From 9b4660e0bab278cf53c775f0fbadfdd395367fed Mon Sep 17 00:00:00 2001
From: Dan Marsden <dan@danmarsden.com>
Date: Mon, 15 Oct 2012 11:31:52 +1300
Subject: [PATCH] MDL-35958 mod_data: backport of MDL-34448 members of seperate
 groups can see database entries for other groups.

---
 mod/data/lib.php  | 20 +++++++++++---------
 mod/data/view.php | 21 ++++++++++++++++++---
 2 files changed, 29 insertions(+), 12 deletions(-)

diff --git a/mod/data/lib.php b/mod/data/lib.php
index e08b5f01829..45af7276ad0 100755
--- a/mod/data/lib.php
+++ b/mod/data/lib.php
@@ -2158,18 +2158,20 @@ function data_get_extra_capabilities() {
  * @param int $dataid      The dataid of the database module.
  * @return array $idarray  An array of record ids
  */
-function data_get_all_recordids($dataid) {
+function data_get_all_recordids($dataid, $selectdata = '') {
     global $CFG;
-    $initsql = "SELECT c.recordid
-                  FROM {$CFG->prefix}data_fields f,
-                       {$CFG->prefix}data_content c
-                 WHERE f.dataid = {$dataid}
-                   AND f.id = c.fieldid
-              GROUP BY c.recordid";
+
+    $initsql = "SELECT r.id
+                  FROM {$CFG->prefix}data_records r
+                 WHERE r.dataid = {$dataid}";
+    if ($selectdata != '') {
+        $initsql .= $selectdata;
+    }
+    $initsql .= ' GROUP BY r.id';
     $initrecord = get_recordset_sql($initsql);
     $idarray = array();
     foreach ($initrecord as $data) {
-        $idarray[] = $data['recordid'];
+        $idarray[] = $data['id'];
     }
     $initrecord->close();
     return $idarray;
@@ -2313,7 +2315,7 @@ function data_get_advanced_search_sql($sort, $data, $recordids, $selectdata, $so
     } else {
         $insql = " = -1";
     }
-    $nestfromsql .= ' AND c.recordid ' . $insql . $groupsql;
+    $nestfromsql .= ' AND c.recordid ' . $insql . $selectdata . $groupsql;
     $nestfromsql = "$nestfromsql $selectdata";
     return "$nestselectsql $nestfromsql $sortorder";
 }
diff --git a/mod/data/view.php b/mod/data/view.php
index 764af53b501..30e058e1991 100755
--- a/mod/data/view.php
+++ b/mod/data/view.php
@@ -300,6 +300,14 @@
     groups_print_activity_menu($cm, $returnurl);
     $currentgroup = groups_get_activity_group($cm);
     $groupmode = groups_get_activity_groupmode($cm);
+    // If a student is not part of a group and seperate groups is enabled, we don't
+    // want them seeing all records.
+    if ($currentgroup == 0 && $groupmode == 1 && !has_capability('mod/data:manageentries', $context)) {
+        $canviewallrecords = false;
+    } else {
+        $canviewallrecords = true;
+    }
+
 
     // deletect entries not approved yet and show hint instead of not found error
     if ($record and $data->approval and !$record->approved and $record->userid != $USER->id and !has_capability('mod/data:manageentries', $context)) {
@@ -439,7 +447,13 @@
             if ($currentgroup) {
                 $groupselect = " AND (r.groupid = '$currentgroup' OR r.groupid = 0)";
             } else {
-                $groupselect = ' ';
+                if ($canviewallrecords) {
+                    $groupselect = ' ';
+                } else {
+                    // If separate groups are enabled and the user isn't in a group or
+                    // a teacher, manager, admin etc, then just show them entries for 'All participants'.
+                    $groupselect = " AND r.groupid = 0";
+                }
             }
 
             $ilike = sql_ilike(); //Be case-insensitive
@@ -546,11 +560,12 @@
             $sqlmax     = "SELECT $count FROM $tables $where $groupselect $approveselect"; // number of all recoirds user may see
 
         /// Work out the paging numbers and counts
+            $selectdata = $groupselect . $approveselect;
+            $recordids = data_get_all_recordids($data->id, $selectdata);
 
-            $recordids = data_get_all_recordids($data->id);
             $newrecordids = data_get_advance_search_ids($recordids, $search_array, $data->id);
             $totalcount = count($newrecordids);
-            $selectdata = $groupselect . $approveselect;
+
             if (!empty($advanced)) {
                 $sqlselect = data_get_advanced_search_sql($sort, $data, $newrecordids, $selectdata, $sortorder);
             } else {