MDL-8840 Loginas cleanup, better course isolation; merged from MOODLE_18_STABLE

diff --git a/lib/accesslib.php b/lib/accesslib.php
index c35c5b5475e6a2266828d8e4ea4e7b91382e492a..a091f0889d20be424da70269daa56eceab47d06e 100755 (executable)
--- a/lib/accesslib.php
+++ b/lib/accesslib.php
@@ -1124,6 +1124,14 @@ function load_all_capabilities() {
             if ($USER->loginascontext->contextlevel != CONTEXT_SYSTEM) {
                 // load only course caqpabilitites - it may not always work as expected
                 load_user_capability('', $USER->loginascontext);
+                // find all child contexts and unset the rest
+                $children = get_child_contexts($USER->loginascontext);
+                $children[] = $USER->loginascontext->id;
+                foreach ($USER->capabilities as $conid => $caps) {
+                    if (!in_array($conid, $children)) {
+                        unset($USER->capabilities[$conid]);
+                    }
+                }
             } else {
                 load_user_capability();
             }