Commit d8d579e3 authored by Richard Mansfield's avatar Richard Mansfield
Browse files

Fix display_name group membership lookups



When dispay_name is called, a check is made to see if the logged-in
user is a tutor in one of the displayed user's groups, and if so,
the logged-in user is allowed to see the displayed user's real name.

Recent group changes allowed the submission of views to be independent
of the grouptype (which only defines the list of roles), and the tutor
lookup was being performed even in groups that don't accept submissions.

Change-Id: I8143a2a8c966f67da75230ff0c0b572437f05190
Signed-off-by: default avatarRichard Mansfield <richard.mansfield@catalyst.net.nz>
parent 50db739e
......@@ -853,7 +853,7 @@ function display_name($user, $userto=null, $nameonly=false, $realname=false, $us
SELECT s.member
FROM {group_member} s
JOIN {group_member} t ON s.group = t.group
JOIN {group} g ON (g.id = s.group AND g.deleted = 0)
JOIN {group} g ON (g.id = s.group AND g.deleted = 0 AND g.submittableto = 1)
JOIN {grouptype_roles} gtr
ON (g.grouptype = gtr.grouptype AND gtr.role = t.role AND gtr.see_submitted_views = 1)
WHERE s.member = ? AND t.member = ?',
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment