MDL-83180 reportbuilder: correct access check for viewing schedules.

reportbuilder/classes/local/systemreports/report_schedules.php

@@ -91,7 +91,10 @@ class report_schedules extends system_report {
      * @return bool
      */
     protected function can_view(): bool {
-        return permission::can_view_reports_list();
+        $reportid = $this->get_parameter('reportid', 0, PARAM_INT);
+        $report = report::get_record(['id' => $reportid], MUST_EXIST);
+
+        return permission::can_edit_report($report);
     }
 
     /**

reportbuilder/classes/system_report.php

@@ -71,6 +71,8 @@ abstract class system_report extends base {
      * This is necessary to implement independently of the page that would typically embed the report because
      * subsequent pages are requested via AJAX requests, and access should be validated each time
      *
+     * Report parameters should also be considered when implementing this method
+     *
      * @return bool
      */
     abstract protected function can_view(): bool;
@@ -201,6 +203,8 @@ abstract class system_report extends base {
     /**
      * Return specific report parameter
      *
+     * Capability/permission checks relating to parameters retrieved here should also be considered in your {@see can_view} method
+     *
      * @param string $param
      * @param mixed $default
      * @param string $type