[MDL-65169] Messaging: search should respect profile visibility when site-wide messaging is used - Moodle Tracker

XML

Word

Printable

Testing Instructions:

Hide

CIBot.

Show
CIBot.
Affected Branches:
MOODLE_37_STABLE
Fixed Branches:
MOODLE_36_STABLE
Epic Link:
Group messaging follow ups for 3.7
Pull from Repository:
https://github.com/snake/moodle.git
Pull Master Branch:
~~MDL-65169~~-master
Pull Master Diff URL:
https://github.com/moodle/moodle/compare/14cdf51189...snake:MDL-65169-master

At present, this returns all users, leaking the names of those who are not otherwise visible to the searcher.

To replicate:

Enable site wide messaging (site admin -> messaging -> messaging settings -> messagingallusers)
Create some users on the site.
Enrol a user (student 1) as a student in course 1
Enrol another user (student 2) as a student in course 2
As student 1, search for student 2.
Notice you can see them in the search results. You should not be able to, given their profile is not visible to you anywhere. You can confirm this by trying to view their profile either at course or site level.

has to be done before

MDL-64671 Add behat test for new message drawer to search

is blocked by

MDL-65170 Messaging: separate groups mode not considered by search results filtering

MDL-65439 Add behat test for new UI to manage messaging preferences to 3.6 (backport of MDL-64665)

will help resolve

MDL-65023 Messaging search: course contacts are found by everyone, despite not sharing a course, nor being a contact.

Component watchers:: Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Ilya Tregubov, Sara Arjona (@sarjona)

Estimated:

Not Specified

Remaining:

Logged:

1d 4h