From 1f47c7fc7b29b672cb1bd5e4b6619225dc613b83 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Mudr=C3=A1k?= Date: Thu, 31 Jan 2019 11:31:57 +0100 Subject: [PATCH 1/2] MDL-64737 privacy: Fix privacy provider testsuite file names Only files ending with "_test.php" suffix are implicit part of a testsuite. So these two were not actually executed. --- .../tests/{privacy_provider.php => privacy_provider_test.php} | 0 .../tests/{privacy_provider.php => privacy_provider_test.php} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename lib/editor/atto/tests/{privacy_provider.php => privacy_provider_test.php} (100%) rename lib/userkey/tests/{privacy_provider.php => privacy_provider_test.php} (100%) diff --git a/lib/editor/atto/tests/privacy_provider.php b/lib/editor/atto/tests/privacy_provider_test.php similarity index 100% rename from lib/editor/atto/tests/privacy_provider.php rename to lib/editor/atto/tests/privacy_provider_test.php diff --git a/lib/userkey/tests/privacy_provider.php b/lib/userkey/tests/privacy_provider_test.php similarity index 100% rename from lib/userkey/tests/privacy_provider.php rename to lib/userkey/tests/privacy_provider_test.php From c2b73b54eb6cbaa2513fbb769a6744615a2b725e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Mudr=C3=A1k?= Date: Thu, 31 Jan 2019 12:28:52 +0100 Subject: [PATCH 2/2] MDL-64737 editor_atto: Fix the privacy export_user_data() implementation Multiple issues fixed: * Fixed order of the statements to avoid access to undefined variables. * Fixed population of the SQL query parameter to make sure they match the placeholder in the query. * Fixed missing table aliases in the second query to make sure the query actually works as expected. --- lib/editor/atto/classes/privacy/provider.php | 21 +++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/lib/editor/atto/classes/privacy/provider.php b/lib/editor/atto/classes/privacy/provider.php index 50e42be178b..cb664bc56a2 100644 --- a/lib/editor/atto/classes/privacy/provider.php +++ b/lib/editor/atto/classes/privacy/provider.php @@ -96,23 +96,30 @@ class provider implements $user = $contextlist->get_user(); + // Firstly export all autosave records from all contexts in the list owned by the given user. + + list($contextsql, $contextparams) = $DB->get_in_or_equal($contextlist->get_contextids(), SQL_PARAMS_NAMED); + $contextparams['userid'] = $user->id; + $sql = "SELECT * FROM {editor_atto_autosave} WHERE userid = :userid AND contextid {$contextsql}"; - list($contextsql, $contextparams) = $DB->get_in_or_equal($contextlist->get_contextids(), SQL_PARAMS_NAMED); - $contextparams['userid'] = $contextlist->get_user()->id; $autosaves = $DB->get_recordset_sql($sql, $contextparams); self::export_autosaves($user, $autosaves); - $sql = "SELECT * - FROM {editor_atto_autosave} - JOIN {context} c ON c.id = eas.contextid - WHERE c.id {$contextsql} AND contextlevel = :contextuser AND c.instanceid = :userid"; + // Additionally export all eventual records in the given user's context regardless the actual owner. + // We still consider them to be the user's personal data even when edited by someone else. list($contextsql, $contextparams) = $DB->get_in_or_equal($contextlist->get_contextids(), SQL_PARAMS_NAMED); - $contextparams['userid'] = $contextlist->get_user()->id; + $contextparams['userid'] = $user->id; $contextparams['contextuser'] = CONTEXT_USER; + + $sql = "SELECT eas.* + FROM {editor_atto_autosave} eas + JOIN {context} c ON c.id = eas.contextid + WHERE c.id {$contextsql} AND c.contextlevel = :contextuser AND c.instanceid = :userid"; + $autosaves = $DB->get_recordset_sql($sql, $contextparams); self::export_autosaves($user, $autosaves); }