From 79e12570d96d49ac4b5fa3316ef34cac35e7a822 Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Mon, 17 Jul 2023 13:28:32 +0100
Subject: [PATCH] MDL-78502 grade: consider only those export formats user can
 access.

---
 grade/export/index.php | 11 +++++++++--
 grade/import/index.php |  9 ++++++++-
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/grade/export/index.php b/grade/export/index.php
index 7901e2b75a9..7e2957b8ee0 100644
--- a/grade/export/index.php
+++ b/grade/export/index.php
@@ -37,14 +37,21 @@ require_login($course);
 $context = context_course::instance($courseid);
 require_capability('moodle/grade:export', $context);
 
-$exportplugins = core_component::get_plugin_list('gradeexport');
+// Retrieve all grade export plugins the current user can access.
+$exportplugins = array_filter(core_component::get_plugin_list('gradeexport'),
+    static function(string $exportplugin) use ($context): bool {
+        return has_capability("gradeexport/{$exportplugin}:view", $context);
+    },
+    ARRAY_FILTER_USE_KEY
+);
+
 if (!empty($exportplugins)) {
     $exportplugin = array_key_first($exportplugins);
     $url = new moodle_url("/grade/export/{$exportplugin}/index.php", ['id' => $courseid]);
     redirect($url);
 }
 
-// Otherwise, output the page with a notification stating that there are no available grade import options.
+// Otherwise, output the page with a notification stating that there are no available grade export options.
 $PAGE->set_title(get_string('export', 'grades'));
 $PAGE->set_pagelayout('incourse');
 $PAGE->set_heading($course->fullname);
diff --git a/grade/import/index.php b/grade/import/index.php
index fc8d4f9cbf3..e5acd9b8730 100644
--- a/grade/import/index.php
+++ b/grade/import/index.php
@@ -37,7 +37,14 @@ require_login($course);
 $context = context_course::instance($courseid);
 require_capability('moodle/grade:import', $context);
 
-$importplugins = core_component::get_plugin_list('gradeimport');
+// Retrieve all grade import plugins the current user can access.
+$importplugins = array_filter(core_component::get_plugin_list('gradeimport'),
+    static function(string $importplugin) use ($context): bool {
+        return has_capability("gradeimport/{$importplugin}:view", $context);
+    },
+    ARRAY_FILTER_USE_KEY
+);
+
 if (!empty($importplugins)) {
     $importplugin = array_key_first($importplugins);
     $url = new moodle_url("/grade/import/{$importplugin}/index.php", ['id' => $courseid]);