From f512355b315d6ddf0d9bd1ab1c6b944ae2ef66b5 Mon Sep 17 00:00:00 2001
From: Mark Nelson <markn@moodle.com>
Date: Thu, 16 Feb 2017 12:54:36 +0800
Subject: [PATCH] MDL-57967 core_message: do not process conversations from
 deleted users

---
 message/classes/api.php    |  8 +++++++-
 message/tests/api_test.php | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/message/classes/api.php b/message/classes/api.php
index 3a629548b67..1554c5a8937 100644
--- a/message/classes/api.php
+++ b/message/classes/api.php
@@ -417,7 +417,8 @@ class api {
         $userfields = \user_picture::fields('', array('lastaccess'));
         $userssql = "SELECT $userfields
                      FROM {user}
-                     WHERE id $useridsql";
+                     WHERE id $useridsql
+                       AND deleted = 0";
         $otherusers = $DB->get_records_sql($userssql, $usersparams);
 
         // Similar to the above use case, we need to pull the contact information and again this has
@@ -478,6 +479,11 @@ class api {
                 $conversation->$prop = ($otheruser) ? $otheruser->$prop : null;
             }
 
+            // Do not process a conversation with a deleted user.
+            if (empty($conversation->id)) {
+                continue;
+            }
+
             // Add the contact's information, if we have one.
             $conversation->blocked = ($contact) ? $contact->blocked : null;
 
diff --git a/message/tests/api_test.php b/message/tests/api_test.php
index d90a48af1e9..e0c7c7039c7 100644
--- a/message/tests/api_test.php
+++ b/message/tests/api_test.php
@@ -462,6 +462,41 @@ class core_message_api_testcase extends core_message_messagelib_testcase {
         $this->assertCount(0, $conversations);
     }
 
+    /**
+     * Tests retrieving conversations when a conversation contains a deleted user.
+     */
+    public function test_get_conversations_with_deleted_user() {
+        // Create some users.
+        $user1 = self::getDataGenerator()->create_user();
+        $user2 = self::getDataGenerator()->create_user();
+        $user3 = self::getDataGenerator()->create_user();
+
+        // Send some messages back and forth, have some different conversations with different users.
+        $time = 1;
+        $this->send_fake_message($user1, $user2, 'Yo!', 0, $time + 1);
+        $this->send_fake_message($user2, $user1, 'Sup mang?', 0, $time + 2);
+        $this->send_fake_message($user1, $user2, 'Writing PHPUnit tests!', 0, $time + 3);
+        $this->send_fake_message($user2, $user1, 'Word.', 0, $time + 4);
+
+        $this->send_fake_message($user1, $user3, 'Booyah', 0, $time + 5);
+        $this->send_fake_message($user3, $user1, 'Whaaat?', 0, $time + 6);
+        $this->send_fake_message($user1, $user3, 'Nothing.', 0, $time + 7);
+        $this->send_fake_message($user3, $user1, 'Cool.', 0, $time + 8);
+
+        // Delete the second user.
+        delete_user($user2);
+
+        // Retrieve the conversations.
+        $conversations = \core_message\api::get_conversations($user1->id);
+
+        // We should only have one conversation because the other user was deleted.
+        $this->assertCount(1, $conversations);
+
+        // Confirm the conversation is from the non-deleted user.
+        $conversation = reset($conversations);
+        $this->assertEquals($user3->id, $conversation->userid);
+    }
+
    /**
     * The data provider for get_conversations_mixed.
     *