Search users group add capability check

[sumaiyamannan]

Hi,

This will add capability check and remove suspended users from the ajax user search.

Whenever the field "Use course groups" within each Dialogue instance is ticked and the user's role doesn't have the 'accessallgroups' capability, then the 'search_users_with_groups' php function returns all users in the course who are in the same groups as the user. e.g. If the user clicking on the ajax Search field is in the course groups: ABC, G123, Course100, then the code returns all users who is also in all those groups: Students, teachers, admins, even users who's enrolments are suspended on the course. It is because the function is not checking whether the returned users have active enrolments and also the 'mod/dialogue:receive' capability.

Regards,
Sumaiya

[danmarsden]

this doesn't look right to me? - 1 = (SELECT permission) ? won't this always fail?

[sumaiyamannan]

@danmarsden
See below from the DB. The roleid 5 (student) row is what will be feeding to the above query.

select * from mdl_role_capabilities where capability like 'mod/dialogue:receive';
  id  | contextid | roleid |      capability      | permission | timemodified | modifierid 
------+-----------+--------+----------------------+------------+--------------+------------
 1525 |         1 |      5 | mod/dialogue:receive |          1 |   1738014397 |          0
 1526 |         1 |      4 | mod/dialogue:receive |          1 |   1738014397 |          0
 1527 |         1 |      3 | mod/dialogue:receive |          1 |   1738014397 |          0
 1528 |         1 |      1 | mod/dialogue:receive |         -1 |   1738014397 |          0

FYI, originally this check was happening here
a780f1a#diff-3225b1da5120a47d49b4b7c16c551baa2345b7752f3934d25424563dde571dfaL142
But it created a performance load on heavy courses as this way was first adding the users n then removing them.

[sumaiyamannan]

Hey @danmarsden
I have redone it using get_enrolled_sql() to get the sql fragments.
Please note the original reported issue had referred to activity instance with "Use course groups" but I noticed that suspended users were being included even if course groups were not being used. This will be fixed with this change.
Regards,
Sumaiya