From fa9243cd855a3b91e13c35e45362b1bec34d57ce Mon Sep 17 00:00:00 2001 From: Andrew Nicols Date: Tue, 27 Mar 2018 08:17:01 +0800 Subject: [PATCH 1/3] MDL-61743 core_privacy: Reduce context specificty Deletion is called for a context against all components, not just modules. --- privacy/classes/local/request/helper.php | 34 ++++++++++++------------ 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/privacy/classes/local/request/helper.php b/privacy/classes/local/request/helper.php index 2f57d98953d..d265a261b86 100644 --- a/privacy/classes/local/request/helper.php +++ b/privacy/classes/local/request/helper.php @@ -90,10 +90,8 @@ class helper { * @param context $context The specific context to delete data for. */ public static function delete_data_for_all_users_in_context(string $component, \context $context) { - if (strpos($component, 'mod_') === 0) { - // Activity modules support data stored by core about them - for example, activity completion. - static::delete_data_for_all_users_in_context_course_module($component, $context); - } + // Activity modules support data stored by core about them - for example, activity completion. + static::delete_data_for_all_users_in_context_course_module($component, $context); } /** @@ -106,10 +104,8 @@ class helper { public static function delete_data_for_user(approved_contextlist $contextlist) { $component = $contextlist->get_component(); - if (strpos($component, 'mod_') === 0) { - // Activity modules support data stored by core about them - for example, activity completion. - static::delete_data_for_user_in_course_module($contextlist); - } + // Activity modules support data stored by core about them - for example, activity completion. + static::delete_data_for_user_in_course_module($contextlist); } /** @@ -270,13 +266,15 @@ class helper { * This will handle deletion for things such as activity completion. * * @param string $component The component being deleted for. - * @param \context_module $context The context to delete all data for. + * @param \context $context The context to delete all data for. */ - public static function delete_data_for_all_users_in_context_course_module(string $component, \context_module $context) { + public static function delete_data_for_all_users_in_context_course_module(string $component, \context $context) { global $DB; - // Delete course completion data for this context. - $DB->delete_records('course_modules_completion', ['coursemoduleid' => $context->instanceid]); + if ($context instanceof \context_module) { + // Delete course completion data for this context. + $DB->delete_records('course_modules_completion', ['coursemoduleid' => $context->instanceid]); + } } /** @@ -290,11 +288,13 @@ class helper { global $DB; foreach ($contextlist as $context) { - // Delete course completion data for this context. - $DB->delete_records('course_modules_completion', [ - 'coursemoduleid' => $context->instanceid, - 'userid' => $contextlist->get_user()->id, - ]); + if ($context instanceof \context_module) { + // Delete course completion data for this context. + $DB->delete_records('course_modules_completion', [ + 'coursemoduleid' => $context->instanceid, + 'userid' => $contextlist->get_user()->id, + ]); + } } } From 3650af761af05343a3bfb389c8d57aff4f90edbc Mon Sep 17 00:00:00 2001 From: David Monllao Date: Tue, 27 Mar 2018 09:08:50 +0200 Subject: [PATCH 2/3] MDL-61743 core_privacy: Add context level checks for all users deletion --- blocks/html/classes/privacy/provider.php | 9 +++++++++ mod/choice/classes/privacy/provider.php | 9 +++++++++ 2 files changed, 18 insertions(+) diff --git a/blocks/html/classes/privacy/provider.php b/blocks/html/classes/privacy/provider.php index 003562b59d4..f3659f77231 100644 --- a/blocks/html/classes/privacy/provider.php +++ b/blocks/html/classes/privacy/provider.php @@ -153,6 +153,11 @@ class provider implements * @param context $context The specific context to delete data for. */ public static function delete_data_for_all_users_in_context(\context $context) { + + if (!$context instanceof \context_block) { + return; + } + // The only way to delete data for the html block is to delete the block instance itself. blocks_delete_instance(static::get_instance_from_context($context)); } @@ -165,6 +170,10 @@ class provider implements public static function delete_data_for_user(approved_contextlist $contextlist) { // The only way to delete data for the html block is to delete the block instance itself. foreach ($contextlist as $context) { + + if (!$context instanceof \context_block) { + continue; + } blocks_delete_instance(static::get_instance_from_context($context)); } } diff --git a/mod/choice/classes/privacy/provider.php b/mod/choice/classes/privacy/provider.php index 229efc9b102..a640bd7480a 100644 --- a/mod/choice/classes/privacy/provider.php +++ b/mod/choice/classes/privacy/provider.php @@ -184,6 +184,11 @@ class provider implements if (empty($context)) { return; } + + if (!$context instanceof \context_module) { + return; + } + $instanceid = $DB->get_field('course_modules', 'instance', ['id' => $context->instanceid], MUST_EXIST); $DB->delete_records('choice_answers', ['choiceid' => $instanceid]); } @@ -202,6 +207,10 @@ class provider implements $userid = $contextlist->get_user()->id; foreach ($contextlist->get_contexts() as $context) { + + if (!$context instanceof \context_module) { + return; + } $instanceid = $DB->get_field('course_modules', 'instance', ['id' => $context->instanceid], MUST_EXIST); $DB->delete_records('choice_answers', ['choiceid' => $instanceid, 'userid' => $userid]); } From 45ade52173cbd5ee631946f2f5b948439c03ef16 Mon Sep 17 00:00:00 2001 From: David Monllao Date: Fri, 6 Apr 2018 09:09:15 +0200 Subject: [PATCH 3/3] MDL-61743 message: Add context level checking --- message/output/airnotifier/classes/privacy/provider.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/message/output/airnotifier/classes/privacy/provider.php b/message/output/airnotifier/classes/privacy/provider.php index 1c0201684ab..9e37c1ef72e 100644 --- a/message/output/airnotifier/classes/privacy/provider.php +++ b/message/output/airnotifier/classes/privacy/provider.php @@ -118,9 +118,14 @@ class provider implements \core_privacy\local\metadata\provider, \core_privacy\l /** * Delete all use data which matches the specified deletion_criteria. * - * @param context $context A user context. + * @param context $context A context. */ public static function delete_data_for_all_users_in_context(\context $context) { + + if (!$context instanceof \context_user) { + return; + } + static::delete_data($context->instanceid); }