From ff274fa59df5201cbfa2ac43eab8e71bfece384c Mon Sep 17 00:00:00 2001
From: Tomo Tsuyuki <tomotsuyuki@catalyst-au.net>
Date: Tue, 16 Nov 2021 15:24:50 +1100
Subject: [PATCH] MDL-72925 mod_forum: Filter discussion when grading

---
 mod/forum/externallib.php                     |  3 ++
 .../behat/separate_group_grade_forum.feature  | 34 +++++++++++++++++++
 mod/forum/tests/externallib_test.php          | 26 ++++++++++++++
 3 files changed, 63 insertions(+)

diff --git a/mod/forum/externallib.php b/mod/forum/externallib.php
index 407dc7096c6..d217bb2d1de 100644
--- a/mod/forum/externallib.php
+++ b/mod/forum/externallib.php
@@ -2237,6 +2237,9 @@ class mod_forum_external extends external_api {
         $builtdiscussions = [];
         foreach ($discussionsummaries as $discussionsummary) {
             $discussion = $discussionsummary->get_discussion();
+            if (!$capabilitymanager->can_view_discussion($USER, $discussion)) {
+                continue;
+            }
             $posts = $postvault->get_posts_in_discussion_for_user_id(
                     $discussion->get_id(),
                     $user->id,
diff --git a/mod/forum/tests/behat/separate_group_grade_forum.feature b/mod/forum/tests/behat/separate_group_grade_forum.feature
index add2b2a9f6c..9978d75c8d9 100644
--- a/mod/forum/tests/behat/separate_group_grade_forum.feature
+++ b/mod/forum/tests/behat/separate_group_grade_forum.feature
@@ -72,3 +72,37 @@ Feature: I can grade a students by group with separate groups
     Then I should not see "1 out of 1"
     And I should not see "1 out of 2"
     And I should see "1 out of 3"
+
+  @javascript
+  Scenario: Teacher can see only the discussions which are joined to
+    Given the following "users" exist:
+      | username | firstname | lastname | email |
+      | teacher2 | Teacher | 2 | teacher2@example.com |
+    And the following "course enrolments" exist:
+      | user | course | role |
+      | teacher2 | C1 | teacher |
+    And the following "group members" exist:
+      | user | group |
+      | teacher2 | G2 |
+      | teacher2 | G3 |
+    And I log out
+    When I am on the "Test Forum 1" "forum activity" page logged in as student1
+    And I select "Group A" from the "Separate groups" singleselect
+    And I click on "Add a new discussion topic" "link"
+    And I set the following fields to these values:
+      | Subject  | Discussion subject A |
+      | Message | Discussion message A |
+    And I press "Post to forum"
+    And I select "Group C" from the "Separate groups" singleselect
+    And I click on "Add a new discussion topic" "link"
+    And I set the following fields to these values:
+      | Subject  | Discussion subject C |
+      | Message | Discussion message C |
+    And I press "Post to forum"
+    And I log out
+    Then I am on the "Test Forum 1" "forum activity" page logged in as teacher2
+    And I select "Group C" from the "Separate groups" singleselect
+    And I click on "Grade users" "button"
+    And I should see "Student 1"
+    And I should see "Discussion subject C"
+    And I should not see "Discussion subject A"
diff --git a/mod/forum/tests/externallib_test.php b/mod/forum/tests/externallib_test.php
index 81dc64a0691..3c089a84bf4 100644
--- a/mod/forum/tests/externallib_test.php
+++ b/mod/forum/tests/externallib_test.php
@@ -3036,6 +3036,32 @@ class mod_forum_external_testcase extends externallib_advanced_testcase {
         $this->assertEquals(2, count($discussions['discussions']));
 
         $this->assertEquals($expectedposts, $discussions);
+
+        // When groupmode is SEPARATEGROUPS, even there is no groupid specified, the post not for the user shouldn't be seen.
+        $group1 = self::getDataGenerator()->create_group(['courseid' => $course1->id]);
+        $group2 = self::getDataGenerator()->create_group(['courseid' => $course1->id]);
+        // Update discussion with group.
+        $discussion = new \stdClass();
+        $discussion->id = $discussion1->id;
+        $discussion->groupid = $group1->id;
+        $DB->update_record('forum_discussions', $discussion);
+        $discussion = new \stdClass();
+        $discussion->id = $discussion2->id;
+        $discussion->groupid = $group2->id;
+        $DB->update_record('forum_discussions', $discussion);
+        $cm = get_coursemodule_from_id('forum', $forum1->cmid);
+        $cm->groupmode = SEPARATEGROUPS;
+        $DB->update_record('course_modules', $cm);
+        $teacher = self::getDataGenerator()->create_user();
+        $role = $DB->get_record('role', array('shortname' => 'teacher'), '*', MUST_EXIST);
+        self::getDataGenerator()->enrol_user($teacher->id, $course1->id, $role->id);
+        groups_add_member($group2->id, $teacher->id);
+        self::setUser($teacher);
+        $discussions = mod_forum_external::get_discussion_posts_by_userid($user2->id, $forum1->cmid, 'modified', 'DESC');
+        $discussions = external_api::clean_returnvalue(mod_forum_external::get_discussion_posts_by_userid_returns(), $discussions);
+        // Discussion is only 1 record (group 2).
+        $this->assertEquals(1, count($discussions['discussions']));
+        $this->assertEquals($expectedposts['discussions'][1], $discussions['discussions'][0]);
     }
 
     /**