Internal: Fix permission to view session by voter - refs BT#21745

src/CoreBundle/Security/Authorization/Voter/SessionVoter.php

@@ -84,22 +84,26 @@ class SessionVoter extends Voter
                     $userIsStudent = $session->hasUserInCourse($user, $currentCourse, Session::STUDENT);
                 }
 
-                if ($userIsGeneralCoach) {
-                    $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_TEACHER);
-                } elseif ($userIsCourseCoach) { // Course-Coach access.
+                $visibilityForUser = $session->setAccessVisibilityByUser($user);
+
+                if ($userIsStudent && Session::LIST_ONLY == $visibilityForUser) {
+                    return false;
+                }
+
+                if ($userIsGeneralCoach || $userIsCourseCoach) {
                     $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_TEACHER);
                 } elseif ($userIsStudent) { // Student access.
                     $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_STUDENT);
                 }
 
-                if (\in_array(
-                    $session->setAccessVisibilityByUser($user),
-                    [Session::INVISIBLE, Session::LIST_ONLY]
-                )) {
-                    return false;
+                if (
+                    ($userIsGeneralCoach || $userIsCourseCoach || $userIsStudent)
+                    && $visibilityForUser != Session::INVISIBLE
+                ) {
+                    return true;
                 }
 
-                return true;
+                return false;
 
             case self::EDIT:
             case self::DELETE: