Possible fix of #3865 when a course is "world" user might see the visibles files ...

main/inc/lib/document.lib.php

@@ -1208,7 +1208,12 @@ return 'application/octet-stream';
     		if (in_array($user_status, array('0', '6'))) {
     			//is true if is an student or a coach
     			$user_in_course = true;
-    		}    		
+    		}
+    		
+    		//Check if course is open then we can consider that the student is regitered to the course
+    		if (isset($course_info) && $course_info['visibility'] == 3) {
+    			$user_in_course = true;
+    		}	
     	}
     	
     	

main/inc/lib/main_api.lib.php

@@ -717,7 +717,11 @@ function api_valid_email($address) {
  * @author Roan Embrechts
  */
 function api_protect_course_script($print_headers = false) {
-    global $is_allowed_in_course;
+    global $is_allowed_in_course;    
+    $course_info = api_get_course_info();
+    if (isset($course_info) && $course_info['visibility'] == 3) {    	
+    	return true;    	
+    }    
     if (!$is_allowed_in_course) {
         api_not_allowed($print_headers);
         return false;