diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cb5726be..bf0ce0bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,7 +31,7 @@ jobs:
       matrix:
         include:
           - php: '8.4'
-            moodle-branch: 'main'
+            moodle-branch: 'MOODLE_502_STABLE'
             database: 'mariadb'
           - php: '8.4'
             moodle-branch: 'MOODLE_501_STABLE'
diff --git a/questionnaire.class.php b/questionnaire.class.php
index d9cf9539..f9573074 100644
--- a/questionnaire.class.php
+++ b/questionnaire.class.php
@@ -439,6 +439,10 @@ public function view_response(
         $currentgroupid = 0,
         $outputtarget = 'html'
     ) {
+        if (!$this->can_view_response($rid)) {
+            throw new \moodle_exception('nopermissions', 'mod_questionnaire');
+        }
+
         $this->print_survey_start('', 1, 1, 0, $rid, false, $outputtarget);
 
         $i = 0;
diff --git a/report.php b/report.php
index f1d92d38..71567bca 100755
--- a/report.php
+++ b/report.php
@@ -89,8 +89,10 @@
 
 // If you can't view the questionnaire, or can't view a specified response, error out.
 $context = context_module::instance($cm->id);
-if (!$questionnaire->can_view_all_responses(null, true) && !$individualresponse) {
-    // Should never happen, unless called directly by a snoop...
+if (
+    !$questionnaire->can_view_all_responses(null, true) &&
+    !($individualresponse && $questionnaire->can_view_response($rid))
+) {
     throw new \moodle_exception('nopermissions', 'mod_questionnaire');
 }
 
@@ -903,7 +905,7 @@
             if ($outputtarget == 'html') {
                 $questionnaire->survey_results_navbar_alpha($rid, $currentgroupid, $cm, $byresponse);
             }
-            if (!$byresponse) { // Show respondents individual responses.
+            if (!$byresponse && $questionnaire->can_view_response($rid)) { // Show respondents individual responses.
                 $questionnaire->view_response($rid, '', $resps, true, true, false, $currentgroupid, $outputtarget);
             }
             echo $questionnaire->renderer->header();
diff --git a/tests/custom_completion_test.php b/tests/custom_completion_test.php
index 6d8a5b9f..d27a0ce0 100644
--- a/tests/custom_completion_test.php
+++ b/tests/custom_completion_test.php
@@ -208,13 +208,12 @@ public function test_get_available_custom_rules(int $status, array $expected): v
         // Build a mock cm_info instance.
         $mockcminfo = $this->getMockBuilder(cm_info::class)
             ->disableOriginalConstructor()
-            ->onlyMethods(['__get'])
+            ->onlyMethods(['get_custom_data'])
             ->getMock();
 
         // Mock the return of magic getter for the customdata attribute.
         $mockcminfo->expects($this->any())
-            ->method('__get')
-            ->with('customdata')
+            ->method('get_custom_data')
             ->willReturn($customdataval);
 
         $customcompletion = new custom_completion($mockcminfo, 1);