From d9be5161c807e1fa9a6c3d6e69a9105c7eb643f6 Mon Sep 17 00:00:00 2001
From: Sara Arjona <sara@moodle.com>
Date: Tue, 14 Oct 2025 14:45:48 +0200
Subject: [PATCH] MDL-86912 assign: Prevent admin submitting unless enrolled as
 student

---
 public/mod/assign/locallib.php                     |  6 ++++--
 .../mod/assign/tests/behat/assign_settings.feature | 14 ++++++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/public/mod/assign/locallib.php b/public/mod/assign/locallib.php
index c113e9ae59f..49b4330f25e 100644
--- a/public/mod/assign/locallib.php
+++ b/public/mod/assign/locallib.php
@@ -6440,8 +6440,10 @@ class assign {
         }
 
         if ($userid == $graderid) {
-            if ($this->submissions_open($userid) &&
-                    has_capability('mod/assign:submit', $this->context, $graderid)) {
+            if (
+                $this->submissions_open($userid)
+                && has_capability('mod/assign:submit', $this->context, $graderid, false)
+            ) {
                 // User can edit their own submission.
                 return true;
             } else {
diff --git a/public/mod/assign/tests/behat/assign_settings.feature b/public/mod/assign/tests/behat/assign_settings.feature
index 5310f2391ef..bdefeb1e016 100644
--- a/public/mod/assign/tests/behat/assign_settings.feature
+++ b/public/mod/assign/tests/behat/assign_settings.feature
@@ -125,3 +125,17 @@ Feature: Assignments settings can be changed
     And I am on the "Test assignment name" Activity page logged in as student3
     Then "Add a new attempt" "button" should exist
     And "Add a new attempt based on previous submission" "button" should exist
+
+  Scenario: Admin cannot add submission if not enrolled as student
+    When I am on the "Test assignment name" Activity page logged in as admin
+    Then I should not see "Add submission"
+    And the following "course enrolments" exist:
+      | user     | course | role    |
+      | admin    | C1     | teacher |
+    And I am on the "Test assignment name" Activity page logged in as admin
+    And I should not see "Add submission"
+    But the following "course enrolments" exist:
+      | user     | course | role    |
+      | admin    | C1     | student |
+    And I am on the "Test assignment name" Activity page logged in as admin
+    And I should see "Add submission"