From 1ce92aebba7ce4f52da36be16579060fb45e921c Mon Sep 17 00:00:00 2001
From: jmontoyaa <gugli100@gmail.com>
Date: Mon, 16 Apr 2018 13:33:01 +0200
Subject: [PATCH] Add permissions when getting user coach info

---
 main/inc/ajax/session.ajax.php | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/main/inc/ajax/session.ajax.php b/main/inc/ajax/session.ajax.php
index 69fadcc47a..fe0352b248 100755
--- a/main/inc/ajax/session.ajax.php
+++ b/main/inc/ajax/session.ajax.php
@@ -1,6 +1,9 @@
 <?php
 /* For licensing terms, see /license.txt */
 
+use Chamilo\UserBundle\Entity\Repository\UserRepository;
+use Chamilo\UserBundle\Entity\User;
+
 /**
  * Responses to AJAX calls.
  */
@@ -172,7 +175,8 @@ switch ($action) {
         }
         break;
     case 'search_general_coach':
-        header('Content-Type: application/json');
+        SessionManager::protectSession(null, false);
+        api_protect_limit_for_session_admin();
 
         if (api_is_anonymous()) {
             echo '';
@@ -184,9 +188,10 @@ switch ($action) {
         ];
 
         $entityManager = Database::getManager();
+        /** @var UserRepository $usersRepo */
         $usersRepo = $entityManager->getRepository('ChamiloUserBundle:User');
-        $users = $usersRepo->searchUsersByStatus($_GET['q'], COURSEMANAGER);
-
+        $users = $usersRepo->searchUsersByStatus($_GET['q'], COURSEMANAGER, api_get_current_access_url_id());
+        /** @var User $user */
         foreach ($users as $user) {
             $list['items'][] = [
                 'id' => $user->getId(),
@@ -194,6 +199,7 @@ switch ($action) {
             ];
         }
 
+        header('Content-Type: application/json');
         echo json_encode($list);
         break;
     case 'get_courses_inside_session':