From e143918f9e7f0fc568de81a5492ab5f087c6917a Mon Sep 17 00:00:00 2001
From: Henning Bostelmann <henning.bostelmann@york.ac.uk>
Date: Thu, 16 Jul 2015 17:03:42 +0100
Subject: [PATCH] MDL-35027 mod_forum: Fix subscriber list in hidden forums

If the forum is force-subscribed and hidden, only subscribers that can
view hidden activities will be shown in the subscriber list.
---
 mod/forum/subscribers.php                          | 36 +++++++++++++++++++---
 .../behat/forum_subscriptions_availability.feature | 15 +++++++++
 2 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/mod/forum/subscribers.php b/mod/forum/subscribers.php
index 3b121a7c154..953eeeb3046 100644
--- a/mod/forum/subscribers.php
+++ b/mod/forum/subscribers.php
@@ -100,7 +100,7 @@ $strsubscribers = get_string("subscribers", "forum");
 $PAGE->navbar->add($strsubscribers);
 $PAGE->set_title($strsubscribers);
 $PAGE->set_heading($COURSE->fullname);
-if (has_capability('mod/forum:managesubscriptions', $context)) {
+if (has_capability('mod/forum:managesubscriptions', $context) && \mod_forum\subscriptions::is_forcesubscribed($forum) === false) {
     if ($edit != -1) {
         $USER->subscriptionsediting = $edit;
     }
@@ -112,11 +112,39 @@ echo $OUTPUT->header();
 echo $OUTPUT->heading(get_string('forum', 'forum').' '.$strsubscribers);
 if (empty($USER->subscriptionsediting)) {
     $subscribers = \mod_forum\subscriptions::fetch_subscribed_users($forum, $currentgroup, $context);
+    if (\mod_forum\subscriptions::is_forcesubscribed($forum)) {
+        $subscribers = mod_forum_filter_hidden_users($cm, $context, $subscribers);
+    }
     echo $forumoutput->subscriber_overview($subscribers, $forum, $course);
-} else if (\mod_forum\subscriptions::is_forcesubscribed($forum)) {
-    $subscriberselector->set_force_subscribed(true);
-    echo $forumoutput->subscribed_users($subscriberselector);
 } else {
     echo $forumoutput->subscriber_selection_form($existingselector, $subscriberselector);
 }
 echo $OUTPUT->footer();
+
+/**
+ * Filters a list of users for whether they can see a given activity.
+ * If the course module is hidden (closed-eye icon), then only users who have
+ * the permission to view hidden activities will appear in the output list.
+ *
+ * @todo MDL-48625 This filtering should be handled in core libraries instead.
+ *
+ * @param stdClass $cm the course module record of the activity.
+ * @param context_module $context the activity context, to save re-fetching it.
+ * @param array $users the list of users to filter.
+ * @return array the filtered list of users.
+ */
+function mod_forum_filter_hidden_users(stdClass $cm, context_module $context, array $users) {
+    if ($cm->visible) {
+        return $users;
+    } else {
+        // Filter for users that can view hidden activities.
+        $filteredusers = array();
+        $hiddenviewers = get_users_by_capability($context, 'moodle/course:viewhiddenactivities');
+        foreach ($hiddenviewers as $hiddenviewer) {
+            if (array_key_exists($hiddenviewer->id, $users)) {
+                $filteredusers[$hiddenviewer->id] = $users[$hiddenviewer->id];
+            }
+        }
+        return $filteredusers;
+    }
+}
diff --git a/mod/forum/tests/behat/forum_subscriptions_availability.feature b/mod/forum/tests/behat/forum_subscriptions_availability.feature
index 32d45675a9a..c613da31041 100644
--- a/mod/forum/tests/behat/forum_subscriptions_availability.feature
+++ b/mod/forum/tests/behat/forum_subscriptions_availability.feature
@@ -66,6 +66,21 @@ Feature: As a teacher I need to see an accurate list of subscribed users
     And I should not see "Student 3"
 
   @javascript
+  Scenario: A forced, hidden forum lists only teachers
+    When I add a "Forum" to section "1" and I fill the form with:
+      | Forum name        | Forced Forum 2 |
+      | Forum type        | Standard forum for general use |
+      | Description       | Test forum description |
+      | Subscription mode | Forced subscription |
+      | Visible           | Hide |
+    And I follow "Forced Forum 2"
+    And I follow "Show/edit current subscribers"
+    Then I should see "Teacher Teacher"
+    And I should not see "Student 1"
+    And I should not see "Student 2"
+    And I should not see "Student 3"
+
+  @javascript
   Scenario: An automatic forum lists all subscribers
     When I add a "Forum" to section "1" and I fill the form with:
       | Forum name        | Forced Forum 1 |
-- 
2.11.4.GIT