find only visible courses if not at least admin, fixes #3046

Closes #3046

Merge request studip/studip!2091

lib/models/RangeTreeNode.php

@@ -146,6 +146,10 @@ class RangeTreeNode extends SimpleORMap implements StudipTreeNode
             $parameters = ['ids' => $with_children ? $this->getDescendantIds() : [$this->id]];
         }
 
+        if (!$GLOBALS['perm']->have_perm(Config::get()->SEM_VISIBILITY_PERM)) {
+            $query .= " AND s.`visible` = 1";
+        }
+
         if ($semclass !== 0) {
             $query .= "  AND s.`status` IN (:types)";
             $parameters['types'] = array_map(
@@ -200,6 +204,10 @@ class RangeTreeNode extends SimpleORMap implements StudipTreeNode
             $parameters = ['ids' => $with_children ? $this->getDescendantIds() : [$this->id]];
         }
 
+        if (!$GLOBALS['perm']->have_perm(Config::get()->SEM_VISIBILITY_PERM)) {
+            $query .= " AND s.`visible` = 1";
+        }
+
         if ($searchterm) {
             $query .= " AND s.`Name` LIKE :searchterm";
             $parameters['searchterm'] = '%' . trim($searchterm) . '%';

lib/models/StudipStudyArea.class.php

@@ -498,6 +498,10 @@ class StudipStudyArea extends SimpleORMap implements StudipTreeNode
             $parameters = ['ids' => $with_children ? $this->getDescendantIds() : [$this->id]];
         }
 
+        if (!$GLOBALS['perm']->have_perm(Config::get()->SEM_VISIBILITY_PERM)) {
+            $query .= " AND s.`visible` = 1";
+        }
+
         if ($semclass !== 0) {
             $query .= "  AND s.`status` IN (:types)";
             $parameters['types'] = array_map(
@@ -544,6 +548,10 @@ class StudipStudyArea extends SimpleORMap implements StudipTreeNode
             $parameters = ['ids' => $with_children ? $this->getDescendantIds() : [$this->id]];
         }
 
+        if (!$GLOBALS['perm']->have_perm(Config::get()->SEM_VISIBILITY_PERM)) {
+            $query .= " AND s.`visible` = 1";
+        }
+
         if ($semclass !== 0) {
             $query .= "  AND s.`status` IN (:types)";
             $parameters['types'] = array_map(