MDL-79310 mod_forum: ensure only visible users can be exported.

2023-10-04 14:31:51 +08:00
parent 4777e96a28
commit c64f39d187
1 changed files with 4 additions and 0 deletions
@@ -191,6 +191,10 @@ if (!$PAGE->has_secondary_navigation()) {
 }

 // It is possible that the following fields have been provided in the URL.
+$userids = array_filter($userids, static function(int $userid) use ($course, $cm): bool {
+    $user = core_user::get_user($userid, '*', MUST_EXIST);
+    return $cm->effectivegroupmode != SEPARATEGROUPS || user_can_view_profile($user, $course);
+});
 $form->set_data(['useridsselected' => $userids, 'discussionids' => $discussionids, 'from' => $from, 'to' => $to]);

 $form->display();