SAK-31393 Students are allow to see members of other sections in rost…

…er (sakaiproject#2887)
cwarden · Jun 22, 2016 · 2cc3776 · 2cc3776
1 parent de8ac20
commit 2cc3776
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/roster2/src/java/org/sakaiproject/roster/impl/SakaiProxyImpl.java b/roster2/src/java/org/sakaiproject/roster/impl/SakaiProxyImpl.java
@@ -532,13 +532,13 @@ private List<RosterMember> filterHiddenMembers(List<RosterMember> members,
 		for (RosterMember member : members) {
 			String userId = member.getUserId();
 
-			// skip if privacy restricted and not the current user
-			if (!userId.equals(currentUserId) && (viewHidden || hiddenUserIds.contains(userId)) && authzGroup.getMember(userId) == null) {
+			// skip if not the current user and privacy restricted or user not in group
+			if (!userId.equals(currentUserId) && ((!viewHidden && hiddenUserIds.contains(userId)) || authzGroup.getMember(userId) == null)) {
 				continue;
 			}
 
 			// now filter out users based on their role
-			if (filterRoles && !viewHidden) {
+			if (filterRoles) {
 				String memberRoleId = member.getRole();
 				if (ArrayUtils.contains(visibleRoles, memberRoleId)){
 					filtered.add(member);