L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-78753 mod_lti: fix access control for LTI External tools page

Browse Source 
To view this page, the user must be able to use preconfigred tools in
the course. This is controlled by the 'mod/lti:addpreconfiguredinstance'
capability. The capability 'mod/lti:addcoursetool' isn't required to
view the page but does add extra functionality to the page.
This commit is contained in:
Jake Dallimore
2023-08-15 18:03:43 +07:00
committed by Huong Nguyen
parent f645d21da1
commit 1e886c375c
3 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/lti/coursetools.php
+1 -1
View File
@@ -35,7 +35,7 @@ $course = get_course($id);
require_course_login($course, false);
$context = context_course::instance($course->id);
if (!has_any_capability(['mod/lti:addpreconfiguredinstance', 'mod/lti:addcoursetool'], $context)) {
if (!has_capability('mod/lti:addpreconfiguredinstance', $context)) {
throw new \moodle_exception('nopermissions', 'error', '', get_string('courseexternaltoolsnoviewpermissions', 'mod_lti'));
}
mod/lti/lib.php
+1 -1
View File
@@ -775,7 +775,7 @@ function mod_lti_core_calendar_provide_event_action(calendar_event $event,
* @return void
*/
function mod_lti_extend_navigation_course($navigation, $course, $context): void {
if (has_any_capability(['mod/lti:addpreconfiguredinstance', 'mod/lti:addcoursetool'], $context)) {
if (has_capability('mod/lti:addpreconfiguredinstance', $context)) {
$url = new moodle_url('/mod/lti/coursetools.php', ['id' => $course->id]);
$settingsnode = navigation_node::create(get_string('courseexternaltools', 'mod_lti'), $url, navigation_node::TYPE_SETTING,
null, 'coursetools', new pix_icon('i/settings', ''));
mod/lti/tests/behat/managecoursetools.feature
+12
View File
@@ -59,6 +59,18 @@ Feature: Manage course tools
When I navigate to "LTI External tools" in current page administration
Then "You don't have permission to edit this tool" "icon" should exist in the "Test tool" "table_row"
Scenario: Viewing course tools with the capability to add/edit and without the capability to use
Given the following "role capability" exists:
| role | editingteacher |
| mod/lti:addcoursetool | allow |
| mod/lti:addmanualinstance | allow |
| mod/lti:addpreconfiguredinstance | prohibit |
And the following "mod_lti > course tools" exist:
| name | description | baseurl | course |
| Test tool | Example description | https://example.com/tool | C1 |
When I am on the "Course 1" course page logged in as teacher1
Then "LTI External tools" "link" should not exist in current page administration
@javascript
Scenario: Edit a course tool
Given the following "mod_lti > course tools" exist: