Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-27177

Allow students to see each other's contact details in full profile without global permission if they are able to see each other's course profile

    XMLWordPrintable

    Details

    • Database:
      MySQL
    • Testing Instructions:
      Hide

      prerequisites

      • Two courses.
      • Students enrolled in either one or the other of the courses.

      Testing

      1. Log in as a student.
      2. Go to messages in the user menu
      3. Select the course in the contacts select box.
      4. Pick a student and click on their profile picture.
      5. You should now be on their system profile page (user/profile.php).
      6. Now try to view a student who is not in any course that this user is in.
      7. You should have no access to that students profile page.
      8. Remove the capability (moodle/user:viewdetails) from the student role in one of the courses.
      9. The student should now have no access to the system profile page of students in that course.

      Course profile

      1. Log in as a student.
      2. Go to the course profile of a student.
      3. Click on a course profile that this student is not enrolled in.
      4. Make sure that you are taken to a screen that says either to enrol in the course or that you can not enrol yourself in this course.

      Separate group testing

      1. Create a course with Group mode set to "Separate groups" and Force group mode to "Yes".
      2. Enrol some students to the course.
      3. Create two groups.
      4. Create a situation where a student is trying to view the full profile of another student who is only in this course but in the other group.
      5. Ensure that no access is given to the full user profile.

      Unit tests

      1. Run user/tests/userlib_test.php and confirm that there are no failures.

      Behat tests

      1. Run user/tests/behat/view_full_profile.feature and confirm that there are no failures.
      Show
      prerequisites Two courses. Students enrolled in either one or the other of the courses. Testing Log in as a student. Go to messages in the user menu Select the course in the contacts select box. Pick a student and click on their profile picture. You should now be on their system profile page (user/profile.php). Now try to view a student who is not in any course that this user is in. You should have no access to that students profile page. Remove the capability (moodle/user:viewdetails) from the student role in one of the courses. The student should now have no access to the system profile page of students in that course. Course profile Log in as a student. Go to the course profile of a student. Click on a course profile that this student is not enrolled in. Make sure that you are taken to a screen that says either to enrol in the course or that you can not enrol yourself in this course. Separate group testing Create a course with Group mode set to "Separate groups" and Force group mode to "Yes". Enrol some students to the course. Create two groups. Create a situation where a student is trying to view the full profile of another student who is only in this course but in the other group. Ensure that no access is given to the full user profile. Unit tests Run user/tests/userlib_test.php and confirm that there are no failures. Behat tests Run user/tests/behat/view_full_profile.feature and confirm that there are no failures.
    • Affected Branches:
      MOODLE_20_STABLE, MOODLE_28_STABLE
    • Fixed Branches:
      MOODLE_30_STABLE
    • Pull from Repository:
    • Pull Master Branch:
      wip-MDL-27177-master
    • Sprint:
      Team '; drop tables Sprint 7, Team '; drop tables Sprint 9, Team ';drop tables Sprint 10
    • Issue size:
      Medium

      Description

      Students cannot see each other's full profile of other student profiles. They can see the basic profile, but not the full profile. Here is how things are currently set up:

      • I have a set of students all enrolled in a course. There are no groups set, so in principle, no student is hidden from another.
      • Student permissions are set to Allow for View user profiles > moodle/user:viewdetails
      • In the user's profile, the Allow only other course members to see my email address is set, and yet, no once can see them. I even tried setting it so that everyone could see their email address and still nothing.
      • I have created some custom user profile fields and they are all set to Visible to everyone, and yet, no one can see them.

      That said, all users can see the full profile of Teachers enrolled in the course. I marked their email as private and it stays private.

      I am using Moodle2.0.1 (Build: 20101225) and another user reported the same issue in the discussion topic about this: http://moodle.org/mod/forum/discuss.php?d=171444

        Attachments

        1. Co-Facilitator_Administration_Users_Permissions_Define roles.pdf
          225 kB
          Laura Gay Majerus
        2. FullProfile_Administration_Users_Permissions_Define roles.pdf
          551 kB
          Laura Gay Majerus
        3. moodle_student_nofullprofilelink_otherstudent.png
          38 kB
          Laura Gay Majerus
        4. moodle_student_yesullprofilelink_otherstudent.png
          43 kB
          Laura Gay Majerus
        5. moodle_teacher_nofullprofilelink_student.png
          57 kB
          Laura Gay Majerus
        6. moodle_teacher_yesfullprofilelink_student.png
          33 kB
          Laura Gay Majerus
        7. Unable to view full profile.png
          34 kB
          Joseph Jacelone

          Issue Links

            Activity

              People

              • Votes:
                32 Vote for this issue
                Watchers:
                31 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Fix Release Date:
                  16/Nov/15