From adc49cf3717cef2e4eb92317287c76a8b953a830 Mon Sep 17 00:00:00 2001 From: Stefan Hanauska Date: Mon, 3 Nov 2025 06:56:17 +0100 Subject: [PATCH] MDL-86960 mod_data: Check user --- public/mod/data/lib.php | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/public/mod/data/lib.php b/public/mod/data/lib.php index 0528192c3e1..50aacbf7897 100644 --- a/public/mod/data/lib.php +++ b/public/mod/data/lib.php @@ -1677,7 +1677,7 @@ function data_rating_validate($params) { * @throws rating_exception */ function mod_data_rating_can_see_item_ratings($params) { - global $DB; + global $DB, $USER; // Check the component is mod_data. if (!isset($params['component']) || $params['component'] != 'mod_data') { @@ -1693,7 +1693,7 @@ function mod_data_rating_can_see_item_ratings($params) { throw new rating_exception('invaliditemid'); } - $datasql = "SELECT d.id as dataid, d.course, r.groupid + $datasql = "SELECT d.id as dataid, d.course, r.userid, r.groupid FROM {data_records} r JOIN {data} d ON r.dataid = d.id WHERE r.id = :itemid"; @@ -1703,14 +1703,23 @@ function mod_data_rating_can_see_item_ratings($params) { throw new rating_exception('invaliditemid'); } + $course = $DB->get_record('course', array('id' => $info->course), '*', MUST_EXIST); + $cm = get_coursemodule_from_instance('data', $info->dataid, $course->id, false, MUST_EXIST); + $context = context_module::instance($cm->id); + + if (!empty($info->userid)) { + $ratingpermissions = data_rating_permissions($context->id, 'mod_data', 'entry'); + $requiredpermission = ($info->userid != $USER->id) ? 'viewall' : 'view'; + if (!$ratingpermissions[$requiredpermission]) { + return false; + } + } + // User can see ratings of all participants. if ($info->groupid == 0) { return true; } - $course = $DB->get_record('course', array('id' => $info->course), '*', MUST_EXIST); - $cm = get_coursemodule_from_instance('data', $info->dataid, $course->id, false, MUST_EXIST); - // Make sure groups allow this user to see the item they're rating. return groups_group_visible($info->groupid, $course, $cm); }