find only visible courses if not at least admin, fixes #3046

Closes #3046

Merge request studip/studip!2091

1 files changed, 8 insertions, 0 deletions

diff --git a/lib/models/RangeTreeNode.php b/lib/models/RangeTreeNode.php
index d1c1823..4d52fed 100644
--- a/lib/models/RangeTreeNode.php
+++ b/lib/models/RangeTreeNode.php
@@ -146,6 +146,10 @@ class RangeTreeNode extends SimpleORMap implements StudipTreeNode
             $parameters = ['ids' => $with_children ? $this->getDescendantIds() : [$this->id]];
         }
 
+        if (!$GLOBALS['perm']->have_perm(Config::get()->SEM_VISIBILITY_PERM)) {
+            $query .= " AND s.`visible` = 1";
+        }
+
         if ($semclass !== 0) {
             $query .= "  AND s.`status` IN (:types)";
             $parameters['types'] = array_map(
@@ -200,6 +204,10 @@ class RangeTreeNode extends SimpleORMap implements StudipTreeNode
             $parameters = ['ids' => $with_children ? $this->getDescendantIds() : [$this->id]];
         }
 
+        if (!$GLOBALS['perm']->have_perm(Config::get()->SEM_VISIBILITY_PERM)) {
+            $query .= " AND s.`visible` = 1";
+        }
+
         if ($searchterm) {
             $query .= " AND s.`Name` LIKE :searchterm";
             $parameters['searchterm'] = '%' . trim($searchterm) . '%';