MDL-12544, hide hidden roles in profile when user has no capability

diff --git a/lib/accesslib.php b/lib/accesslib.php
index 0ab6525827aca36f958fbab89e7dfb36e7ab8743..531e7f02f06b5aa927433c3da1dcf97c8f19d754 100755 (executable)
--- a/lib/accesslib.php
+++ b/lib/accesslib.php
@@ -3927,19 +3927,22 @@ function get_roles_used_in_context($context, $view = false) {
 /**
  * This function is used to print roles column in user profile page.
  * @param int userid
- * @param int contextid
+ * @param object context
  * @return string
  */
-function get_user_roles_in_context($userid, $contextid){
-    global $CFG;
+function get_user_roles_in_context($userid, $context, $view=true){
+    global $CFG, $USER;
 
     $rolestring = '';
-    $SQL = 'select * from '.$CFG->prefix.'role_assignments ra, '.$CFG->prefix.'role r where ra.userid='.$userid.' and ra.contextid='.$contextid.' and ra.roleid = r.id';
+    $SQL = 'select * from '.$CFG->prefix.'role_assignments ra, '.$CFG->prefix.'role r where ra.userid='.$userid.' and ra.contextid='.$context->id.' and ra.roleid = r.id';
     if ($roles = get_records_sql($SQL)) {
         foreach ($roles as $userrole) {
+            // MDL-12544, if we are in view mode and current user has no capability to view hidden assignment, skip it
+            if ($userrole->hidden && $view && !has_capability('moodle/role:viewhiddenassigns', $context)) {
+                continue;
+            }
             $rolestring .= '<a href="'.$CFG->wwwroot.'/user/index.php?contextid='.$userrole->contextid.'&amp;roleid='.$userrole->roleid.'">'.$userrole->name.'</a>, ';
         }
-
     }
     return rtrim($rolestring, ', ');
 }

diff --git a/user/view.php b/user/view.php
index 2615236cd150f94aa481a9d999a98443dbb3fd83..9e98ea75906751efccf9bc2854874255b72134eb 100644 (file)
--- a/user/view.php
+++ b/user/view.php
@@ -360,8 +360,8 @@
         print_row(get_string("lastaccess").":", $datestring);
     }
 /// printing roles
-
-    if ($rolestring = get_user_roles_in_context($id, $coursecontext->id)) {
+    
+    if ($rolestring = get_user_roles_in_context($id, $coursecontext)) {
         print_row(get_string('roles').':', format_string($rolestring, false));
     }