From c9f6ca1142723ae4e95596bcc7a8f6dec2f6adeb Mon Sep 17 00:00:00 2001
From: Mark Nelson <markn@moodle.com>
Date: Mon, 6 Aug 2018 17:11:53 +0800
Subject: [PATCH] MDL-27520 core: allow retrieval of files from grade files
 areas

Also added 'history' filearea for the history report where files
will be copied to if the site has enabled this feature.

We will also be storing files in the module context, not course,
so that check was removed.
---
 lib/filelib.php | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/lib/filelib.php b/lib/filelib.php
index ded335b63a8..7afd3c65500 100644
--- a/lib/filelib.php
+++ b/lib/filelib.php
@@ -4213,15 +4213,35 @@ function file_pluginfile($relativepath, $forcedownload, $preview = null, $offlin
             \core\session\manager::write_close(); // Unlock session during file serving.
             send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions);
 
-        } else if ($filearea === 'feedback' and $context->contextlevel == CONTEXT_COURSE) {
-            //TODO: nobody implemented this yet in grade edit form!!
-            send_file_not_found();
-
-            if ($CFG->forcelogin || $course->id != SITEID) {
-                require_login($course);
+        } else if ($filearea === 'feedback' || $filearea == 'history') {
+            if ($context->contextlevel != CONTEXT_MODULE) {
+                send_file_not_found;
             }
 
-            $fullpath = "/$context->id/$component/$filearea/".implode('/', $args);
+            require_login($course, false);
+
+            $gradeid = (int) array_shift($args);
+            $filename = array_pop($args);
+            if ($filearea == 'historyfeedback') {
+                $grade = $DB->get_record('grade_grades_history', ['id' => $gradeid]);
+            } else {
+                $grade = $DB->get_record('grade_grades', ['id' => $gradeid]);
+            }
+
+            if (!$grade) {
+                send_file_not_found();
+            }
+
+            $iscurrentuser = $USER->id == $grade->userid;
+
+            if (!$iscurrentuser) {
+                $coursecontext = context_course::instance($course->id);
+                if (!has_capability('moodle/grade:viewall', $coursecontext)) {
+                    send_file_not_found();
+                }
+            }
+
+            $fullpath = "/$context->id/$component/$filearea/$gradeid/$filename";
 
             if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
                 send_file_not_found();