L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-56310 restore: Confirm user has permission to change capabilities

Browse Source
This commit is contained in:
Peter Dias
2020-10-30 13:57:29 +01:00
committed by Jenkins
parent 8aa5030df3
commit 086d433a2e
1 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backup/moodle2/restore_stepslib.php
+19 -4
View File
@@ -2110,14 +2110,29 @@ class restore_ras_and_caps_structure_step extends restore_structure_step {
$data = (object)$data;
// Check roleid is one of the mapped ones
$newroleid = $this->get_mappingid('role', $data->roleid);
$newrole = $this->get_mapping('role', $data->roleid);
$newroleid = $newrole->newitemid ?? false;
$userid = $this->task->get_userid();
// If newroleid and context are valid assign it via API (it handles dupes and so on)
if ($newroleid && $this->task->get_contextid()) {
if (!get_capability_info($data->capability)) {
if (!$capability = get_capability_info($data->capability)) {
$this->log("Capability '{$data->capability}' was not found!", backup::LOG_WARNING);
} else {
// TODO: assign_capability() needs one userid param to be able to specify our restore userid.
assign_capability($data->capability, $data->permission, $newroleid, $this->task->get_contextid());
$context = context::instance_by_id($this->task->get_contextid());
$overrideableroles = get_overridable_roles($context, ROLENAME_SHORT);
$safecapability = is_safe_capability($capability);
// Check if the new role is an overrideable role AND if the user performing the restore has the
// capability to assign the capability.
if (in_array($newrole->info['shortname'], $overrideableroles) &&
($safecapability && has_capability('moodle/role:safeoverride', $context, $userid) ||
!$safecapability && has_capability('moodle/role:override', $context, $userid))
) {
assign_capability($data->capability, $data->permission, $newroleid, $this->task->get_contextid());
} else {
$this->log("Insufficient capability to assign capability '{$data->capability}' to role!", backup::LOG_WARNING);
}
}
}
}