From 4d199d6b3308feeb768d17c3fc4e87a870ebe9b1 Mon Sep 17 00:00:00 2001 From: Petr Skoda Date: Sun, 18 Dec 2011 11:54:02 +0100 Subject: [PATCH] MDL-30787 fix use of module and section edit capabilities --- course/lib.php | 56 +++++++++--------- course/mod.php | 112 ++++++++++++++++-------------------- course/modedit.php | 5 +- course/moodleform_mod.php | 6 ++ course/rest.php | 42 +++++++------- course/view.php | 28 ++++----- lib/accesslib.php | 6 +- lib/ajax/section_classes.js | 64 +++++++++++++-------- lib/db/access.php | 6 +- 9 files changed, 173 insertions(+), 152 deletions(-) diff --git a/course/lib.php b/course/lib.php index 8a9b0d21fa0..d043a745413 100644 --- a/course/lib.php +++ b/course/lib.php @@ -3062,13 +3062,13 @@ function moveto_module($mod, $section, $beforemod=NULL) { * @global core_renderer $OUTPUT * @staticvar type $str * @param stdClass $mod The module to produce editing buttons for - * @param bool $absolute If true an absolute link is produced (default true) + * @param bool $absolute_ignored ignored - all links are absolute * @param bool $moveselect If true a move seleciton process is used (default true) * @param int $indent The current indenting * @param int $section The section to link back to * @return string XHTML for the editing buttons */ -function make_editing_buttons(stdClass $mod, $absolute = true, $moveselect = true, $indent=-1, $section=-1) { +function make_editing_buttons(stdClass $mod, $absolute_ignored = true, $moveselect = true, $indent=-1, $section=-1) { global $CFG, $OUTPUT; static $str; @@ -3076,11 +3076,16 @@ function make_editing_buttons(stdClass $mod, $absolute = true, $moveselect = tru $coursecontext = get_context_instance(CONTEXT_COURSE, $mod->course); $modcontext = get_context_instance(CONTEXT_MODULE, $mod->id); - // no permission to edit - if (!has_capability('moodle/course:manageactivities', $modcontext)) { + $editcaps = array('moodle/course:manageactivities', 'moodle/course:activityvisibility', 'moodle/role:assign'); + $dupecaps = array('moodle/backup:backuptargetimport', 'moodle/restore:restoretargetimport'); + + // no permission to edit anything + if (!has_any_capability($editcaps, $modcontext) and !has_all_capabilities($dupecaps, $coursecontext)) { return false; } + $hasmanageactivities = has_capability('moodle/course:manageactivities', $modcontext); + if (!isset($str)) { $str = new stdClass; $str->assign = get_string("assignroles", 'role'); @@ -3101,11 +3106,7 @@ function make_editing_buttons(stdClass $mod, $absolute = true, $moveselect = tru $str->groupsvisible = get_string("groupsvisible"); } - if ($absolute) { - $baseurl = new moodle_url('/course/mod.php', array('sesskey' => sesskey())); - } else { - $baseurl = new moodle_url('mod.php', array('sesskey' => sesskey())); - } + $baseurl = new moodle_url('/course/mod.php', array('sesskey' => sesskey())); if ($section >= 0) { $baseurl->param('sr', $section); @@ -3113,7 +3114,7 @@ function make_editing_buttons(stdClass $mod, $absolute = true, $moveselect = tru $actions = array(); // leftright - if (has_capability('moodle/course:update', $coursecontext)) { + if ($hasmanageactivities) { if (right_to_left()) { // Exchange arrows on RTL $rightarrow = 't/left'; $leftarrow = 't/right'; @@ -3141,7 +3142,7 @@ function make_editing_buttons(stdClass $mod, $absolute = true, $moveselect = tru } // move - if (has_capability('moodle/course:update', $coursecontext)) { + if ($hasmanageactivities) { if ($moveselect) { $actions[] = new action_link( new moodle_url($baseurl, array('copy' => $mod->id)), @@ -3166,15 +3167,16 @@ function make_editing_buttons(stdClass $mod, $absolute = true, $moveselect = tru } // Update - $actions[] = new action_link( - new moodle_url($baseurl, array('update' => $mod->id)), - new pix_icon('t/edit', $str->update, 'moodle', array('class' => 'iconsmall')), - null, - array('class' => 'editing_update', 'title' => $str->update) - ); + if ($hasmanageactivities) { + $actions[] = new action_link( + new moodle_url($baseurl, array('update' => $mod->id)), + new pix_icon('t/edit', $str->update, 'moodle', array('class' => 'iconsmall')), + null, + array('class' => 'editing_update', 'title' => $str->update) + ); + } // Duplicate (require both target import caps to be able to duplicate, see modduplicate.php) - $dupecaps = array('moodle/backup:backuptargetimport', 'moodle/restore:restoretargetimport'); if (has_all_capabilities($dupecaps, $coursecontext)) { $actions[] = new action_link( new moodle_url($baseurl, array('duplicate' => $mod->id)), @@ -3185,12 +3187,14 @@ function make_editing_buttons(stdClass $mod, $absolute = true, $moveselect = tru } // Delete - $actions[] = new action_link( - new moodle_url($baseurl, array('delete' => $mod->id)), - new pix_icon('t/delete', $str->delete, 'moodle', array('class' => 'iconsmall')), - null, - array('class' => 'editing_delete', 'title' => $str->delete) - ); + if ($hasmanageactivities) { + $actions[] = new action_link( + new moodle_url($baseurl, array('delete' => $mod->id)), + new pix_icon('t/delete', $str->delete, 'moodle', array('class' => 'iconsmall')), + null, + array('class' => 'editing_delete', 'title' => $str->delete) + ); + } // hideshow if (has_capability('moodle/course:activityvisibility', $modcontext)) { @@ -3212,7 +3216,7 @@ function make_editing_buttons(stdClass $mod, $absolute = true, $moveselect = tru } // groupmode - if ($mod->groupmode !== false) { + if ($hasmanageactivities and $mod->groupmode !== false) { if ($mod->groupmode == SEPARATEGROUPS) { $groupmode = 0; $grouptitle = $str->groupsseparate; @@ -3242,7 +3246,7 @@ function make_editing_buttons(stdClass $mod, $absolute = true, $moveselect = tru } // Assign - if (has_capability('moodle/course:managegroups', $modcontext)){ + if (has_capability('moodle/role:assign', $modcontext)){ $actions[] = new action_link( new moodle_url('/'.$CFG->admin.'/roles/assign.php', array('contextid' => $modcontext->id)), new pix_icon('i/roles', $str->assign, 'moodle', array('class' => 'iconsmall')), diff --git a/course/mod.php b/course/mod.php index d6b9e05b786..365c7e65182 100644 --- a/course/mod.php +++ b/course/mod.php @@ -26,8 +26,6 @@ require("../config.php"); require_once("lib.php"); -require_login(); - $sectionreturn = optional_param('sr', '', PARAM_INT); $add = optional_param('add', '', PARAM_ALPHA); $type = optional_param('type', '', PARAM_ALPHA); @@ -66,6 +64,8 @@ if ($groupmode !== '') { } $PAGE->set_url($url); +require_login(); + //check if we are adding / editing a module that has new forms using formslib if (!empty($add)) { $id = required_param('id', PARAM_INT); @@ -76,9 +76,7 @@ if (!empty($add)) { redirect("$CFG->wwwroot/course/modedit.php?add=$add&type=$type&course=$id§ion=$section&return=$returntomod"); } else if (!empty($update)) { - if (!$cm = get_coursemodule_from_id('', $update, 0, true)) { - print_error('invalidcoursemodule'); - } + $cm = get_coursemodule_from_id('', $update, 0, true, MUST_EXIST); $returntomod = optional_param('return', 0, PARAM_BOOL); redirect("$CFG->wwwroot/course/modedit.php?update=$update&return=$returntomod"); @@ -86,7 +84,7 @@ if (!empty($add)) { $cm = get_coursemodule_from_id('', $duplicate, 0, true, MUST_EXIST); $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST); - require_login($course->id); + require_login($course, false, $cm); $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id); $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); require_capability('moodle/course:manageactivities', $coursecontext); @@ -119,17 +117,13 @@ if (!empty($add)) { } } else if (!empty($delete)) { - if (!$cm = get_coursemodule_from_id('', $delete, 0, true)) { - print_error('invalidcoursemodule'); - } + $cm = get_coursemodule_from_id('', $delete, 0, true, MUST_EXIST); + $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST); - if (!$course = $DB->get_record('course', array('id'=>$cm->course))) { - print_error('invalidcourseid'); - } - require_login($course->id); // needed to setup proper $COURSE - $context = get_context_instance(CONTEXT_COURSE, $course->id); + require_login($course, false, $cm); + $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id); $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); - require_capability('moodle/course:manageactivities', $context); + require_capability('moodle/course:manageactivities', $modcontext); $return = "$CFG->wwwroot/course/view.php?id=$cm->course#section-$cm->sectionnum"; @@ -203,9 +197,13 @@ if (!empty($add)) { if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) { - if (!$cm = get_coursemodule_from_id('', $USER->activitycopy, 0, true)) { - print_error('invalidcoursemodule'); - } + $cm = get_coursemodule_from_id('', $USER->activitycopy, 0, true, MUST_EXIST); + $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST); + + require_login($course, false, $cm); + $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id); + $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); + require_capability('moodle/course:manageactivities', $modcontext); if (!empty($movetosection)) { if (!$section = $DB->get_record('course_sections', array('id'=>$movetosection, 'course'=>$cm->course))) { @@ -222,10 +220,6 @@ if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) { } } - require_login($section->course); // needed to setup proper $COURSE - $context = get_context_instance(CONTEXT_COURSE, $section->course); - require_capability('moodle/course:manageactivities', $context); - if (!ismoving($section->course)) { print_error('needcopy', '', "view.php?id=$section->course"); } @@ -246,13 +240,14 @@ if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) { } else if (!empty($indent) and confirm_sesskey()) { $id = required_param('id', PARAM_INT); - if (!$cm = get_coursemodule_from_id('', $id, 0, true)) { - print_error('invalidcoursemodule'); - } - require_login($cm->course); // needed to setup proper $COURSE - $context = get_context_instance(CONTEXT_COURSE, $cm->course); - require_capability('moodle/course:manageactivities', $context); + $cm = get_coursemodule_from_id('', $id, 0, true, MUST_EXIST); + $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST); + + require_login($course, false, $cm); + $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id); + $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); + require_capability('moodle/course:manageactivities', $modcontext); $cm->indent += $indent; @@ -271,13 +266,13 @@ if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) { } } else if (!empty($hide) and confirm_sesskey()) { - if (!$cm = get_coursemodule_from_id('', $hide, 0, true)) { - print_error('invalidcoursemodule'); - } + $cm = get_coursemodule_from_id('', $hide, 0, true, MUST_EXIST); + $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST); - require_login($cm->course); // needed to setup proper $COURSE - $context = get_context_instance(CONTEXT_MODULE, $cm->id); - require_capability('moodle/course:activityvisibility', $context); + require_login($course, false, $cm); + $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id); + $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); + require_capability('moodle/course:activityvisibility', $modcontext); set_coursemodule_visible($cm->id, 0); @@ -290,21 +285,17 @@ if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) { } } else if (!empty($show) and confirm_sesskey()) { - if (!$cm = get_coursemodule_from_id('', $show, 0, true)) { - print_error('invalidcoursemodule'); - } + $cm = get_coursemodule_from_id('', $show, 0, true, MUST_EXIST); + $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST); - require_login($cm->course); // needed to setup proper $COURSE - $context = get_context_instance(CONTEXT_COURSE, $cm->course); - require_capability('moodle/course:activityvisibility', $context); + require_login($course, false, $cm); + $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id); + $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); + require_capability('moodle/course:activityvisibility', $modcontext); - if (!$section = $DB->get_record('course_sections', array('id'=>$cm->section))) { - print_error('sectionnotexist'); - } + $section = $DB->get_record('course_sections', array('id'=>$cm->section), '*', MUST_EXIST); - if (!$module = $DB->get_record('modules', array('id'=>$cm->module))) { - print_error('moduledoesnotexist'); - } + $module = $DB->get_record('modules', array('id'=>$cm->module), '*', MUST_EXIST); if ($module->visible and ($section->visible or (SITEID == $cm->course))) { set_coursemodule_visible($cm->id, 1); @@ -319,13 +310,14 @@ if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) { } else if ($groupmode > -1 and confirm_sesskey()) { $id = required_param('id', PARAM_INT); - if (!$cm = get_coursemodule_from_id('', $id, 0, true)) { - print_error('invalidcoursemodule'); - } - require_login($cm->course); // needed to setup proper $COURSE - $context = get_context_instance(CONTEXT_MODULE, $cm->id); - require_capability('moodle/course:manageactivities', $context); + $cm = get_coursemodule_from_id('', $id, 0, true, MUST_EXIST); + $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST); + + require_login($course, false, $cm); + $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id); + $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); + require_capability('moodle/course:manageactivities', $modcontext); set_coursemodule_groupmode($cm->id, $groupmode); @@ -338,17 +330,15 @@ if ((!empty($movetosection) or !empty($moveto)) and confirm_sesskey()) { } } else if (!empty($copy) and confirm_sesskey()) { // value = course module - if (!$cm = get_coursemodule_from_id('', $copy, 0, true)) { - print_error('invalidcoursemodule'); - } + $cm = get_coursemodule_from_id('', $copy, 0, true, MUST_EXIST); + $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST); - require_login($cm->course); // needed to setup proper $COURSE - $context = get_context_instance(CONTEXT_COURSE, $cm->course); - require_capability('moodle/course:manageactivities', $context); + require_login($course, false, $cm); + $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id); + $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); + require_capability('moodle/course:manageactivities', $modcontext); - if (!$section = $DB->get_record('course_sections', array('id'=>$cm->section))) { - print_error('sectionnotexist'); - } + $section = $DB->get_record('course_sections', array('id'=>$cm->section), '*', MUST_EXIST); $USER->activitycopy = $copy; $USER->activitycopycourse = $cm->course; diff --git a/course/modedit.php b/course/modedit.php index 7041d80a719..5865e4a2cef 100644 --- a/course/modedit.php +++ b/course/modedit.php @@ -365,7 +365,9 @@ if ($mform->is_cancelled()) { } // make sure visibility is set correctly (in particular in calendar) - set_coursemodule_visible($fromform->coursemodule, $fromform->visible); + if (has_capability('moodle/course:activityvisibility', $modcontext)) { + set_coursemodule_visible($fromform->coursemodule, $fromform->visible); + } if (isset($fromform->cmidnumber)) { //label // set cm idnumber - uniqueness is already verified by form validation @@ -477,6 +479,7 @@ if ($mform->is_cancelled()) { $DB->set_field('course_modules', 'section', $sectionid, array('id'=>$fromform->coursemodule)); // make sure visibility is set correctly (in particular in calendar) + // note: allow them to set it even without moodle/course:activityvisibility set_coursemodule_visible($fromform->coursemodule, $fromform->visible); if (isset($fromform->cmidnumber)) { //label diff --git a/course/moodleform_mod.php b/course/moodleform_mod.php index a531061cd5b..c860689e466 100644 --- a/course/moodleform_mod.php +++ b/course/moodleform_mod.php @@ -422,6 +422,12 @@ abstract class moodleform_mod extends moodleform { } $mform->addElement('modvisible', 'visible', get_string('visible')); + if (!empty($this->_cm)) { + $context = get_context_instance(CONTEXT_MODULE, $this->_cm->id); + if (!has_capability('moodle/course:activityvisibility', $context)) { + $mform->hardFreeze('visible'); + } + } if ($this->_features->idnumber) { $mform->addElement('text', 'cmidnumber', get_string('idnumbermod')); diff --git a/course/rest.php b/course/rest.php index 17be6684196..933e4f1a9c1 100644 --- a/course/rest.php +++ b/course/rest.php @@ -43,16 +43,16 @@ $pageaction = optional_param('action', '', PARAM_ALPHA); // Used to simulate a D $PAGE->set_url('/course/rest.php', array('courseId'=>$courseid,'class'=>$class)); +//NOTE: when making any changes here please make sure it is using the same access control as course/mod.php !! + +require_login(); + // Authorise the user and verify some incoming data if (!$course = $DB->get_record('course', array('id'=>$courseid))) { error_log('AJAX commands.php: Course does not exist'); die; } -$context = get_context_instance(CONTEXT_COURSE, $course->id); -require_login($course); -require_capability('moodle/course:update', $context); - if (empty($CFG->enablecourseajax)) { error_log('Course AJAX not allowed'); die; @@ -72,22 +72,13 @@ switch($requestmethod) { switch ($class) { case 'block': - - switch ($field) { - case 'visible': - blocks_execute_action($PAGE, $pageblocks, 'toggle', $blockinstance); - break; - - case 'position': // Misleading case. Should probably call it 'move'. - // We want to move the block around. This means changing - // the column (position field) and/or block sort order - // (weight field). - blocks_move_block($PAGE, $blockinstance, $column, $value); - break; - } + // not used any more break; case 'section': + require_login($course); + $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id); + require_capability('moodle/course:update', $coursecontext); if (!$DB->record_exists('course_sections', array('course'=>$course->id, 'section'=>$id))) { error_log('AJAX commands.php: Bad Section ID '.$id); @@ -111,16 +102,21 @@ switch($requestmethod) { error_log('AJAX commands.php: Bad course module ID '.$id); die; } + require_login($course, false, $cm); + $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); switch ($field) { case 'visible': + require_capability('moodle/course:activityvisibility', $modcontext); set_coursemodule_visible($cm->id, $value); break; case 'groupmode': + require_capability('moodle/course:manageactivities', $modcontext); set_coursemodule_groupmode($cm->id, $value); break; case 'indentleft': + require_capability('moodle/course:manageactivities', $modcontext); if ($cm->indent > 0) { $cm->indent--; $DB->update_record('course_modules', $cm); @@ -128,11 +124,13 @@ switch($requestmethod) { break; case 'indentright': + require_capability('moodle/course:manageactivities', $modcontext); $cm->indent++; $DB->update_record('course_modules', $cm); break; case 'move': + require_capability('moodle/course:manageactivities', $modcontext); if (!$section = $DB->get_record('course_sections', array('course'=>$course->id, 'section'=>$sectionid))) { error_log('AJAX commands.php: Bad section ID '.$sectionid); die; @@ -158,6 +156,9 @@ switch($requestmethod) { case 'course': switch($field) { case 'marker': + require_login($course); + $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id); + require_capability('moodle/course:update', $coursecontext); $newcourse = new stdClass(); $newcourse->id = $course->id; $newcourse->marker = $value; @@ -171,7 +172,7 @@ switch($requestmethod) { case 'DELETE': switch ($class) { case 'block': - blocks_execute_action($PAGE, $pageblocks, 'delete', $blockinstance); + // not used any more break; case 'resource': @@ -179,6 +180,9 @@ switch($requestmethod) { error_log('AJAX rest.php: Bad course module ID '.$id); die; } + require_login($course, false, $cm); + $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); + require_capability('moodle/course:manageactivities', $modcontext); $modlib = "$CFG->dirroot/mod/$cm->modname/lib.php"; if (file_exists($modlib)) { @@ -195,8 +199,6 @@ switch($requestmethod) { die; } - $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); - // remove all module files in case modules forget to do that $fs = get_file_storage(); $fs->delete_area_files($modcontext->id); diff --git a/course/view.php b/course/view.php index 28ed12459f2..73095db91b8 100644 --- a/course/view.php +++ b/course/view.php @@ -117,22 +117,24 @@ redirect($PAGE->url); } - if ($hide && confirm_sesskey()) { - set_section_visible($course->id, $hide, '0'); - } + if (has_capability('moodle/course:update', $context)) { + if ($hide && confirm_sesskey()) { + set_section_visible($course->id, $hide, '0'); + } - if ($show && confirm_sesskey()) { - set_section_visible($course->id, $show, '1'); - } + if ($show && confirm_sesskey()) { + set_section_visible($course->id, $show, '1'); + } - if (!empty($section)) { - if (!empty($move) and confirm_sesskey()) { - if (!move_section($course, $section, $move)) { - echo $OUTPUT->notification('An error occurred while moving a section'); + if (!empty($section)) { + if (!empty($move) and confirm_sesskey()) { + if (!move_section($course, $section, $move)) { + echo $OUTPUT->notification('An error occurred while moving a section'); + } + // Clear the navigation cache at this point so that the affects + // are seen immediately on the navigation. + $PAGE->navigation->clear_cache(); } - // Clear the navigation cache at this point so that the affects - // are seen immediately on the navigation. - $PAGE->navigation->clear_cache(); } } } else { diff --git a/lib/accesslib.php b/lib/accesslib.php index 80ebfc91ff1..672309b8d48 100644 --- a/lib/accesslib.php +++ b/lib/accesslib.php @@ -6396,10 +6396,6 @@ class context_module extends context { $extracaps = array_merge($subcaps, $extracaps); - // All modules allow viewhiddenactivities. This is so you can hide - // the module then override to allow specific roles to see it. - // The actual check is in course page so not module-specific - $extracaps[] = "moodle/course:viewhiddenactivities"; list($extra, $params) = $DB->get_in_or_equal( $extracaps, SQL_PARAMS_NAMED, 'cap0'); $extra = "OR name $extra"; @@ -6407,7 +6403,7 @@ class context_module extends context { $sql = "SELECT * FROM {capabilities} WHERE (contextlevel = ".CONTEXT_MODULE." - AND component = :component) + AND (component = :component OR component = 'moodle')) $extra"; $params['component'] = "mod_$module->name"; diff --git a/lib/ajax/section_classes.js b/lib/ajax/section_classes.js index 0daf295df3a..cac7cec692e 100644 --- a/lib/ajax/section_classes.js +++ b/lib/ajax/section_classes.js @@ -628,6 +628,9 @@ resource_class.prototype.init_buttons = function() { var buttons = commandContainer.getElementsByTagName('a'); // Buttons that we might need to add back in. + var deletePresent = false; + var hideshow = false; + var movehandle = false; var moveLeft = false; var moveRight = false; var updateButton = null; @@ -654,25 +657,34 @@ resource_class.prototype.init_buttons = function() { this.groupmode = this.SEPARATEGROUPS; } else if (buttons[x].className == 'editing_groupsvisible') { this.groupmode = this.VISIBLEGROUPS; + } else if (buttons[x].className == 'editing_delete') { + deletePresent = true; + } else if (buttons[x].className == 'editing_hide') { + hideshow = true; + } else if (buttons[x].className == 'editing_show') { + hideshow = true; + } else if (buttons[x].className == 'editing_moveup') { + movehandle = true; + } else if (buttons[x].className == 'editing_movedown') { + movehandle = true; + } else if (buttons[x].className == 'editing_move') { + movehandle = true; } } - if (updateButton == null) { - // Update button must always be present. - YAHOO.log('Cannot find updateButton for '+this.getEl().id, 'error'); - } - // Clear all the buttons. commandContainer.innerHTML = ''; // Add move-handle for drag and drop. - var handleRef = main.mk_button('a', main.portal.icons['move_2d'], main.portal.strings['move'], - [['style', 'cursor:move']], [['class', 'iconsmall']]); + if (movehandle) { + var handleRef = main.mk_button('a', main.portal.icons['move_2d'], main.portal.strings['move'], + [['style', 'cursor:move']], [['class', 'iconsmall']]); - YAHOO.util.Dom.generateId(handleRef, 'sectionHandle'); - this.handle = handleRef; - commandContainer.appendChild(handleRef); - this.setHandleElId(this.handle.id); + YAHOO.util.Dom.generateId(handleRef, 'sectionHandle'); + this.handle = handleRef; + commandContainer.appendChild(handleRef); + this.setHandleElId(this.handle.id); + } // Add indentation buttons if needed (move left, move right). if (moveLeft) { @@ -691,27 +703,33 @@ resource_class.prototype.init_buttons = function() { this.indentRightButton = button; } - // Add edit button back in. - commandContainer.appendChild(updateButton); + if (updateButton) { + // Add edit button back in. + commandContainer.appendChild(updateButton); + } if (duplicateButton) { commandContainer.appendChild(duplicateButton); } // Add the delete button. - var button = main.mk_button('a', main.portal.icons['delete'], main.portal.strings['delete'], null, [['class', 'iconsmall']]); - YAHOO.util.Event.addListener(button, 'click', this.delete_button, this, true); - commandContainer.appendChild(button); + if (deletePresent) { + var button = main.mk_button('a', main.portal.icons['delete'], main.portal.strings['delete'], null, [['class', 'iconsmall']]); + YAHOO.util.Event.addListener(button, 'click', this.delete_button, this, true); + commandContainer.appendChild(button); + } // Add the hide or show button. - if (this.hidden) { - var button = main.mk_button('a', main.portal.icons['show'], main.portal.strings['show'], null, [['class', 'iconsmall']]); - } else { - var button = main.mk_button('a', main.portal.icons['hide'], main.portal.strings['hide'], null, [['class', 'iconsmall']]); + if (hideshow) { + if (this.hidden) { + var button = main.mk_button('a', main.portal.icons['show'], main.portal.strings['show'], null, [['class', 'iconsmall']]); + } else { + var button = main.mk_button('a', main.portal.icons['hide'], main.portal.strings['hide'], null, [['class', 'iconsmall']]); + } + YAHOO.util.Event.addListener(button, 'click', this.toggle_hide, this, true); + commandContainer.appendChild(button); + this.viewButton = button; } - YAHOO.util.Event.addListener(button, 'click', this.toggle_hide, this, true); - commandContainer.appendChild(button); - this.viewButton = button; // Add the groupmode button if needed. if (this.groupmode != null) { diff --git a/lib/db/access.php b/lib/db/access.php index 75380fe7412..ae5ca8e6a88 100644 --- a/lib/db/access.php +++ b/lib/db/access.php @@ -856,7 +856,7 @@ $capabilities = array( 'riskbitmask' => RISK_XSS, 'captype' => 'write', - 'contextlevel' => CONTEXT_COURSE, + 'contextlevel' => CONTEXT_MODULE, 'archetypes' => array( 'editingteacher' => CAP_ALLOW, 'manager' => CAP_ALLOW @@ -866,7 +866,7 @@ $capabilities = array( 'moodle/course:activityvisibility' => array( 'captype' => 'write', - 'contextlevel' => CONTEXT_COURSE, + 'contextlevel' => CONTEXT_MODULE, 'archetypes' => array( 'editingteacher' => CAP_ALLOW, 'manager' => CAP_ALLOW @@ -876,7 +876,7 @@ $capabilities = array( 'moodle/course:viewhiddenactivities' => array( 'captype' => 'write', - 'contextlevel' => CONTEXT_COURSE, + 'contextlevel' => CONTEXT_MODULE, 'archetypes' => array( 'teacher' => CAP_ALLOW, 'editingteacher' => CAP_ALLOW,