From dec2ad8603d5c26fb9e5d45f088c3bd837081613 Mon Sep 17 00:00:00 2001
From: Simey Lameze <simey@moodle.com>
Date: Tue, 17 Sep 2019 13:58:56 +0800
Subject: [PATCH 1/2] MDL-61450 calendar: fix course event type permissions

---
 calendar/lib.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/calendar/lib.php b/calendar/lib.php
index b26473012fc..bc8aa2c919a 100644
--- a/calendar/lib.php
+++ b/calendar/lib.php
@@ -2203,8 +2203,8 @@ function calendar_view_event_allowed(calendar_event $event) {
         if (has_capability('moodle/calendar:manageentries', $event->context)) {
             return true;
         }
-        $mycourses = enrol_get_my_courses('id');
-        return isset($mycourses[$event->courseid]);
+
+        return can_access_course(get_course($event->courseid));
     } else if ($event->userid) {
         if ($event->userid != $USER->id) {
             // No-one can ever see another users events.

From 7070a23d97267f25044c13595ed379a58d3e273d Mon Sep 17 00:00:00 2001
From: Jun Pataleta <jun@moodle.com>
Date: Thu, 3 Oct 2019 15:31:24 +0800
Subject: [PATCH 2/2] MDL-61450 calendar: Unit test for
 calendar_view_event_allowed()

* Unit test for calendar_view_event_allowed() when dealing with course
events.
---
 calendar/tests/lib_test.php | 68 +++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)

diff --git a/calendar/tests/lib_test.php b/calendar/tests/lib_test.php
index 35809ec18b7..5264d9da7a8 100644
--- a/calendar/tests/lib_test.php
+++ b/calendar/tests/lib_test.php
@@ -772,4 +772,72 @@ class core_calendar_lib_testcase extends advanced_testcase {
         $this->assertEquals(array($coursegroups[$courses[0]->id][1]->id), $groupids);
         $this->assertEquals($users[1]->id, $userid);
     }
+
+    /**
+     *  Test for calendar_view_event_allowed for course event types.
+     */
+    public function test_calendar_view_event_allowed_course_event() {
+        global $USER;
+
+        $this->setAdminUser();
+
+        $generator = $this->getDataGenerator();
+
+        // A student in a course.
+        $student = $generator->create_user();
+        // Some user not enrolled in any course.
+        $someuser = $generator->create_user();
+
+        // A course with manual enrolments.
+        $manualcourse = $generator->create_course();
+
+        // Enrol the student to the manual enrolment course.
+        $generator->enrol_user($student->id, $manualcourse->id);
+
+        // A course that allows guest access.
+        $guestcourse = $generator->create_course(
+            (object)[
+                'shortname' => 'guestcourse',
+                'enrol_guest_status_0' => ENROL_INSTANCE_ENABLED,
+                'enrol_guest_password_0' => ''
+            ]);
+
+        $manualevent = (object)[
+            'name' => 'Manual course event',
+            'description' => '',
+            'format' => 1,
+            'categoryid' => 0,
+            'courseid' => $manualcourse->id,
+            'groupid' => 0,
+            'userid' => $USER->id,
+            'modulename' => 0,
+            'instance' => 0,
+            'eventtype' => 'course',
+            'timestart' => time(),
+            'timeduration' => 86400,
+            'visible' => 1
+        ];
+        $caleventmanual = calendar_event::create($manualevent, false);
+
+        // Create a course event for the course with guest access.
+        $guestevent = clone $manualevent;
+        $guestevent->name = 'Guest course event';
+        $guestevent->courseid = $guestcourse->id;
+        $caleventguest = calendar_event::create($guestevent, false);
+
+        // Viewing as admin.
+        $this->assertTrue(calendar_view_event_allowed($caleventmanual));
+        $this->assertTrue(calendar_view_event_allowed($caleventguest));
+
+        // Viewing as someone enrolled in a course.
+        $this->setUser($student);
+        $this->assertTrue(calendar_view_event_allowed($caleventmanual));
+
+        // Viewing as someone not enrolled in any course.
+        $this->setUser($someuser);
+        // Viewing as someone not enrolled in a course without guest access on.
+        $this->assertFalse(calendar_view_event_allowed($caleventmanual));
+        // Viewing as someone not enrolled in a course with guest access on.
+        $this->assertTrue(calendar_view_event_allowed($caleventguest));
+    }
 }