diff --git a/contentbank/classes/contenttype.php b/contentbank/classes/contenttype.php index ba9442be89c..6b6a140429e 100644 --- a/contentbank/classes/contenttype.php +++ b/contentbank/classes/contenttype.php @@ -330,10 +330,13 @@ abstract class contenttype { /** * Returns whether or not the user has permission to use the editor. + * This function will be called with the content to be edited as parameter, + * or null when is checking permission to create a new content using the editor. * + * @param content $content The content to be edited or null when creating a new content. * @return bool True if the user can edit content. False otherwise. */ - final public function can_edit(): bool { + final public function can_edit(?content $content = null): bool { if (!$this->is_feature_supported(self::CAN_EDIT)) { return false; } @@ -342,19 +345,24 @@ abstract class contenttype { return false; } + if (!is_null($content) && !$this->can_manage($content)) { + return false; + } + $classname = 'contenttype/'.$this->get_plugin_name(); $editioncap = $classname.':useeditor'; $hascapabilities = has_all_capabilities(['moodle/contentbank:useeditor', $editioncap], $this->context); - return $hascapabilities && $this->is_edit_allowed(); + return $hascapabilities && $this->is_edit_allowed($content); } /** * Returns plugin allows edition. * + * @param content $content The content to be edited. * @return bool True if plugin allows edition. False otherwise. */ - protected function is_edit_allowed(): bool { + protected function is_edit_allowed(?content $content): bool { // Plugins can overwrite this function to add any check they need. return true; } diff --git a/contentbank/classes/output/viewcontent.php b/contentbank/classes/output/viewcontent.php index efb403ed6ad..48871a6fb57 100644 --- a/contentbank/classes/output/viewcontent.php +++ b/contentbank/classes/output/viewcontent.php @@ -75,7 +75,7 @@ class viewcontent implements renderable, templatable { $data->contenthtml = $contenthtml; // Check if the user can edit this content type. - if ($this->contenttype->can_edit()) { + if ($this->contenttype->can_edit($this->content)) { $data->usercanedit = true; $urlparams = [ 'contextid' => $this->content->get_contextid(), diff --git a/contentbank/edit.php b/contentbank/edit.php index 832f1c2148d..cdddcd4fd78 100644 --- a/contentbank/edit.php +++ b/contentbank/edit.php @@ -45,6 +45,7 @@ if (!empty($id)) { } else { $contenttypename = "contenttype_$pluginname"; $heading = get_string('addinganew', 'moodle', get_string('description', $contenttypename)); + $content = null; } // Check plugin is enabled. @@ -61,9 +62,9 @@ if (class_exists($contenttypeclass)) { print_error('unsupported', 'core_contentbank', $returnurl); } -// Checks the user can edit this content type. -if (!$contenttype->can_edit()) { - print_error('contenttypenoedit', 'core_contentbank', $returnurl, $contenttype->get_plugin_name()); +// Checks the user can edit this content and content type. +if (!$contenttype->can_edit($content)) { + print_error('contenttypenoedit', 'core_contentbank', $returnurl); } $values = [ diff --git a/contentbank/tests/behat/edit_content.feature b/contentbank/tests/behat/edit_content.feature index aef6eab5386..29108c7a2eb 100644 --- a/contentbank/tests/behat/edit_content.feature +++ b/contentbank/tests/behat/edit_content.feature @@ -115,3 +115,47 @@ Feature: Content bank use editor feature And I click on "Edit" "link" And I switch to "h5p-editor-iframe" class iframe Then the field "Title" matches value "New title" + + Scenario: Teachers can edit their own content in the content bank + Given the following "users" exist: + | username | firstname | lastname | email | + | teacher1 | Teacher | 1 | teacher1@example.com | + And the following "courses" exist: + | fullname | shortname | category | + | Course 1 | C1 | 0 | + And the following "course enrolments" exist: + | user | course | role | + | teacher1 | C1 | editingteacher | + And the following "contentbank content" exist: + | contextlevel | reference | contenttype | user | contentname | filepath | + | Course | C1 | contenttype_h5p | admin | filltheblanks.h5p | /h5p/tests/fixtures/filltheblanks.h5p | + | Course | C1 | contenttype_h5p | teacher1 | ipsums.h5p | /h5p/tests/fixtures/ipsums.h5p | + When I log out + And I log in as "teacher1" + And I am on "Course 1" course homepage + And I expand "Site pages" node + And I click on "Content bank" "link" + And I follow "ipsums.h5p" + Then "Edit" "link" should exist in the "region-main" "region" + + Scenario: Teachers can't edit content created by other users in the content bank + Given the following "users" exist: + | username | firstname | lastname | email | + | teacher1 | Teacher | 1 | teacher1@example.com | + And the following "courses" exist: + | fullname | shortname | category | + | Course 1 | C1 | 0 | + And the following "course enrolments" exist: + | user | course | role | + | teacher1 | C1 | editingteacher | + And the following "contentbank content" exist: + | contextlevel | reference | contenttype | user | contentname | filepath | + | Course | C1 | contenttype_h5p | admin | filltheblanks.h5p | /h5p/tests/fixtures/filltheblanks.h5p | + | Course | C1 | contenttype_h5p | teacher1 | ipsums.h5p | /h5p/tests/fixtures/ipsums.h5p | + When I log out + And I log in as "teacher1" + And I am on "Course 1" course homepage + And I expand "Site pages" node + And I click on "Content bank" "link" + And I follow "filltheblanks.h5p" + Then "Edit" "link" should not exist in the "region-main" "region" diff --git a/lang/en/contentbank.php b/lang/en/contentbank.php index 6e9176d5805..7c63e1e3b81 100644 --- a/lang/en/contentbank.php +++ b/lang/en/contentbank.php @@ -32,7 +32,7 @@ $string['contentnotrenamed'] = 'An error was encountered while trying to rename $string['contentrenamed'] = 'The content has been renamed.'; $string['contentsmoved'] = 'Content bank contents moved to {$a}.'; $string['contenttypenoaccess'] = 'You cannot view this {$a} instance.'; -$string['contenttypenoedit'] = 'You cannot edit contents of the {$a} content type.'; +$string['contenttypenoedit'] = 'You can not edit this content'; $string['eventcontentcreated'] = 'Content created'; $string['eventcontentdeleted'] = 'Content deleted'; $string['eventcontentupdated'] = 'Content updated';