Secure group viewing when in separate mode

diff --git a/course/group.php b/course/group.php
index feb00ca5dab2acfcb7ad2a09c5494ed605115f6b..f4430bd956ec923915f4d3b88ab282785191ea1b 100644 (file)
--- a/course/group.php
+++ b/course/group.php
@@ -16,10 +16,13 @@
 
     require_login($course->id);
 
-
-    if ($group and (isteacheredit($course->id) or $course->groupmode == VISIBLEGROUPS)) {
-        if (! $group = get_record("groups", "id", $group)) {
-            error('Specified group could not be found!', "groups.php?id=$course->id");
+    if ($group) {
+        if (isteacheredit($course->id) or $course->groupmode == VISIBLEGROUPS) {
+            if (! $group = get_record("groups", "id", $group)) {
+                error('Specified group could not be found!', "groups.php?id=$course->id");
+            }
+        } else {
+            error('Sorry, you don\'t have access to view this group', "view.php?id=$course->id");
         }
     } else if (! $group = get_current_group($course->id, 'full')) {
         error('You are not currently in a group!', "view.php?id=$course->id");