Major At present, this returns all users, leaking the names of those who are not otherwise visible to the searcher.
To replicate:
- Enable site wide messaging (site admin -> messaging -> messaging settings -> messagingallusers)
- Create some users on the site.
- Enrol a user (student 1) as a student in course 1
- Enrol another user (student 2) as a student in course 2
- As student 1, search for student 2.
- Notice you can see them in the search results. You should not be able to, given their profile is not visible to you anywhere. You can confirm this by trying to view their profile either at course or site level.
- has to be done before
-
MDL-64671 Add behat test for new message drawer to search
-
- Open
-
- is blocked by
-
MDL-65170 Messaging: separate groups mode not considered by search results filtering
-
- Closed
-
-
-
- Closed
-
- will help resolve
-
-
- Closed
-
