online user block MDL-15325 Online Users Block didn't perform capability check when...

diff --git a/blocks/online_users/block_online_users.php b/blocks/online_users/block_online_users.php
index caa25307e7b09f6933c491f1750d3c9d03c9bbfe..7c65c47732ae99b6fbc825ceb0d7c6c4bc4c8160 100644 (file)
--- a/blocks/online_users/block_online_users.php
+++ b/blocks/online_users/block_online_users.php
@@ -153,6 +153,7 @@ class block_online_users extends block_base {
                     $this->content->text .= $user->fullname.'</a></div>';
                 }
                 if (!empty($USER->id) and ($USER->id != $user->id) and !empty($CFG->messaging) and
+                    has_capability('moodle/site:sendmessage', $context) and
                     !isguest() and $user->username != 'guest') {  // Only when logged in and messaging active etc
                     $this->content->text .= '<div class="message"><a title="'.get_string('messageselectadd').'" href="'.$CFG->wwwroot.'/message/discussion.php?id='.$user->id.'" onclick="this.target=\'message_'.$user->id.'\';return openpopup(\'/message/discussion.php?id='.$user->id.'\', \'message_'.$user->id.'\', \'menubar=0,location=0,scrollbars,status,resizable,width=400,height=500\', 0);">'
                         .'<img class="iconsmall" src="'.$CFG->pixpath.'/t/message.gif" alt="'. get_string('messageselectadd') .'" /></a></div>';