From: toyomoyo <toyomoyo>
Date: Tue, 28 Aug 2007 07:04:41 +0000 (+0000)
Subject: merged fix for MDL-10818, do not display graph if user has no permission
X-Git-Url: http://git.mjollnir.org/gw?a=commitdiff_plain;h=a683deeca688ec0340a9e816ca1a27eee3d3c213;p=moodle.git

merged fix for MDL-10818, do not display graph if user has no permission
---

diff --git a/course/lib.php b/course/lib.php
index 22dae509d2..16e16965a1 100644
--- a/course/lib.php
+++ b/course/lib.php
@@ -959,12 +959,16 @@ function print_log_ods($course, $user, $date, $order='l.time DESC', $modname,
 
 
 function print_log_graph($course, $userid=0, $type="course.png", $date=0) {
-    global $CFG;
+    global $CFG, $USER;
     if (empty($CFG->gdversion)) {
         echo "(".get_string("gdneed").")";
     } else {
-        echo '<img src="'.$CFG->wwwroot.'/course/report/log/graph.php?id='.$course->id.
-             '&amp;user='.$userid.'&amp;type='.$type.'&amp;date='.$date.'" alt="" />';
+        // MDL-10818, do not display broken graph when user has no permission to view graph
+        if (has_capability('moodle/site:viewreports', get_context_instance(CONTEXT_COURSE, $course->id)) ||
+            ($course->showreports and $USER->id == $userid)) {
+            echo '<img src="'.$CFG->wwwroot.'/course/report/log/graph.php?id='.$course->id.
+                 '&amp;user='.$userid.'&amp;type='.$type.'&amp;date='.$date.'" alt="" />';
+        }
     }
 }
 
diff --git a/course/user.php b/course/user.php
index fe4bf7237e..4c270b1dc8 100644
--- a/course/user.php
+++ b/course/user.php
@@ -157,7 +157,8 @@
             }
 
             // MDL-10818, do not display broken graph when user has no permission to view graph
-            if (has_capability('moodle/site:viewreports', get_context_instance(CONTEXT_COURSE, $id))) {
+            if (has_capability('moodle/site:viewreports', get_context_instance(CONTEXT_COURSE, $id)) ||
+                ($course->showreports and $USER->id == $user->id)) {
                 echo '<center><img src="'.$CFG->wwwroot.'/course/report/stats/graph.php?mode='.STATS_MODE_DETAILED.'&course='.$course->id.'&time='.$time.'&report='.STATS_REPORT_USER_VIEW.'&userid='.$user->id.'" alt="'.get_string('statisticsgraph').'" /></center>';
             }