Security: verify teacher-student relationship before showing tracking

myStudents.php granted access to a student's full tracking profile to any
user holding a tracking-capable role (teacher / course admin) without
checking that the requesting teacher actually teaches the target student,
so a teacher could read the learning records of any student on the
platform by changing the `student` query parameter.

Add a per-student authorization layer after the existing role check:
teachers and course admins must share a course with the target student
(UserManager::isTeacherOfStudent) or be allowed to coach them in a session
(Tracking::is_allowed_to_coach_student). Platform/session admins, HR
managers and student bosses keep their wider tracking scope. This mirrors
the access rule already enforced in lp_tracking.php.

Refs GHSA-rp64-899j-x9f6

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: AngelFQC

public/main/my_space/myStudents.php

@@ -104,6 +104,21 @@
     api_not_allowed(true);
 }
 
+// Beyond holding a tracking-capable role, a teacher / course admin may only
+// view the tracking data of a student they actually teach. Platform and session
+// admins, HR managers (DRH) and student bosses keep their wider tracking scope.
+// Mirrors the per-student access rule already enforced in lp_tracking.php.
+if (
+    !api_is_platform_admin(true, true)
+    && !api_is_session_admin()
+    && !api_is_drh()
+    && !api_is_student_boss()
+    && !UserManager::isTeacherOfStudent(api_get_user_id(), $studentId)
+    && !Tracking::is_allowed_to_coach_student(api_get_user_id(), $studentId)
+) {
+    api_not_allowed(true);
+}
+
 $completeName = UserManager::formatUserFullName($user);
 
 if ($export) {