merged fix for MDL-10037, hide hidden user's blogs from course view

diff --git a/blog/lib.php b/blog/lib.php
index 3c4859d387b4b6a52f32d7874b64333ff8297dad..ba831fe12982a5a7eed0dde9d7444a16a1f4f3d5 100755 (executable)
--- a/blog/lib.php
+++ b/blog/lib.php
@@ -567,6 +567,13 @@
             case 'course':
                 // all users with a role assigned
                 $context = get_context_instance(CONTEXT_COURSE, $filterselect);
+                
+                // MDL-10037, hidden users' blogs should not appear
+                if (has_capability('moodle/role:viewhiddenassigns', $context)) {
+                    $hiddensql = ''; 
+                } else {                    
+                    $hiddensql = ' AND ra.hidden = 0 '; 
+                }
 
                 $SQL = 'SELECT '.$requiredfields.' FROM '.$CFG->prefix.'post p, '.$tagtablesql
                         .$CFG->prefix.'role_assignments ra, '.$CFG->prefix.'user u
@@ -574,7 +581,7 @@
                         AND ra.contextid '.get_related_contexts_string($context).'
                         AND u.id = p.userid
                         AND u.deleted = 0
-                        '.$permissionsql.$typesql;
+                        '.$hiddensql.$permissionsql.$typesql;
 
             break;