MDL-20355 teachers may not see overview of all students in course because they might...

diff --git a/grade/report/overview/index.php b/grade/report/overview/index.php
index b16199007368de1a989e3fb12502ac588ed308d0..474d22f9bb9a5f9a92ec9498d0fe7c7f01af5b05 100644 (file)
--- a/grade/report/overview/index.php
+++ b/grade/report/overview/index.php
@@ -30,10 +30,11 @@ if (!$course = $DB->get_record('course', array('id' => $courseid))) {
 require_login($course);
 
 $context = get_context_instance(CONTEXT_COURSE, $course->id);
+$systemcontext = get_context_instance(CONTEXT_SYSTEM);
 require_capability('gradereport/overview:view', $context);
 
 if (empty($userid)) {
-    require_capability('moodle/grade:viewall', $context);
+    require_capability('moodle/grade:viewall', $systemcontext);
 
 } else {
     if (!$DB->get_record('user', array('id'=>$userid, 'deleted'=>0)) or isguestuser($userid)) {
@@ -42,12 +43,16 @@ if (empty($userid)) {
 }
 
 $access = false;
-if (has_capability('moodle/grade:viewall', $context)) {
+if (has_capability('moodle/grade:viewall', $systemcontext)) {
     //ok - can view all course grades
     $access = true;
 
+} else if ($userid == $USER->id and has_capability('moodle/grade:viewall', $context)) {
+    //ok - can view any own grades
+    $access = true;
+    
 } else if ($userid == $USER->id and has_capability('moodle/grade:view', $context) and $course->showgrades) {
-    //ok - can view own grades
+    //ok - can view own course grades
     $access = true;
 
 } else if (has_capability('moodle/grade:viewall', get_context_instance(CONTEXT_USER, $userid)) and $course->showgrades) {
@@ -72,7 +77,8 @@ $USER->grade_last_report[$course->id] = 'overview';
 //first make sure we have proper final grades - this must be done before constructing of the grade tree
 grade_regrade_final_grades($courseid);
 
-if (has_capability('moodle/grade:viewall', $context)) { //Teachers will see all student reports
+if (has_capability('moodle/grade:viewall', $systemcontext)) { //Admins will see all student reports
+    // please note this would be extremely slow if we wanted to implement this properly for all teachers
     $groupmode    = groups_get_course_groupmode($course);   // Groups are being used
     $currentgroup = groups_get_course_group($course, true);
 
@@ -122,7 +128,7 @@ if (has_capability('moodle/grade:viewall', $context)) { //Teachers will see all
             }
         }
     }
-} else { //Students will see just their own report
+} else { //Non-admins will see just their own report
 
     // Create a report instance
     $report = new grade_report_overview($userid, $gpr, $context);
@@ -137,4 +143,4 @@ if (has_capability('moodle/grade:viewall', $context)) { //Teachers will see all
 
 echo $OUTPUT->footer();
 
-?>
+