Blocking access to a LP if users are not registered via user_id or group_id

main/group/group_edit.php

@@ -448,6 +448,7 @@ if ($defaults['maximum_number_of_students'] == GroupManager::MEMBER_PER_GROUP_NO
     $defaults['max_member'] = $defaults['maximum_number_of_students'];
 }
 
+
 if (!empty($_GET['keyword']) && !empty($_GET['submit'])) {
     $keyword_name = Security::remove_XSS($_GET['keyword']);
     echo '<br/>'.get_lang('SearchResultsFor').' <span style="font-style: italic ;"> '.$keyword_name.' </span><br>';

main/inc/Entity/Repository/ItemPropertyRepository.php

@@ -102,13 +102,16 @@ class ItemPropertyRepository extends EntityRepository
         }
 
         foreach ($newList as $groupId) {
-            $groupObj = $em->find('Entity\EntityCGroupInfo', $groupId);
             if (!in_array($groupId, $alreadyAdded)) {
                 $item = new \Entity\EntityCItemProperty($course);
+                $groupObj = $em->find('Entity\EntityCGroupInfo', $groupId);
                 $item->setGroup($groupObj);
                 $item->setTool($tool);
                 $item->setRef($itemId);
-                $item->setIdSession($sessionId);
+
+                if (!empty($session)) {
+                    $item->setSession($session);
+                }
                 $item->setLasteditType('LearnpathSubscription');
                 $item->setVisibility('1');
                 $em->persist($item); //$em is an instance of EntityManager
@@ -117,6 +120,13 @@ class ItemPropertyRepository extends EntityRepository
         $em->flush();
     }
 
+    /**
+     * @param $tool
+     * @param \Entity\EntityCourse $course
+     * @param \Entity\EntitySession $session
+     * @param $itemId
+     * @param array $newUserList
+     */
     public function SubscribedUsersToItem($tool, \Entity\EntityCourse $course, \Entity\EntitySession $session = null, $itemId, $newUserList = array())
     {
         $em = $this->getEntityManager();

main/inc/lib/main_api.lib.php

@@ -3021,7 +3021,7 @@ function api_get_datetime($time = null) {
  * @param int       The session ID (optional)
  * @return int      -1 on error, 0 if invisible, 1 if visible
  */
-function api_get_item_visibility($_course, $tool, $id, $session = 0, $user_id = null, $type = null) {
+function api_get_item_visibility($_course, $tool, $id, $session = 0, $user_id = null, $type = null, $group_id = null) {
     if (!is_array($_course) || count($_course) == 0 || empty($tool) || empty($id)) { return -1; }
     $tool = Database::escape_string($tool);
     $id = Database::escape_string($id);
@@ -3034,18 +3034,26 @@ function api_get_item_visibility($_course, $tool, $id, $session = 0, $user_id =
         $user_condition = " AND to_user_id = $user_id ";
     }
     $type_condition = null;
+
     if (!empty($type)) {
         $type = Database::escape_string($type);
         $type_condition = " AND lastedit_type = '$type' ";
     }
 
+    $group_condition = null;
+    if (!empty($group_id)) {
+        $group_id = intval($group_id);
+        $group_condition = " AND to_group_id = '$group_id' ";
+    }
+
     $sql = "SELECT visibility FROM $TABLE_ITEMPROPERTY
     		WHERE 	c_id = $course_id AND
     				tool = '$tool' AND
     				ref = $id AND
-    				(id_session = $session OR id_session = 0) $user_condition $type_condition
+    				(id_session = $session OR id_session = 0 OR id_session IS NULL) $user_condition $type_condition $group_condition
     		ORDER BY id_session DESC, lastedit_date DESC";
     $res = Database::query($sql);
+
     if ($res === false || Database::num_rows($res) == 0) { return -1; }
     $row = Database::fetch_array($res);
     return $row['visibility'];

main/inc/lib/pear/HTML/QuickForm/advmultiselect.php

@@ -878,16 +878,21 @@ class HTML_QuickForm_advmultiselect extends HTML_QuickForm_select
             }
 
             $strHtmlSelected = "<select$attrSelected>".PHP_EOL;
+
             if ($selected_count > 0) {
                 foreach ($arrHtmlSelected as $data) {
+                    if (!empty($data) && isset($data['attr'])) {
+
                     $strHtmlSelected
                         .= $tabs.$tab
                         .'<option'.$this->_getAttrString($data['attr']).'>'
                         .$data['text'].'</option>'.PHP_EOL;
+                    }
                 }
             } else {
                 $strHtmlSelected .= '<option value="">&nbsp;</option>';
             }
+
             $strHtmlSelected .= '</select>';
 
             $strHtmlSelected = '<input placeholder="'.get_lang('Search').'" id="t-'.$selectId.'-filter" type="text" class="search-query"><br /><br />'.$strHtmlSelected;
@@ -896,10 +901,11 @@ class HTML_QuickForm_advmultiselect extends HTML_QuickForm_select
             $strHtmlHidden = "<select$attrHidden>".PHP_EOL;
             if (count($arrHtmlHidden) > 0) {
                 foreach ($arrHtmlHidden as $data) {
+                    if (!empty($data) && isset($data['attr'])) {
                     $strHtmlHidden
                         .= $tabs.$tab
-                        .'<option'.$this->_getAttrString($data['attr']).'>'
-                        .$data['text'].'</option>'.PHP_EOL;
+                        .'<option'.$this->_getAttrString($data['attr']).'>'.$data['text'].'</option>'.PHP_EOL;
+                    }
                 }
             }
             $strHtmlHidden .= '</select>';

main/newscorm/learnpath.class.php

@@ -2389,9 +2389,25 @@ class learnpath
             }
 
             if (isset($row['subscribe_users']) && $row['subscribe_users'] == 1 ) {
-                $visibility = api_get_item_visibility($course_info, 'learnpath', $row['id'], $session_id, $student_id, 'LearnpathSubscription');
-                if ($visibility == -1) {
-                    return false;
+                $userVisibility = api_get_item_visibility($course_info, 'learnpath', $row['id'], $session_id, $student_id, 'LearnpathSubscription');
+
+                if ($userVisibility == 1) {
+                    $is_visible = true;
+                } else {
+                    $is_visible = false;
+                }
+
+                $groupList = GroupManager::get_group_ids($course_info['real_id'], $student_id);
+
+                if (!empty($groupList)) {
+                    foreach($groupList as $groupId) {
+                        $groupVisibility = api_get_item_visibility($course_info, 'learnpath', $row['id'], $session_id, 0, 'LearnpathSubscription', $groupId);
+
+                        if ($groupVisibility == 1) {
+                            $is_visible = true;
+                            break;
+                        }
+                    }
                 }
             }
 

src/ChamiloLMS/Controller/LearnpathController.php

@@ -1,6 +1,7 @@
 <?php
 
 namespace ChamiloLMS\Controller;
+
 use Silex\Application;
 use Symfony\Component\HttpFoundation\Response;
 
@@ -8,13 +9,14 @@ use Symfony\Component\HttpFoundation\Response;
  * Class LearnpathController
  * @package ChamiloLMS\Controller
  */
-class LearnpathController {
+class LearnpathController
+{
 
     /**
      * Index
      *
-     * @param \Silex\Application $app
-     * @param int $lpId
+     * @param   \Silex\Application $app
+     * @param   int $lpId
      *
      * @todo move calls in repositories
      *
@@ -22,15 +24,21 @@ class LearnpathController {
      */
     public function indexAction(Application $app, $lpId)
     {
-        $request = $app['request'];
+        $request    = $app['request'];
         $courseCode = api_get_course_id();
-        $lp = new \learnpath($courseCode, $lpId, api_get_user_id());
+        $lp         = new \learnpath($courseCode, $lpId, api_get_user_id());
 
         $url = $app['url_generator']->generate('subscribe_users', array('lpId' => $lpId));
 
         $breadcrumb = array(
-            array('url' => api_get_path(WEB_CODE_PATH).'newscorm/lp_controller.php?action=list', 'name' => get_lang('LearningPaths')),
-            array('url' => api_get_path(WEB_CODE_PATH)."newscorm/lp_controller.php?action=build&lp_id=".$lp->get_id(), 'name' => $lp->get_name()),
+            array(
+                'url'  => api_get_path(WEB_CODE_PATH).'newscorm/lp_controller.php?action=list',
+                'name' => get_lang('LearningPaths')
+            ),
+            array(
+                'url'  => api_get_path(WEB_CODE_PATH)."newscorm/lp_controller.php?action=build&lp_id=".$lp->get_id(),
+                'name' => $lp->get_name()
+            ),
             array('url' => '#', 'name' => get_lang('SubscribeUsers'))
         );
 
@@ -51,19 +59,23 @@ class LearnpathController {
         $course = $app['orm.em']->getRepository('Entity\EntityCourse')->find($courseId);
 
         $subscribedUsers = $app['orm.em']->getRepository('Entity\EntityCourse')->getSubscribedStudents($course);
-
         $subscribedUsers = $subscribedUsers->getQuery();
-        $subscribedUsers =  $subscribedUsers->execute();
+        $subscribedUsers = $subscribedUsers->execute();
 
-        //All choices
+        //Getting all users
         $choices = array();
         foreach ($subscribedUsers as $user) {
             $choices[$user->getUserId()] = $user->getCompleteNameWithClasses();
         }
 
-        $subscribedUsersInLp = $app['orm.em']->getRepository('Entity\EntityCItemProperty')->getUsersSubscribedToItem('learnpath', $lpId, $course, $session);
+        $subscribedUsersInLp = $app['orm.em']->getRepository('Entity\EntityCItemProperty')->getUsersSubscribedToItem(
+            'learnpath',
+            $lpId,
+            $course,
+            $session
+        );
 
-        //Selected choices
+        //Getting users subscribed to the LP
         $selectedChoices = array();
         foreach ($subscribedUsersInLp as $itemProperty) {
             $selectedChoices[] = $itemProperty->getToUserId();
@@ -76,8 +88,8 @@ class LearnpathController {
         $userMultiSelect->setButtonAttributes('add');
         $userMultiSelect->setButtonAttributes('remove');
 
+        //Group list
         $groupList = \CourseManager::get_group_list_of_course(api_get_course_id(), api_get_session_id(), 1);
-
         $groupChoices = array();
         if (!empty($groupList)) {
             foreach ($groupList as $group) {
@@ -85,7 +97,13 @@ class LearnpathController {
             }
         }
 
-        $subscribedGroupsInLp = $app['orm.em']->getRepository('Entity\EntityCItemProperty')->getGroupsSubscribedToItem('learnpath', $lpId, $course, $session);
+        //Subscribed groups to a LP
+        $subscribedGroupsInLp = $app['orm.em']->getRepository('Entity\EntityCItemProperty')->getGroupsSubscribedToItem(
+            'learnpath',
+            $lpId,
+            $course,
+            $session
+        );
 
         $selectedGroupChoices = array();
         foreach ($subscribedGroupsInLp as $itemProperty) {
@@ -135,19 +153,26 @@ class LearnpathController {
         if (!empty($selectedGroupChoices)) {
             $defaults['groups'] = $selectedGroupChoices;
         }
-
         $form->setDefaults($defaults);
 
         if ($request->getMethod() == 'POST') {
-            //$form->bind($request);
-            //$data = $form->getData();
-            //var_dump($request->request);exit;
             $users = $request->get('users');
-            //$destination = isset($data['destination']) ? $data['destination'] : array();
-            $app['orm.em']->getRepository('Entity\EntityCItemProperty')->SubscribedUsersToItem('learnpath', $course, $session, $lpId, $users);
+            $app['orm.em']->getRepository('Entity\EntityCItemProperty')->SubscribedUsersToItem(
+                'learnpath',
+                $course,
+                $session,
+                $lpId,
+                $users
+            );
 
             $groups = $request->get('groups');
-            $app['orm.em']->getRepository('Entity\EntityCItemProperty')->SubscribedGroupsToItem('learnpath', $course, $session, $lpId, $groups);
+            $app['orm.em']->getRepository('Entity\EntityCItemProperty')->SubscribedGroupsToItem(
+                'learnpath',
+                $course,
+                $session,
+                $lpId,
+                $groups
+            );
 
             return $app->redirect($url);
         } else {