Fices bug when loading another user's capabilities (it would trash your own)

diff --git a/lib/accesslib.php b/lib/accesslib.php
index 34af2d717e8638644d61961684602bc0a3da553a..6810de83b523eaee41ef37e413ea18d69d4fd017 100755 (executable)
--- a/lib/accesslib.php
+++ b/lib/accesslib.php
@@ -177,7 +177,7 @@ function has_capability($capability, $context=NULL, $userid=NULL, $doanything='t
 
     global $USER, $CONTEXT, $CFG;
 
-    if (!isloggedin() && !isset($USER->capabilities)) {
+    if (empty($userid) && !isloggedin() && !isset($USER->capabilities)) {
         load_notloggedin_role();
     }
 
@@ -383,7 +383,7 @@ function capability_search($capability, $context, $capabilities) {
             error ('This is an unknown context!');
         return false;
     }
-    if ($CFG->debug > 15) {
+    if ($CFG->debug > 7) {
         notify("Found $capability recursively from context $context->id at level $context->aggregatelevel: $permission", 'notifytiny');
     }
 
@@ -410,13 +410,16 @@ function load_user_capability($capability='', $context ='', $userid='') {
 
     global $USER, $CFG;
 
-    // make sure it's cleaned when loaded (again)
-    if (!empty($USER->capabilities)) {
-        unset($USER->capabilities);  
-    }
     
     if (empty($userid)) {
+        if (empty($USER->id)) {               // We have no user to get capabilities for
+            return false;
+        }
+        if (!empty($USER->capabilities)) {    // make sure it's cleaned when loaded (again)
+            unset($USER->capabilities);  
+        }
         $userid = $USER->id;
+        $otheruserid = false;
     } else {
         $otheruserid = $userid;
     }
@@ -1158,6 +1161,11 @@ function role_assign($roleid, $userid, $groupid, $contextid, $timestart=0, $time
         return false;
     }
 
+    if ($groupid && !record_exists('groups', 'id', $groupid)) {
+        notify('Group does not exist!');
+        return false;
+    }
+
     if (!$context = get_context_instance_by_id($contextid)) {
         notify('A valid context must be provided');
         return false;