MDL-42643 course: Member in same group should only loginas
authorRajesh Taneja <rajesh@moodle.com>
Wed, 20 Nov 2013 00:32:06 +0000 (08:32 +0800)
committerDan Poltawski <dan@moodle.com>
Tue, 7 Jan 2014 03:05:52 +0000 (11:05 +0800)
If course groupmode is set to SEPARATEGROUPS, and user doesn't have
site:accessallgroups capability than only allow user to loginas if
current user is in same group as loginas user

course/loginas.php

index 51e7bbe..c43c6ab 100644 (file)
@@ -60,6 +60,23 @@ if (has_capability('moodle/user:loginas', $systemcontext)) {
         print_error('usernotincourse');
     }
     $context = $coursecontext;
+
+    // Check if course has SEPARATEGROUPS and user is part of that group.
+    if (groups_get_course_groupmode($course) == SEPARATEGROUPS &&
+            !has_capability('moodle/site:accessallgroups', $context)) {
+        $samegroup = false;
+        if ($groups = groups_get_all_groups($course->id, $USER->id)) {
+            foreach ($groups as $group) {
+                if (groups_is_member($group->id, $userid)) {
+                    $samegroup = true;
+                    break;
+                }
+            }
+        }
+        if (!$samegroup) {
+            print_error('nologinas');
+        }
+    }
 }
 
 /// Login as this user and return to course home page.