MDL-14998 - roles: add mod/forum:viewdiscussion protection to forum_get_discussions...

diff --git a/mod/forum/lib.php b/mod/forum/lib.php
index 9c8198a5315b8de2b5718f17643503dfa1b70ebe..aab45ef6d957f643fc1715ac307c8d6293b436a7 100644 (file)
--- a/mod/forum/lib.php
+++ b/mod/forum/lib.php
@@ -2420,9 +2420,13 @@ function forum_get_discussions($cm, $forumsort="d.timemodified DESC", $fullpost=
     $now = round(time(), -2);
     $params = array($cm->instance);
 
-    if (!empty($CFG->forum_enabletimedposts)) {
+    $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id);
 
-        $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id);
+    if (!has_capability('mod/forum:viewdiscussion', $modcontext)) { /// User must have perms to view discussions
+        return array();
+    }
+
+    if (!empty($CFG->forum_enabletimedposts)) { /// Users must fulfill timed posts
 
         if (!has_capability('mod/forum:viewhiddentimedposts', $modcontext)) {
             $timelimit = " AND ((d.timestart <= ? AND (d.timeend = 0 OR d.timeend > ?))";