MDL-68900 mod_forum: permission check for user who is viewing timed post
Pass current user object to post builder as argument, so that the permission to view timed post will check with current user, who is viewing the posts instead of user who made that post.
This commit is contained in:
Sumit Negi
@@ -110,7 +110,7 @@ class exported_posts {
|
||||
* Note: Some posts will be removed as part of the build process according to capabilities.
|
||||
* A one-to-one mapping should not be expected.
|
||||
*
|
||||
* @param stdClass $user The user to export the posts for.
|
||||
* @param stdClass $user The user who is viewing the posts.
|
||||
* @param forum_entity[] $forums A list of all forums that each of the $discussions belong to
|
||||
* @param discussion_entity[] $discussions A list of all discussions that each of the $posts belong to
|
||||
* @param post_entity[] $posts The list of posts to export.
|
||||
|
||||
@@ -2245,7 +2245,7 @@ class mod_forum_external extends external_api {
|
||||
$parentposts = [];
|
||||
if ($parentids) {
|
||||
$parentposts = $postbuilder->build(
|
||||
$user,
|
||||
$USER,
|
||||
[$forum],
|
||||
[$discussion],
|
||||
$postvault->get_from_ids(array_values($parentids))
|
||||
@@ -2261,7 +2261,7 @@ class mod_forum_external extends external_api {
|
||||
'timecreated' => $firstpost->get_time_created(),
|
||||
'authorfullname' => $discussionauthor->get_full_name(),
|
||||
'posts' => [
|
||||
'userposts' => $postbuilder->build($user, [$forum], [$discussion], $posts),
|
||||
'userposts' => $postbuilder->build($USER, [$forum], [$discussion], $posts),
|
||||
'parentposts' => $parentposts,
|
||||
],
|
||||
];
|
||||
|
||||
@@ -2611,6 +2611,7 @@ class mod_forum_external_testcase extends externallib_advanced_testcase {
|
||||
* Test get forum posts by user id.
|
||||
*/
|
||||
public function test_mod_forum_get_discussion_posts_by_userid() {
|
||||
global $DB;
|
||||
$this->resetAfterTest(true);
|
||||
|
||||
$urlfactory = mod_forum\local\container::get_url_factory();
|
||||
@@ -2722,9 +2723,20 @@ class mod_forum_external_testcase extends externallib_advanced_testcase {
|
||||
|
||||
// Following line enrol and assign default role id to the user.
|
||||
// So the user automatically gets mod/forum:viewdiscussion on all forums of the course.
|
||||
$this->getDataGenerator()->enrol_user($user1->id, $course1->id);
|
||||
$this->getDataGenerator()->enrol_user($user1->id, $course1->id, 'teacher');
|
||||
$this->getDataGenerator()->enrol_user($user2->id, $course1->id);
|
||||
|
||||
// Changed display period for the discussions in past.
|
||||
$time = time();
|
||||
$discussion = new \stdClass();
|
||||
$discussion->id = $discussion1->id;
|
||||
$discussion->timestart = $time - 200;
|
||||
$discussion->timeend = $time - 100;
|
||||
$DB->update_record('forum_discussions', $discussion);
|
||||
$discussion = new \stdClass();
|
||||
$discussion->id = $discussion2->id;
|
||||
$discussion->timestart = $time - 200;
|
||||
$discussion->timeend = $time - 100;
|
||||
$DB->update_record('forum_discussions', $discussion);
|
||||
// Create what we expect to be returned when querying the discussion.
|
||||
$expectedposts = array(
|
||||
'discussions' => array(),
|
||||
@@ -2773,34 +2785,36 @@ class mod_forum_external_testcase extends externallib_advanced_testcase {
|
||||
'view' => true,
|
||||
'edit' => true,
|
||||
'delete' => true,
|
||||
'split' => false,
|
||||
'split' => true,
|
||||
'reply' => true,
|
||||
'export' => false,
|
||||
'controlreadstatus' => false,
|
||||
'canreplyprivately' => false,
|
||||
'canreplyprivately' => true,
|
||||
'selfenrol' => false
|
||||
],
|
||||
'urls' => [
|
||||
'view' => $urlfactory->get_view_post_url_from_post_id(
|
||||
$discussion1reply1->discussion, $discussion1reply1->id)->out(false),
|
||||
$discussion1reply1->discussion, $discussion1reply1->id)->out(false),
|
||||
'viewisolated' => $isolatedurluser->out(false),
|
||||
'viewparent' => $urlfactory->get_view_post_url_from_post_id(
|
||||
$discussion1reply1->discussion, $discussion1reply1->parent)->out(false),
|
||||
$discussion1reply1->discussion, $discussion1reply1->parent)->out(false),
|
||||
'edit' => (new moodle_url('/mod/forum/post.php', [
|
||||
'edit' => $discussion1reply1->id
|
||||
'edit' => $discussion1reply1->id
|
||||
]))->out(false),
|
||||
'delete' => (new moodle_url('/mod/forum/post.php', [
|
||||
'delete' => $discussion1reply1->id
|
||||
'delete' => $discussion1reply1->id
|
||||
]))->out(false),
|
||||
'split' => (new moodle_url('/mod/forum/post.php', [
|
||||
'prune' => $discussion1reply1->id
|
||||
]))->out(false),
|
||||
'split' => null,
|
||||
'reply' => (new moodle_url('/mod/forum/post.php#mformforum', [
|
||||
'reply' => $discussion1reply1->id
|
||||
'reply' => $discussion1reply1->id
|
||||
]))->out(false),
|
||||
'export' => null,
|
||||
'markasread' => null,
|
||||
'markasunread' => null,
|
||||
'discuss' => $urlfactory->get_discussion_view_url_from_discussion_id(
|
||||
$discussion1reply1->discussion)->out(false),
|
||||
$discussion1reply1->discussion)->out(false),
|
||||
],
|
||||
]
|
||||
],
|
||||
@@ -2833,13 +2847,13 @@ class mod_forum_external_testcase extends externallib_advanced_testcase {
|
||||
'charcount' => null,
|
||||
'capabilities' => [
|
||||
'view' => true,
|
||||
'edit' => false,
|
||||
'delete' => false,
|
||||
'edit' => true,
|
||||
'delete' => true,
|
||||
'split' => false,
|
||||
'reply' => true,
|
||||
'export' => false,
|
||||
'controlreadstatus' => false,
|
||||
'canreplyprivately' => false,
|
||||
'canreplyprivately' => true,
|
||||
'selfenrol' => false
|
||||
],
|
||||
'urls' => [
|
||||
@@ -2847,8 +2861,12 @@ class mod_forum_external_testcase extends externallib_advanced_testcase {
|
||||
$discussion1firstpostobject->discussion, $discussion1firstpostobject->id)->out(false),
|
||||
'viewisolated' => $isolatedurlparent->out(false),
|
||||
'viewparent' => null,
|
||||
'edit' => null,
|
||||
'delete' => null,
|
||||
'edit' => (new moodle_url('/mod/forum/post.php', [
|
||||
'edit' => $discussion1firstpostobject->id
|
||||
]))->out(false),
|
||||
'delete' => (new moodle_url('/mod/forum/post.php', [
|
||||
'delete' => $discussion1firstpostobject->id
|
||||
]))->out(false),
|
||||
'split' => null,
|
||||
'reply' => (new moodle_url('/mod/forum/post.php#mformforum', [
|
||||
'reply' => $discussion1firstpostobject->id
|
||||
@@ -2906,11 +2924,11 @@ class mod_forum_external_testcase extends externallib_advanced_testcase {
|
||||
'view' => true,
|
||||
'edit' => true,
|
||||
'delete' => true,
|
||||
'split' => false,
|
||||
'split' => true,
|
||||
'reply' => true,
|
||||
'export' => false,
|
||||
'controlreadstatus' => false,
|
||||
'canreplyprivately' => false,
|
||||
'canreplyprivately' => true,
|
||||
'selfenrol' => false
|
||||
],
|
||||
'urls' => [
|
||||
@@ -2925,7 +2943,9 @@ class mod_forum_external_testcase extends externallib_advanced_testcase {
|
||||
'delete' => (new moodle_url('/mod/forum/post.php', [
|
||||
'delete' => $discussion2reply1->id
|
||||
]))->out(false),
|
||||
'split' => null,
|
||||
'split' => (new moodle_url('/mod/forum/post.php', [
|
||||
'prune' => $discussion2reply1->id
|
||||
]))->out(false),
|
||||
'reply' => (new moodle_url('/mod/forum/post.php#mformforum', [
|
||||
'reply' => $discussion2reply1->id
|
||||
]))->out(false),
|
||||
@@ -2966,13 +2986,13 @@ class mod_forum_external_testcase extends externallib_advanced_testcase {
|
||||
'charcount' => null,
|
||||
'capabilities' => [
|
||||
'view' => true,
|
||||
'edit' => false,
|
||||
'delete' => false,
|
||||
'edit' => true,
|
||||
'delete' => true,
|
||||
'split' => false,
|
||||
'reply' => true,
|
||||
'export' => false,
|
||||
'controlreadstatus' => false,
|
||||
'canreplyprivately' => false,
|
||||
'canreplyprivately' => true,
|
||||
'selfenrol' => false
|
||||
],
|
||||
'urls' => [
|
||||
@@ -2980,8 +3000,12 @@ class mod_forum_external_testcase extends externallib_advanced_testcase {
|
||||
$discussion2firstpostobject->discussion, $discussion2firstpostobject->id)->out(false),
|
||||
'viewisolated' => $isolatedurlparent->out(false),
|
||||
'viewparent' => null,
|
||||
'edit' => null,
|
||||
'delete' => null,
|
||||
'edit' => (new moodle_url('/mod/forum/post.php', [
|
||||
'edit' => $discussion2firstpostobject->id
|
||||
]))->out(false),
|
||||
'delete' => (new moodle_url('/mod/forum/post.php', [
|
||||
'delete' => $discussion2firstpostobject->id
|
||||
]))->out(false),
|
||||
'split' => null,
|
||||
'reply' => (new moodle_url('/mod/forum/post.php#mformforum', [
|
||||
'reply' => $discussion2firstpostobject->id
|
||||
|
||||
@@ -9,6 +9,9 @@ information provided here is intended especially for developers.
|
||||
for each post in the database when posts are created or updated. For posts that existed prior to a Moodle 3.8 upgrade, these
|
||||
are calculated by the refresh_forum_post_counts ad-hoc task in chunks of 5000 posts by default. Site admins are able to modify this
|
||||
default, by setting $CFG->forumpostcountchunksize to the required integer value.
|
||||
* Changes in external function mod_forum_external::get_discussion_posts_by_userid
|
||||
$postbuilder build the posts of given user in respect of the permission check of current user $USER who is viewing the user posts,
|
||||
it could be teacher or privileged user who can view student post or it can be the user himself.
|
||||
|
||||
=== 3.7 ===
|
||||
* Changed the forum discussion rendering to use templates rather than print functions.
|
||||
|
||||
Reference in New Issue
Block a user