From a8134ff68ba53ef25a5ada82ccb7e244ee669e51 Mon Sep 17 00:00:00 2001
From: Dan Poltawski <dan.poltawski@luns.net.uk>
Date: Sat, 28 May 2011 08:46:47 +0100
Subject: [PATCH] messaging: MDL-26960 Check correct users permissions

When on message profile page, the incorrect capability was checked
---
 lib/messagelib.php | 7 ++++---
 message/edit.php   | 8 +++-----
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/lib/messagelib.php b/lib/messagelib.php
index f7a8c240f48..dfd8610fd19 100644
--- a/lib/messagelib.php
+++ b/lib/messagelib.php
@@ -353,11 +353,12 @@ function message_set_default_message_preference($component, $messagename, $filep
 }
 
 /**
- * Returns the active providers for the current user, based on capability
+ * Returns the active providers for the user specified, based on capability
  *
+ * @param int $userid id of user
  * @return array of message providers
  */
-function message_get_my_providers() {
+function message_get_providers_for_user($userid) {
     global $DB;
 
     $systemcontext = get_context_instance(CONTEXT_SYSTEM);
@@ -367,7 +368,7 @@ function message_get_my_providers() {
     // Remove all the providers we aren't allowed to see now
     foreach ($providers as $providerid => $provider) {
         if (!empty($provider->capability)) {
-            if (!has_capability($provider->capability, $systemcontext)) {
+            if (!has_capability($provider->capability, $systemcontext, $userid)) {
                 unset($providers[$providerid]);   // Not allowed to see this
             }
         }
diff --git a/message/edit.php b/message/edit.php
index 9af68c182be..479d876a4d7 100644
--- a/message/edit.php
+++ b/message/edit.php
@@ -91,13 +91,14 @@ if ($user->id == $USER->id) {
     $PAGE->navigation->extend_for_user($user);
 }
 
+// Fetch message providers
+$providers = message_get_providers_for_user($user->id);
+
 /// Save new preferences if data was submitted
 
 if (($form = data_submitted()) && confirm_sesskey()) {
     $preferences = array();
 
-/// Set all the preferences for all the message providers
-    $providers = message_get_my_providers();
     foreach ($providers as $provider) {
         $componentproviderbase = $provider->component.'_'.$provider->name;
         foreach (array('loggedin', 'loggedoff') as $state) {
@@ -142,7 +143,6 @@ $preferences = new stdClass();
 $preferences->userdefaultemail = $user->email;//may be displayed by the email processor
 
 /// Get providers preferences
-$providers = message_get_my_providers();
 foreach ($providers as $provider) {
     foreach (array('loggedin', 'loggedoff') as $state) {
         $linepref = get_user_preferences('message_provider_'.$provider->component.'_'.$provider->name.'_'.$state, '', $user->id);
@@ -182,8 +182,6 @@ if ($course->id != SITEID) {
 
 // Grab the renderer
 $renderer = $PAGE->get_renderer('core', 'message');
-// Fetch message providers
-$providers = message_get_my_providers();
 // Fetch default (site) preferences
 $defaultpreferences = get_message_output_default_preferences();