action_factory();
+
+        // Decorate action event.
+        $actionevent = mod_folder_core_calendar_provide_event_action($event, $factory);
+
+        // Confirm the event is not shown at all.
+        $this->assertNull($actionevent);
+    }
+
+    public function test_folder_core_calendar_provide_event_action_in_hidden_section() {
+        // Create a course.
+        $course = $this->getDataGenerator()->create_course();
+
+        // Create a student.
+        $student = $this->getDataGenerator()->create_and_enrol($course, 'student');
+
+        // Create the activity.
+        $folder = $this->getDataGenerator()->create_module('folder', array('course' => $course->id));
+
+        // Create a calendar event.
+        $event = $this->create_action_event($course->id, $folder->id,
+                \core_completion\api::COMPLETION_EVENT_TYPE_DATE_COMPLETION_EXPECTED);
+
+        // Set sections 0 as hidden.
+        set_section_visible($course->id, 0, 0);
+
+        // Create an action factory.
+        $factory = new \core_calendar\action_factory();
+
+        // Decorate action event.
+        $actionevent = mod_folder_core_calendar_provide_event_action($event, $factory, $student->id);
+
+        // Confirm the event is not shown at all.
+        $this->assertNull($actionevent);
+    }
+
     public function test_folder_core_calendar_provide_event_action_for_user() {
         // Create a course.
         $course = $this->getDataGenerator()->create_course();