From 1c6f0e8a196b5620bc768b2d52d14568e06a559c Mon Sep 17 00:00:00 2001 From: Paul Holden Date: Wed, 11 Jan 2023 23:50:02 +0000 Subject: [PATCH] MDL-76878 user: amend permission callbacks for preference definitions. Ensure those preferences that are used for storing state can always be updated via web service requests for the current user. --- blocks/accessreview/lib.php | 5 ++++- blocks/myoverview/lib.php | 23 ++++++++++++++++------- blocks/timeline/lib.php | 15 ++++++++++----- contentbank/lib.php | 9 ++++++--- lib/classes/user.php | 25 ++++++++++++++++++------- user/upgrade.txt | 4 ++++ 6 files changed, 58 insertions(+), 23 deletions(-) diff --git a/blocks/accessreview/lib.php b/blocks/accessreview/lib.php index 81942fe3687..72e22e854ca 100644 --- a/blocks/accessreview/lib.php +++ b/blocks/accessreview/lib.php @@ -51,7 +51,9 @@ function block_accessreview_get_fontawesome_icon_map() { /** * Define preferences which may be set via the core_user_set_user_preferences external function. * - * @return array + * @uses core_user::is_current_user + * + * @return array[] */ function block_accessreview_user_preferences(): array { return [ @@ -60,6 +62,7 @@ function block_accessreview_user_preferences(): array { 'null' => NULL_NOT_ALLOWED, 'default' => 0, 'choices' => [0, 1], + 'permissioncallback' => [core_user::class, 'is_current_user'], ], ]; } diff --git a/blocks/myoverview/lib.php b/blocks/myoverview/lib.php index 8352f63ab05..4dd7a1aa446 100644 --- a/blocks/myoverview/lib.php +++ b/blocks/myoverview/lib.php @@ -74,9 +74,11 @@ define('BLOCK_MYOVERVIEW_DISPLAY_CATEGORIES_OFF', 'off'); /** * Get the current user preferences that are available * - * @return mixed Array representing current options along with defaults + * @uses core_user::is_current_user + * + * @return array[] Array representing current options along with defaults */ -function block_myoverview_user_preferences() { +function block_myoverview_user_preferences(): array { $preferences['block_myoverview_user_grouping_preference'] = array( 'null' => NULL_NOT_ALLOWED, 'default' => BLOCK_MYOVERVIEW_GROUPING_ALL, @@ -90,13 +92,15 @@ function block_myoverview_user_preferences() { BLOCK_MYOVERVIEW_GROUPING_FAVOURITES, BLOCK_MYOVERVIEW_GROUPING_HIDDEN, BLOCK_MYOVERVIEW_GROUPING_CUSTOMFIELD, - ) + ), + 'permissioncallback' => [core_user::class, 'is_current_user'], ); $preferences['block_myoverview_user_grouping_customfieldvalue_preference'] = [ 'null' => NULL_ALLOWED, 'default' => null, 'type' => PARAM_RAW, + 'permissioncallback' => [core_user::class, 'is_current_user'], ]; $preferences['block_myoverview_user_sort_preference'] = array( @@ -107,8 +111,10 @@ function block_myoverview_user_preferences() { BLOCK_MYOVERVIEW_SORTING_TITLE, BLOCK_MYOVERVIEW_SORTING_LASTACCESSED, BLOCK_MYOVERVIEW_SORTING_SHORTNAME - ) + ), + 'permissioncallback' => [core_user::class, 'is_current_user'], ); + $preferences['block_myoverview_user_view_preference'] = array( 'null' => NULL_NOT_ALLOWED, 'default' => BLOCK_MYOVERVIEW_VIEW_CARD, @@ -117,7 +123,8 @@ function block_myoverview_user_preferences() { BLOCK_MYOVERVIEW_VIEW_CARD, BLOCK_MYOVERVIEW_VIEW_LIST, BLOCK_MYOVERVIEW_VIEW_SUMMARY - ) + ), + 'permissioncallback' => [core_user::class, 'is_current_user'], ); $preferences['/^block_myoverview_hidden_course_(\d)+$/'] = array( @@ -125,7 +132,8 @@ function block_myoverview_user_preferences() { 'choices' => array(0, 1), 'type' => PARAM_INT, 'null' => NULL_NOT_ALLOWED, - 'default' => 'none' + 'default' => 0, + 'permissioncallback' => [core_user::class, 'is_current_user'], ); $preferences['block_myoverview_user_paging_preference'] = array( @@ -138,7 +146,8 @@ function block_myoverview_user_preferences() { BLOCK_MYOVERVIEW_PAGING_48, BLOCK_MYOVERVIEW_PAGING_96, BLOCK_MYOVERVIEW_PAGING_ALL - ) + ), + 'permissioncallback' => [core_user::class, 'is_current_user'], ); return $preferences; diff --git a/blocks/timeline/lib.php b/blocks/timeline/lib.php index 712684e055a..6602707dc9e 100644 --- a/blocks/timeline/lib.php +++ b/blocks/timeline/lib.php @@ -43,14 +43,17 @@ define('BLOCK_TIMELINE_ACTIVITIES_LIMIT_DEFAULT', 5); /** * Returns the name of the user preferences as well as the details this plugin uses. * - * @return array + * @uses core_user::is_current_user + * + * @return array[] */ -function block_timeline_user_preferences() { +function block_timeline_user_preferences(): array { $preferences['block_timeline_user_sort_preference'] = array( 'null' => NULL_NOT_ALLOWED, 'default' => BLOCK_TIMELINE_SORT_BY_DATES, 'type' => PARAM_ALPHA, - 'choices' => array(BLOCK_TIMELINE_SORT_BY_DATES, BLOCK_TIMELINE_SORT_BY_COURSES) + 'choices' => array(BLOCK_TIMELINE_SORT_BY_DATES, BLOCK_TIMELINE_SORT_BY_COURSES), + 'permissioncallback' => [core_user::class, 'is_current_user'], ); $preferences['block_timeline_user_filter_preference'] = array( @@ -64,13 +67,15 @@ function block_timeline_user_preferences() { BLOCK_TIMELINE_FILTER_BY_30_DAYS, BLOCK_TIMELINE_FILTER_BY_3_MONTHS, BLOCK_TIMELINE_FILTER_BY_6_MONTHS - ) + ), + 'permissioncallback' => [core_user::class, 'is_current_user'], ); $preferences['block_timeline_user_limit_preference'] = array( 'null' => NULL_NOT_ALLOWED, 'default' => BLOCK_TIMELINE_ACTIVITIES_LIMIT_DEFAULT, - 'type' => PARAM_INT + 'type' => PARAM_INT, + 'permissioncallback' => [core_user::class, 'is_current_user'], ); return $preferences; diff --git a/contentbank/lib.php b/contentbank/lib.php index f2ec543afa6..f4f13e3c366 100644 --- a/contentbank/lib.php +++ b/contentbank/lib.php @@ -27,15 +27,18 @@ use \core_contentbank\content; /** * Get the current user preferences that are available * - * @return Array preferences configuration + * @uses core_user::is_current_user + * + * @return array[] preferences configuration */ -function core_contentbank_user_preferences() { +function core_contentbank_user_preferences(): array { return [ 'core_contentbank_view_list' => [ 'choices' => array(0, 1), 'type' => PARAM_INT, 'null' => NULL_NOT_ALLOWED, - 'default' => 'none' + 'default' => 0, + 'permissioncallback' => [core_user::class, 'is_current_user'], ], 'core_contentbank_visibility' => [ 'choices' => [content::VISIBILITY_UNLISTED, content::VISIBILITY_PUBLIC], diff --git a/lib/classes/user.php b/lib/classes/user.php index 245a2722ee9..0593334241d 100644 --- a/lib/classes/user.php +++ b/lib/classes/user.php @@ -529,6 +529,18 @@ class core_user { } } + /** + * Determine whether the given user ID is that of the current user. Useful for components implementing permission callbacks + * for preferences consumed by {@see fill_preferences_cache} + * + * @param stdClass $user + * @return bool + */ + public static function is_current_user(stdClass $user): bool { + global $USER; + return $user->id == $USER->id; + } + /** * Check if the given user is an active user in the site. * @@ -960,13 +972,12 @@ class core_user { }); $preferences['badgeprivacysetting'] = array('type' => PARAM_INT, 'null' => NULL_NOT_ALLOWED, 'default' => 1, 'choices' => array(0, 1), 'permissioncallback' => function($user, $preferencename) { - global $CFG, $USER; - return !empty($CFG->enablebadges) && $user->id == $USER->id; + global $CFG; + return !empty($CFG->enablebadges) && self::is_current_user($user); }); $preferences['blogpagesize'] = array('type' => PARAM_INT, 'null' => NULL_NOT_ALLOWED, 'default' => 10, 'permissioncallback' => function($user, $preferencename) { - global $USER; - return $USER->id == $user->id && has_capability('moodle/blog:view', context_system::instance()); + return self::is_current_user($user) && has_capability('moodle/blog:view', context_system::instance()); }); $choices = [HOMEPAGE_SITE]; @@ -980,8 +991,8 @@ class core_user { 'default' => get_default_home_page(), 'choices' => $choices, 'permissioncallback' => function ($user, $preferencename) { - global $CFG, $USER; - return $user->id == $USER->id && + global $CFG; + return self::is_current_user($user) && (!empty($CFG->defaulthomepage) && ($CFG->defaulthomepage == HOMEPAGE_USER)); } ]; @@ -1048,7 +1059,7 @@ class core_user { return false; } - if ($user->id == $USER->id) { + if (self::is_current_user($user)) { // Editing own profile. $systemcontext = context_system::instance(); return has_capability('moodle/user:editownprofile', $systemcontext); diff --git a/user/upgrade.txt b/user/upgrade.txt index 8ee39d48394..6041942b042 100644 --- a/user/upgrade.txt +++ b/user/upgrade.txt @@ -1,5 +1,9 @@ This files describes API changes for code that uses the user API. +=== 4.1.2 === + +* New method `core_user::is_current_user`, useful for components implementing permission callbacks for their preferences + === 4.1 === * Added a new method is_transform_supported() in the profile_field_base class.