From ff7bacf32bbe148a7ab6db3b5fa69e106e54d6a4 Mon Sep 17 00:00:00 2001
From: Simey Lameze <simey@moodle.com>
Date: Mon, 29 Feb 2016 13:39:39 +0800
Subject: [PATCH] MDL-51167 tool_monitor: check course visibility and user
 capabilities

---
 admin/tool/monitor/lib.php | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/admin/tool/monitor/lib.php b/admin/tool/monitor/lib.php
index 7e91f0b9027..2904832d3c6 100644
--- a/admin/tool/monitor/lib.php
+++ b/admin/tool/monitor/lib.php
@@ -103,10 +103,13 @@ function tool_monitor_get_user_courses() {
     if (has_capability('tool/monitor:subscribe', context_system::instance())) {
         $options[0] = get_string('site');
     }
-    if ($courses = get_user_capability_course('tool/monitor:subscribe', null, true, 'fullname', $orderby)) {
+    if ($courses = get_user_capability_course('tool/monitor:subscribe', null, true, 'fullname, visible', $orderby)) {
         foreach ($courses as $course) {
-            $options[$course->id] = format_string($course->fullname, true,
-                array('context' => context_course::instance($course->id)));
+            if ($course->visible === true || has_capability('moodle/course:viewhiddencourses',
+                    context_course::instance($course->id))) {
+                $options[$course->id] = format_string($course->fullname, true,
+                    array('context' => context_course::instance($course->id)));
+            }
         }
     }
     // If there are no courses and there is no site permission then return false.