From 4f0c2d0009a81995bae574b47e87f2ccbebfb8e2 Mon Sep 17 00:00:00 2001 From: Petr Skoda Date: Wed, 31 Mar 2010 07:41:31 +0000 Subject: [PATCH] MDL-21655 big scary enrolment and roles improvements - see tacker for list of changes, includes other minor fixes too --- admin/cron.php | 4 +- admin/generator.php | 3 +- admin/register.php | 4 +- admin/report/courseoverview/db/access.php | 2 +- admin/report/questioninstances/db/access.php | 2 +- admin/report/security/db/access.php | 2 +- admin/report/security/lib.php | 215 +-- admin/report/unittest/db/access.php | 2 +- admin/roles/admins.php | 137 ++ admin/roles/assign.php | 15 +- admin/roles/define.php | 4 +- admin/roles/lib.php | 228 +-- admin/roles/manage.php | 16 +- admin/settings/appearance.php | 2 +- admin/settings/security.php | 6 +- admin/settings/subsystems.php | 2 +- admin/settings/users.php | 104 +- admin/uploaduser.php | 14 +- admin/uploaduser_form.php | 4 +- admin/webservice/lib.php | 6 +- auth/cas/auth.php | 6 +- auth/fc/auth.php | 2 +- auth/ldap/auth.php | 6 +- auth/mnet/auth.php | 4 +- backup/backuplib.php | 5 +- backup/restore_form.html | 6 +- backup/restorelib.php | 16 +- blocks/admin/block_admin.php | 27 +- blocks/admin_tree/block_admin_tree.php | 2 +- blocks/comments/block_comments.php | 3 +- blocks/course_list/block_course_list.php | 8 +- .../block_global_navigation_tree.php | 7 +- blocks/messages/block_messages.php | 2 +- blocks/mnet_hosts/block_mnet_hosts.php | 2 +- blocks/moodleblock.class.php | 6 +- blocks/news_items/block_news_items.php | 2 +- blocks/online_users/block_online_users.php | 26 +- blocks/online_users/db/access.php | 2 +- blocks/quiz_results/block_quiz_results.php | 2 +- blocks/rss_client/db/access.php | 4 +- blocks/section_links/block_section_links.php | 2 +- blocks/tags/block_tags.php | 3 +- blog/edit_form.php | 4 +- blog/lib.php | 5 +- blog/locallib.php | 6 +- blog/rsslib.php | 4 +- calendar/export.php | 12 +- calendar/lib.php | 16 +- calendar/view.php | 14 +- comment/comment_ajax.php | 6 - comment/comment_post.php | 4 - course/category.php | 6 +- course/delete_category_form.php | 7 +- course/edit.php | 2 +- course/edit_form.php | 2 +- course/enrol.php | 4 +- course/external.php | 4 +- course/info.php | 7 +- course/lib.php | 86 +- course/loginas.php | 10 +- course/recent_form.php | 10 +- course/report/log/db/access.php | 6 +- course/report/log/lib.php | 4 +- course/report/outline/db/access.php | 2 +- course/report/participation/db/access.php | 2 +- course/report/participation/index.php | 1 + course/report/progress/db/access.php | 2 +- course/report/stats/db/access.php | 2 +- course/search.php | 12 +- course/user.php | 2 +- enrol/authorize/db/access.php | 4 +- enrol/authorize/index.php | 2 +- enrol/flatfile/enrol.php | 35 +- enrol/manual/enrol.php | 13 +- enrol/paypal/return.php | 2 +- filter/censor/filter.php | 10 +- grade/export/ods/db/access.php | 4 +- grade/export/txt/db/access.php | 4 +- grade/export/xls/db/access.php | 4 +- grade/export/xml/db/access.php | 4 +- grade/import/csv/db/access.php | 2 +- grade/import/xml/db/access.php | 4 +- grade/report/grader/db/access.php | 2 +- grade/report/outcomes/db/access.php | 2 +- grade/report/overview/db/access.php | 2 +- grade/report/user/db/access.php | 2 +- group/assign.php | 3 +- group/autogroup.php | 11 +- group/externallib.php | 6 +- group/index.php | 55 +- group/lib.php | 77 +- group/members.php | 27 +- index.php | 4 +- lang/en_utf8/admin.php | 2 + lang/en_utf8/role.php | 24 +- lib/accesslib.php | 1501 ++++++++++------- lib/adminlib.php | 17 +- lib/blocklib.php | 21 +- lib/datalib.php | 180 +- lib/db/access.php | 332 ++-- lib/db/install.php | 111 +- lib/db/install.xml | 3 +- lib/db/upgrade.php | 281 +-- lib/deprecatedlib.php | 221 ++- lib/externallib.php | 38 +- lib/moodlelib.php | 156 +- lib/navigationlib.php | 168 +- lib/outputrenderers.php | 2 +- lib/pagelib.php | 5 +- lib/setuplib.php | 2 +- lib/simpletest/broken_testfilelib.php | 2 - lib/simpletest/testaccesslib.php | 46 +- lib/statslib.php | 9 +- lib/upgradelib.php | 4 +- login/change_password.php | 2 +- login/index.php | 4 +- message/discussion.php | 2 +- message/history.php | 2 +- message/index.php | 2 +- message/refresh.php | 2 +- message/user.php | 2 +- mod/assignment/db/access.php | 6 +- mod/assignment/lib.php | 47 +- .../type/upload/assignment.class.php | 2 +- .../type/uploadsingle/assignment.class.php | 2 +- mod/chat/chat_ajax.php | 2 +- mod/chat/db/access.php | 10 +- mod/chat/gui_header_js/insert.php | 4 +- mod/chat/gui_sockets/index.php | 4 +- mod/chat/lib.php | 4 +- mod/choice/db/access.php | 9 +- mod/choice/lib.php | 6 +- mod/choice/view.php | 15 +- mod/data/db/access.php | 29 +- mod/data/edit.php | 2 +- mod/data/lib.php | 14 +- mod/data/rate.php | 4 - mod/data/restorelib.php | 6 +- mod/data/tabs.php | 2 +- mod/feedback/db/access.php | 18 +- mod/feedback/lib.php | 4 - mod/forum/db/access.php | 43 +- mod/forum/db/upgrade.php | 2 +- mod/forum/discuss.php | 3 +- mod/forum/index.php | 2 +- mod/forum/lib.php | 222 +-- mod/forum/markposts.php | 4 +- mod/forum/post.php | 37 +- mod/forum/rate.php | 9 +- mod/forum/rate_ajax.php | 8 +- mod/forum/restorelib.php | 6 +- mod/forum/subscribe.php | 2 +- mod/glossary/db/access.php | 24 +- mod/glossary/edit.php | 9 +- mod/glossary/index.php | 2 +- mod/glossary/lib.php | 6 +- mod/glossary/sql.php | 3 +- mod/glossary/view.php | 2 +- mod/hotpot/db/access.php | 8 +- mod/hotpot/lib.php | 6 +- mod/lesson/db/access.php | 4 +- mod/quiz/db/access.php | 16 +- mod/quiz/report/statistics/db/access.php | 2 +- mod/scorm/db/access.php | 8 +- mod/survey/db/access.php | 6 +- mod/survey/index.php | 2 +- mod/survey/view.php | 4 +- mod/url/locallib.php | 2 +- mod/wiki/db/access.php | 6 +- mod/wiki/lib.php | 2 +- mod/workshop/db/access.php | 26 +- mod/workshop/lib.php | 2 +- my/index.php | 2 +- pluginfile.php | 14 +- question/type/randomsamatch/questiontype.php | 2 +- repository/alfresco/db/access.php | 2 +- repository/boxnet/db/access.php | 2 +- repository/filesystem/db/access.php | 2 +- repository/flickr/db/access.php | 2 +- repository/flickr_public/db/access.php | 2 +- repository/googledocs/db/access.php | 2 +- repository/lib.php | 19 +- repository/local/db/access.php | 2 +- repository/mahara/db/access.php | 2 +- repository/merlot/db/access.php | 2 +- repository/picasa/db/access.php | 2 +- repository/remotemoodle/db/access.php | 2 +- repository/s3/db/access.php | 2 +- repository/upload/db/access.php | 2 +- repository/url/db/access.php | 2 +- repository/webdav/db/access.php | 2 +- repository/wikimedia/db/access.php | 2 +- repository/youtube/db/access.php | 2 +- rss/file.php | 4 +- search/add.php | 2 +- search/delete.php | 2 +- search/documents/forum_document.php | 6 +- search/documents/label_document.php | 2 +- search/documents/physical_doc.php | 2 +- search/documents/physical_htm.php | 2 +- search/documents/physical_odt.php | 2 +- search/documents/physical_pdf.php | 2 +- search/documents/physical_ppt.php | 2 +- search/documents/physical_swf.php | 2 +- search/documents/physical_txt.php | 2 +- search/documents/physical_xml.php | 2 +- search/documents/resource_document.php | 2 +- search/documents/user_document.php | 2 +- search/indexer.php | 2 +- search/indexersplash.php | 2 +- search/query.php | 2 +- search/querylib.php | 2 +- search/stats.php | 4 +- search/tests/index.php | 2 +- search/update.php | 2 +- tag/coursetags_more.php | 4 +- tag/coursetagslib.php | 2 +- tag/locallib.php | 2 +- user/editadvanced.php | 7 +- user/index.php | 359 ++-- user/managetoken.php | 2 +- user/repository.php | 7 +- user/selector/lib.php | 38 +- user/view.php | 247 ++- version.php | 2 +- 225 files changed, 2941 insertions(+), 3097 deletions(-) create mode 100644 admin/roles/admins.php diff --git a/admin/cron.php b/admin/cron.php index b7bd96919c3..b3435c86711 100644 --- a/admin/cron.php +++ b/admin/cron.php @@ -280,14 +280,14 @@ } $rs->close(); /// Execute the same query again, looking for remaining records and deleting them - /// if the user hasn't moodle/course:view in the CONTEXT_COURSE context (orphan records) + /// if the user hasn't moodle/course:participate in the CONTEXT_COURSE context (orphan records) $rs = $DB->get_recordset_sql ("SELECT id, userid, courseid FROM {user_lastaccess} WHERE courseid != ".SITEID." AND timeaccess < ?", array($cuttime)); foreach ($rs as $assign) { if ($context = get_context_instance(CONTEXT_COURSE, $assign->courseid)) { - if (!has_capability('moodle/course:view', $context, $assign->userid)) { + if (!is_enrolled($context, $assign->userid) and !is_viewing($context, $assign->userid)) { $DB->delete_records('user_lastaccess', array('userid'=>$assign->userid, 'courseid'=>$assign->courseid)); mtrace("Deleted orphan user_lastaccess for user $assign->userid from course $assign->courseid"); } diff --git a/admin/generator.php b/admin/generator.php index 499afa3f222..c5b0be84d7e 100755 --- a/admin/generator.php +++ b/admin/generator.php @@ -1187,7 +1187,8 @@ class generator_cli extends generator { } complete_user_login($user); $systemcontext = get_context_instance(CONTEXT_SYSTEM); - if (!has_capability('moodle/site:doanything', $systemcontext)) { + + if (!is_siteadmin($user->id)) {//TODO: add some proper access control check here!! echo "You do not have administration privileges on this Moodle site. " ."These are required for running the generation script.{$this->eolchar}"; die(); diff --git a/admin/register.php b/admin/register.php index 78c44806bc5..c4bcdb30567 100644 --- a/admin/register.php +++ b/admin/register.php @@ -122,11 +122,11 @@ FROM {role_capabilities} rc, {role_assignments} ra, {user} u - WHERE (rc.capability = ? or rc.capability = ?) + WHERE (rc.capability = ?) AND rc.roleid = ra.roleid AND u.id = ra.userid"; - $count = $DB->count_records_sql($sql, array('moodle/course:update', 'moodle/site:doanything')); + $count = $DB->count_records_sql($sql, array('moodle/course:update')); echo get_string("teachers").": ".$count; echo "\n"; echo '
'; diff --git a/admin/report/courseoverview/db/access.php b/admin/report/courseoverview/db/access.php index c2145dc07ef..ca8a508741d 100644 --- a/admin/report/courseoverview/db/access.php +++ b/admin/report/courseoverview/db/access.php @@ -32,7 +32,7 @@ $capabilities = array( 'legacy' => array( 'teacher' => CAP_ALLOW, 'editingteacher' => CAP_ALLOW, - 'admin' => CAP_ALLOW + 'manager' => CAP_ALLOW ), 'clonepermissionsfrom' => 'moodle/site:viewreports', diff --git a/admin/report/questioninstances/db/access.php b/admin/report/questioninstances/db/access.php index 7afd65a3cc0..b537c358c9c 100644 --- a/admin/report/questioninstances/db/access.php +++ b/admin/report/questioninstances/db/access.php @@ -29,7 +29,7 @@ $capabilities = array( 'captype' => 'read', 'contextlevel' => CONTEXT_SYSTEM, 'legacy' => array( - 'admin' => CAP_ALLOW + 'manager' => CAP_ALLOW ), 'clonepermissionsfrom' => 'moodle/site:config', diff --git a/admin/report/security/db/access.php b/admin/report/security/db/access.php index 479e71b2d6d..6aefdcaec77 100644 --- a/admin/report/security/db/access.php +++ b/admin/report/security/db/access.php @@ -30,7 +30,7 @@ $capabilities = array( 'captype' => 'read', 'contextlevel' => CONTEXT_SYSTEM, 'legacy' => array( - 'admin' => CAP_ALLOW + 'manager' => CAP_ALLOW ), ) ); diff --git a/admin/report/security/lib.php b/admin/report/security/lib.php index 7f86e0f4269..2d59c764369 100644 --- a/admin/report/security/lib.php +++ b/admin/report/security/lib.php @@ -576,16 +576,6 @@ function report_security_check_defaultuserrole($detailed=false) { return $result; } - // first test if do anything enabled - that would be really crazy! - $params = array('doanything'=>'moodle/site:doanything', 'capallow'=>CAP_ALLOW, 'roleid'=>$default_role->id); - $sql = "SELECT COUNT(DISTINCT rc.contextid) - FROM {role_capabilities} rc - WHERE rc.capability = :doanything - AND rc.permission = :capallow - AND rc.roleid = :roleid"; - - $anythingcount = $DB->count_records_sql($sql, $params); - // risky caps - usually very dangerous $params = array('capallow'=>CAP_ALLOW, 'roleid'=>$default_role->id); $sql = "SELECT COUNT(DISTINCT rc.contextid) @@ -598,24 +588,16 @@ function report_security_check_defaultuserrole($detailed=false) { $riskycount = $DB->count_records_sql($sql, $params); // default role can not have view cap in all courses - this would break moodle badly - $viewcap = $DB->record_exists('role_capabilities', array('roleid'=>$default_role->id, 'permission'=>CAP_ALLOW, 'capability'=>'moodle/course:view')); + $viewcap = $DB->record_exists('role_capabilities', array('roleid'=>$default_role->id, 'permission'=>CAP_ALLOW, 'capability'=>'moodle/course:participate')); - // it may have either no or 'user' legacy type - nothing else, or else it would break during upgrades badly - $legacyok = false; - $params = array('capallow'=>CAP_ALLOW, 'roleid'=>$default_role->id, 'legacy'=>'moodle/legacy:%'); - $sql = "SELECT rc.capability, 1 - FROM {role_capabilities} rc - WHERE rc.capability LIKE :legacy - AND rc.permission = :capallow - AND rc.roleid = :roleid"; - $legacycaps = $DB->get_records_sql($sql, $params); - if (!$legacycaps) { - $legacyok = true; - } else if (count($legacycaps) == 1 and isset($legacycaps['moodle/legacy:user'])) { + // it may have either none or 'user' archetype - nothing else, or else it would break during upgrades badly + if ($default_role->archetype === '' or $default_role->archetype === 'user') { $legacyok = true; + } else { + $legacyok = false; } - if ($anythingcount or $riskycount or $viewcap or !$legacyok) { + if ($riskycount or $viewcap or !$legacyok) { $result->status = REPORT_SECURITY_CRITICAL; $result->info = get_string('check_defaultuserrole_error', 'report_security', format_string($default_role->name)); @@ -655,16 +637,6 @@ function report_security_check_guestrole($detailed=false) { return $result; } - // first test if do anything enabled - that would be really crazy! - $params = array('doanything'=>'moodle/site:doanything', 'capallow'=>CAP_ALLOW, 'roleid'=>$guest_role->id); - $sql = "SELECT COUNT(DISTINCT rc.contextid) - FROM {role_capabilities} rc - WHERE rc.capability = :doanything - AND rc.permission = :capallow - AND rc.roleid = :roleid"; - - $anythingcount = $DB->count_records_sql($sql, $params); - // risky caps - usually very dangerous $params = array('capallow'=>CAP_ALLOW, 'roleid'=>$guest_role->id); $sql = "SELECT COUNT(DISTINCT rc.contextid) @@ -676,22 +648,14 @@ function report_security_check_guestrole($detailed=false) { $riskycount = $DB->count_records_sql($sql, $params); - // it may have either no or 'guest' legacy type - nothing else, or else it would break during upgrades badly - $legacyok = false; - $params = array('capallow'=>CAP_ALLOW, 'roleid'=>$guest_role->id, 'legacy'=>'moodle/legacy:%'); - $sql = "SELECT rc.capability, 1 - FROM {role_capabilities} rc - WHERE rc.capability LIKE :legacy - AND rc.permission = :capallow - AND rc.roleid = :roleid"; - $legacycaps = $DB->get_records_sql($sql, $params); - if (!$legacycaps) { - $legacyok = true; - } else if (count($legacycaps) == 1 and isset($legacycaps['moodle/legacy:guest'])) { + // it may have either no or 'guest' archetype - nothing else, or else it would break during upgrades badly + if ($guest_role->archetype === '' or $guest_role->archetype === 'guest') { $legacyok = true; + } else { + $legacyok = false; } - if ($anythingcount or $riskycount or !$legacyok) { + if ($riskycount or !$legacyok) { $result->status = REPORT_SECURITY_CRITICAL; $result->info = get_string('check_guestrole_error', 'report_security', format_string($guest_role->name)); @@ -731,16 +695,6 @@ function report_security_check_frontpagerole($detailed=false) { return $result; } - // first test if do anything enabled - that would be really crazy! - $params = array('doanything'=>'moodle/site:doanything', 'capallow'=>CAP_ALLOW, 'roleid'=>$frontpage_role->id); - $sql = "SELECT COUNT(DISTINCT rc.contextid) - FROM {role_capabilities} rc - WHERE rc.capability = :doanything - AND rc.permission = :capallow - AND rc.roleid = :roleid"; - - $anythingcount = $DB->count_records_sql($sql, $params); - // risky caps - usually very dangerous $params = array('capallow'=>CAP_ALLOW, 'roleid'=>$frontpage_role->id); $sql = "SELECT COUNT(DISTINCT rc.contextid) @@ -753,19 +707,14 @@ function report_security_check_frontpagerole($detailed=false) { $riskycount = $DB->count_records_sql($sql, $params); // there is no legacy role type for frontpage yet - anyway we can not allow teachers or admins there! - $params = array('capallow'=>CAP_ALLOW, 'roleid'=>$frontpage_role->id, 'legacy'=>'moodle/legacy:%'); - $sql = "SELECT rc.capability, 1 - FROM {role_capabilities} rc - WHERE rc.capability LIKE :legacy - AND rc.permission = :capallow - AND rc.roleid = :roleid"; - $legacycaps = $DB->get_records_sql($sql, $params); - $legacyok = (!isset($legacycaps['moodle/legacy:teacher']) - and !isset($legacycaps['moodle/legacy:editingteacher']) - and !isset($legacycaps['moodle/legacy:coursecreator']) - and !isset($legacycaps['moodle/legacy:admin'])); + if ($frontpage_role->archetype === 'teacher' or $frontpage_role->archetype === 'editingteacher' + or $frontpage_role->archetype === 'coursecreator' or $frontpage_role->archetype === 'manager') { + $legacyok = false; + } else { + $legacyok = true; + } - if ($anythingcount or $riskycount or !$legacyok) { + if ($riskycount or !$legacyok) { $result->status = REPORT_SECURITY_CRITICAL; $result->info = get_string('check_frontpagerole_error', 'report_security', format_string($frontpage_role->name)); @@ -811,25 +760,6 @@ function report_security_check_defaultcourserole($detailed=false) { return $result; } - // first test if do anything enabled - that would be really crazy! - $params = array('doanything'=>'moodle/site:doanything', 'capallow'=>CAP_ALLOW, 'roleid'=>$student_role->id); - $sql = "SELECT DISTINCT rc.contextid - FROM {role_capabilities} rc - WHERE rc.capability = :doanything - AND rc.permission = :capallow - AND rc.roleid = :roleid"; - - if ($anything_contexts = $DB->get_records_sql($sql, $params)) { - foreach($anything_contexts as $contextid) { - if ($contextid == SYSCONTEXTID) { - $a = "$CFG->wwwroot/$CFG->admin/roles/define.php?action=view&roleid=$CFG->defaultcourseroleid"; - } else { - $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&roleid=$CFG->defaultcourseroleid"; - } - $problems[] = get_string('check_defaultcourserole_anything', 'report_security', $a); - } - } - // risky caps - usually very dangerous $params = array('capallow'=>CAP_ALLOW, 'roleid'=>$student_role->id); $sql = "SELECT DISTINCT rc.contextid @@ -851,14 +781,7 @@ function report_security_check_defaultcourserole($detailed=false) { } // course creator or administrator does not make any sense here - $params = array('capallow'=>CAP_ALLOW, 'roleid'=>$student_role->id, 'legacy'=>'moodle/legacy:%'); - $sql = "SELECT rc.capability, 1 - FROM {role_capabilities} rc - WHERE rc.capability LIKE :legacy - AND rc.permission = :capallow - AND rc.roleid = :roleid"; - $legacycaps = $DB->get_records_sql($sql, $params); - if (isset($legacycaps['moodle/legacy:coursecreator']) or isset($legacycaps['moodle/legacy:admin'])) { + if ($student_role->archetype === 'coursecreator' or $student_role->archetype === 'manager') { $problems[] = get_string('check_defaultcourserole_legacy', 'report_security'); } @@ -922,43 +845,16 @@ function report_security_check_courserole($detailed=false) { $sql = "SELECT DISTINCT rc.roleid FROM {role_capabilities} rc - WHERE (rc.capability = :coursecreator OR rc.capability = :admin OR rc.capability = :teacher OR rc.capability = :editingteacher) - AND rc.permission = ".CAP_ALLOW.""; - $params = array('coursecreator' => 'moodle/legacy:coursecreator', - 'admin' => 'moodle/legacy:admin', - 'teacher' => 'moodle/legacy:teacher', - 'editingteacher' => 'moodle/legacy:editingteacher'); + JOIN {role} r ON r.id = rc.roleid + WHERE (r.archetype = :coursecreator OR r.archetype = :teacher OR r.archetype = :editingteacher OR r.archetype = :manager)"; + $params = array('coursecreator' => 'coursecreator', + 'teacher' => 'teacher', + 'editingteacher' => 'editingteacher', + 'manager' => 'manager'); $riskyroleids = $DB->get_records_sql($sql, $params); $riskyroleids = array_keys($riskyroleids); - - // first test if do anything enabled - that would be really crazy!!!!!! - list($inroles, $params) = $DB->get_in_or_equal($roleids, SQL_PARAMS_NAMED, 'r0', true); - $params = array_merge($params, array('doanything'=>'moodle/site:doanything', 'capallow'=>CAP_ALLOW)); - $params['doanything'] = 'moodle/site:doanything'; - $params['capallow'] = CAP_ALLOW; - $sql = "SELECT rc.roleid, rc.contextid - FROM {role_capabilities} rc - WHERE rc.capability = :doanything - AND rc.permission = :capallow - AND rc.roleid $inroles - GROUP BY rc.roleid, rc.contextid - ORDER BY rc.roleid, rc.contextid"; - - $rs = $DB->get_recordset_sql($sql, $params); - foreach($rs as $res) { - $roleid = $res->roleid; - $contextid = $res->contextid; - if ($contextid == SYSCONTEXTID) { - $a = "$CFG->wwwroot/$CFG->admin/roles/define.php?action=view&roleid=$roleid"; - } else { - $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&roleid=$roleid"; - } - $problems[] = get_string('check_courserole_anything', 'report_security', $a); - } - $rs->close(); - // any XSS legacy cap does not make any sense here! list($inroles, $params) = $DB->get_in_or_equal($roleids, SQL_PARAMS_NAMED, 'r0', true); $sql = "SELECT DISTINCT c.id, c.shortname @@ -1034,37 +930,13 @@ function report_security_check_riskadmin($detailed=false) { $result->status = null; $result->link = null; - $params = array('doanything'=>'moodle/site:doanything', 'syscontextid'=>SYSCONTEXTID, 'capallow'=>CAP_ALLOW); + $sql = "SELECT u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email + FROM {user} u + WHERE u.id IN ($CFG->siteadmins)"; - $sql = "SELECT DISTINCT u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email - FROM {role_capabilities} rc - JOIN {role_assignments} ra ON (ra.contextid = rc.contextid AND ra.roleid = rc.roleid) - JOIN {user} u ON u.id = ra.userid - WHERE rc.capability = :doanything - AND rc.permission = :capallow - AND u.deleted = 0 - AND rc.contextid = :syscontextid"; - - $admins = $DB->get_records_sql($sql, $params); + $admins = $DB->get_records_sql($sql); $admincount = count($admins); - $sqlunsup = "SELECT u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid - FROM (SELECT rcx.* - FROM {role_capabilities} rcx - WHERE rcx.capability = :doanything AND rcx.permission = :capallow) rc, - {context} c, - {context} sc, - {role_assignments} ra, - {user} u - WHERE c.id = rc.contextid - AND (sc.path = c.path OR sc.path LIKE ".$DB->sql_concat('c.path', "'/%'")." OR c.path LIKE ".$DB->sql_concat('sc.path', "'/%'").") - AND u.id = ra.userid AND u.deleted = 0 - AND ra.contextid = sc.id AND ra.roleid = rc.roleid AND ra.contextid <> :syscontextid - GROUP BY u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid - ORDER BY u.lastname, u.firstname"; - - $unsupcount = $DB->count_records_sql("SELECT COUNT('x') FROM ($sqlunsup) unsup", $params); - if ($detailed) { foreach ($admins as $uid=>$user) { $url = "$CFG->wwwroot/user/view.php?id=$user->id"; @@ -1073,32 +945,11 @@ function report_security_check_riskadmin($detailed=false) { $admins = ''; } - if (!$unsupcount) { - $result->status = REPORT_SECURITY_OK; - $result->info = get_string('check_riskadmin_ok', 'report_security', $admincount); + $result->status = REPORT_SECURITY_OK; + $result->info = get_string('check_riskadmin_ok', 'report_security', $admincount); - if ($detailed) { - $result->details = get_string('check_riskadmin_detailsok', 'report_security', $admins); - } - - } else { - $result->status = REPORT_SECURITY_WARNING; - $a = (object)array('admincount'=>$admincount, 'unsupcount'=>$unsupcount); - $result->info = get_string('check_riskadmin_warning', 'report_security', $a); - - if ($detailed) { - $rs = $DB->get_recordset_sql($sqlunsup, $params); - $users = array(); - foreach ($rs as $user) { - $url = "$CFG->wwwroot/$CFG->admin/roles/assign.php?contextid=$user->contextid&roleid=$user->roleid"; - $a = (object)array('fullname'=>fullname($user), 'url'=>$url, 'email'=>$user->email); - $users[] = '
  • '.get_string('check_riskadmin_unassign', 'report_security', $a).'
    • '; - } - $rs->close(); - $users = ''; - $a = (object)array('admins'=>$admins, 'unsupported'=>$users); - $result->details = get_string('check_riskadmin_detailswarning', 'report_security', $a); - } + if ($detailed) { + $result->details = get_string('check_riskadmin_detailsok', 'report_security', $admins); } return $result; diff --git a/admin/report/unittest/db/access.php b/admin/report/unittest/db/access.php index 73d906b344a..0821a99d322 100644 --- a/admin/report/unittest/db/access.php +++ b/admin/report/unittest/db/access.php @@ -30,7 +30,7 @@ $capabilities = array( 'captype' => 'read', 'contextlevel' => CONTEXT_SYSTEM, 'legacy' => array( - 'admin' => CAP_ALLOW + 'manager' => CAP_ALLOW ), 'clonepermissionsfrom' => 'moodle/site:config', diff --git a/admin/roles/admins.php b/admin/roles/admins.php new file mode 100644 index 00000000000..065e29a0b22 --- /dev/null +++ b/admin/roles/admins.php @@ -0,0 +1,137 @@ +. + +/** + * Lets you site administrators + * + * @package moodlecore + * @subpackage role + * @copyright 2010 Petr Skoda (skodak) http://skodak.org + * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later + */ + +require_once(dirname(__FILE__) . '/../../config.php'); +require_once($CFG->dirroot . '/' . $CFG->admin . '/roles/lib.php'); + +$confirmadd = optional_param('confirmadd', 0, PARAM_INT); +$confirmdel = optional_param('confirmdel', 0, PARAM_INT); + +$PAGE->set_url('/admin/roles/admins.php'); + +admin_externalpage_setup('admins'); +if (!is_siteadmin()) { + die; +} + +$admisselector = new admins_existing_selector(); +$admisselector->set_extra_fields(array('username', 'email')); + +$potentialadmisselector = new admins_potential_selector(); +$potentialadmisselector->set_extra_fields(array('username', 'email')); + +if (optional_param('add', false, PARAM_BOOL) and confirm_sesskey()) { + if ($userstoadd = $potentialadmisselector->get_selected_users()) { + $user = reset($userstoadd); + $username = fullname($user) . " ($user->username, $user->email)"; + echo $OUTPUT->header(); + echo $OUTPUT->confirm(get_string('confirmaddadmin', 'role', $username), new moodle_url('/admin/roles/admins.php', array('confirmadd'=>$user->id, 'sesskey'=>sesskey())), $PAGE->url); + echo $OUTPUT->footer(); + die; + } + +} else if (optional_param('remove', false, PARAM_BOOL) and confirm_sesskey()) { + if ($userstoremove = $admisselector->get_selected_users()) { + $user = reset($userstoremove); + if ($USER->id == $user->id) { + //can not remove self + } else { + $username = fullname($user) . " ($user->username, $user->email)"; + echo $OUTPUT->header(); + echo $OUTPUT->confirm(get_string('confirmdeladmin', 'role', $username), new moodle_url('/admin/roles/admins.php', array('confirmdel'=>$user->id, 'sesskey'=>sesskey())), $PAGE->url); + echo $OUTPUT->footer(); + die; + } + } + +} else if ($confirmadd and confirm_sesskey()) { + $admins = array(); + foreach(explode(',', $CFG->siteadmins) as $admin) { + $admin = (int)$admin; + if ($admin) { + $admins[$admin] = $admin; + } + } + $admins[$confirmadd] = $confirmadd; + set_config('siteadmins', implode(',', $admins)); + redirect($PAGE->url); + +} else if ($confirmdel and confirm_sesskey() and $confirmdel != $USER->id) { + $admins = array(); + foreach(explode(',', $CFG->siteadmins) as $admin) { + $admin = (int)$admin; + if ($admin) { + $admins[$admin] = $admin; + } + } + unset($admins[$confirmdel]); + set_config('siteadmins', implode(',', $admins)); + redirect($PAGE->url); +} + +/// Print header +echo $OUTPUT->header(); +?> + +
    +

    + +
    +
    + + + + + + + + +
    +

    + +

    + display(); ?> +     		+

    +
    + +

    +     		+

    + +

    + display(); ?> +
    +
    +
    +
    + +requires->js_function_call('init_add_remove_admis_page'); + +echo $OUTPUT->footer(); diff --git a/admin/roles/assign.php b/admin/roles/assign.php index 268788e9fdc..32ebadfb2ba 100755 --- a/admin/roles/assign.php +++ b/admin/roles/assign.php @@ -33,7 +33,6 @@ $roleid = optional_param('roleid', 0, PARAM_INT); $userid = optional_param('userid', 0, PARAM_INT); // needed for user tabs $courseid = optional_param('courseid', 0, PARAM_INT); // needed for user tabs - $hidden = optional_param('hidden', 0, PARAM_BOOL); // whether this assignment is hidden $extendperiod = optional_param('extendperiod', 0, PARAM_INT); $extendbase = optional_param('extendbase', 3, PARAM_INT); @@ -148,11 +147,7 @@ $options = array('context' => $context, 'roleid' => $roleid); $potentialuserselector = roles_get_potential_user_selector($context, 'addselect', $options); - if ($context->contextlevel == CONTEXT_SYSTEM && is_admin_role($roleid)) { - $currentuserselector = new existing_role_holders_site_admin('removeselect', $options); - } else { - $currentuserselector = new existing_role_holders('removeselect', $options); - } + $currentuserselector = new existing_role_holders('removeselect', $options); /// Process incoming role assignments $errors = array(); @@ -196,7 +191,7 @@ } else { $timeend = 0; } - if (! role_assign($roleid, $adduser->id, 0, $context->id, $timestart, $timeend, $hidden)) { + if (! role_assign($roleid, $adduser->id, 0, $context->id, $timestart, $timeend)) { $a = new stdClass; $a->role = $assignableroles[$roleid]; $a->user = fullname($adduser); @@ -314,12 +309,6 @@ -

    /> -


    diff --git a/admin/roles/define.php b/admin/roles/define.php index 3ba2e3cbabd..9e6e2194b2b 100755 --- a/admin/roles/define.php +++ b/admin/roles/define.php @@ -103,7 +103,7 @@ admin_externalpage_print_header(); $currenttab = 'manage'; - include_once('managetabs.php'); + include('managetabs.php'); if ($action == 'add') { $title = get_string('addinganewrole', 'role'); @@ -131,7 +131,7 @@ $options['action'] = 'edit'; echo $OUTPUT->single_button(new moodle_url($defineurl, $options), get_string('edit')); $options['action'] = 'reset'; - if ($definitiontable->get_legacy_type()) { + if ($definitiontable->get_archetype()) { echo $OUTPUT->single_button(new moodle_url($manageurl, $options), get_string('resetrole', 'role')); } else { echo $OUTPUT->single_button(new moodle_url($manageurl, $options), get_string('resetrolenolegacy', 'role')); diff --git a/admin/roles/lib.php b/admin/roles/lib.php index 09c11317d1a..dde9acaac21 100644 --- a/admin/roles/lib.php +++ b/admin/roles/lib.php @@ -144,7 +144,7 @@ abstract class capability_table_base { protected abstract function num_extra_columns(); /** - * For subclasses to override. Allows certain capabilties (e.g. legacy capabilities) + * For subclasses to override. Allows certain capabilties * to be left out of the table. * * @param object $capability the capability this row relates to. @@ -213,10 +213,6 @@ class check_capability_table extends capability_table_base { return 1; } - protected function skip_row($capability) { - return $capability->name != 'moodle/site:doanything' && is_legacy($capability->name); - } - protected function get_row_classes($capability) { $this->hascap = has_capability($capability->name, $this->context, $this->user->id); if ($this->hascap) { @@ -285,10 +281,6 @@ class permissions_table extends capability_table_base { return 3; } - protected function skip_row($capability) { - return $capability->name != 'moodle/site:doanything' && is_legacy($capability->name); - } - protected function add_row_cells($capability) { global $OUTPUT, $PAGE; @@ -554,7 +546,6 @@ class define_role_table_advanced extends capability_table_with_risks { protected $errors; protected $contextlevels; protected $allcontextlevels; - protected $legacyroles; protected $disabled = ''; public function __construct($context, $roleid) { @@ -571,8 +562,6 @@ class define_role_table_advanced extends capability_table_with_risks { CONTEXT_MODULE => get_string('activitymodule'), CONTEXT_BLOCK => get_string('block') ); - - $this->legacyroles = get_legacy_roles(); } protected function load_current_permissions() { @@ -581,7 +570,6 @@ class define_role_table_advanced extends capability_table_with_risks { if (!$this->role = $DB->get_record('role', array('id' => $this->roleid))) { throw new moodle_exception('invalidroleid'); } - $this->role->legacytype = get_legacy_type($this->roleid); $contextlevels = get_role_contextlevels($this->roleid); // Put the contextlevels in the array keys, as well as the values. if (!empty($contextlevels)) { @@ -594,7 +582,7 @@ class define_role_table_advanced extends capability_table_with_risks { $this->role->name = ''; $this->role->shortname = ''; $this->role->description = ''; - $this->role->legacytype = ''; + $this->role->archetype = ''; $this->contextlevels = array(); } parent::load_current_permissions(); @@ -638,12 +626,13 @@ class define_role_table_advanced extends capability_table_with_risks { } // Legacy type. - $legacytype = optional_param('legacytype', null, PARAM_RAW); - if (!is_null($legacytype)) { - if (array_key_exists($legacytype, $this->legacyroles)) { - $this->role->legacytype = $legacytype; + $archetype = optional_param('archetype', null, PARAM_RAW); + if ($archetype) { + $archetypes = get_role_archetypes(); + if (isset($archetypes[$archetype])){ + $this->role->archetype = $archetype; } else { - $this->role->legacytype = ''; + $this->role->archetype = ''; } } @@ -686,16 +675,12 @@ class define_role_table_advanced extends capability_table_with_risks { return $this->role->id; } - public function get_legacy_type() { - return $this->role->legacytype; + public function get_archetype() { + return $this->role->archetype; } protected function load_parent_permissions() { - if ($this->role->legacytype) { - $this->parentpermissions = get_default_capabilities($this->role->legacytype); - } else { - $this->parentpermissions = array(); - } + $this->parentpermissions = get_default_capabilities($this->role->archetype); } public function save_changes() { @@ -703,25 +688,11 @@ class define_role_table_advanced extends capability_table_with_risks { if (!$this->roleid) { // Creating role - if (isset($this->legacyroles[$this->role->legacytype])) { - $legacycap = $this->legacyroles[$this->role->legacytype]; - } else { - $legacycap = ''; - } - $this->role->id = create_role($this->role->name, $this->role->shortname, $this->role->description, $legacycap); + $this->role->id = create_role($this->role->name, $this->role->shortname, $this->role->description, $this->role->archetype); $this->roleid = $this->role->id; // Needed to make the parent::save_changes(); call work. } else { // Updating role $DB->update_record('role', $this->role); - - // Legacy type - foreach($this->legacyroles as $type => $cap) { - if ($type == $this->role->legacytype) { - assign_capability($cap, CAP_ALLOW, $this->role->id, $this->context->id); - } else { - unassign_capability($cap, $this->role->id); - } - } } // Assignable contexts. @@ -731,10 +702,6 @@ class define_role_table_advanced extends capability_table_with_risks { parent::save_changes(); } - protected function skip_row($capability) { - return is_legacy($capability->name); - } - protected function get_name_field($id) { return ''; } @@ -747,14 +714,14 @@ class define_role_table_advanced extends capability_table_with_risks { return print_textarea(true, 10, 50, 50, 10, 'description', $this->role->description, 0, true); } - protected function get_legacy_type_field($id) { + protected function get_archetype_field($id) { global $OUTPUT; $options = array(); $options[''] = get_string('none'); - foreach($this->legacyroles as $type => $cap) { - $options[$type] = get_string('legacy:'.$type, 'role'); + foreach(get_role_archetypes() as $type) { + $options[$type] = get_string('archetype'.$type, 'role'); } - return html_writer::select($options, 'legacytype', $this->role->legacytype, false); + return html_writer::select($options, 'archetype', $this->role->archetype, false); } protected function get_assignable_levels_control() { @@ -814,7 +781,7 @@ class define_role_table_advanced extends capability_table_with_risks { $this->print_field('name', get_string('name'), $this->get_name_field('name')); $this->print_field('shortname', get_string('shortname'), $this->get_shortname_field('shortname')); $this->print_field('edit-description', get_string('description'), $this->get_description_field('description')); - $this->print_field('menulegacytype', get_string('legacytype', 'role'), $this->get_legacy_type_field('legacytype')); + $this->print_field('menuarchetype', get_string('archetype', 'role'), $this->get_archetype_field('archetype')); $this->print_field('', get_string('maybeassignedin', 'role'), $this->get_assignable_levels_control()); echo ""; @@ -905,11 +872,11 @@ class view_role_definition_table extends define_role_table_advanced { return format_text($this->role->description, FORMAT_HTML); } - protected function get_legacy_type_field($id) { - if (empty($this->role->legacytype)) { + protected function get_archetype_field($id) { + if (empty($this->role->archetype)) { return get_string('none'); } else { - return get_string('legacy:'.$this->role->legacytype, 'role'); + return get_string('archetype'.$this->role->archetype, 'role'); } } @@ -976,10 +943,6 @@ class override_permissions_table_advanced extends capability_table_with_risks { return $this->haslockedcapabiltites; } - protected function skip_row($capability) { - return is_legacy($capability->name); - } - protected function add_permission_cells($capability) { $disabled = ''; if ($capability->locked || $this->parentpermissions[$capability->name] == CAP_PROHIBIT) { @@ -1058,7 +1021,7 @@ abstract class role_assign_user_selector_base extends user_selector_base { * some CONTEXT_BLOCK). * * In this case we replicate part of get_users_by_capability() get the users - * with moodle/course:view (or moodle/site:doanything). We can't use + * with moodle/course:participate. We can't use * get_users_by_capability() becuase * 1) get_users_by_capability() does not deal with searching by name * 2) exceptions array can be potentially large for large courses @@ -1067,26 +1030,20 @@ class potential_assignees_below_course extends role_assign_user_selector_base { public function find_users($search) { global $DB; - // Get roles with some assignement to the 'moodle/course:view' capability. - $possibleroles = get_roles_with_capability('moodle/course:view', CAP_ALLOW, $this->context); + // Get roles with some assignement to the 'moodle/course:participate' capability. + $possibleroles = get_roles_with_capability('moodle/course:participate', CAP_ALLOW, $this->context); if (empty($possibleroles)) { // If there aren't any, we are done. return array(); } // Now exclude the admin roles, and check the actual permission on - // 'moodle/course:view' to make sure it is allow. - $doanythingroles = get_roles_with_capability('moodle/site:doanything', - CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM)); + // 'moodle/course:participate' to make sure it is allow. $validroleids = array(); foreach ($possibleroles as $possiblerole) { - if (isset($doanythingroles[$possiblerole->id])) { - continue; - } - - if ($caps = role_context_capabilities($possiblerole->id, $this->context, 'moodle/course:view')) { // resolved list - if (isset($caps['moodle/course:view']) && $caps['moodle/course:view'] > 0) { // resolved capability > 0 + if ($caps = role_context_capabilities($possiblerole->id, $this->context, 'moodle/course:participate')) { // resolved list + if (isset($caps['moodle/course:participate']) && $caps['moodle/course:participate'] > 0) { // resolved capability > 0 $validroleids[] = $possiblerole->id; } } @@ -1116,13 +1073,13 @@ class potential_assignees_below_course extends role_assign_user_selector_base { AND u.id NOT IN ( SELECT u.id FROM {role_assignments} r, {user} u - WHERE r.contextid = ? + WHERE r.contextid = :contextid AND u.id = r.userid - AND r.roleid = ?)"; + AND r.roleid = :roleid)"; $order = ' ORDER BY lastname ASC, firstname ASC'; - $params[] = $this->context->id; - $params[] = $this->roleid; + $params['contextid'] = $this->context->id; + $params['roleid'] = $this->roleid; // Check to see if there are too many to show sensibly. if (!$this->is_validating()) { @@ -1168,13 +1125,13 @@ class potential_assignees_course_and_above extends role_assign_user_selector_bas AND id NOT IN ( SELECT u.id FROM {role_assignments} r, {user} u - WHERE r.contextid = ? + WHERE r.contextid = :contextid AND u.id = r.userid - AND r.roleid = ?)"; + AND r.roleid = :roleid)"; $order = ' ORDER BY lastname ASC, firstname ASC'; - $params[] = $this->context->id; - $params[] = $this->roleid; + $params['contextid'] = $this->context->id; + $params['roleid'] = $this->roleid; if (!$this->is_validating()) { $potentialmemberscount = $DB->count_records_sql($countfields . $sql, $params); @@ -1204,29 +1161,27 @@ class potential_assignees_course_and_above extends role_assign_user_selector_bas * question on the assign roles page. */ class existing_role_holders extends role_assign_user_selector_base { - protected $strhidden; public function __construct($name, $options) { parent::__construct($name, $options); - $this->strhidden = get_string('hiddenassign'); } public function find_users($search) { global $DB; list($wherecondition, $params) = $this->search_sql($search, 'u'); - list($ctxcondition, $ctxparams) = $DB->get_in_or_equal(get_parent_contexts($this->context, true)); + list($ctxcondition, $ctxparams) = $DB->get_in_or_equal(get_parent_contexts($this->context, true), SQL_PARAMS_NAMED, 'ctx00'); $params = array_merge($params, $ctxparams); - $params[] = $this->roleid; + $params['roleid'] = $this->roleid; - $sql = "SELECT ra.id as raid," . $this->required_fields_sql('u') . ",ra.hidden,ra.contextid + $sql = "SELECT ra.id as raid," . $this->required_fields_sql('u') . ",ra.contextid FROM {role_assignments} ra JOIN {user} u ON u.id = ra.userid JOIN {context} ctx ON ra.contextid = ctx.id WHERE $wherecondition AND ctx.id $ctxcondition AND - ra.roleid = ? + ra.roleid = :roleid ORDER BY ctx.depth DESC, u.lastname, u.firstname"; $contextusers = $DB->get_records_sql($sql, $params); @@ -1314,34 +1269,6 @@ class existing_role_holders extends role_assign_user_selector_base { return get_string('usersfrom', 'role', $contextname); } } - - // Override to add (hidden) to hidden role assignments. - public function output_user($user) { - $output = parent::output_user($user); - if ($user->hidden) { - $output .= ' (' . $this->strhidden . ')'; - } - return $output; - } -} - -/** - * A special subclass to use when unassigning admins at site level. Disables - * the option for admins to unassign themselves. - */ -class existing_role_holders_site_admin extends existing_role_holders { - public function find_users($search) { - global $USER; - $groupedusers = parent::find_users($search); - foreach ($groupedusers as $group) { - foreach ($group as &$user) { - if ($user->id == $USER->id) { - $user->disabled = true; - } - } - } - return $groupedusers; - } } /** @@ -1590,3 +1517,82 @@ function roles_get_potential_user_selector($context, $name, $options) { return $potentialuserselector; } +class admins_potential_selector extends user_selector_base { + /** + * @param string $name control name + * @param array $options should have two elements with keys groupid and courseid. + */ + public function __construct() { + global $CFG, $USER; + $admins = explode(',', $CFG->siteadmins); + parent::__construct('addselect', array('multiselect'=>false, 'exclude'=>$admins)); + } + + public function find_users($search) { + global $DB; + list($wherecondition, $params) = $this->search_sql($search, ''); + + $fields = 'SELECT ' . $this->required_fields_sql(''); + $countfields = 'SELECT COUNT(1)'; + + $sql = " FROM {user} + WHERE $wherecondition"; + $order = ' ORDER BY lastname ASC, firstname ASC'; + + $availableusers = $DB->get_records_sql($fields . $sql . $order, $params); + + if (empty($availableusers)) { + return array(); + } + + if ($search) { + $groupname = get_string('potusersmatching', 'role', $search); + } else { + $groupname = get_string('potusers', 'role'); + } + + return array($groupname => $availableusers); + } +} + +class admins_existing_selector extends user_selector_base { + /** + * @param string $name control name + * @param array $options should have two elements with keys groupid and courseid. + */ + public function __construct() { + global $CFG, $USER; + parent::__construct('removeselect', array('multiselect'=>false)); + } + + public function find_users($search) { + global $DB, $CFG; + list($wherecondition, $params) = $this->search_sql($search, ''); + + $fields = 'SELECT ' . $this->required_fields_sql(''); + $countfields = 'SELECT COUNT(1)'; + + if ($wherecondition) { + $wherecondition = "$wherecondition AND id IN ($CFG->siteadmins)"; + } else { + $wherecondition = "id IN ($CFG->siteadmins)"; + } + $sql = " FROM {user} + WHERE $wherecondition"; + $order = ' ORDER BY lastname ASC, firstname ASC'; + + $availableusers = $DB->get_records_sql($fields . $sql . $order, $params); + + if (empty($availableusers)) { + return array(); + } + + if ($search) { + $groupname = get_string('extusersmatching', 'role', $search); + } else { + $groupname = get_string('extusers', 'role'); + } + + return array($groupname => $availableusers); + } +} diff --git a/admin/roles/manage.php b/admin/roles/manage.php index 81e693e846f..f09efb5ee14 100755 --- a/admin/roles/manage.php +++ b/admin/roles/manage.php @@ -61,11 +61,6 @@ $undeletableroles[$CFG->guestroleid] = 1; $undeletableroles[$CFG->defaultuserroleid] = 1; $undeletableroles[$CFG->defaultcourseroleid] = 1; - // If there is only one admin role, add that to $undeletableroles too. - $adminroles = get_admin_roles(); - if (count($adminroles) == 1) { - $undeletableroles[reset($adminroles)->id] = 1; - } ///.Process submitted data. $confirmed = optional_param('confirm', false, PARAM_BOOL) && data_submitted() && confirm_sesskey(); @@ -160,7 +155,7 @@ $a->id = $roleid; $a->name = $roles[$roleid]->name; $a->shortname = $roles[$roleid]->shortname; - $a->legacytype = get_legacy_type($roleid); + $a->legacytype = $roles[$roleid]->archetype; if (empty($a->legacytype)) { $warning = get_string('resetrolesurenolegacy', 'role', $a); } else { @@ -168,22 +163,21 @@ } $formcontinue = new single_button(new moodle_url('manage.php', $optionsyes), get_string('yes')); $formcancel = new single_button(new moodle_url('manage.php', $optionsno), get_string('no'), 'get'); - echo $OUTPUT->confirm(get_string('confirmmessage', 'bulkusers', $usernames), $formcontinue, $formcancel); + echo $OUTPUT->confirm($warning, $formcontinue, $formcancel); echo $OUTPUT->footer(); die; } // Do the reset. - $legacytype = get_legacy_type($roleid); - if ($legacytype) { - set_role_contextlevels($roleid, get_default_contextlevels($legacytype)); + if ($roles[$roleid]->archetype) { + set_role_contextlevels($roleid, get_default_contextlevels($roles[$roleid]->archetype)); } reset_role_capabilities($roleid); // Mark context dirty, log and redirect. mark_context_dirty($systemcontext->path); add_to_log(SITEID, 'role', 'reset', 'admin/roles/manage.php?action=reset&roleid=' . $roleid, $roles[$roleid]->localname, '', $USER->id); - redirect($defineurl . '?action=view&roleid=' . $roleid); + redirect($defineurl . '?action=view&roleid=' . $roleid); break; } diff --git a/admin/settings/appearance.php b/admin/settings/appearance.php index 941122efb0a..7f09dbd3bd6 100644 --- a/admin/settings/appearance.php +++ b/admin/settings/appearance.php @@ -128,7 +128,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page $temp->add(new admin_setting_configtext('mycoursesperpage', get_string('mycoursesperpage', 'admin'), get_string('configmycoursesperpage', 'admin'), 21, PARAM_INT)); $ADMIN->add('appearance', $temp); - // new CFG variable for coursemanager (what roles to display) + // coursemanager is the person responsible for course - usually manages enrolments, receives notification, etc. $temp = new admin_settingpage('coursemanager', get_string('coursemanager', 'admin')); $temp->add(new admin_setting_special_coursemanager()); $ADMIN->add('appearance', $temp); diff --git a/admin/settings/security.php b/admin/settings/security.php index e59b8a232a8..6c1081d04b9 100644 --- a/admin/settings/security.php +++ b/admin/settings/security.php @@ -17,7 +17,11 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page $temp->add(new admin_setting_configcheckbox('forcelogin', get_string('forcelogin', 'admin'), get_string('configforcelogin', 'admin'), 0)); $temp->add(new admin_setting_configcheckbox('forceloginforprofiles', get_string('forceloginforprofiles', 'admin'), get_string('configforceloginforprofiles', 'admin'), 1)); $temp->add(new admin_setting_configcheckbox('opentogoogle', get_string('opentogoogle', 'admin'), get_string('configopentogoogle', 'admin'), 0)); - + $temp->add(new admin_setting_pickroles('profileroles', + get_string('profileroles','admin'), + get_string('configprofileroles', 'admin'), + array('student', 'teacher', 'editingteacher'))); + $max_upload_choices = get_max_upload_sizes(); // maxbytes set to 0 will allow the maxium server lmit for uploads $max_upload_choices[0] = get_string('serverlimit', 'admin'); diff --git a/admin/settings/subsystems.php b/admin/settings/subsystems.php index d4e46e61ec7..2fa348c2f12 100644 --- a/admin/settings/subsystems.php +++ b/admin/settings/subsystems.php @@ -37,7 +37,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page $optionalsubsystems->add(new admin_setting_pickroles('progresstrackedroles', get_string('progresstrackedroles','completion'), get_string('configprogresstrackedroles', 'completion'), - array('moodle/legacy:student'))); + array('student'))); $optionalsubsystems->add(new admin_setting_configcheckbox('enableavailability', get_string('enableavailability','condition'), get_string('configenableavailability','condition'), 0)); diff --git a/admin/settings/users.php b/admin/settings/users.php index 2a5ebf3b26a..3029472ed9a 100644 --- a/admin/settings/users.php +++ b/admin/settings/users.php @@ -84,65 +84,78 @@ if ($hassiteconfig if ($ADMIN->fulltree) { if (!during_initial_install()) { $context = get_context_instance(CONTEXT_SYSTEM); - if (!$guestrole = get_guest_role()) { - $guestrole->id = 0; - } - if ($studentroles = get_roles_with_capability('moodle/legacy:student', CAP_ALLOW)) { - $studentrole = array_shift($studentroles); /// Take the first one - } else { - $studentrole->id = 0; - } - if ($userroles = get_roles_with_capability('moodle/legacy:user', CAP_ALLOW)) { - $userrole = array_shift($userroles); /// Take the first one - } else { - $userrole->id = 0; - } - if (empty($CFG->creatornewroleid)) { - if ($teacherroles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW, $context)) { - $teachereditrole = array_shift($teacherroles); - set_config('creatornewroleid', $teachereditrole->id); - } else { - set_config('creatornewroleid', 0); + $allroles = array(); + $generalroles = array(); + $guestroles = array(); + $userroles = array(); + $studentroles = array(); + $teacherroles = array(); + $creatornewroles = array(); + + foreach (get_all_roles() as $role) { + $rolename = strip_tags(format_string($role->name)) . ' ('. $role->shortname . ')'; + $allroles[$role->id] = $rolename; + switch ($role->archetype) { + case 'manager': + $creatornewroles[$role->id] = $rolename; + break; + case 'coursecreator': + break; + case 'editingteacher': + $teacherroles[$role->id] = $rolename; + $creatornewroles[$role->id] = $rolename; + break; + case 'teacher': + $creatornewroles[$role->id] = $rolename; + break; + case 'student': + $studentroles[$role->id] = $rolename; + break; + case 'guest': + $guestroles[$role->id] = $rolename; + break; + case 'user': + $userroles[$role->id] = $rolename; + break; + case 'frontpage': + break; + default: + $creatornewroles[$role->id] = $rolename; + $generalroles[$role->id] = $rolename; + break; } } - if (!$guestroles = get_roles_with_capability('moodle/legacy:guest', CAP_ALLOW)) { - $guestroles = array(); - $defaultguestid = null; - } else { - $defaultguestid = reset($guestroles); - $defaultguestid = $defaultguestid->id; - } - // we must not use assignable roles here: - // 1/ unsetting roles as assignable for admin might bork the settings! - // 2/ default user role should not be assignable anyway - $allroles = array(); - $nonguestroles = array(); - if ($roles = get_all_roles()) { - foreach ($roles as $role) { - $rolename = strip_tags(format_string($role->name, true)); - $allroles[$role->id] = $rolename; - if (!isset($guestroles[$role->id])) { - $nonguestroles[$role->id] = $rolename; - } - } + reset($guestroles); + $defaultguestid = key($guestroles); + reset($studentroles); + $defaultstudentid = key($studentroles); + reset($teacherroles); + $defaultteacherid = key($teacherroles); + + if ($userroles) { + reset($userroles); + $defaultuserid = key($userroles); + } else { + $userroles = array('0'=>get_string('none')); + $defaultuserid = 0; } $temp->add(new admin_setting_configselect('notloggedinroleid', get_string('notloggedinroleid', 'admin'), - get_string('confignotloggedinroleid', 'admin'), $defaultguestid, $allroles )); + get_string('confignotloggedinroleid', 'admin'), $defaultguestid, ($guestroles + $generalroles))); $temp->add(new admin_setting_configselect('guestroleid', get_string('guestroleid', 'admin'), - get_string('configguestroleid', 'admin'), $defaultguestid, $allroles)); + get_string('configguestroleid', 'admin'), $defaultguestid, ($guestroles + $generalroles))); $temp->add(new admin_setting_configselect('defaultuserroleid', get_string('defaultuserroleid', 'admin'), - get_string('configdefaultuserroleid', 'admin'), $userrole->id, $nonguestroles)); // guest role here breaks a lot of stuff + get_string('configdefaultuserroleid', 'admin'), $defaultuserid, ($userroles + $generalroles))); } $temp->add(new admin_setting_configcheckbox('nodefaultuserrolelists', get_string('nodefaultuserrolelists', 'admin'), get_string('confignodefaultuserrolelists', 'admin'), 0)); if (!during_initial_install()) { $temp->add(new admin_setting_configselect('defaultcourseroleid', get_string('defaultcourseroleid', 'admin'), - get_string('configdefaultcourseroleid', 'admin'), $studentrole->id, $allroles)); + get_string('configdefaultcourseroleid', 'admin'), $defaultstudentid, $allroles)); $temp->add(new admin_setting_configselect('creatornewroleid', get_string('creatornewroleid', 'admin'), - get_string('configcreatornewroleid', 'admin'), $CFG->creatornewroleid, $allroles)); + get_string('configcreatornewroleid', 'admin'), $defaultteacherid, $creatornewroles)); } $temp->add(new admin_setting_configcheckbox('autologinguests', get_string('autologinguests', 'admin'), get_string('configautologinguests', 'admin'), 0)); @@ -174,6 +187,9 @@ if ($hassiteconfig } $ADMIN->add('roles', $temp); + if (is_siteadmin()) { + $ADMIN->add('roles', new admin_externalpage('admins', get_string('siteadministrators', 'role'), "$CFG->wwwroot/$CFG->admin/roles/admins.php")); + } $ADMIN->add('roles', new admin_externalpage('defineroles', get_string('defineroles', 'role'), "$CFG->wwwroot/$CFG->admin/roles/manage.php", 'moodle/role:manage')); $ADMIN->add('roles', new admin_externalpage('assignroles', get_string('assignglobalroles', 'role'), "$CFG->wwwroot/$CFG->admin/roles/assign.php?contextid=".$systemcontext->id, 'moodle/role:assign')); $ADMIN->add('roles', new admin_externalpage('checkpermissions', get_string('checkglobalpermissions', 'role'), "$CFG->wwwroot/$CFG->admin/roles/check.php?contextid=".$systemcontext->id, array('moodle/role:assign', 'moodle/role:safeoverride', 'moodle/role:override', 'moodle/role:manage'))); diff --git a/admin/uploaduser.php b/admin/uploaduser.php index b085ddc2fcc..39669f9bbf2 100755 --- a/admin/uploaduser.php +++ b/admin/uploaduser.php @@ -322,7 +322,7 @@ if ($formdata = $mform->is_cancelled()) { continue; } if ($existinguser) { - if (has_capability('moodle/site:doanything', $systemcontext, $existinguser->id)) { + if (is_siteadmin($existinguser->id)) { $upt->track('status', $strusernotdeletedadmin, 'error'); $deleteerrors++; continue; @@ -360,7 +360,7 @@ if ($formdata = $mform->is_cancelled()) { if ($olduser = $DB->get_record('user', array('username'=>$oldusername, 'mnethostid'=>$user->mnethostid))) { $upt->track('id', $olduser->id, 'normal', false); - if (has_capability('moodle/site:doanything', $systemcontext, $olduser->id)) { + if (is_siteadmin($olduser->id)) { $upt->track('status', $strusernotrenamedadmin, 'error'); $renameerrors++; continue; @@ -423,7 +423,7 @@ if ($formdata = $mform->is_cancelled()) { if ($existinguser) { $user->id = $existinguser->id; - if (has_capability('moodle/site:doanything', $systemcontext, $user->id)) { + if (is_siteadmin($user->id)) { $upt->track('status', $strusernotupdatedadmin, 'error'); $userserrors++; continue; @@ -668,7 +668,7 @@ if ($formdata = $mform->is_cancelled()) { // find group to add to if (!empty($user->{'group'.$i})) { // make sure user is enrolled into course before adding into groups - if (!has_capability('moodle/course:view', $coursecontext, $user->id, false)) { + if (!is_enrolled($coursecontext, $user->id)) { $upt->track('enrolments', get_string('addedtogroupnotenrolled', '', $gname), 'error'); continue; } @@ -1175,12 +1175,6 @@ function uu_allowed_roles($shortname=false) { $choices[$role->id] = format_string($role->name); } } - // get rid of all admin roles - if ($adminroles = get_roles_with_capability('moodle/site:doanything', CAP_ALLOW)) { - foreach($adminroles as $adminrole) { - unset($choices[$adminrole->id]); - } - } return $choices; } diff --git a/admin/uploaduser_form.php b/admin/uploaduser_form.php index 48a9158eae5..14c40abc3d9 100644 --- a/admin/uploaduser_form.php +++ b/admin/uploaduser_form.php @@ -121,7 +121,7 @@ class admin_uploaduser_form2 extends moodleform { unset($choices[0]); $mform->addElement('select', 'uulegacy2', get_string('uulegacy2role', 'admin'), $choices); - if ($editteacherroles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW)) { + if ($editteacherroles = get_archetype_roles('editingteacher')) { $editteacherrole = array_shift($editteacherroles); /// Take the first one $mform->setDefault('uulegacy2', $editteacherrole->id); unset($editteacherroles); @@ -130,7 +130,7 @@ class admin_uploaduser_form2 extends moodleform { } $mform->addElement('select', 'uulegacy3', get_string('uulegacy3role', 'admin'), $choices); - if ($teacherroles = get_roles_with_capability('moodle/legacy:teacher', CAP_ALLOW)) { + if ($teacherroles = get_archetype_roles('teacher')) { $teacherrole = array_shift($teacherroles); /// Take the first one $mform->setDefault('uulegacy3', $teacherrole->id); unset($teacherroles); diff --git a/admin/webservice/lib.php b/admin/webservice/lib.php index 0e6ed07dbde..c192dc29ec0 100644 --- a/admin/webservice/lib.php +++ b/admin/webservice/lib.php @@ -59,7 +59,7 @@ class service_user_selector extends user_selector_base { //by default wherecondition retrieves all users except the deleted, not //confirmed and guest list($wherecondition, $params) = $this->search_sql($search, 'u'); - $params[] = $this->serviceid; + $params['serviceid'] = $this->serviceid; $fields = 'SELECT ' . $this->required_fields_sql('u'); @@ -70,13 +70,13 @@ class service_user_selector extends user_selector_base { $sql = " FROM {user} u, {external_services_users} esu WHERE $wherecondition AND esu.userid = u.id - AND esu.externalserviceid = ?"; + AND esu.externalserviceid = :serviceid"; } else { ///the following SQL retrieve all users that are not allowed to the serviceid $sql = " FROM {user} u WHERE $wherecondition AND NOT EXISTS (SELECT esu.userid FROM {external_services_users} esu - WHERE esu.externalserviceid = ? + WHERE esu.externalserviceid = :serviceid AND esu.userid = u.id)"; } diff --git a/auth/cas/auth.php b/auth/cas/auth.php index 9687cddd332..7652e0dc266 100644 --- a/auth/cas/auth.php +++ b/auth/cas/auth.php @@ -797,7 +797,7 @@ if ( !is_object($PHPCAS_CLIENT) ) { $sitecontext = get_context_instance(CONTEXT_SYSTEM); if (!empty($this->config->creators) and !empty($this->config->memberattribute) - and $roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) { + and $roles = get_archetype_roles('coursecreator')) { $creatorrole = array_shift($roles); // We can only use one, let's use the first one } else { $creatorrole = false; @@ -846,7 +846,7 @@ if ( !is_object($PHPCAS_CLIENT) ) { $sitecontext = get_context_instance(CONTEXT_SYSTEM); if (!empty($this->config->creators) and !empty($this->config->memberattribute) - and $roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) { + and $roles = get_archetype_roles('coursecreator')) { $creatorrole = array_shift($roles); // We can only use one, let's use the first one } else { $creatorrole = false; @@ -1118,7 +1118,7 @@ if (!empty($this->config->attrcreators)) { if ($iscreator === null) { return; //nothing to sync - creators not configured } - if ($roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) { + if ($roles = get_archetype_roles('coursecreator')) { $creatorrole = array_shift($roles); // We can only use one, let's use the first one $systemcontext = get_context_instance(CONTEXT_SYSTEM); if ($iscreator) { // Following calls will not create duplicates diff --git a/auth/fc/auth.php b/auth/fc/auth.php index 8e9018204a9..ce9a5933399 100644 --- a/auth/fc/auth.php +++ b/auth/fc/auth.php @@ -178,7 +178,7 @@ class auth_plugin_fc extends auth_plugin_base { return; //nothing to sync - creators not configured } - if ($roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) { + if ($roles = get_archetype_roles('coursecreator')) { $creatorrole = array_shift($roles); // We can only use one, let's use the first one $systemcontext = get_context_instance(CONTEXT_SYSTEM); diff --git a/auth/ldap/auth.php b/auth/ldap/auth.php index 57ab1322351..e92af769ac8 100644 --- a/auth/ldap/auth.php +++ b/auth/ldap/auth.php @@ -724,7 +724,7 @@ class auth_plugin_ldap extends auth_plugin_base { $sitecontext = get_context_instance(CONTEXT_SYSTEM); if (!empty($this->config->creators) and !empty($this->config->memberattribute) - and $roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) { + and $roles = get_archetype_roles('coursecreator')) { $creatorrole = array_shift($roles); // We can only use one, let's use the first one } else { $creatorrole = false; @@ -774,7 +774,7 @@ class auth_plugin_ldap extends auth_plugin_base { $sitecontext = get_context_instance(CONTEXT_SYSTEM); if (!empty($this->config->creators) and !empty($this->config->memberattribute) - and $roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) { + and $roles = get_archetype_roles('coursecreator')) { $creatorrole = array_shift($roles); // We can only use one, let's use the first one } else { $creatorrole = false; @@ -1945,7 +1945,7 @@ class auth_plugin_ldap extends auth_plugin_base { return; //nothing to sync - creators not configured } - if ($roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) { + if ($roles = get_archetype_roles('coursecreator')) { $creatorrole = array_shift($roles); // We can only use one, let's use the first one $systemcontext = get_context_instance(CONTEXT_SYSTEM); diff --git a/auth/mnet/auth.php b/auth/mnet/auth.php index 29fe2381c00..7ca250a2196 100644 --- a/auth/mnet/auth.php +++ b/auth/mnet/auth.php @@ -141,8 +141,8 @@ class auth_plugin_mnet extends auth_plugin_base { // check remote login permissions if (! has_capability('moodle/site:mnetlogintoremote', get_context_instance(CONTEXT_SYSTEM)) or is_mnet_remote_user($USER) - or $USER->username == 'guest' - or empty($USER->id)) { + or isguestuser() + or !isloggedin()) { print_error('notpermittedtojump', 'mnet'); } diff --git a/backup/backuplib.php b/backup/backuplib.php index 64571d652fe..775bfed21c6 100644 --- a/backup/backuplib.php +++ b/backup/backuplib.php @@ -162,10 +162,10 @@ function backup_get_enrolled_users ($courseid) { global $CFG; - // get all users with moodle/course:view capability, this will include people + // get all users with moodle/course:participate capability, this will include people // assigned at cat level, or site level // but it should be ok if they have no direct assignment at course, mod, block level - return get_users_by_capability(get_context_instance(CONTEXT_COURSE, $courseid), 'moodle/course:view', '', '', '', '', '', '', false); + return get_users_by_capability(get_context_instance(CONTEXT_COURSE, $courseid), 'moodle/course:participate', '', '', '', '', '', '', false); } //Returns all users ids (every record in users table) @@ -2911,7 +2911,6 @@ if (backup_getid($preferences->backup_unique_code, 'user', $assignment->userid)) { fwrite ($bf, start_tag("ASSIGNMENT", $startlevel+3, true)); fwrite ($bf, full_tag("USERID", $startlevel+4, false, $assignment->userid)); - fwrite ($bf, full_tag("HIDDEN", $startlevel+4, false, $assignment->hidden)); fwrite ($bf, full_tag("TIMESTART", $startlevel+4, false, $assignment->timestart)); fwrite ($bf, full_tag("TIMEEND", $startlevel+4, false, $assignment->timeend)); fwrite ($bf, full_tag("TIMEMODIFIED", $startlevel+4, false, $assignment->timemodified)); diff --git a/backup/restore_form.html b/backup/restore_form.html index 3ec04cbe6df..3331d27d3fd 100644 --- a/backup/restore_form.html +++ b/backup/restore_form.html @@ -636,7 +636,7 @@ if ($restoreuserinfo) { echo (''); // get the first teacheredit legacy - $roles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM)); + $roles = get_archetype_roles('editingteacher'); $editteacher = reset($roles); echo html_writer::select($siterolesarray, "defaultteacheredit", $editteacher->id, array(''=>'new role')); @@ -649,7 +649,7 @@ if ($restoreuserinfo) { echo (''); // get the first teacheredit legacy - $roles = get_roles_with_capability('moodle/legacy:teacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM)); + $roles = get_archetype_roles('teacher'); $teacher = reset($roles); echo html_writer::select($siterolesarray, "defaultteacher", $teacher->id, array(''=>'new role')); @@ -662,7 +662,7 @@ if ($restoreuserinfo) { echo (''); // get the first teacheredit legacy - $roles = get_roles_with_capability('moodle/legacy:student', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM)); + $roles = get_archetype_roles('student'); $studentrole = array_shift($roles); echo html_writer::select($siterolesarray, "defaultstudent", $studentrole->id, array(''=>'new role')); diff --git a/backup/restorelib.php b/backup/restorelib.php index e018a9e79ff..6e4fab0004e 100644 --- a/backup/restorelib.php +++ b/backup/restorelib.php @@ -1557,7 +1557,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3); // anything except id $restore->userswhocanviewcourse=get_users_by_capability( get_context_instance(CONTEXT_COURSE, $restore->course_id), - 'moodle/course:view','u.id'); + 'moodle/course:participate','u.id'); } foreach($info->completiondata as $data) { @@ -5952,9 +5952,6 @@ define('RESTORE_GROUPS_GROUPINGS', 3); $this->info->tempuser = $this->getContents(); $this->info->roleassignments[$this->info->tempid]->assignments[$this->info->tempuser]->userid = $this->getContents(); break; - case "HIDDEN": - $this->info->roleassignments[$this->info->tempid]->assignments[$this->info->tempuser]->hidden = $this->getContents(); - break; case "TIMESTART": $this->info->roleassignments[$this->info->tempid]->assignments[$this->info->tempuser]->timestart = $this->getContents(); break; @@ -6175,9 +6172,6 @@ define('RESTORE_GROUPS_GROUPINGS', 3); $this->info->tempinstance->roleassignments[$this->info->tempid]->assignments[$this->info->tempuser]->userid = $this->getContents(); break; - case "HIDDEN": - $this->info->tempinstance->roleassignments[$this->info->tempid]->assignments[$this->info->tempuser]->hidden = $this->getContents(); - break; case "TIMESTART": $this->info->tempinstance->roleassignments[$this->info->tempid]->assignments[$this->info->tempuser]->timestart = $this->getContents(); break; @@ -6428,9 +6422,6 @@ define('RESTORE_GROUPS_GROUPINGS', 3); $this->info->tempsection->mods[$this->info->tempmod->id]->roleassignments[$this->info->tempid]->assignments[$this->info->tempuser]->userid = $this->getContents(); break; - case "HIDDEN": - $this->info->tempsection->mods[$this->info->tempmod->id]->roleassignments[$this->info->tempid]->assignments[$this->info->tempuser]->hidden = $this->getContents(); - break; case "TIMESTART": $this->info->tempsection->mods[$this->info->tempmod->id]->roleassignments[$this->info->tempid]->assignments[$this->info->tempuser]->timestart = $this->getContents(); break; @@ -7315,9 +7306,6 @@ define('RESTORE_GROUPS_GROUPINGS', 3); $this->info->tempuser->roleassignments[$this->info->tempid]->assignments[$this->info->tempuserid]->userid = $this->getContents(); break; - case "HIDDEN": - $this->info->tempuser->roleassignments[$this->info->tempid]->assignments[$this->info->tempuserid]->hidden = $this->getContents(); - break; case "TIMESTART": $this->info->tempuser->roleassignments[$this->info->tempid]->assignments[$this->info->tempuserid]->timestart = $this->getContents(); break; @@ -9171,7 +9159,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3); if ($CFG->creatornewroleid) { role_assign($CFG->creatornewroleid, $USER->id, 0, $newcontext->id); } else { - if ($legacyteachers = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM))) { + if ($legacyteachers = get_archetype_roles('editingteacher')) { if ($legacyteacher = array_shift($legacyteachers)) { role_assign($legacyteacher->id, $USER->id, 0, $newcontext->id); } diff --git a/blocks/admin/block_admin.php b/blocks/admin/block_admin.php index 27eafb1eb5a..bda3cb2bcf5 100644 --- a/blocks/admin/block_admin.php +++ b/blocks/admin/block_admin.php @@ -20,16 +20,15 @@ class block_admin extends block_list { $course = $this->page->course; - if (!has_capability('moodle/course:view', $this->page->context)) { // Just return - return $this->content; - } - if (empty($CFG->loginhttps)) { $securewwwroot = $CFG->wwwroot; } else { $securewwwroot = str_replace('http:','https:',$CFG->wwwroot); } + $isenrolled = is_enrolled($this->page->context); + $isviewing = is_viewing($this->page->context); + /// Course editing on/off if ($course->id !== SITEID and has_capability('moodle/course:update', $this->page->context)) { $this->content->icons[]=''; @@ -56,7 +55,7 @@ class block_admin extends block_list { /// View course grades (or just your own grades, same link) /// find all accessible reports - if ($course->id !== SITEID) { + if ($course->id !== SITEID and ($isenrolled or $isviewing)) { $reportavailable = false; if (has_capability('moodle/grade:viewall', $this->page->context)) { $reportavailable = true; @@ -194,17 +193,23 @@ class block_admin extends block_list { /// Unenrol link if (empty($course->metacourse) && ($course->id!==SITEID)) { - if (has_capability('moodle/legacy:guest', $this->page->context, NULL, false)) { // Are a guest now + if ($isenrolled) { + if (has_capability('moodle/role:unassignself', $this->page->context, NULL, false) and get_user_roles($this->page->context, $USER->id, false)) { // Have some role + $this->content->items[]=''.get_string('unenrolme', '', format_string($course->shortname)).''; + $this->content->icons[]=''; + } + + } else if ($isviewing) { + // inspector, manager, etc. - do not show anything + } else { + // access because otherwise they would not get into this course at all $this->content->items[]=''.get_string('enrolme', '', format_string($course->shortname)).''; $this->content->icons[]=''; - } else if (has_capability('moodle/role:unassignself', $this->page->context, NULL, false) and get_user_roles($this->page->context, $USER->id, false)) { // Have some role - $this->content->items[]=''.get_string('unenrolme', '', format_string($course->shortname)).''; - $this->content->icons[]=''; } } - /// Link to the user own profile (except guests) - if (!isguestuser() and isloggedin()) { + /// Link to the user own profile if they are enrolled + if ($isenrolled) { $this->content->items[]=''.get_string('profile').''; $this->content->icons[]=''; } diff --git a/blocks/admin_tree/block_admin_tree.php b/blocks/admin_tree/block_admin_tree.php index 8da9137df91..f99922cff00 100644 --- a/blocks/admin_tree/block_admin_tree.php +++ b/blocks/admin_tree/block_admin_tree.php @@ -108,7 +108,7 @@ class block_admin_tree extends block_base { } if (isguestuser() or !isloggedin()) { - // these users can not change any settings + // shortcut - these users can not change any settings $this->content = ''; return ''; } diff --git a/blocks/comments/block_comments.php b/blocks/comments/block_comments.php index 4f908648ab1..1ed793255f5 100644 --- a/blocks/comments/block_comments.php +++ b/blocks/comments/block_comments.php @@ -38,9 +38,10 @@ class block_comments extends block_base { } $this->content->footer = ''; $this->content->text = ''; + //TODO: guest and not-logged-in shoudl be able to read comments, right? if (isloggedin() && !isguestuser()) { // Show the block $cmt = new stdclass; - $cmt->context = $this->instance->context; + $cmt->context = $this->context; $cmt->area = 'block_comments'; $cmt->itemid = $this->instance->id; $cmt->course = $this->page->course; diff --git a/blocks/course_list/block_course_list.php b/blocks/course_list/block_course_list.php index 010f9147c7c..3a1923a9ae1 100644 --- a/blocks/course_list/block_course_list.php +++ b/blocks/course_list/block_course_list.php @@ -34,10 +34,8 @@ class block_course_list extends block_list { } } - if (empty($CFG->disablemycourses) and - !empty($USER->id) and - !(has_capability('moodle/course:update', get_context_instance(CONTEXT_SYSTEM)) and $adminseesall) and - !isguestuser()) { // Just print My Courses + if (empty($CFG->disablemycourses) and isloggedin() and !isguestuser() and + !(has_capability('moodle/course:update', get_context_instance(CONTEXT_SYSTEM)) and $adminseesall)) { // Just print My Courses if ($courses = get_my_courses($USER->id, 'visible DESC, fullname ASC')) { foreach ($courses as $course) { if ($course->id == SITEID) { @@ -118,7 +116,7 @@ class block_course_list extends block_list { $icon = ''.get_string('course').''; - // only for logged in users! + // shortcut - the rest is only for logged in users! if (!isloggedin() || isguestuser()) { return false; } diff --git a/blocks/global_navigation_tree/block_global_navigation_tree.php b/blocks/global_navigation_tree/block_global_navigation_tree.php index 95907184b5e..9f501ab3d2e 100644 --- a/blocks/global_navigation_tree/block_global_navigation_tree.php +++ b/blocks/global_navigation_tree/block_global_navigation_tree.php @@ -94,7 +94,7 @@ class block_global_navigation_tree extends block_tree { global $CFG, $OUTPUT; // First check if we have already generated, don't waste cycles if ($this->contentgenerated === true) { - return true; + return $this->content; } $this->page->requires->yui2_lib('dom'); // JS for navigation moved to the standard theme, the code will probably have to depend on the actual page structure @@ -158,7 +158,7 @@ class block_global_navigation_tree extends block_tree { $module = array('name'=>'block_navigation', 'fullpath'=>'/blocks/global_navigation_tree/navigation.js', 'requires'=>array('core_dock', 'io', 'node', 'dom', 'event-custom', 'json-parse')); $arguments = array($this->instance->id, array('expansions'=>$expandable, 'instance'=>$this->instance->id, 'candock'=>$this->instance_can_be_docked())); $this->page->requires->js_init_call('M.block_navigation.init_add_tree', $arguments, false, $module); - + // Grab the items to display $this->content->items = array($this->page->navigation); @@ -168,7 +168,8 @@ class block_global_navigation_tree extends block_tree { // Set content generated to true so that we know it has been done $this->contentgenerated = true; - return true; + + return $this->content; } /** diff --git a/blocks/messages/block_messages.php b/blocks/messages/block_messages.php index 927585497d6..19ba42f45ee 100644 --- a/blocks/messages/block_messages.php +++ b/blocks/messages/block_messages.php @@ -25,7 +25,7 @@ class block_messages extends block_base { $this->content->text = ''; $this->content->footer = ''; - if (empty($this->instance) or empty($USER->id) or isguestuser() or empty($CFG->messaging)) { + if (empty($this->instance) or !isloggedin() or isguestuser() or empty($CFG->messaging)) { return $this->content; } diff --git a/blocks/mnet_hosts/block_mnet_hosts.php b/blocks/mnet_hosts/block_mnet_hosts.php index 111af037999..4242a0d990a 100644 --- a/blocks/mnet_hosts/block_mnet_hosts.php +++ b/blocks/mnet_hosts/block_mnet_hosts.php @@ -21,7 +21,7 @@ class block_mnet_hosts extends block_list { function get_content() { global $CFG, $USER, $DB, $OUTPUT; - // only for logged in users! + // shortcut - only for logged in users! if (!isloggedin() || isguestuser()) { return false; } diff --git a/blocks/moodleblock.class.php b/blocks/moodleblock.class.php index 7601d98d81a..0e7c2a72a9a 100644 --- a/blocks/moodleblock.class.php +++ b/blocks/moodleblock.class.php @@ -555,11 +555,7 @@ class block_base { $this->config = unserialize(base64_decode($instance->configdata)); } $this->instance = $instance; - if (isset($instance->context)) { - $this->context = $instance->context; - } else { - $this->context = get_context_instance(CONTEXT_BLOCK, $instance->id); - } + $this->context = get_context_instance(CONTEXT_BLOCK, $instance->id); $this->page = $page; $this->specialization(); $this->get_required_javascript(); diff --git a/blocks/news_items/block_news_items.php b/blocks/news_items/block_news_items.php index 34b12cb5928..b94c651e499 100644 --- a/blocks/news_items/block_news_items.php +++ b/blocks/news_items/block_news_items.php @@ -102,7 +102,7 @@ class block_news_items extends block_base { } else { $tooltiptext = get_string('rsssubscriberssposts','forum',format_string($forum->name)); } - if (empty($USER->id)) { + if (!isloggedin()) { $userid = 0; } else { $userid = $USER->id; diff --git a/blocks/online_users/block_online_users.php b/blocks/online_users/block_online_users.php index 8a2243e4720..7cc7556bc85 100644 --- a/blocks/online_users/block_online_users.php +++ b/blocks/online_users/block_online_users.php @@ -55,12 +55,14 @@ class block_online_users extends block_base { $params['currentgroup'] = $currentgroup; } + $userfields = user_picture::fields('u').', username'; + if ($this->page->course->id == SITEID) { // Site-level - $sql = "SELECT u.id, u.username, u.firstname, u.lastname, u.picture, MAX(u.lastaccess) AS lastaccess + $sql = "SELECT $userfields, MAX(u.lastaccess) AS lastaccess FROM {user} u $groupmembers WHERE u.lastaccess > $timefrom $groupselect - GROUP BY u.id, u.username, u.firstname, u.lastname, u.picture + GROUP BY $userfields ORDER BY lastaccess DESC "; $csql = "SELECT COUNT(u.id), u.id @@ -69,24 +71,26 @@ class block_online_users extends block_base { $groupselect GROUP BY u.id"; - } else { // Course-level - if (!has_capability('moodle/role:viewhiddenassigns', $this->page->context)) { - $pcontext = get_related_contexts_string($this->page->context); - $rafrom = ", {role_assignments} ra"; - $rawhere = " AND ra.userid = u.id AND ra.contextid $pcontext AND ra.hidden = 0"; - } + } else { + // Course level - show only enrolled users for now + // TODO: add a new capability for viewing of all users (guests+enrolled+viewing) - $sql = "SELECT u.id, u.username, u.firstname, u.lastname, u.picture, MAX(ul.timeaccess) AS lastaccess + list($esqljoin, $eparams) = get_enrolled_sql($this->page->context); + $params = array_merge($params, $eparams); + + $sql = "SELECT $userfields, MAX(ul.timeaccess) AS lastaccess FROM {user_lastaccess} ul, {user} u $groupmembers $rafrom + JOIN ($esqljoin) euj ON euj.id = u.id WHERE ul.timeaccess > $timefrom AND u.id = ul.userid AND ul.courseid = :courseid $groupselect $rawhere - GROUP BY u.id, u.username, u.firstname, u.lastname, u.picture + GROUP BY $userfields ORDER BY lastaccess DESC"; $csql = "SELECT u.id FROM {user_lastaccess} ul, {user} u $groupmembers $rafrom + JOIN ($esqljoin) euj ON euj.id = u.id WHERE ul.timeaccess > $timefrom AND u.id = ul.userid AND ul.courseid = :courseid @@ -131,7 +135,7 @@ class block_online_users extends block_base { //Accessibility: Don't want 'Alt' text for the user picture; DO want it for the envelope/message link (existing lang string). //Accessibility: Converted
    to