MDL-27520 core: allow retrieval of files from grade files areas

Also added 'history' filearea for the history report where files
will be copied to if the site has enabled this feature.

We will also be storing files in the module context, not course,
so that check was removed.

lib/filelib.php

@@ -4213,15 +4213,35 @@ function file_pluginfile($relativepath, $forcedownload, $preview = null, $offlin
             \core\session\manager::write_close(); // Unlock session during file serving.
             send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions);
 
-        } else if ($filearea === 'feedback' and $context->contextlevel == CONTEXT_COURSE) {
-            //TODO: nobody implemented this yet in grade edit form!!
-            send_file_not_found();
+        } else if ($filearea === 'feedback' || $filearea == 'history') {
+            if ($context->contextlevel != CONTEXT_MODULE) {
+                send_file_not_found;
+            }
 
-            if ($CFG->forcelogin || $course->id != SITEID) {
-                require_login($course);
+            require_login($course, false);
+
+            $gradeid = (int) array_shift($args);
+            $filename = array_pop($args);
+            if ($filearea == 'historyfeedback') {
+                $grade = $DB->get_record('grade_grades_history', ['id' => $gradeid]);
+            } else {
+                $grade = $DB->get_record('grade_grades', ['id' => $gradeid]);
             }
 
-            $fullpath = "/$context->id/$component/$filearea/".implode('/', $args);
+            if (!$grade) {
+                send_file_not_found();
+            }
+
+            $iscurrentuser = $USER->id == $grade->userid;
+
+            if (!$iscurrentuser) {
+                $coursecontext = context_course::instance($course->id);
+                if (!has_capability('moodle/grade:viewall', $coursecontext)) {
+                    send_file_not_found();
+                }
+            }
+
+            $fullpath = "/$context->id/$component/$filearea/$gradeid/$filename";
 
             if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
                 send_file_not_found();