Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-65169

Messaging: search should respect profile visibility when site-wide messaging is used

    XMLWordPrintable

    Details

      Description

      At present, this returns all users, leaking the names of those who are not otherwise visible to the searcher.

      To replicate:

      1. Enable site wide messaging (site admin -> messaging -> messaging settings -> messagingallusers)
      2. Create some users on the site.
      3. Enrol a user (student 1) as a student in course 1
      4. Enrol another user (student 2) as a student in course 2
      5. As student 1, search for student 2.
      6. Notice you can see them in the search results. You should not be able to, given their profile is not visible to you anywhere. You can confirm this by trying to view their profile either at course or site level.

        Attachments

          Issue Links

          has to be done before

          Improvement - An enhancement to an existing Moodle feature. MDL-64671 Add behat test for new message drawer to search

          • Minor - Minor loss of function where workaround is possible
          • Open
          is blocked by

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-65170 Messaging: separate groups mode not considered by search results filtering

          • Minor - Minor loss of function where workaround is possible
          • Closed

          Improvement - An enhancement to an existing Moodle feature. MDL-65439 Add behat test for new UI to manage messaging preferences to 3.6 (backport of MDL-64665)

          • Minor - Minor loss of function where workaround is possible
          • Closed
          will help resolve

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-65023 Messaging search: course contacts are found by everyone, despite not sharing a course, nor being a contact.

          • Minor - Minor loss of function where workaround is possible
          • Closed

            Activity

              People

              Assignee:
              jaked Jake Dallimore
              Reporter:
              jaked Jake Dallimore
              Peer reviewer:
              Mark Nelson
              Integrator:
              Sara Arjona (@sarjona)
              Tester:
              CiBoT
              Participants:
              Component watchers:
              Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Sara Arjona (@sarjona)
              Votes:
              3 Vote for this issue
              Watchers:
              7 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Fix Release Date:
                13/May/19

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 1 day, 4 hours
                  1d 4h