Add permissions when getting user coach info

main/inc/ajax/session.ajax.php

@@ -1,6 +1,9 @@
 <?php
 /* For licensing terms, see /license.txt */
 
+use Chamilo\UserBundle\Entity\Repository\UserRepository;
+use Chamilo\UserBundle\Entity\User;
+
 /**
  * Responses to AJAX calls.
  */
@@ -172,7 +175,8 @@ switch ($action) {
         }
         break;
     case 'search_general_coach':
-        header('Content-Type: application/json');
+        SessionManager::protectSession(null, false);
+        api_protect_limit_for_session_admin();
 
         if (api_is_anonymous()) {
             echo '';
@@ -184,9 +188,10 @@ switch ($action) {
         ];
 
         $entityManager = Database::getManager();
+        /** @var UserRepository $usersRepo */
         $usersRepo = $entityManager->getRepository('ChamiloUserBundle:User');
-        $users = $usersRepo->searchUsersByStatus($_GET['q'], COURSEMANAGER);
-
+        $users = $usersRepo->searchUsersByStatus($_GET['q'], COURSEMANAGER, api_get_current_access_url_id());
+        /** @var User $user */
         foreach ($users as $user) {
             $list['items'][] = [
                 'id' => $user->getId(),
@@ -194,6 +199,7 @@ switch ($action) {
             ];
         }
 
+        header('Content-Type: application/json');
         echo json_encode($list);
         break;
     case 'get_courses_inside_session':