MDL-27183 quiz reports: don't show data to users not in any group

if the quiz is set to separate groups, and the user does not have access all groups.

mod/quiz/report/attemptsreport.php

@@ -72,15 +72,20 @@ protected function should_show_grades($quiz) {
     /**
      * Get information about which students to show in the report.
      * @param object $cm the coures module.
+     * @param object $course the course settings.
      * @return an array with four elements:
      *      0 => integer the current group id (0 for none).
      *      1 => array ids of all the students in this course.
      *      2 => array ids of all the students in the current group.
      *      3 => array ids of all the students to show in the report. Will be the
      *              same as either element 1 or 2.
      */
-    protected function load_relevant_students($cm) {
-        $currentgroup = groups_get_activity_group($cm, true);
+    protected function load_relevant_students($cm, $course = null) {
+        $currentgroup = $this->get_current_group($cm, $course, $this->context);
+
+        if ($currentgroup == self::NO_GROUPS_ALLOWED) {
+            return array($currentgroup, array(), array(), array());
+        }
 
         if (!$students = get_users_by_capability($this->context,
                 array('mod/quiz:reviewmyattempts', 'mod/quiz:attempt'),

mod/quiz/report/default.php

@@ -43,6 +43,8 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 abstract class quiz_default_report {
+    const NO_GROUPS_ALLOWED = -2;
+
     /**
      * Override this function to displays the report.
      * @param $cm the course-module for this quiz.
@@ -51,6 +53,14 @@ abstract class quiz_default_report {
      */
     public abstract function display($cm, $course, $quiz);
 
+    /**
+     * Initialise some parts of $PAGE and start output.
+     *
+     * @param object $cm the course_module information.
+     * @param object $coures the course settings.
+     * @param object $quiz the quiz settings.
+     * @param string $reportmode the report name.
+     */
     public function print_header_and_tabs($cm, $course, $quiz, $reportmode = 'overview') {
         global $PAGE, $OUTPUT;
 
@@ -59,4 +69,24 @@ public function print_header_and_tabs($cm, $course, $quiz, $reportmode = 'overvi
         $PAGE->set_heading($course->fullname);
         echo $OUTPUT->header();
     }
+
+    /**
+     * Get the current group for the user user looking at the report.
+     *
+     * @param object $cm the course_module information.
+     * @param object $coures the course settings.
+     * @param context $context the quiz context.
+     * @return int the current group id, if applicable. 0 for all users,
+     *      NO_GROUPS_ALLOWED if the user cannot see any group.
+     */
+    public function get_current_group($cm, $course, $context) {
+        $groupmode = groups_get_activity_groupmode($cm, $course);
+        $currentgroup = groups_get_activity_group($cm, true);
+
+        if ($groupmode == SEPARATEGROUPS && !$currentgroup && !has_capability('moodle/site:accessallgroups', $context)) {
+            $currentgroup = self::NO_GROUPS_ALLOWED;
+        }
+
+        return $currentgroup;
+    }
 }

mod/quiz/report/grading/report.php

@@ -117,10 +117,14 @@ public function display($quiz, $cm, $course) {
         }
 
         // Get the group, and the list of significant users.
-        $this->currentgroup = groups_get_activity_group($this->cm, true);
-        $this->users = get_users_by_capability($this->context,
-                array('mod/quiz:reviewmyattempts', 'mod/quiz:attempt'), '', '', '', '',
-                $this->currentgroup, '', false);
+        $this->currentgroup = $this->get_current_group($cm, $course, $this->context);
+        if ($this->currentgroup == self::NO_GROUPS_ALLOWED) {
+            $this->users = array();
+        } else {
+            $this->users = get_users_by_capability($this->context,
+                    array('mod/quiz:reviewmyattempts', 'mod/quiz:attempt'), '', '', '', '',
+                    $this->currentgroup, '', false);
+        }
 
         // Start output.
         $this->print_header_and_tabs($cm, $course, $quiz, 'grading');

mod/quiz/report/overview/report.php

@@ -47,7 +47,7 @@ public function display($quiz, $cm, $course) {
         $download = optional_param('download', '', PARAM_ALPHA);
 
         list($currentgroup, $students, $groupstudents, $allowed) =
-                $this->load_relevant_students($cm);
+                $this->load_relevant_students($cm, $course);
 
         $pageoptions = array();
         $pageoptions['id'] = $cm->id;

mod/quiz/report/responses/report.php

@@ -55,7 +55,7 @@ public function display($quiz, $cm, $course) {
         $download = optional_param('download', '', PARAM_ALPHA);
 
         list($currentgroup, $students, $groupstudents, $allowed) =
-                $this->load_relevant_students($cm);
+                $this->load_relevant_students($cm, $course);
 
         $pageoptions = array();
         $pageoptions['id'] = $cm->id;

mod/quiz/report/statistics/report.php

@@ -85,13 +85,16 @@ public function display($quiz, $cm, $course) {
         }
 
         // Find out current groups mode
-        $groupmode = groups_get_activity_groupmode($cm);
-        $currentgroup = groups_get_activity_group($cm, true);
+        $currentgroup = $this->get_current_group($cm, $course, $context);
         $nostudentsingroup = false; // True if a group is selected and there is no one in it.
         if (empty($currentgroup)) {
             $currentgroup = 0;
             $groupstudents = array();
 
+        } else if ($currentgroup == self::NO_GROUPS_ALLOWED) {
+            $groupstudents = array();
+            $nostudentsingroup = true;
+
         } else {
             // All users who can attempt quizzes and who are in the currently selected group
             $groupstudents = get_users_by_capability($context,
@@ -152,7 +155,7 @@ public function display($quiz, $cm, $course) {
         if (!$this->table->is_downloading()) {
             $this->print_header_and_tabs($cm, $course, $quiz, 'statistics');
 
-            if ($groupmode) {
+            if (groups_get_activity_groupmode($cm)) {
                 groups_print_activity_menu($cm, $reporturl->out());
                 if ($currentgroup && !$groupstudents) {
                     $OUTPUT->notification(get_string('nostudentsingroup', 'quiz_statistics'));