diff --git a/lang/en_utf8/quiz.php b/lang/en_utf8/quiz.php
index 27a839b4690..06f6539f607 100644
--- a/lang/en_utf8/quiz.php
+++ b/lang/en_utf8/quiz.php
@@ -430,6 +430,7 @@ $string['quiz:grade'] = 'Grade quizzes manually';
 $string['quiz:ignoretimelimits'] = 'Ignores time limit on quizzes';
 $string['quiz:manage'] = 'Manage quizzes';
 $string['quiz:preview'] = 'Preview quizzes';
+$string['quiz:reviewmyattempts'] = 'Review your own attempts';
 $string['quiz:view'] = 'View quiz information';
 $string['quiz:viewreports'] = 'View quiz reports';
 $string['quizavailable'] = 'The quiz is available until: $a';
diff --git a/mod/quiz/db/access.php b/mod/quiz/db/access.php
index 9d5adbb8162..18f02d69303 100644
--- a/mod/quiz/db/access.php
+++ b/mod/quiz/db/access.php
@@ -22,6 +22,7 @@ $mod_quiz_capabilities = array(
 
     // Ability to do the quiz as a 'student'.
     'mod/quiz:attempt' => array(
+        'riskbitmask' => RISK_SPAM,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -29,6 +30,17 @@ $mod_quiz_capabilities = array(
         )
     ),
 
+    // Ability for a 'Student' to review their previous attempts. Review by
+    // 'Teachers' is controlled by mod/quiz:viewreports.
+    'mod/quiz:reviewmyattempts' => array(
+        'captype' => 'read',
+        'contextlevel' => CONTEXT_MODULE,
+        'legacy' => array(
+            'student' => CAP_ALLOW
+        ),
+        'clonepermissionsfrom' => 'moodle/quiz:attempt'
+    ),
+
     // Edit the quiz settings, add and remove questions.
     'mod/quiz:manage' => array(
         'riskbitmask' => RISK_SPAM,
diff --git a/mod/quiz/index.php b/mod/quiz/index.php
index b28e7660268..1d6d903e829 100644
--- a/mod/quiz/index.php
+++ b/mod/quiz/index.php
@@ -53,15 +53,16 @@
     }
     array_unshift($align, 'center');
 
-    $showing = 'scores';  // default
+    $showing = '';  // default
 
     if (has_capability('mod/quiz:viewreports', $coursecontext)) {
         array_push($headings, get_string('attempts', 'quiz'));
         array_push($align, 'left');
         $showing = 'stats';
-    } else if (has_capability('mod/quiz:attempt', $coursecontext)) {
+    } else if (has_any_capability(array('mod/quiz:reviewmyattempts', 'mod/quiz:attempt'), $coursecontext)) {
         array_push($headings, get_string('bestgrade', 'quiz'), get_string('feedback', 'quiz'));
         array_push($align, 'left', 'left');
+        $showing = 'scores';  // default
     }
 
     $table->head = $headings;
diff --git a/mod/quiz/lib.php b/mod/quiz/lib.php
index 3bb465e46ad..0e656ee7399 100644
--- a/mod/quiz/lib.php
+++ b/mod/quiz/lib.php
@@ -1106,7 +1106,7 @@ function quiz_print_overview($courses, &$htmlarray) {
                 // The $quiz objects returned by get_all_instances_in_course have the necessary $cm 
                 // fields set to make the following call work.
                 $str .= '<div class="info">' . quiz_num_attempt_summary($quiz, $quiz, true) . '</div>';
-            } else if (has_capability('mod/quiz:attempt', $context)){ // Student
+            } else if (has_any_capability(array('mod/quiz:reviewmyattempts', 'mod/quiz:attempt'), $context)) { // Student
             /// For student-like people, tell them how many attempts they have made.
                 if (isset($USER->id) && ($attempts = quiz_get_user_attempts($quiz->id, $USER->id))) {
                     $numattempts = count($attempts);
diff --git a/mod/quiz/report/grading/report.php b/mod/quiz/report/grading/report.php
index 2279fb072a5..2d4f7cb74fd 100644
--- a/mod/quiz/report/grading/report.php
+++ b/mod/quiz/report/grading/report.php
@@ -83,8 +83,8 @@ class quiz_report extends quiz_default_report {
         }
 
         $currentgroup = groups_get_activity_group($this->cm, true);
-        $this->users     = get_users_by_capability($this->context, 'mod/quiz:attempt','','','','',$currentgroup,'',false);
-        $this->userids   = implode(',', array_keys($this->users));
+        $this->users = get_users_by_capability($this->context, array('mod/quiz:reviewmyattempts', 'mod/quiz:attempt'),'','','','',$currentgroup,'',false);
+        $this->userids = implode(',', array_keys($this->users));
 
 
         if (!empty($questionid)) {
diff --git a/mod/quiz/report/overview/overviewgraph.php b/mod/quiz/report/overview/overviewgraph.php
index 791056a4b42..8380f6c5eb4 100644
--- a/mod/quiz/report/overview/overviewgraph.php
+++ b/mod/quiz/report/overview/overviewgraph.php
@@ -87,7 +87,7 @@ if (array_sum($line->y_data['allusers'])>QUIZ_REPORT_MAX_PARTICIPANTS_TO_SHOW_AL
 $line->y_order = array('allusers');
 if ($groups){
     foreach (array_keys($groups) as $group){
-        $useridingroup = get_users_by_capability($modcontext, 'mod/quiz:attempt','','','','',$group,'',false);
+        $useridingroup = get_users_by_capability($modcontext, array('mod/quiz:reviewmyattempts', 'mod/quiz:attempt'),'','','','',$group,'',false);
         if ($useridingroup){
             $useridingrouplist = join(',',array_keys($useridingroup));
             $groupdata = quiz_report_grade_bands($bandwidth, $bands, $quizid, $useridingrouplist);
diff --git a/mod/quiz/report/overview/report.php b/mod/quiz/report/overview/report.php
index 45e0a740076..59d6024ed03 100644
--- a/mod/quiz/report/overview/report.php
+++ b/mod/quiz/report/overview/report.php
@@ -119,7 +119,7 @@ class quiz_report extends quiz_default_report {
             }
         }
         $nostudents = false;
-        if (!$students = get_users_by_capability($context, 'mod/quiz:attempt','','','','','','',false)){
+        if (!$students = get_users_by_capability($context, array('mod/quiz:reviewmyattempts', 'mod/quiz:attempt'),'','','','','','',false)){
             notify(get_string('nostudentsyet'));
             $nostudents = true;
             $studentslist = '';
diff --git a/mod/quiz/review.php b/mod/quiz/review.php
index 8a4833c2b26..1ae285e6cfc 100644
--- a/mod/quiz/review.php
+++ b/mod/quiz/review.php
@@ -52,6 +52,12 @@
         if ($attempt->userid != $USER->id) {
             error("This is not your attempt!", 'view.php?q=' . $quiz->id);
         }
+        // Check capabilities.
+        if ($options->quizstate == QUIZ_STATE_IMMEDIATELY) {
+            require_capability('mod/quiz:attempt', $context);
+        } else {
+            require_capability('mod/quiz:reviewmyattempts', $context);
+        }
         // Can't review if Student's may review ... Responses is turned on.
         if (!$options->responses) {
             if ($options->quizstate == QUIZ_STATE_IMMEDIATELY) {
diff --git a/mod/quiz/reviewquestion.php b/mod/quiz/reviewquestion.php
index e00ec12045e..d12ee905891 100644
--- a/mod/quiz/reviewquestion.php
+++ b/mod/quiz/reviewquestion.php
@@ -63,6 +63,7 @@
         if (!$attempt->timefinish) {
             redirect('attempt.php?q='.$quiz->id);
         }
+        require_capability('mod/quiz:reviewmyattempts', $context);
         // If not even responses are to be shown in review then we
         // don't allow any review
         if (!($quiz->review & QUIZ_REVIEW_RESPONSES)) {
diff --git a/mod/quiz/version.php b/mod/quiz/version.php
index 56bc5cbc934..ec35ea41f3a 100644
--- a/mod/quiz/version.php
+++ b/mod/quiz/version.php
@@ -5,7 +5,7 @@
 //  This fragment is called by moodle_needs_upgrading() and /admin/index.php
 ////////////////////////////////////////////////////////////////////////////////
 
-$module->version  = 2007101510;   // The (date) version of this module
+$module->version  = 2007101511;   // The (date) version of this module
 $module->requires = 2007101509;   // Requires this Moodle version
 $module->cron     = 0;            // How often should cron check this module (seconds)?
 
diff --git a/mod/quiz/view.php b/mod/quiz/view.php
index ed59e1c4005..acf125c35d9 100644
--- a/mod/quiz/view.php
+++ b/mod/quiz/view.php
@@ -103,7 +103,8 @@
 
         // Print information about timings.
         $timenow = time();
-        $available = ($quiz->timeopen < $timenow and ($timenow < $quiz->timeclose or !$quiz->timeclose));
+        $available = ($quiz->timeopen < $timenow and ($timenow < $quiz->timeclose or !$quiz->timeclose)) &&
+                has_capability('mod/quiz:attempt', $context);
         if ($available) {
             if ($quiz->timelimit) {
                 echo "<p>".get_string("quiztimelimit","quiz", format_time($quiz->timelimit * 60))."</p>";
@@ -144,7 +145,7 @@
         finish_page($course);
     }
 
-    if (!(has_capability('mod/quiz:attempt', $context) || has_capability('mod/quiz:preview', $context))) {
+    if (!has_any_capability(array('mod/quiz:reviewmyattempts', 'mod/quiz:attempt', 'mod/quiz:preview'), $context)) {
         print_box('<p>' . get_string('youneedtoenrol', 'quiz') . '</p><p>' .
                 print_continue($CFG->wwwroot . '/course/view.php?id=' . $course->id, true) .
                 '</p>', 'generalbox', 'notice');
@@ -229,9 +230,9 @@
 
             // Add the attempt number, making it a link, if appropriate.
             if ($attempt->preview) {
-                $row[] = make_review_link(get_string('preview', 'quiz'), $quiz, $attempt);
+                $row[] = make_review_link(get_string('preview', 'quiz'), $quiz, $attempt, $context);
             } else {
-                $row[] = make_review_link($attempt->attempt, $quiz, $attempt);
+                $row[] = make_review_link($attempt->attempt, $quiz, $attempt, $context);
             }
 
             // prepare strings for time taken and date completed
@@ -258,7 +259,7 @@
 
             if ($markcolumn && $attempt->timefinish > 0) {
                 if ($attemptoptions->scores) {
-                    $row[] = make_review_link(round($attempt->sumgrades, $quiz->decimalpoints), $quiz, $attempt);
+                    $row[] = make_review_link(round($attempt->sumgrades, $quiz->decimalpoints), $quiz, $attempt, $context);
                 } else {
                     $row[] = '';
                 }
@@ -275,7 +276,7 @@
                         $table->rowclass[$attempt->attempt] = 'bestrow';
                     }
 
-                    $row[] = make_review_link($formattedgrade, $quiz, $attempt);
+                    $row[] = make_review_link($formattedgrade, $quiz, $attempt, $context);
                 } else {
                     $row[] = '';
                 }
@@ -453,9 +454,13 @@ function finish_page($course) {
 }
 
 /** Make some text into a link to review the quiz, if that is appropriate. */
-function make_review_link($linktext, $quiz, $attempt) {
-    // If not even responses are to be shown in review then we don't allow any review
-    if (!($quiz->review & QUIZ_REVIEW_RESPONSES)) {
+function make_review_link($linktext, $quiz, $attempt, $context) {
+    static $canreview = null;
+    if (is_null($canreview)) {
+        $canreview = has_capability('mod/quiz:reviewmyattempts', $context);
+    }
+    // If not even responses are to be shown in review then we don't allow any review, or does not have review capability.
+    if (!$canreview || !($quiz->review & QUIZ_REVIEW_RESPONSES)) {
         return $linktext;
     }