L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-85257 mod_quiz: Dont show edit links when you dont have permission

Browse Source 
The quiz editing page includes an edit link for each question, and a
badge for questions in a shared bank that links to that bank.

It is possible that the user viewing the quiz does not have access to
edit the question or view the question bank, which means these links are
broken.

This change only adds the links if the user has permission for the pages
they link to.
This commit is contained in:
Mark Johnson
2025-07-10 09:16:44 +01:00
parent 0365910448
commit 4eace2bee8
3 changed files with 46 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/quiz/classes/output/edit_renderer.php
+16 -7
View File
@@ -761,7 +761,7 @@ class edit_renderer extends \plugin_renderer_base {
$question = $structure->get_question_in_slot($slot);
$bank = $structure->get_source_bank($slot);
if ($bank?->issharedbank) {
if ($bank?->issharedbank && question_has_capability_on($question, 'view')) {
$bankurl = (new \moodle_url('/question/edit.php',
[
'cmid' => $bank->cminfo->id,
@@ -1082,12 +1082,21 @@ class edit_renderer extends \plugin_renderer_base {
'badge bg-danger text-white ms-3'
);
} else {
// Display the link itself.
$activitylink = $icon . html_writer::tag('span', $editicon . $instancename, ['class' => 'instancename']);
$output .= html_writer::link($editurl, $activitylink,
['title' => get_string('editquestion', 'quiz') . ' ' . $title]);
$canedit = question_has_capability_on($question->questionid, 'edit');
$instancename = $canedit ? $editicon . $instancename : $instancename;
// Display the link, if the user has permission to edit. Otherwise, just display the name and icon.
$questionname = $icon . html_writer::tag('span', $instancename, ['class' => 'instancename']);
if ($canedit) {
$output .= html_writer::link(
$editurl,
$questionname,
[
'title' => get_string('editquestion', 'quiz') . ' ' . $title,
],
);
} else {
$output .= $questionname;
}
}
return $output;
mod/quiz/templates/question_slot.mustache
+6 -2
View File
@@ -57,9 +57,13 @@
<div>{{{questionname}}}</div>
{{#issharedbank}}
<div class="sharedbank">
<a href="{{bankurl}}">
{{#bankurl}}
<a href="{{bankurl}}">
{{/bankurl}}
<span class="badge bg-primary text-light ms-2 mt-1">{{{bankname}}}</span>
</a>
{{#bankurl}}
</a>
{{/bankurl}}
</div>
{{/issharedbank}}
</div>
mod/quiz/tests/behat/editing_add_from_question_bank.feature
+24
View File
@@ -216,3 +216,27 @@ Feature: Adding questions to a quiz from the question bank
When I am on the "Quiz 1" "mod_quiz > Edit" page logged in as teacher1
Then I should see "Question Bank A" in the "TF1" "list_item"
And I should see "Question Bank B" in the "TF2" "list_item"
@javascript
Scenario: Don't show the edit link if the user doesn't have permission
Given the following "courses" exist:
| fullname | shortname | category |
| Course 2 | C2 | 0 |
And the following "activities" exist:
| activity | name | course | idnumber |
| qbank | Question Bank C | C2 | qbankC |
And the following "question categories" exist:
| contextlevel | reference | name |
| Activity module | qbankC | Qbank Questions 3 |
And the following "questions" exist:
| questioncategory | qtype | name | questiontext |
| Qbank Questions 3 | truefalse | Shared question | Answer the question |
And quiz "Quiz 1" contains the following questions:
| question | page |
| TF1 | 1 |
| Shared question | 1 |
When I am on the "Quiz 1" "mod_quiz > Edit" page logged in as teacher1
Then "TF1" "link" should exist
And "Question Bank A" "link" should exist
And "Shared question" "link" should not exist
And "Question Bank C" "link" should not exist