Search users group add capability check

danmarsden · Jan 28, 2025 · a484481 · a484481
1 parent 7c74844
commit a484481
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/classes/local/course_enrolment_manager.php b/classes/local/course_enrolment_manager.php
@@ -41,6 +41,8 @@ public function search_users_with_groups(string $search = '', bool $searchanywhe
             array $groups = []) {
         global $DB;
 
+        $context = $this->context;
+
         [$ufields, $joins, $params, $wherecondition] = $this->get_basic_search_conditions($search, $searchanywhere);
 
         $fields      = 'SELECT ' . $ufields;
@@ -53,10 +55,17 @@ public function search_users_with_groups(string $search = '', bool $searchanywhe
                  JOIN {enrol} e ON ue.enrolid = e.id
                  JOIN ({groups_members} gm JOIN {groups} g ON (g.id = gm.groupid))
                       ON (u.id = gm.userid AND g.courseid = e.courseid)
+                 JOIN {role_assignments} ra ON ra.userid = u.id
                 WHERE $wherecondition
                   AND e.courseid = :courseid
+                  AND u.suspended = 0
+                  AND 1 = (SELECT permission FROM {role_capabilities}
+                        WHERE capability LIKE :capability AND roleid = ra.roleid LIMIT 1)
+                  AND ra.contextid = :contextid
                   AND g.id $insql";
         $params['courseid'] = $this->course->id;
+        $params['capability'] = 'mod/dialogue:receive';
+        $params['contextid'] = $context->id;
         $params = array_merge($params, $inparams);
         return $this->execute_search_queries($search, $fields, $countfields, $sql, $params, $page, $perpage, 0, false);
     }