From 3a93df8b9a673d1f6eac0730874f6dafeccc15e7 Mon Sep 17 00:00:00 2001
From: Marina Glancy <marina@moodle.com>
Date: Mon, 8 Jan 2018 13:29:42 +0800
Subject: [PATCH] MDL-61163 mod_wiki: correct capability check in modinfo

Wiki defines capability mod/wiki:viewpage instead of standard mod/wiki:view . This means that people
who do not have capability to view wiki still see it in the modules list.

Also corrected unittest that was testing situation when student has capability to create pages
but does not have capability to view pages. Such student should not see wiki module at all.
---
 mod/wiki/lib.php                    | 19 ++++++++++++++++++-
 mod/wiki/tests/externallib_test.php | 14 ++++++++++++--
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/mod/wiki/lib.php b/mod/wiki/lib.php
index 1da396edc7c..db845c5fdb6 100644
--- a/mod/wiki/lib.php
+++ b/mod/wiki/lib.php
@@ -835,4 +835,21 @@ function mod_wiki_core_calendar_provide_event_action(calendar_event $event,
         1,
         true
     );
-}
\ No newline at end of file
+}
+
+/**
+ * Sets dynamic information about a course module
+ *
+ * This callback is called from cm_info when checking module availability (incl. $cm->uservisible)
+ *
+ * Main viewing capability in mod_wiki is 'mod/wiki:viewpage' instead of the expected standardised 'mod/wiki:view'.
+ * The method cm_info::is_user_access_restricted_by_capability() does not work for wiki, we need to implement
+ * this callback.
+ *
+ * @param cm_info $cm
+ */
+function wiki_cm_info_dynamic(cm_info $cm) {
+    if (!has_capability('mod/wiki:viewpage', $cm->context, $cm->get_modinfo()->get_user_id())) {
+        $cm->set_available(false);
+    }
+}
diff --git a/mod/wiki/tests/externallib_test.php b/mod/wiki/tests/externallib_test.php
index 3e3c9dceb17..7ecf190ba51 100644
--- a/mod/wiki/tests/externallib_test.php
+++ b/mod/wiki/tests/externallib_test.php
@@ -255,17 +255,27 @@ class mod_wiki_external_testcase extends externallib_advanced_testcase {
         // Now, prohibit capabilities.
         $this->setUser($this->student);
         $contextcourse1 = context_course::instance($this->course->id);
+
+        // Default student role allows to view wiki and create pages.
+        $wikis = mod_wiki_external::get_wikis_by_courses(array($this->course->id));
+        $wikis = external_api::clean_returnvalue(mod_wiki_external::get_wikis_by_courses_returns(), $wikis);
+        $this->assertEquals('Test wiki 1', $wikis['wikis'][0]['intro']);
+        $this->assertEquals(1, $wikis['wikis'][0]['cancreatepages']);
+
         // Prohibit capability = mod:wiki:viewpage on Course1 for students.
-        assign_capability('mod/wiki:viewpage', CAP_PROHIBIT, $this->studentrole->id, $contextcourse1->id);
+        assign_capability('mod/wiki:viewpage', CAP_PROHIBIT, $this->studentrole->id, $contextcourse1->id, true);
         accesslib_clear_all_caches_for_unit_testing();
+        course_modinfo::clear_instance_cache(null);
 
         $wikis = mod_wiki_external::get_wikis_by_courses(array($this->course->id));
         $wikis = external_api::clean_returnvalue(mod_wiki_external::get_wikis_by_courses_returns(), $wikis);
-        $this->assertFalse(isset($wikis['wikis'][0]['intro']));
+        $this->assertEquals(0, count($wikis['wikis']));
 
         // Prohibit capability = mod:wiki:createpage on Course1 for students.
+        assign_capability('mod/wiki:viewpage', CAP_ALLOW, $this->studentrole->id, $contextcourse1->id, true);
         assign_capability('mod/wiki:createpage', CAP_PROHIBIT, $this->studentrole->id, $contextcourse1->id);
         accesslib_clear_all_caches_for_unit_testing();
+        course_modinfo::clear_instance_cache(null);
 
         $wikis = mod_wiki_external::get_wikis_by_courses(array($this->course->id));
         $wikis = external_api::clean_returnvalue(mod_wiki_external::get_wikis_by_courses_returns(), $wikis);