From c49b7392a8701ff397d2963ddbe5eb11936951d1 Mon Sep 17 00:00:00 2001
From: Rajesh Taneja <rajesh@moodle.com>
Date: Wed, 20 Nov 2013 08:32:06 +0800
Subject: [PATCH] MDL-42643 course: Member in same group should only loginas

If course groupmode is set to SEPARATEGROUPS, and user doesn't have
site:accessallgroups capability than only allow user to loginas if
current user is in same group as loginas user
---
 course/loginas.php | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/course/loginas.php b/course/loginas.php
index 51e7bbe2572..c43c6abdcbc 100644
--- a/course/loginas.php
+++ b/course/loginas.php
@@ -60,6 +60,23 @@ if (has_capability('moodle/user:loginas', $systemcontext)) {
         print_error('usernotincourse');
     }
     $context = $coursecontext;
+
+    // Check if course has SEPARATEGROUPS and user is part of that group.
+    if (groups_get_course_groupmode($course) == SEPARATEGROUPS &&
+            !has_capability('moodle/site:accessallgroups', $context)) {
+        $samegroup = false;
+        if ($groups = groups_get_all_groups($course->id, $USER->id)) {
+            foreach ($groups as $group) {
+                if (groups_is_member($group->id, $userid)) {
+                    $samegroup = true;
+                    break;
+                }
+            }
+        }
+        if (!$samegroup) {
+            print_error('nologinas');
+        }
+    }
 }
 
 /// Login as this user and return to course home page.