L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-21655 big scary enrolment and roles improvements - see tacker for list of changes, includes other minor fixes too

Browse Source
This commit is contained in:
Petr Skoda
2010-03-31 07:41:31 +00:00
parent d1d4813ff2
commit 4f0c2d0009
225 changed files with 2941 additions and 3097 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/cron.php
+2 -2
View File
@@ -280,14 +280,14 @@
}
$rs->close();
/// Execute the same query again, looking for remaining records and deleting them
/// if the user hasn't moodle/course:view in the CONTEXT_COURSE context (orphan records)
/// if the user hasn't moodle/course:participate in the CONTEXT_COURSE context (orphan records)
$rs = $DB->get_recordset_sql ("SELECT id, userid, courseid
FROM {user_lastaccess}
WHERE courseid != ".SITEID."
AND timeaccess < ?", array($cuttime));
foreach ($rs as $assign) {
if ($context = get_context_instance(CONTEXT_COURSE, $assign->courseid)) {
if (!has_capability('moodle/course:view', $context, $assign->userid)) {
if (!is_enrolled($context, $assign->userid) and !is_viewing($context, $assign->userid)) {
$DB->delete_records('user_lastaccess', array('userid'=>$assign->userid, 'courseid'=>$assign->courseid));
mtrace("Deleted orphan user_lastaccess for user $assign->userid from course $assign->courseid");
}
admin/generator.php
+2 -1
View File
@@ -1187,7 +1187,8 @@ class generator_cli extends generator {
}
complete_user_login($user);
$systemcontext = get_context_instance(CONTEXT_SYSTEM);
if (!has_capability('moodle/site:doanything', $systemcontext)) {
if (!is_siteadmin($user->id)) {//TODO: add some proper access control check here!!
echo "You do not have administration privileges on this Moodle site. "
."These are required for running the generation script.{$this->eolchar}";
die();
admin/register.php
+2 -2
View File
@@ -122,11 +122,11 @@
FROM {role_capabilities} rc,
{role_assignments} ra,
{user} u
WHERE (rc.capability = ? or rc.capability = ?)
WHERE (rc.capability = ?)
AND rc.roleid = ra.roleid
AND u.id = ra.userid";
$count = $DB->count_records_sql($sql, array('moodle/course:update', 'moodle/site:doanything'));
$count = $DB->count_records_sql($sql, array('moodle/course:update'));
echo get_string("teachers").": ".$count;
echo "<input type=\"hidden\" name=\"courseupdaters\" value=\"$count\" />\n";
echo '<br />';
admin/report/courseoverview/db/access.php
+1 -1
View File
@@ -32,7 +32,7 @@ $capabilities = array(
'legacy' => array(
'teacher' => CAP_ALLOW,
'editingteacher' => CAP_ALLOW,
'admin' => CAP_ALLOW
'manager' => CAP_ALLOW
),
'clonepermissionsfrom' => 'moodle/site:viewreports',
admin/report/questioninstances/db/access.php
+1 -1
View File
@@ -29,7 +29,7 @@ $capabilities = array(
'captype' => 'read',
'contextlevel' => CONTEXT_SYSTEM,
'legacy' => array(
'admin' => CAP_ALLOW
'manager' => CAP_ALLOW
),
'clonepermissionsfrom' => 'moodle/site:config',
admin/report/security/db/access.php
+1 -1
View File
@@ -30,7 +30,7 @@ $capabilities = array(
'captype' => 'read',
'contextlevel' => CONTEXT_SYSTEM,
'legacy' => array(
'admin' => CAP_ALLOW
'manager' => CAP_ALLOW
),
)
);
admin/report/security/lib.php
+33 -182
View File
@@ -576,16 +576,6 @@ function report_security_check_defaultuserrole($detailed=false) {
return $result;
}
// first test if do anything enabled - that would be really crazy!
$params = array('doanything'=>'moodle/site:doanything', 'capallow'=>CAP_ALLOW, 'roleid'=>$default_role->id);
$sql = "SELECT COUNT(DISTINCT rc.contextid)
FROM {role_capabilities} rc
WHERE rc.capability = :doanything
AND rc.permission = :capallow
AND rc.roleid = :roleid";
$anythingcount = $DB->count_records_sql($sql, $params);
// risky caps - usually very dangerous
$params = array('capallow'=>CAP_ALLOW, 'roleid'=>$default_role->id);
$sql = "SELECT COUNT(DISTINCT rc.contextid)
@@ -598,24 +588,16 @@ function report_security_check_defaultuserrole($detailed=false) {
$riskycount = $DB->count_records_sql($sql, $params);
// default role can not have view cap in all courses - this would break moodle badly
$viewcap = $DB->record_exists('role_capabilities', array('roleid'=>$default_role->id, 'permission'=>CAP_ALLOW, 'capability'=>'moodle/course:view'));
$viewcap = $DB->record_exists('role_capabilities', array('roleid'=>$default_role->id, 'permission'=>CAP_ALLOW, 'capability'=>'moodle/course:participate'));
// it may have either no or 'user' legacy type - nothing else, or else it would break during upgrades badly
$legacyok = false;
$params = array('capallow'=>CAP_ALLOW, 'roleid'=>$default_role->id, 'legacy'=>'moodle/legacy:%');
$sql = "SELECT rc.capability, 1
FROM {role_capabilities} rc
WHERE rc.capability LIKE :legacy
AND rc.permission = :capallow
AND rc.roleid = :roleid";
$legacycaps = $DB->get_records_sql($sql, $params);
if (!$legacycaps) {
$legacyok = true;
} else if (count($legacycaps) == 1 and isset($legacycaps['moodle/legacy:user'])) {
// it may have either none or 'user' archetype - nothing else, or else it would break during upgrades badly
if ($default_role->archetype === '' or $default_role->archetype === 'user') {
$legacyok = true;
} else {
$legacyok = false;
}
if ($anythingcount or $riskycount or $viewcap or !$legacyok) {
if ($riskycount or $viewcap or !$legacyok) {
$result->status = REPORT_SECURITY_CRITICAL;
$result->info = get_string('check_defaultuserrole_error', 'report_security', format_string($default_role->name));
@@ -655,16 +637,6 @@ function report_security_check_guestrole($detailed=false) {
return $result;
}
// first test if do anything enabled - that would be really crazy!
$params = array('doanything'=>'moodle/site:doanything', 'capallow'=>CAP_ALLOW, 'roleid'=>$guest_role->id);
$sql = "SELECT COUNT(DISTINCT rc.contextid)
FROM {role_capabilities} rc
WHERE rc.capability = :doanything
AND rc.permission = :capallow
AND rc.roleid = :roleid";
$anythingcount = $DB->count_records_sql($sql, $params);
// risky caps - usually very dangerous
$params = array('capallow'=>CAP_ALLOW, 'roleid'=>$guest_role->id);
$sql = "SELECT COUNT(DISTINCT rc.contextid)
@@ -676,22 +648,14 @@ function report_security_check_guestrole($detailed=false) {
$riskycount = $DB->count_records_sql($sql, $params);
// it may have either no or 'guest' legacy type - nothing else, or else it would break during upgrades badly
$legacyok = false;
$params = array('capallow'=>CAP_ALLOW, 'roleid'=>$guest_role->id, 'legacy'=>'moodle/legacy:%');
$sql = "SELECT rc.capability, 1
FROM {role_capabilities} rc
WHERE rc.capability LIKE :legacy
AND rc.permission = :capallow
AND rc.roleid = :roleid";
$legacycaps = $DB->get_records_sql($sql, $params);
if (!$legacycaps) {
$legacyok = true;
} else if (count($legacycaps) == 1 and isset($legacycaps['moodle/legacy:guest'])) {
// it may have either no or 'guest' archetype - nothing else, or else it would break during upgrades badly
if ($guest_role->archetype === '' or $guest_role->archetype === 'guest') {
$legacyok = true;
} else {
$legacyok = false;
}
if ($anythingcount or $riskycount or !$legacyok) {
if ($riskycount or !$legacyok) {
$result->status = REPORT_SECURITY_CRITICAL;
$result->info = get_string('check_guestrole_error', 'report_security', format_string($guest_role->name));
@@ -731,16 +695,6 @@ function report_security_check_frontpagerole($detailed=false) {
return $result;
}
// first test if do anything enabled - that would be really crazy!
$params = array('doanything'=>'moodle/site:doanything', 'capallow'=>CAP_ALLOW, 'roleid'=>$frontpage_role->id);
$sql = "SELECT COUNT(DISTINCT rc.contextid)
FROM {role_capabilities} rc
WHERE rc.capability = :doanything
AND rc.permission = :capallow
AND rc.roleid = :roleid";
$anythingcount = $DB->count_records_sql($sql, $params);
// risky caps - usually very dangerous
$params = array('capallow'=>CAP_ALLOW, 'roleid'=>$frontpage_role->id);
$sql = "SELECT COUNT(DISTINCT rc.contextid)
@@ -753,19 +707,14 @@ function report_security_check_frontpagerole($detailed=false) {
$riskycount = $DB->count_records_sql($sql, $params);
// there is no legacy role type for frontpage yet - anyway we can not allow teachers or admins there!
$params = array('capallow'=>CAP_ALLOW, 'roleid'=>$frontpage_role->id, 'legacy'=>'moodle/legacy:%');
$sql = "SELECT rc.capability, 1
FROM {role_capabilities} rc
WHERE rc.capability LIKE :legacy
AND rc.permission = :capallow
AND rc.roleid = :roleid";
$legacycaps = $DB->get_records_sql($sql, $params);
$legacyok = (!isset($legacycaps['moodle/legacy:teacher'])
and !isset($legacycaps['moodle/legacy:editingteacher'])
and !isset($legacycaps['moodle/legacy:coursecreator'])
and !isset($legacycaps['moodle/legacy:admin']));
if ($frontpage_role->archetype === 'teacher' or $frontpage_role->archetype === 'editingteacher'
or $frontpage_role->archetype === 'coursecreator' or $frontpage_role->archetype === 'manager') {
$legacyok = false;
} else {
$legacyok = true;
}
if ($anythingcount or $riskycount or !$legacyok) {
if ($riskycount or !$legacyok) {
$result->status = REPORT_SECURITY_CRITICAL;
$result->info = get_string('check_frontpagerole_error', 'report_security', format_string($frontpage_role->name));
@@ -811,25 +760,6 @@ function report_security_check_defaultcourserole($detailed=false) {
return $result;
}
// first test if do anything enabled - that would be really crazy!
$params = array('doanything'=>'moodle/site:doanything', 'capallow'=>CAP_ALLOW, 'roleid'=>$student_role->id);
$sql = "SELECT DISTINCT rc.contextid
FROM {role_capabilities} rc
WHERE rc.capability = :doanything
AND rc.permission = :capallow
AND rc.roleid = :roleid";
if ($anything_contexts = $DB->get_records_sql($sql, $params)) {
foreach($anything_contexts as $contextid) {
if ($contextid == SYSCONTEXTID) {
$a = "$CFG->wwwroot/$CFG->admin/roles/define.php?action=view&amp;roleid=$CFG->defaultcourseroleid";
} else {
$a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$CFG->defaultcourseroleid";
}
$problems[] = get_string('check_defaultcourserole_anything', 'report_security', $a);
}
}
// risky caps - usually very dangerous
$params = array('capallow'=>CAP_ALLOW, 'roleid'=>$student_role->id);
$sql = "SELECT DISTINCT rc.contextid
@@ -851,14 +781,7 @@ function report_security_check_defaultcourserole($detailed=false) {
}
// course creator or administrator does not make any sense here
$params = array('capallow'=>CAP_ALLOW, 'roleid'=>$student_role->id, 'legacy'=>'moodle/legacy:%');
$sql = "SELECT rc.capability, 1
FROM {role_capabilities} rc
WHERE rc.capability LIKE :legacy
AND rc.permission = :capallow
AND rc.roleid = :roleid";
$legacycaps = $DB->get_records_sql($sql, $params);
if (isset($legacycaps['moodle/legacy:coursecreator']) or isset($legacycaps['moodle/legacy:admin'])) {
if ($student_role->archetype === 'coursecreator' or $student_role->archetype === 'manager') {
$problems[] = get_string('check_defaultcourserole_legacy', 'report_security');
}
@@ -922,43 +845,16 @@ function report_security_check_courserole($detailed=false) {
$sql = "SELECT DISTINCT rc.roleid
FROM {role_capabilities} rc
WHERE (rc.capability = :coursecreator OR rc.capability = :admin OR rc.capability = :teacher OR rc.capability = :editingteacher)
AND rc.permission = ".CAP_ALLOW."";
$params = array('coursecreator' => 'moodle/legacy:coursecreator',
'admin' => 'moodle/legacy:admin',
'teacher' => 'moodle/legacy:teacher',
'editingteacher' => 'moodle/legacy:editingteacher');
JOIN {role} r ON r.id = rc.roleid
WHERE (r.archetype = :coursecreator OR r.archetype = :teacher OR r.archetype = :editingteacher OR r.archetype = :manager)";
$params = array('coursecreator' => 'coursecreator',
'teacher' => 'teacher',
'editingteacher' => 'editingteacher',
'manager' => 'manager');
$riskyroleids = $DB->get_records_sql($sql, $params);
$riskyroleids = array_keys($riskyroleids);
// first test if do anything enabled - that would be really crazy!!!!!!
list($inroles, $params) = $DB->get_in_or_equal($roleids, SQL_PARAMS_NAMED, 'r0', true);
$params = array_merge($params, array('doanything'=>'moodle/site:doanything', 'capallow'=>CAP_ALLOW));
$params['doanything'] = 'moodle/site:doanything';
$params['capallow'] = CAP_ALLOW;
$sql = "SELECT rc.roleid, rc.contextid
FROM {role_capabilities} rc
WHERE rc.capability = :doanything
AND rc.permission = :capallow
AND rc.roleid $inroles
GROUP BY rc.roleid, rc.contextid
ORDER BY rc.roleid, rc.contextid";
$rs = $DB->get_recordset_sql($sql, $params);
foreach($rs as $res) {
$roleid = $res->roleid;
$contextid = $res->contextid;
if ($contextid == SYSCONTEXTID) {
$a = "$CFG->wwwroot/$CFG->admin/roles/define.php?action=view&amp;roleid=$roleid";
} else {
$a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$roleid";
}
$problems[] = get_string('check_courserole_anything', 'report_security', $a);
}
$rs->close();
// any XSS legacy cap does not make any sense here!
list($inroles, $params) = $DB->get_in_or_equal($roleids, SQL_PARAMS_NAMED, 'r0', true);
$sql = "SELECT DISTINCT c.id, c.shortname
@@ -1034,37 +930,13 @@ function report_security_check_riskadmin($detailed=false) {
$result->status = null;
$result->link = null;
$params = array('doanything'=>'moodle/site:doanything', 'syscontextid'=>SYSCONTEXTID, 'capallow'=>CAP_ALLOW);
$sql = "SELECT u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email
FROM {user} u
WHERE u.id IN ($CFG->siteadmins)";
$sql = "SELECT DISTINCT u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email
FROM {role_capabilities} rc
JOIN {role_assignments} ra ON (ra.contextid = rc.contextid AND ra.roleid = rc.roleid)
JOIN {user} u ON u.id = ra.userid
WHERE rc.capability = :doanything
AND rc.permission = :capallow
AND u.deleted = 0
AND rc.contextid = :syscontextid";
$admins = $DB->get_records_sql($sql, $params);
$admins = $DB->get_records_sql($sql);
$admincount = count($admins);
$sqlunsup = "SELECT u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid
FROM (SELECT rcx.*
FROM {role_capabilities} rcx
WHERE rcx.capability = :doanything AND rcx.permission = :capallow) rc,
{context} c,
{context} sc,
{role_assignments} ra,
{user} u
WHERE c.id = rc.contextid
AND (sc.path = c.path OR sc.path LIKE ".$DB->sql_concat('c.path', "'/%'")." OR c.path LIKE ".$DB->sql_concat('sc.path', "'/%'").")
AND u.id = ra.userid AND u.deleted = 0
AND ra.contextid = sc.id AND ra.roleid = rc.roleid AND ra.contextid <> :syscontextid
GROUP BY u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid
ORDER BY u.lastname, u.firstname";
$unsupcount = $DB->count_records_sql("SELECT COUNT('x') FROM ($sqlunsup) unsup", $params);
if ($detailed) {
foreach ($admins as $uid=>$user) {
$url = "$CFG->wwwroot/user/view.php?id=$user->id";
@@ -1073,32 +945,11 @@ function report_security_check_riskadmin($detailed=false) {
$admins = '<ul>'.implode($admins).'</ul>';
}
if (!$unsupcount) {
$result->status = REPORT_SECURITY_OK;
$result->info = get_string('check_riskadmin_ok', 'report_security', $admincount);
$result->status = REPORT_SECURITY_OK;
$result->info = get_string('check_riskadmin_ok', 'report_security', $admincount);
if ($detailed) {
$result->details = get_string('check_riskadmin_detailsok', 'report_security', $admins);
}
} else {
$result->status = REPORT_SECURITY_WARNING;
$a = (object)array('admincount'=>$admincount, 'unsupcount'=>$unsupcount);
$result->info = get_string('check_riskadmin_warning', 'report_security', $a);
if ($detailed) {
$rs = $DB->get_recordset_sql($sqlunsup, $params);
$users = array();
foreach ($rs as $user) {
$url = "$CFG->wwwroot/$CFG->admin/roles/assign.php?contextid=$user->contextid&amp;roleid=$user->roleid";
$a = (object)array('fullname'=>fullname($user), 'url'=>$url, 'email'=>$user->email);
$users[] = '<li>'.get_string('check_riskadmin_unassign', 'report_security', $a).'</li>';
}
$rs->close();
$users = '<ul>'.implode($users).'</ul>';
$a = (object)array('admins'=>$admins, 'unsupported'=>$users);
$result->details = get_string('check_riskadmin_detailswarning', 'report_security', $a);
}
if ($detailed) {
$result->details = get_string('check_riskadmin_detailsok', 'report_security', $admins);
}
return $result;
admin/report/unittest/db/access.php
+1 -1
View File
@@ -30,7 +30,7 @@ $capabilities = array(
'captype' => 'read',
'contextlevel' => CONTEXT_SYSTEM,
'legacy' => array(
'admin' => CAP_ALLOW
'manager' => CAP_ALLOW
),
'clonepermissionsfrom' => 'moodle/site:config',
admin/roles/admins.php
+137
View File
@@ -0,0 +1,137 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* Lets you site administrators
*
* @package moodlecore
* @subpackage role
* @copyright 2010 Petr Skoda (skodak) http://skodak.org
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
require_once(dirname(__FILE__) . '/../../config.php');
require_once($CFG->dirroot . '/' . $CFG->admin . '/roles/lib.php');
$confirmadd = optional_param('confirmadd', 0, PARAM_INT);
$confirmdel = optional_param('confirmdel', 0, PARAM_INT);
$PAGE->set_url('/admin/roles/admins.php');
admin_externalpage_setup('admins');
if (!is_siteadmin()) {
die;
}
$admisselector = new admins_existing_selector();
$admisselector->set_extra_fields(array('username', 'email'));
$potentialadmisselector = new admins_potential_selector();
$potentialadmisselector->set_extra_fields(array('username', 'email'));
if (optional_param('add', false, PARAM_BOOL) and confirm_sesskey()) {
if ($userstoadd = $potentialadmisselector->get_selected_users()) {
$user = reset($userstoadd);
$username = fullname($user) . " ($user->username, $user->email)";
echo $OUTPUT->header();
echo $OUTPUT->confirm(get_string('confirmaddadmin', 'role', $username), new moodle_url('/admin/roles/admins.php', array('confirmadd'=>$user->id, 'sesskey'=>sesskey())), $PAGE->url);
echo $OUTPUT->footer();
die;
}
} else if (optional_param('remove', false, PARAM_BOOL) and confirm_sesskey()) {
if ($userstoremove = $admisselector->get_selected_users()) {
$user = reset($userstoremove);
if ($USER->id == $user->id) {
//can not remove self
} else {
$username = fullname($user) . " ($user->username, $user->email)";
echo $OUTPUT->header();
echo $OUTPUT->confirm(get_string('confirmdeladmin', 'role', $username), new moodle_url('/admin/roles/admins.php', array('confirmdel'=>$user->id, 'sesskey'=>sesskey())), $PAGE->url);
echo $OUTPUT->footer();
die;
}
}
} else if ($confirmadd and confirm_sesskey()) {
$admins = array();
foreach(explode(',', $CFG->siteadmins) as $admin) {
$admin = (int)$admin;
if ($admin) {
$admins[$admin] = $admin;
}
}
$admins[$confirmadd] = $confirmadd;
set_config('siteadmins', implode(',', $admins));
redirect($PAGE->url);
} else if ($confirmdel and confirm_sesskey() and $confirmdel != $USER->id) {
$admins = array();
foreach(explode(',', $CFG->siteadmins) as $admin) {
$admin = (int)$admin;
if ($admin) {
$admins[$admin] = $admin;
}
}
unset($admins[$confirmdel]);
set_config('siteadmins', implode(',', $admins));
redirect($PAGE->url);
}
/// Print header
echo $OUTPUT->header();
?>
<div id="addadmisform">
<h3 class="main"><?php print_string('manageadmins', 'role'); ?></h3>
<form id="assignform" method="post" action="<?php echo $PAGE->url ?>">
<div>
<input type="hidden" name="sesskey" value="<?php p(sesskey()); ?>" />
<table class="generaltable generalbox groupmanagementtable boxaligncenter" summary="">
<tr>
<td id='existingcell'>
<p>
<label for="removeselect"><?php print_string('existingadmins', 'role'); ?></label>
</p>
<?php $admisselector->display(); ?>
</td>
<td id='buttonscell'>
<p class="arrow_button">
<input name="add" id="add" type="submit" value="<?php echo $OUTPUT->larrow().'&nbsp;'.get_string('add'); ?>" title="<?php print_string('add'); ?>" /><br />
<input name="remove" id="remove" type="submit" value="<?php echo get_string('remove').'&nbsp;'.$OUTPUT->rarrow(); ?>" title="<?php print_string('remove'); ?>" />
</p>
</td>
<td id='potentialcell'>
<p>
<label for="addselect"><?php print_string('users'); ?></label>
</p>
<?php $potentialadmisselector->display(); ?>
</td>
</tr>
</table>
</div>
</form>
</div>
<?php
//this must be after calling display() on the selectors so their setup JS executes first
//////$PAGE->requires->js_function_call('init_add_remove_admis_page');
echo $OUTPUT->footer();
admin/roles/assign.php
+2 -13
View File
@@ -33,7 +33,6 @@
$roleid = optional_param('roleid', 0, PARAM_INT);
$userid = optional_param('userid', 0, PARAM_INT); // needed for user tabs
$courseid = optional_param('courseid', 0, PARAM_INT); // needed for user tabs
$hidden = optional_param('hidden', 0, PARAM_BOOL); // whether this assignment is hidden
$extendperiod = optional_param('extendperiod', 0, PARAM_INT);
$extendbase = optional_param('extendbase', 3, PARAM_INT);
@@ -148,11 +147,7 @@
$options = array('context' => $context, 'roleid' => $roleid);
$potentialuserselector = roles_get_potential_user_selector($context, 'addselect', $options);
if ($context->contextlevel == CONTEXT_SYSTEM && is_admin_role($roleid)) {
$currentuserselector = new existing_role_holders_site_admin('removeselect', $options);
} else {
$currentuserselector = new existing_role_holders('removeselect', $options);
}
$currentuserselector = new existing_role_holders('removeselect', $options);
/// Process incoming role assignments
$errors = array();
@@ -196,7 +191,7 @@
} else {
$timeend = 0;
}
if (! role_assign($roleid, $adduser->id, 0, $context->id, $timestart, $timeend, $hidden)) {
if (! role_assign($roleid, $adduser->id, 0, $context->id, $timestart, $timeend)) {
$a = new stdClass;
$a->role = $assignableroles[$roleid];
$a->user = fullname($adduser);
@@ -314,12 +309,6 @@
<?php print_collapsible_region_start('', 'assignoptions', get_string('enrolmentoptions', 'role'),
'assignoptionscollapse', true); ?>
<p><input type="checkbox" name="hidden" id="hidden" value="1" <?php
if ($hidden) { echo 'checked="checked" '; } ?>/>
<label for="hidden" title="<?php print_string('createhiddenassign', 'role'); ?>">
<?php print_string('hidden', 'role'); ?>
<?php echo $OUTPUT->help_icon('hiddenassign', get_string('createhiddenassign', 'role')); ?>
</label></p>
<p><label for="extendperiod"><?php print_string('enrolperiod') ?></label><br />
<?php echo html_writer::select($periodmenu, 'extendperiod', $defaultperiod, $unlimitedperiod); ?></p>
admin/roles/define.php
+2 -2
View File
@@ -103,7 +103,7 @@
admin_externalpage_print_header();
$currenttab = 'manage';
include_once('managetabs.php');
include('managetabs.php');
if ($action == 'add') {
$title = get_string('addinganewrole', 'role');
@@ -131,7 +131,7 @@
$options['action'] = 'edit';
echo $OUTPUT->single_button(new moodle_url($defineurl, $options), get_string('edit'));
$options['action'] = 'reset';
if ($definitiontable->get_legacy_type()) {
if ($definitiontable->get_archetype()) {
echo $OUTPUT->single_button(new moodle_url($manageurl, $options), get_string('resetrole', 'role'));
} else {
echo $OUTPUT->single_button(new moodle_url($manageurl, $options), get_string('resetrolenolegacy', 'role'));
admin/roles/lib.php
+117 -111
View File
@@ -144,7 +144,7 @@ abstract class capability_table_base {
protected abstract function num_extra_columns();
/**
* For subclasses to override. Allows certain capabilties (e.g. legacy capabilities)
* For subclasses to override. Allows certain capabilties
* to be left out of the table.
*
* @param object $capability the capability this row relates to.
@@ -213,10 +213,6 @@ class check_capability_table extends capability_table_base {
return 1;
}
protected function skip_row($capability) {
return $capability->name != 'moodle/site:doanything' && is_legacy($capability->name);
}
protected function get_row_classes($capability) {
$this->hascap = has_capability($capability->name, $this->context, $this->user->id);
if ($this->hascap) {
@@ -285,10 +281,6 @@ class permissions_table extends capability_table_base {
return 3;
}
protected function skip_row($capability) {
return $capability->name != 'moodle/site:doanything' && is_legacy($capability->name);
}
protected function add_row_cells($capability) {
global $OUTPUT, $PAGE;
@@ -554,7 +546,6 @@ class define_role_table_advanced extends capability_table_with_risks {
protected $errors;
protected $contextlevels;
protected $allcontextlevels;
protected $legacyroles;
protected $disabled = '';
public function __construct($context, $roleid) {
@@ -571,8 +562,6 @@ class define_role_table_advanced extends capability_table_with_risks {
CONTEXT_MODULE => get_string('activitymodule'),
CONTEXT_BLOCK => get_string('block')
);
$this->legacyroles = get_legacy_roles();
}
protected function load_current_permissions() {
@@ -581,7 +570,6 @@ class define_role_table_advanced extends capability_table_with_risks {
if (!$this->role = $DB->get_record('role', array('id' => $this->roleid))) {
throw new moodle_exception('invalidroleid');
}
$this->role->legacytype = get_legacy_type($this->roleid);
$contextlevels = get_role_contextlevels($this->roleid);
// Put the contextlevels in the array keys, as well as the values.
if (!empty($contextlevels)) {
@@ -594,7 +582,7 @@ class define_role_table_advanced extends capability_table_with_risks {
$this->role->name = '';
$this->role->shortname = '';
$this->role->description = '';
$this->role->legacytype = '';
$this->role->archetype = '';
$this->contextlevels = array();
}
parent::load_current_permissions();
@@ -638,12 +626,13 @@ class define_role_table_advanced extends capability_table_with_risks {
}
// Legacy type.
$legacytype = optional_param('legacytype', null, PARAM_RAW);
if (!is_null($legacytype)) {
if (array_key_exists($legacytype, $this->legacyroles)) {
$this->role->legacytype = $legacytype;
$archetype = optional_param('archetype', null, PARAM_RAW);
if ($archetype) {
$archetypes = get_role_archetypes();
if (isset($archetypes[$archetype])){
$this->role->archetype = $archetype;
} else {
$this->role->legacytype = '';
$this->role->archetype = '';
}
}
@@ -686,16 +675,12 @@ class define_role_table_advanced extends capability_table_with_risks {
return $this->role->id;
}
public function get_legacy_type() {
return $this->role->legacytype;
public function get_archetype() {
return $this->role->archetype;
}
protected function load_parent_permissions() {
if ($this->role->legacytype) {
$this->parentpermissions = get_default_capabilities($this->role->legacytype);
} else {
$this->parentpermissions = array();
}
$this->parentpermissions = get_default_capabilities($this->role->archetype);
}
public function save_changes() {
@@ -703,25 +688,11 @@ class define_role_table_advanced extends capability_table_with_risks {
if (!$this->roleid) {
// Creating role
if (isset($this->legacyroles[$this->role->legacytype])) {
$legacycap = $this->legacyroles[$this->role->legacytype];
} else {
$legacycap = '';
}
$this->role->id = create_role($this->role->name, $this->role->shortname, $this->role->description, $legacycap);
$this->role->id = create_role($this->role->name, $this->role->shortname, $this->role->description, $this->role->archetype);
$this->roleid = $this->role->id; // Needed to make the parent::save_changes(); call work.
} else {
// Updating role
$DB->update_record('role', $this->role);
// Legacy type
foreach($this->legacyroles as $type => $cap) {
if ($type == $this->role->legacytype) {
assign_capability($cap, CAP_ALLOW, $this->role->id, $this->context->id);
} else {
unassign_capability($cap, $this->role->id);
}
}
}
// Assignable contexts.
@@ -731,10 +702,6 @@ class define_role_table_advanced extends capability_table_with_risks {
parent::save_changes();
}
protected function skip_row($capability) {
return is_legacy($capability->name);
}
protected function get_name_field($id) {
return '<input type="text" id="' . $id . '" name="' . $id . '" maxlength="254" value="' . s($this->role->name) . '" />';
}
@@ -747,14 +714,14 @@ class define_role_table_advanced extends capability_table_with_risks {
return print_textarea(true, 10, 50, 50, 10, 'description', $this->role->description, 0, true);
}
protected function get_legacy_type_field($id) {
protected function get_archetype_field($id) {
global $OUTPUT;
$options = array();
$options[''] = get_string('none');
foreach($this->legacyroles as $type => $cap) {
$options[$type] = get_string('legacy:'.$type, 'role');
foreach(get_role_archetypes() as $type) {
$options[$type] = get_string('archetype'.$type, 'role');
}
return html_writer::select($options, 'legacytype', $this->role->legacytype, false);
return html_writer::select($options, 'archetype', $this->role->archetype, false);
}
protected function get_assignable_levels_control() {
@@ -814,7 +781,7 @@ class define_role_table_advanced extends capability_table_with_risks {
$this->print_field('name', get_string('name'), $this->get_name_field('name'));
$this->print_field('shortname', get_string('shortname'), $this->get_shortname_field('shortname'));
$this->print_field('edit-description', get_string('description'), $this->get_description_field('description'));
$this->print_field('menulegacytype', get_string('legacytype', 'role'), $this->get_legacy_type_field('legacytype'));
$this->print_field('menuarchetype', get_string('archetype', 'role'), $this->get_archetype_field('archetype'));
$this->print_field('', get_string('maybeassignedin', 'role'), $this->get_assignable_levels_control());
echo "</div>";
@@ -905,11 +872,11 @@ class view_role_definition_table extends define_role_table_advanced {
return format_text($this->role->description, FORMAT_HTML);
}
protected function get_legacy_type_field($id) {
if (empty($this->role->legacytype)) {
protected function get_archetype_field($id) {
if (empty($this->role->archetype)) {
return get_string('none');
} else {
return get_string('legacy:'.$this->role->legacytype, 'role');
return get_string('archetype'.$this->role->archetype, 'role');
}
}
@@ -976,10 +943,6 @@ class override_permissions_table_advanced extends capability_table_with_risks {
return $this->haslockedcapabiltites;
}
protected function skip_row($capability) {
return is_legacy($capability->name);
}
protected function add_permission_cells($capability) {
$disabled = '';
if ($capability->locked || $this->parentpermissions[$capability->name] == CAP_PROHIBIT) {
@@ -1058,7 +1021,7 @@ abstract class role_assign_user_selector_base extends user_selector_base {
* some CONTEXT_BLOCK).
*
* In this case we replicate part of get_users_by_capability() get the users
* with moodle/course:view (or moodle/site:doanything). We can't use
* with moodle/course:participate. We can't use
* get_users_by_capability() becuase
* 1) get_users_by_capability() does not deal with searching by name
* 2) exceptions array can be potentially large for large courses
@@ -1067,26 +1030,20 @@ class potential_assignees_below_course extends role_assign_user_selector_base {
public function find_users($search) {
global $DB;
// Get roles with some assignement to the 'moodle/course:view' capability.
$possibleroles = get_roles_with_capability('moodle/course:view', CAP_ALLOW, $this->context);
// Get roles with some assignement to the 'moodle/course:participate' capability.
$possibleroles = get_roles_with_capability('moodle/course:participate', CAP_ALLOW, $this->context);
if (empty($possibleroles)) {
// If there aren't any, we are done.
return array();
}
// Now exclude the admin roles, and check the actual permission on
// 'moodle/course:view' to make sure it is allow.
$doanythingroles = get_roles_with_capability('moodle/site:doanything',
CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM));
// 'moodle/course:participate' to make sure it is allow.
$validroleids = array();
foreach ($possibleroles as $possiblerole) {
if (isset($doanythingroles[$possiblerole->id])) {
continue;
}
if ($caps = role_context_capabilities($possiblerole->id, $this->context, 'moodle/course:view')) { // resolved list
if (isset($caps['moodle/course:view']) && $caps['moodle/course:view'] > 0) { // resolved capability > 0
if ($caps = role_context_capabilities($possiblerole->id, $this->context, 'moodle/course:participate')) { // resolved list
if (isset($caps['moodle/course:participate']) && $caps['moodle/course:participate'] > 0) { // resolved capability > 0
$validroleids[] = $possiblerole->id;
}
}
@@ -1116,13 +1073,13 @@ class potential_assignees_below_course extends role_assign_user_selector_base {
AND u.id NOT IN (
SELECT u.id
FROM {role_assignments} r, {user} u
WHERE r.contextid = ?
WHERE r.contextid = :contextid
AND u.id = r.userid
AND r.roleid = ?)";
AND r.roleid = :roleid)";
$order = ' ORDER BY lastname ASC, firstname ASC';
$params[] = $this->context->id;
$params[] = $this->roleid;
$params['contextid'] = $this->context->id;
$params['roleid'] = $this->roleid;
// Check to see if there are too many to show sensibly.
if (!$this->is_validating()) {
@@ -1168,13 +1125,13 @@ class potential_assignees_course_and_above extends role_assign_user_selector_bas
AND id NOT IN (
SELECT u.id
FROM {role_assignments} r, {user} u
WHERE r.contextid = ?
WHERE r.contextid = :contextid
AND u.id = r.userid
AND r.roleid = ?)";
AND r.roleid = :roleid)";
$order = ' ORDER BY lastname ASC, firstname ASC';
$params[] = $this->context->id;
$params[] = $this->roleid;
$params['contextid'] = $this->context->id;
$params['roleid'] = $this->roleid;
if (!$this->is_validating()) {
$potentialmemberscount = $DB->count_records_sql($countfields . $sql, $params);
@@ -1204,29 +1161,27 @@ class potential_assignees_course_and_above extends role_assign_user_selector_bas
* question on the assign roles page.
*/
class existing_role_holders extends role_assign_user_selector_base {
protected $strhidden;
public function __construct($name, $options) {
parent::__construct($name, $options);
$this->strhidden = get_string('hiddenassign');
}
public function find_users($search) {
global $DB;
list($wherecondition, $params) = $this->search_sql($search, 'u');
list($ctxcondition, $ctxparams) = $DB->get_in_or_equal(get_parent_contexts($this->context, true));
list($ctxcondition, $ctxparams) = $DB->get_in_or_equal(get_parent_contexts($this->context, true), SQL_PARAMS_NAMED, 'ctx00');
$params = array_merge($params, $ctxparams);
$params[] = $this->roleid;
$params['roleid'] = $this->roleid;
$sql = "SELECT ra.id as raid," . $this->required_fields_sql('u') . ",ra.hidden,ra.contextid
$sql = "SELECT ra.id as raid," . $this->required_fields_sql('u') . ",ra.contextid
FROM {role_assignments} ra
JOIN {user} u ON u.id = ra.userid
JOIN {context} ctx ON ra.contextid = ctx.id
WHERE
$wherecondition AND
ctx.id $ctxcondition AND
ra.roleid = ?
ra.roleid = :roleid
ORDER BY ctx.depth DESC, u.lastname, u.firstname";
$contextusers = $DB->get_records_sql($sql, $params);
@@ -1314,34 +1269,6 @@ class existing_role_holders extends role_assign_user_selector_base {
return get_string('usersfrom', 'role', $contextname);
}
}
// Override to add (hidden) to hidden role assignments.
public function output_user($user) {
$output = parent::output_user($user);
if ($user->hidden) {
$output .= ' (' . $this->strhidden . ')';
}
return $output;
}
}
/**
* A special subclass to use when unassigning admins at site level. Disables
* the option for admins to unassign themselves.
*/
class existing_role_holders_site_admin extends existing_role_holders {
public function find_users($search) {
global $USER;
$groupedusers = parent::find_users($search);
foreach ($groupedusers as $group) {
foreach ($group as &$user) {
if ($user->id == $USER->id) {
$user->disabled = true;
}
}
}
return $groupedusers;
}
}
/**
@@ -1590,3 +1517,82 @@ function roles_get_potential_user_selector($context, $name, $options) {
return $potentialuserselector;
}
class admins_potential_selector extends user_selector_base {
/**
* @param string $name control name
* @param array $options should have two elements with keys groupid and courseid.
*/
public function __construct() {
global $CFG, $USER;
$admins = explode(',', $CFG->siteadmins);
parent::__construct('addselect', array('multiselect'=>false, 'exclude'=>$admins));
}
public function find_users($search) {
global $DB;
list($wherecondition, $params) = $this->search_sql($search, '');
$fields = 'SELECT ' . $this->required_fields_sql('');
$countfields = 'SELECT COUNT(1)';
$sql = " FROM {user}
WHERE $wherecondition";
$order = ' ORDER BY lastname ASC, firstname ASC';
$availableusers = $DB->get_records_sql($fields . $sql . $order, $params);
if (empty($availableusers)) {
return array();
}
if ($search) {
$groupname = get_string('potusersmatching', 'role', $search);
} else {
$groupname = get_string('potusers', 'role');
}
return array($groupname => $availableusers);
}
}
class admins_existing_selector extends user_selector_base {
/**
* @param string $name control name
* @param array $options should have two elements with keys groupid and courseid.
*/
public function __construct() {
global $CFG, $USER;
parent::__construct('removeselect', array('multiselect'=>false));
}
public function find_users($search) {
global $DB, $CFG;
list($wherecondition, $params) = $this->search_sql($search, '');
$fields = 'SELECT ' . $this->required_fields_sql('');
$countfields = 'SELECT COUNT(1)';
if ($wherecondition) {
$wherecondition = "$wherecondition AND id IN ($CFG->siteadmins)";
} else {
$wherecondition = "id IN ($CFG->siteadmins)";
}
$sql = " FROM {user}
WHERE $wherecondition";
$order = ' ORDER BY lastname ASC, firstname ASC';
$availableusers = $DB->get_records_sql($fields . $sql . $order, $params);
if (empty($availableusers)) {
return array();
}
if ($search) {
$groupname = get_string('extusersmatching', 'role', $search);
} else {
$groupname = get_string('extusers', 'role');
}
return array($groupname => $availableusers);
}
}
admin/roles/manage.php
+5 -11
View File
@@ -61,11 +61,6 @@
$undeletableroles[$CFG->guestroleid] = 1;
$undeletableroles[$CFG->defaultuserroleid] = 1;
$undeletableroles[$CFG->defaultcourseroleid] = 1;
// If there is only one admin role, add that to $undeletableroles too.
$adminroles = get_admin_roles();
if (count($adminroles) == 1) {
$undeletableroles[reset($adminroles)->id] = 1;
}
///.Process submitted data.
$confirmed = optional_param('confirm', false, PARAM_BOOL) && data_submitted() && confirm_sesskey();
@@ -160,7 +155,7 @@
$a->id = $roleid;
$a->name = $roles[$roleid]->name;
$a->shortname = $roles[$roleid]->shortname;
$a->legacytype = get_legacy_type($roleid);
$a->legacytype = $roles[$roleid]->archetype;
if (empty($a->legacytype)) {
$warning = get_string('resetrolesurenolegacy', 'role', $a);
} else {
@@ -168,22 +163,21 @@
}
$formcontinue = new single_button(new moodle_url('manage.php', $optionsyes), get_string('yes'));
$formcancel = new single_button(new moodle_url('manage.php', $optionsno), get_string('no'), 'get');
echo $OUTPUT->confirm(get_string('confirmmessage', 'bulkusers', $usernames), $formcontinue, $formcancel);
echo $OUTPUT->confirm($warning, $formcontinue, $formcancel);
echo $OUTPUT->footer();
die;
}
// Do the reset.
$legacytype = get_legacy_type($roleid);
if ($legacytype) {
set_role_contextlevels($roleid, get_default_contextlevels($legacytype));
if ($roles[$roleid]->archetype) {
set_role_contextlevels($roleid, get_default_contextlevels($roles[$roleid]->archetype));
}
reset_role_capabilities($roleid);
// Mark context dirty, log and redirect.
mark_context_dirty($systemcontext->path);
add_to_log(SITEID, 'role', 'reset', 'admin/roles/manage.php?action=reset&roleid=' . $roleid, $roles[$roleid]->localname, '', $USER->id);
redirect($defineurl . '?action=view&amp;roleid=' . $roleid);
redirect($defineurl . '?action=view&roleid=' . $roleid);
break;
}
admin/settings/appearance.php
+1 -1
View File
@@ -128,7 +128,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
$temp->add(new admin_setting_configtext('mycoursesperpage', get_string('mycoursesperpage', 'admin'), get_string('configmycoursesperpage', 'admin'), 21, PARAM_INT));
$ADMIN->add('appearance', $temp);
// new CFG variable for coursemanager (what roles to display)
// coursemanager is the person responsible for course - usually manages enrolments, receives notification, etc.
$temp = new admin_settingpage('coursemanager', get_string('coursemanager', 'admin'));
$temp->add(new admin_setting_special_coursemanager());
$ADMIN->add('appearance', $temp);
admin/settings/security.php
+5 -1
View File
@@ -17,7 +17,11 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
$temp->add(new admin_setting_configcheckbox('forcelogin', get_string('forcelogin', 'admin'), get_string('configforcelogin', 'admin'), 0));
$temp->add(new admin_setting_configcheckbox('forceloginforprofiles', get_string('forceloginforprofiles', 'admin'), get_string('configforceloginforprofiles', 'admin'), 1));
$temp->add(new admin_setting_configcheckbox('opentogoogle', get_string('opentogoogle', 'admin'), get_string('configopentogoogle', 'admin'), 0));
$temp->add(new admin_setting_pickroles('profileroles',
get_string('profileroles','admin'),
get_string('configprofileroles', 'admin'),
array('student', 'teacher', 'editingteacher')));
$max_upload_choices = get_max_upload_sizes();
// maxbytes set to 0 will allow the maxium server lmit for uploads
$max_upload_choices[0] = get_string('serverlimit', 'admin');
admin/settings/subsystems.php
+1 -1
View File
@@ -37,7 +37,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
$optionalsubsystems->add(new admin_setting_pickroles('progresstrackedroles',
get_string('progresstrackedroles','completion'),
get_string('configprogresstrackedroles', 'completion'),
array('moodle/legacy:student')));
array('student')));
$optionalsubsystems->add(new admin_setting_configcheckbox('enableavailability',
get_string('enableavailability','condition'),
get_string('configenableavailability','condition'), 0));
admin/settings/users.php
+60 -44
View File
@@ -84,65 +84,78 @@ if ($hassiteconfig
if ($ADMIN->fulltree) {
if (!during_initial_install()) {
$context = get_context_instance(CONTEXT_SYSTEM);
if (!$guestrole = get_guest_role()) {
$guestrole->id = 0;
}
if ($studentroles = get_roles_with_capability('moodle/legacy:student', CAP_ALLOW)) {
$studentrole = array_shift($studentroles); /// Take the first one
} else {
$studentrole->id = 0;
}
if ($userroles = get_roles_with_capability('moodle/legacy:user', CAP_ALLOW)) {
$userrole = array_shift($userroles); /// Take the first one
} else {
$userrole->id = 0;
}
if (empty($CFG->creatornewroleid)) {
if ($teacherroles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW, $context)) {
$teachereditrole = array_shift($teacherroles);
set_config('creatornewroleid', $teachereditrole->id);
} else {
set_config('creatornewroleid', 0);
$allroles = array();
$generalroles = array();
$guestroles = array();
$userroles = array();
$studentroles = array();
$teacherroles = array();
$creatornewroles = array();
foreach (get_all_roles() as $role) {
$rolename = strip_tags(format_string($role->name)) . ' ('. $role->shortname . ')';
$allroles[$role->id] = $rolename;
switch ($role->archetype) {
case 'manager':
$creatornewroles[$role->id] = $rolename;
break;
case 'coursecreator':
break;
case 'editingteacher':
$teacherroles[$role->id] = $rolename;
$creatornewroles[$role->id] = $rolename;
break;
case 'teacher':
$creatornewroles[$role->id] = $rolename;
break;
case 'student':
$studentroles[$role->id] = $rolename;
break;
case 'guest':
$guestroles[$role->id] = $rolename;
break;
case 'user':
$userroles[$role->id] = $rolename;
break;
case 'frontpage':
break;
default:
$creatornewroles[$role->id] = $rolename;
$generalroles[$role->id] = $rolename;
break;
}
}
if (!$guestroles = get_roles_with_capability('moodle/legacy:guest', CAP_ALLOW)) {
$guestroles = array();
$defaultguestid = null;
} else {
$defaultguestid = reset($guestroles);
$defaultguestid = $defaultguestid->id;
}
// we must not use assignable roles here:
// 1/ unsetting roles as assignable for admin might bork the settings!
// 2/ default user role should not be assignable anyway
$allroles = array();
$nonguestroles = array();
if ($roles = get_all_roles()) {
foreach ($roles as $role) {
$rolename = strip_tags(format_string($role->name, true));
$allroles[$role->id] = $rolename;
if (!isset($guestroles[$role->id])) {
$nonguestroles[$role->id] = $rolename;
}
}
reset($guestroles);
$defaultguestid = key($guestroles);
reset($studentroles);
$defaultstudentid = key($studentroles);
reset($teacherroles);
$defaultteacherid = key($teacherroles);
if ($userroles) {
reset($userroles);
$defaultuserid = key($userroles);
} else {
$userroles = array('0'=>get_string('none'));
$defaultuserid = 0;
}
$temp->add(new admin_setting_configselect('notloggedinroleid', get_string('notloggedinroleid', 'admin'),
get_string('confignotloggedinroleid', 'admin'), $defaultguestid, $allroles ));
get_string('confignotloggedinroleid', 'admin'), $defaultguestid, ($guestroles + $generalroles)));
$temp->add(new admin_setting_configselect('guestroleid', get_string('guestroleid', 'admin'),
get_string('configguestroleid', 'admin'), $defaultguestid, $allroles));
get_string('configguestroleid', 'admin'), $defaultguestid, ($guestroles + $generalroles)));
$temp->add(new admin_setting_configselect('defaultuserroleid', get_string('defaultuserroleid', 'admin'),
get_string('configdefaultuserroleid', 'admin'), $userrole->id, $nonguestroles)); // guest role here breaks a lot of stuff
get_string('configdefaultuserroleid', 'admin'), $defaultuserid, ($userroles + $generalroles)));
}
$temp->add(new admin_setting_configcheckbox('nodefaultuserrolelists', get_string('nodefaultuserrolelists', 'admin'), get_string('confignodefaultuserrolelists', 'admin'), 0));
if (!during_initial_install()) {
$temp->add(new admin_setting_configselect('defaultcourseroleid', get_string('defaultcourseroleid', 'admin'),
get_string('configdefaultcourseroleid', 'admin'), $studentrole->id, $allroles));
get_string('configdefaultcourseroleid', 'admin'), $defaultstudentid, $allroles));
$temp->add(new admin_setting_configselect('creatornewroleid', get_string('creatornewroleid', 'admin'),
get_string('configcreatornewroleid', 'admin'), $CFG->creatornewroleid, $allroles));
get_string('configcreatornewroleid', 'admin'), $defaultteacherid, $creatornewroles));
}
$temp->add(new admin_setting_configcheckbox('autologinguests', get_string('autologinguests', 'admin'), get_string('configautologinguests', 'admin'), 0));
@@ -174,6 +187,9 @@ if ($hassiteconfig
}
$ADMIN->add('roles', $temp);
if (is_siteadmin()) {
$ADMIN->add('roles', new admin_externalpage('admins', get_string('siteadministrators', 'role'), "$CFG->wwwroot/$CFG->admin/roles/admins.php"));
}
$ADMIN->add('roles', new admin_externalpage('defineroles', get_string('defineroles', 'role'), "$CFG->wwwroot/$CFG->admin/roles/manage.php", 'moodle/role:manage'));
$ADMIN->add('roles', new admin_externalpage('assignroles', get_string('assignglobalroles', 'role'), "$CFG->wwwroot/$CFG->admin/roles/assign.php?contextid=".$systemcontext->id, 'moodle/role:assign'));
$ADMIN->add('roles', new admin_externalpage('checkpermissions', get_string('checkglobalpermissions', 'role'), "$CFG->wwwroot/$CFG->admin/roles/check.php?contextid=".$systemcontext->id, array('moodle/role:assign', 'moodle/role:safeoverride', 'moodle/role:override', 'moodle/role:manage')));
admin/uploaduser.php
+4 -10
View File
@@ -322,7 +322,7 @@ if ($formdata = $mform->is_cancelled()) {
continue;
}
if ($existinguser) {
if (has_capability('moodle/site:doanything', $systemcontext, $existinguser->id)) {
if (is_siteadmin($existinguser->id)) {
$upt->track('status', $strusernotdeletedadmin, 'error');
$deleteerrors++;
continue;
@@ -360,7 +360,7 @@ if ($formdata = $mform->is_cancelled()) {
if ($olduser = $DB->get_record('user', array('username'=>$oldusername, 'mnethostid'=>$user->mnethostid))) {
$upt->track('id', $olduser->id, 'normal', false);
if (has_capability('moodle/site:doanything', $systemcontext, $olduser->id)) {
if (is_siteadmin($olduser->id)) {
$upt->track('status', $strusernotrenamedadmin, 'error');
$renameerrors++;
continue;
@@ -423,7 +423,7 @@ if ($formdata = $mform->is_cancelled()) {
if ($existinguser) {
$user->id = $existinguser->id;
if (has_capability('moodle/site:doanything', $systemcontext, $user->id)) {
if (is_siteadmin($user->id)) {
$upt->track('status', $strusernotupdatedadmin, 'error');
$userserrors++;
continue;
@@ -668,7 +668,7 @@ if ($formdata = $mform->is_cancelled()) {
// find group to add to
if (!empty($user->{'group'.$i})) {
// make sure user is enrolled into course before adding into groups
if (!has_capability('moodle/course:view', $coursecontext, $user->id, false)) {
if (!is_enrolled($coursecontext, $user->id)) {
$upt->track('enrolments', get_string('addedtogroupnotenrolled', '', $gname), 'error');
continue;
}
@@ -1175,12 +1175,6 @@ function uu_allowed_roles($shortname=false) {
$choices[$role->id] = format_string($role->name);
}
}
// get rid of all admin roles
if ($adminroles = get_roles_with_capability('moodle/site:doanything', CAP_ALLOW)) {
foreach($adminroles as $adminrole) {
unset($choices[$adminrole->id]);
}
}
return $choices;
}
admin/uploaduser_form.php
+2 -2
View File
@@ -121,7 +121,7 @@ class admin_uploaduser_form2 extends moodleform {
unset($choices[0]);
$mform->addElement('select', 'uulegacy2', get_string('uulegacy2role', 'admin'), $choices);
if ($editteacherroles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW)) {
if ($editteacherroles = get_archetype_roles('editingteacher')) {
$editteacherrole = array_shift($editteacherroles); /// Take the first one
$mform->setDefault('uulegacy2', $editteacherrole->id);
unset($editteacherroles);
@@ -130,7 +130,7 @@ class admin_uploaduser_form2 extends moodleform {
}
$mform->addElement('select', 'uulegacy3', get_string('uulegacy3role', 'admin'), $choices);
if ($teacherroles = get_roles_with_capability('moodle/legacy:teacher', CAP_ALLOW)) {
if ($teacherroles = get_archetype_roles('teacher')) {
$teacherrole = array_shift($teacherroles); /// Take the first one
$mform->setDefault('uulegacy3', $teacherrole->id);
unset($teacherroles);
admin/webservice/lib.php
+3 -3
View File
@@ -59,7 +59,7 @@ class service_user_selector extends user_selector_base {
//by default wherecondition retrieves all users except the deleted, not
//confirmed and guest
list($wherecondition, $params) = $this->search_sql($search, 'u');
$params[] = $this->serviceid;
$params['serviceid'] = $this->serviceid;
$fields = 'SELECT ' . $this->required_fields_sql('u');
@@ -70,13 +70,13 @@ class service_user_selector extends user_selector_base {
$sql = " FROM {user} u, {external_services_users} esu
WHERE $wherecondition
AND esu.userid = u.id
AND esu.externalserviceid = ?";
AND esu.externalserviceid = :serviceid";
}
else {
///the following SQL retrieve all users that are not allowed to the serviceid
$sql = " FROM {user} u WHERE $wherecondition
AND NOT EXISTS (SELECT esu.userid FROM {external_services_users} esu
WHERE esu.externalserviceid = ?
WHERE esu.externalserviceid = :serviceid
AND esu.userid = u.id)";
}