From 1e886c375c614e746fcbfee7edb68e0c5940db83 Mon Sep 17 00:00:00 2001
From: Jake Dallimore <jake@moodle.com>
Date: Mon, 24 Jul 2023 16:11:49 +0800
Subject: [PATCH] MDL-78753 mod_lti: fix access control for LTI External tools
 page

To view this page, the user must be able to use preconfigred tools in
the course. This is controlled by the 'mod/lti:addpreconfiguredinstance'
capability. The capability 'mod/lti:addcoursetool' isn't required to
view the page but does add extra functionality to the page.
---
 mod/lti/coursetools.php                       |  2 +-
 mod/lti/lib.php                               |  2 +-
 mod/lti/tests/behat/managecoursetools.feature | 12 ++++++++++++
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/mod/lti/coursetools.php b/mod/lti/coursetools.php
index e1192d0b633..dbd3e6a0e6e 100644
--- a/mod/lti/coursetools.php
+++ b/mod/lti/coursetools.php
@@ -35,7 +35,7 @@ $course = get_course($id);
 require_course_login($course, false);
 
 $context = context_course::instance($course->id);
-if (!has_any_capability(['mod/lti:addpreconfiguredinstance', 'mod/lti:addcoursetool'], $context)) {
+if (!has_capability('mod/lti:addpreconfiguredinstance', $context)) {
     throw new \moodle_exception('nopermissions', 'error', '', get_string('courseexternaltoolsnoviewpermissions', 'mod_lti'));
 }
 
diff --git a/mod/lti/lib.php b/mod/lti/lib.php
index 4d6951af5fb..bf7b379eb22 100644
--- a/mod/lti/lib.php
+++ b/mod/lti/lib.php
@@ -775,7 +775,7 @@ function mod_lti_core_calendar_provide_event_action(calendar_event $event,
  * @return void
  */
 function mod_lti_extend_navigation_course($navigation, $course, $context): void {
-    if (has_any_capability(['mod/lti:addpreconfiguredinstance', 'mod/lti:addcoursetool'], $context)) {
+    if (has_capability('mod/lti:addpreconfiguredinstance', $context)) {
         $url = new moodle_url('/mod/lti/coursetools.php', ['id' => $course->id]);
         $settingsnode = navigation_node::create(get_string('courseexternaltools', 'mod_lti'), $url, navigation_node::TYPE_SETTING,
             null, 'coursetools', new pix_icon('i/settings', ''));
diff --git a/mod/lti/tests/behat/managecoursetools.feature b/mod/lti/tests/behat/managecoursetools.feature
index 78492e9eb64..8276b7d9b59 100644
--- a/mod/lti/tests/behat/managecoursetools.feature
+++ b/mod/lti/tests/behat/managecoursetools.feature
@@ -59,6 +59,18 @@ Feature: Manage course tools
     When I navigate to "LTI External tools" in current page administration
     Then "You don't have permission to edit this tool" "icon" should exist in the "Test tool" "table_row"
 
+  Scenario: Viewing course tools with the capability to add/edit and without the capability to use
+    Given the following "role capability" exists:
+      | role                             | editingteacher |
+      | mod/lti:addcoursetool            | allow          |
+      | mod/lti:addmanualinstance        | allow          |
+      | mod/lti:addpreconfiguredinstance | prohibit       |
+    And the following "mod_lti > course tools" exist:
+      | name      | description         | baseurl                  | course |
+      | Test tool | Example description | https://example.com/tool | C1     |
+    When I am on the "Course 1" course page logged in as teacher1
+    Then "LTI External tools" "link" should not exist in current page administration
+
   @javascript
   Scenario: Edit a course tool
     Given the following "mod_lti > course tools" exist: