From 4eace2bee8a3eec58c6d82255607f9cd967d62b1 Mon Sep 17 00:00:00 2001
From: Mark Johnson <mark.johnson@catalyst-eu.net>
Date: Fri, 20 Jun 2025 13:15:09 +0100
Subject: [PATCH] MDL-85257 mod_quiz: Dont show edit links when you dont have
 permission

The quiz editing page includes an edit link for each question, and a
badge for questions in a shared bank that links to that bank.

It is possible that the user viewing the quiz does not have access to
edit the question or view the question bank, which means these links are
broken.

This change only adds the links if the user has permission for the pages
they link to.
---
 mod/quiz/classes/output/edit_renderer.php     | 23 ++++++++++++------
 mod/quiz/templates/question_slot.mustache     |  8 +++++--
 .../editing_add_from_question_bank.feature    | 24 +++++++++++++++++++
 3 files changed, 46 insertions(+), 9 deletions(-)

diff --git a/mod/quiz/classes/output/edit_renderer.php b/mod/quiz/classes/output/edit_renderer.php
index e6a570e0922..b52f7441d85 100644
--- a/mod/quiz/classes/output/edit_renderer.php
+++ b/mod/quiz/classes/output/edit_renderer.php
@@ -761,7 +761,7 @@ class edit_renderer extends \plugin_renderer_base {
         $question = $structure->get_question_in_slot($slot);
         $bank = $structure->get_source_bank($slot);
 
-        if ($bank?->issharedbank) {
+        if ($bank?->issharedbank && question_has_capability_on($question, 'view')) {
             $bankurl = (new \moodle_url('/question/edit.php',
                 [
                     'cmid' => $bank->cminfo->id,
@@ -1082,12 +1082,21 @@ class edit_renderer extends \plugin_renderer_base {
                 'badge bg-danger text-white ms-3'
             );
         } else {
-
-            // Display the link itself.
-            $activitylink = $icon . html_writer::tag('span', $editicon . $instancename, ['class' => 'instancename']);
-            $output .= html_writer::link($editurl, $activitylink,
-                ['title' => get_string('editquestion', 'quiz') . ' ' . $title]);
-
+            $canedit = question_has_capability_on($question->questionid, 'edit');
+            $instancename = $canedit ? $editicon . $instancename : $instancename;
+            // Display the link, if the user has permission to edit. Otherwise, just display the name and icon.
+            $questionname = $icon . html_writer::tag('span', $instancename, ['class' => 'instancename']);
+            if ($canedit) {
+                $output .= html_writer::link(
+                    $editurl,
+                    $questionname,
+                    [
+                        'title' => get_string('editquestion', 'quiz') . ' ' . $title,
+                    ],
+                );
+            } else {
+                $output .= $questionname;
+            }
         }
 
         return $output;
diff --git a/mod/quiz/templates/question_slot.mustache b/mod/quiz/templates/question_slot.mustache
index a6c4fb680b8..fe24e3ccc30 100644
--- a/mod/quiz/templates/question_slot.mustache
+++ b/mod/quiz/templates/question_slot.mustache
@@ -57,9 +57,13 @@
         <div>{{{questionname}}}</div>
         {{#issharedbank}}
             <div class="sharedbank">
-                <a href="{{bankurl}}">
+                {{#bankurl}}
+                    <a href="{{bankurl}}">
+                {{/bankurl}}
                     <span class="badge bg-primary text-light ms-2 mt-1">{{{bankname}}}</span>
-                </a>
+                {{#bankurl}}
+                    </a>
+                {{/bankurl}}
             </div>
         {{/issharedbank}}
     </div>
diff --git a/mod/quiz/tests/behat/editing_add_from_question_bank.feature b/mod/quiz/tests/behat/editing_add_from_question_bank.feature
index 33fb35b7a48..ae07a3d4795 100644
--- a/mod/quiz/tests/behat/editing_add_from_question_bank.feature
+++ b/mod/quiz/tests/behat/editing_add_from_question_bank.feature
@@ -216,3 +216,27 @@ Feature: Adding questions to a quiz from the question bank
     When I am on the "Quiz 1" "mod_quiz > Edit" page logged in as teacher1
     Then I should see "Question Bank A" in the "TF1" "list_item"
     And I should see "Question Bank B" in the "TF2" "list_item"
+
+  @javascript
+  Scenario: Don't show the edit link if the user doesn't have permission
+    Given the following "courses" exist:
+      | fullname | shortname | category |
+      | Course 2 | C2        | 0        |
+    And the following "activities" exist:
+      | activity   | name            | course | idnumber |
+      | qbank      | Question Bank C | C2     | qbankC   |
+    And the following "question categories" exist:
+      | contextlevel    | reference | name              |
+      | Activity module | qbankC    | Qbank Questions 3 |
+    And the following "questions" exist:
+      | questioncategory  | qtype     | name            | questiontext        |
+      | Qbank Questions 3 | truefalse | Shared question | Answer the question |
+    And quiz "Quiz 1" contains the following questions:
+      | question        | page |
+      | TF1             | 1    |
+      | Shared question | 1    |
+    When I am on the "Quiz 1" "mod_quiz > Edit" page logged in as teacher1
+    Then "TF1" "link" should exist
+    And "Question Bank A" "link" should exist
+    And "Shared question" "link" should not exist
+    And "Question Bank C" "link" should not exist