From c87f15a1bbb80670a6d7c16705f7d8f0bde3109a Mon Sep 17 00:00:00 2001
From: Mike Churchward <mike.churchward@poetopensource.org>
Date: Tue, 4 Aug 2026 12:03:38 -0400
Subject: [PATCH 1/4] ISS772 - Ensure responses cannot be viewed by ineligible
 users.

---
 questionnaire.class.php | 4 ++++
 report.php              | 6 +++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/questionnaire.class.php b/questionnaire.class.php
index d9cf9539..f9573074 100644
--- a/questionnaire.class.php
+++ b/questionnaire.class.php
@@ -439,6 +439,10 @@ public function view_response(
         $currentgroupid = 0,
         $outputtarget = 'html'
     ) {
+        if (!$this->can_view_response($rid)) {
+            throw new \moodle_exception('nopermissions', 'mod_questionnaire');
+        }
+
         $this->print_survey_start('', 1, 1, 0, $rid, false, $outputtarget);
 
         $i = 0;
diff --git a/report.php b/report.php
index f1d92d38..eb13adba 100755
--- a/report.php
+++ b/report.php
@@ -89,8 +89,8 @@
 
 // If you can't view the questionnaire, or can't view a specified response, error out.
 $context = context_module::instance($cm->id);
-if (!$questionnaire->can_view_all_responses(null, true) && !$individualresponse) {
-    // Should never happen, unless called directly by a snoop...
+if (!$questionnaire->can_view_all_responses(null, true) &&
+        !($individualresponse && $questionnaire->can_view_response($rid))) {
     throw new \moodle_exception('nopermissions', 'mod_questionnaire');
 }
 
@@ -903,7 +903,7 @@
             if ($outputtarget == 'html') {
                 $questionnaire->survey_results_navbar_alpha($rid, $currentgroupid, $cm, $byresponse);
             }
-            if (!$byresponse) { // Show respondents individual responses.
+            if (!$byresponse && $questionnaire->can_view_response($rid)) { // Show respondents individual responses.
                 $questionnaire->view_response($rid, '', $resps, true, true, false, $currentgroupid, $outputtarget);
             }
             echo $questionnaire->renderer->header();

From e92206e7ed8622585bc5bf027557b1cf2305642a Mon Sep 17 00:00:00 2001
From: Mike Churchward <mike.churchward@poetopensource.org>
Date: Tue, 4 Aug 2026 12:52:05 -0400
Subject: [PATCH 2/4] CI fixes.

---
 .github/workflows/ci.yml | 2 +-
 report.php               | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cb5726be..bf0ce0bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,7 +31,7 @@ jobs:
       matrix:
         include:
           - php: '8.4'
-            moodle-branch: 'main'
+            moodle-branch: 'MOODLE_502_STABLE'
             database: 'mariadb'
           - php: '8.4'
             moodle-branch: 'MOODLE_501_STABLE'
diff --git a/report.php b/report.php
index eb13adba..71567bca 100755
--- a/report.php
+++ b/report.php
@@ -89,8 +89,10 @@
 
 // If you can't view the questionnaire, or can't view a specified response, error out.
 $context = context_module::instance($cm->id);
-if (!$questionnaire->can_view_all_responses(null, true) &&
-        !($individualresponse && $questionnaire->can_view_response($rid))) {
+if (
+    !$questionnaire->can_view_all_responses(null, true) &&
+    !($individualresponse && $questionnaire->can_view_response($rid))
+) {
     throw new \moodle_exception('nopermissions', 'mod_questionnaire');
 }
 

From 1a2f8c1462fbd51fd2580ebaf59725cf17a3ead6 Mon Sep 17 00:00:00 2001
From: Mike Churchward <mike.churchward@poetopensource.org>
Date: Tue, 4 Aug 2026 13:32:03 -0400
Subject: [PATCH 3/4] Core changed a function.

---
 tests/custom_completion_test.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/custom_completion_test.php b/tests/custom_completion_test.php
index 6d8a5b9f..f20e6497 100644
--- a/tests/custom_completion_test.php
+++ b/tests/custom_completion_test.php
@@ -208,12 +208,12 @@ public function test_get_available_custom_rules(int $status, array $expected): v
         // Build a mock cm_info instance.
         $mockcminfo = $this->getMockBuilder(cm_info::class)
             ->disableOriginalConstructor()
-            ->onlyMethods(['__get'])
+            ->onlyMethods(['get_custom_data'])
             ->getMock();
 
         // Mock the return of magic getter for the customdata attribute.
         $mockcminfo->expects($this->any())
-            ->method('__get')
+            ->method('get_custom_data')
             ->with('customdata')
             ->willReturn($customdataval);
 

From e433ab2c2c84efd04dda040c2cd8a9ca0b5fbee0 Mon Sep 17 00:00:00 2001
From: Mike Churchward <mike.churchward@poetopensource.org>
Date: Tue, 4 Aug 2026 14:07:12 -0400
Subject: [PATCH 4/4] Core changed a function.

---
 tests/custom_completion_test.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/custom_completion_test.php b/tests/custom_completion_test.php
index f20e6497..d27a0ce0 100644
--- a/tests/custom_completion_test.php
+++ b/tests/custom_completion_test.php
@@ -214,7 +214,6 @@ public function test_get_available_custom_rules(int $status, array $expected): v
         // Mock the return of magic getter for the customdata attribute.
         $mockcminfo->expects($this->any())
             ->method('get_custom_data')
-            ->with('customdata')
             ->willReturn($customdataval);
 
         $customcompletion = new custom_completion($mockcminfo, 1);