From b8d91beab44bbce73be33f035a72ae416bb25ada Mon Sep 17 00:00:00 2001
From: Shamim Rezaie <shamim@moodle.com>
Date: Thu, 6 Sep 2018 14:19:43 +1000
Subject: [PATCH] MDL-63136 mod_data: Check if the module is visible to the
 user

---
 mod/data/lib.php            |  6 ++++
 mod/data/tests/lib_test.php | 68 +++++++++++++++++++++++++++++++++++++
 2 files changed, 74 insertions(+)

diff --git a/mod/data/lib.php b/mod/data/lib.php
index 36dabca647d..12c17c8c699 100644
--- a/mod/data/lib.php
+++ b/mod/data/lib.php
@@ -4471,6 +4471,12 @@ function mod_data_core_calendar_provide_event_action(calendar_event $event,
     }
 
     $cm = get_fast_modinfo($event->courseid, $userid)->instances['data'][$event->instance];
+
+    if (!$cm->uservisible) {
+        // The module is not visible to the user for any reason.
+        return null;
+    }
+
     $now = time();
 
     if (!empty($cm->customdata['timeavailableto']) && $cm->customdata['timeavailableto'] < $now) {
diff --git a/mod/data/tests/lib_test.php b/mod/data/tests/lib_test.php
index 17a537c870f..893ab81dd83 100644
--- a/mod/data/tests/lib_test.php
+++ b/mod/data/tests/lib_test.php
@@ -1314,6 +1314,74 @@ class mod_data_lib_testcase extends advanced_testcase {
         $this->assertEquals([$datarecor1did, $datarecor2did], $updates->entries->itemids, '', 0, 10, true);
     }
 
+    public function test_data_core_calendar_provide_event_action_in_hidden_section() {
+        global $CFG;
+
+        $this->resetAfterTest();
+
+        $this->setAdminUser();
+
+        // Create a course.
+        $course = $this->getDataGenerator()->create_course();
+
+        // Create a student.
+        $student = $this->getDataGenerator()->create_and_enrol($course, 'student');
+
+        // Create a database activity.
+        $data = $this->getDataGenerator()->create_module('data', array('course' => $course->id,
+                'timeavailablefrom' => time() - DAYSECS, 'timeavailableto' => time() + DAYSECS));
+
+        // Create a calendar event.
+        $event = $this->create_action_event($course->id, $data->id, DATA_EVENT_TYPE_OPEN);
+
+        // Set sections 0 as hidden.
+        set_section_visible($course->id, 0, 0);
+
+        // Now, log out.
+        $CFG->forcelogin = true; // We don't want to be logged in as guest, as guest users might still have some capabilities.
+        $this->setUser();
+
+        // Create an action factory.
+        $factory = new \core_calendar\action_factory();
+
+        // Decorate action event for the student.
+        $actionevent = mod_data_core_calendar_provide_event_action($event, $factory, $student->id);
+
+        // Confirm the event is not shown at all.
+        $this->assertNull($actionevent);
+    }
+
+    public function test_data_core_calendar_provide_event_action_for_non_user() {
+        global $CFG;
+
+        $this->resetAfterTest();
+
+        $this->setAdminUser();
+
+        // Create a course.
+        $course = $this->getDataGenerator()->create_course();
+
+        // Create a database activity.
+        $data = $this->getDataGenerator()->create_module('data', array('course' => $course->id,
+            'timeavailablefrom' => time() - DAYSECS, 'timeavailableto' => time() + DAYSECS));
+
+        // Create a calendar event.
+        $event = $this->create_action_event($course->id, $data->id, DATA_EVENT_TYPE_OPEN);
+
+        // Now, log out.
+        $CFG->forcelogin = true; // We don't want to be logged in as guest, as guest users might still have some capabilities.
+        $this->setUser();
+
+        // Create an action factory.
+        $factory = new \core_calendar\action_factory();
+
+        // Decorate action event.
+        $actionevent = mod_data_core_calendar_provide_event_action($event, $factory);
+
+        // Confirm the event is not shown at all.
+        $this->assertNull($actionevent);
+    }
+
     public function test_data_core_calendar_provide_event_action_open() {
         $this->resetAfterTest();