L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-17081 add role export/import

Browse Source 
This includes improved role creation, allowed roles are editable and other improvements.
This commit is contained in:
Petr Škoda
2013-06-24 12:40:59 +02:00
parent 0ea1fbbb55
commit 5e72efd498
12 changed files with 1177 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/roles/classes/preset.php
+312
View File
@@ -0,0 +1,312 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* New role XML processing.
*
* @package core_role
* @copyright 2013 Petr Skoda {@link http://skodak.org}
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
defined('MOODLE_INTERNAL') || die();
/**
* XML role file manipulation class.
*
* @package core_role
* @copyright 2013 Petr Skoda {@link http://skodak.org}
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
class core_role_preset {
/**
* Send role export xml file to browser.
*
* @param int $roleid
* @return void does not return, send the file to output
*/
public static function send_export_xml($roleid) {
global $CFG, $DB;
require_once($CFG->libdir . '/filelib.php');
$role = $DB->get_record('role', array('id'=>$roleid), '*', MUST_EXIST);
if ($role->shortname) {
$filename = $role->shortname.'.xml';
} else {
$filename = 'role.xml';
}
$xml = self::get_export_xml($roleid);
send_file($xml, $filename, 0, false, true, true);
die();
}
/**
* Generate role export xml file.
*
* @param $roleid
* @return string
*/
public static function get_export_xml($roleid) {
global $DB;
$role = $DB->get_record('role', array('id'=>$roleid), '*', MUST_EXIST);
$dom = new DOMDocument('1.0', 'UTF-8');
$top = $dom->createElement('role');
$dom->appendChild($top);
$top->appendChild($dom->createElement('shortname', $role->shortname));
$top->appendChild($dom->createElement('name', $role->name));
$top->appendChild($dom->createElement('description', $role->description));
$top->appendChild($dom->createElement('archetype', $role->archetype));
$contextlevels = $dom->createElement('contextlevels');
$top->appendChild($contextlevels);
foreach (get_role_contextlevels($roleid) as $level) {
$name = context_helper::get_class_for_level($level);
$name = preg_replace('/^context_/', '', $name);
$contextlevels->appendChild($dom->createElement('level', $name));
}
foreach (array('assign', 'override', 'switch') as $type) {
$allows = $dom->createElement('allow'.$type);
$top->appendChild($allows);
$records = $DB->get_records('role_allow_'.$type, array('roleid'=>$roleid), "allow$type ASC");
foreach ($records as $record) {
if (!$ar = $DB->get_record('role', array('id'=>$record->{'allow'.$type}))) {
continue;
}
$allows->appendChild($dom->createElement('shortname', $ar->shortname));
}
}
$permissions = $dom->createElement('permissions');
$top->appendChild($permissions);
$capabilities = $DB->get_records_sql(
"SELECT *
FROM {role_capabilities}
WHERE contextid = :syscontext AND roleid = :roleid
ORDER BY capability ASC",
array('syscontext'=>context_system::instance()->id, 'roleid'=>$roleid));
foreach ($capabilities as $cap) {
if ($cap->permission == CAP_INHERIT) {
$permissions->appendChild($dom->createElement('inherit', $cap->capability));
}
}
foreach ($capabilities as $cap) {
if ($cap->permission == CAP_ALLOW) {
$permissions->appendChild($dom->createElement('allow', $cap->capability));
}
}
foreach ($capabilities as $cap) {
if ($cap->permission == CAP_PREVENT) {
$permissions->appendChild($dom->createElement('prevent', $cap->capability));
}
}
foreach ($capabilities as $cap) {
if ($cap->permission == CAP_PROHIBIT) {
$permissions->appendChild($dom->createElement('prohibit', $cap->capability));
}
}
return $dom->saveXML();
}
/**
* Is this XML valid role preset?
*
* @param string $xml
* @return bool
*/
public static function is_valid_preset($xml) {
$dom = new DOMDocument();
if (!$dom->loadXML($xml)) {
return false;
} else {
$val = @$dom->schemaValidate(__DIR__.'/../role_schema.xml');
if (!$val) {
return false;
}
}
return true;
}
/**
* Parse role preset xml file.
*
* @param string $xml
* @return array role info, null on error
*/
public static function parse_preset($xml) {
global $DB;
$info = array();
if (!self::is_valid_preset($xml)) {
return null;
}
$dom = new DOMDocument();
$dom->loadXML($xml);
$info['shortname'] = self::get_node_value($dom, '/role/shortname');
if (isset($info['shortname'])) {
$info['shortname'] = strtolower(clean_param($info['shortname'], PARAM_ALPHANUMEXT));
}
$info['name'] = self::get_node_value($dom, '/role/name');
if (isset($value)) {
$info['name'] = clean_param($info['name'], PARAM_TEXT);
}
$info['description'] = self::get_node_value($dom, '/role/description');
if (isset($value)) {
$info['description'] = clean_param($info['description'], PARAM_CLEANHTML);
}
$info['archetype'] = self::get_node_value($dom, '/role/archetype');
if (isset($value)) {
$archetypes = get_role_archetypes();
if (!isset($archetypes[$info['archetype']])) {
$info['archetype'] = null;
}
}
$values = self::get_node_children_values($dom, '/role/contextlevels', 'level');
if (isset($values)) {
$info['contextlevels'] = array();
$levelmap = array_flip(context_helper::get_all_levels());
foreach ($values as $value) {
$level = 'context_'.$value;
if (isset($levelmap[$level])) {
$cl = $levelmap[$level];
$info['contextlevels'][$cl] = $cl;
}
}
}
foreach (array('assign', 'override', 'switch') as $type) {
$values = self::get_node_children_values($dom, '/role/allow'.$type, 'shortname');
if (!isset($values)) {
$info['allow'.$type] = null;
continue;
}
$info['allow'.$type] = array();
foreach ($values as $value) {
if ($value === $info['shortname']) {
array_unshift($info['allow'.$type], -1); // Means self.
}
if ($role = $DB->get_record('role', array('shortname'=>$value))) {
$info['allow'.$type][] = $role->id;
continue;
}
}
}
$info['permissions'] = array();
$values = self::get_node_children_values($dom, '/role/permissions', 'inherit');
if (isset($values)) {
foreach ($values as $value) {
if ($value = clean_param($value, PARAM_CAPABILITY)) {
$info['permissions'][$value] = CAP_INHERIT;
}
}
}
$values = self::get_node_children_values($dom, '/role/permissions', 'allow');
if (isset($values)) {
foreach ($values as $value) {
if ($value = clean_param($value, PARAM_CAPABILITY)) {
$info['permissions'][$value] = CAP_ALLOW;
}
}
}
$values = self::get_node_children_values($dom, '/role/permissions', 'prevent');
if (isset($values)) {
foreach ($values as $value) {
if ($value = clean_param($value, PARAM_CAPABILITY)) {
$info['permissions'][$value] = CAP_PREVENT;
}
}
}
$values = self::get_node_children_values($dom, '/role/permissions', 'prohibit');
if (isset($values)) {
foreach ($values as $value) {
if ($value = clean_param($value, PARAM_CAPABILITY)) {
$info['permissions'][$value] = CAP_PROHIBIT;
}
}
}
return $info;
}
protected static function get_node(DOMDocument $dom, $path) {
$parts = explode('/', $path);
$elname = end($parts);
$nodes = $dom->getElementsByTagName($elname);
if ($nodes->length == 0) {
return null;
}
foreach ($nodes as $node) {
if ($node->getNodePath() === $path) {
return $node;
}
}
return null;
}
protected static function get_node_value(DOMDocument $dom, $path) {
if (!$node = self::get_node($dom, $path)) {
return null;
}
return $node->nodeValue;
}
protected static function get_node_children(DOMDocument $dom, $path, $tagname) {
if (!$node = self::get_node($dom, $path)) {
return null;
}
$return = array();
foreach ($node->childNodes as $child) {
if ($child->nodeName === $tagname) {
$return[] = $child;
}
}
return $return;
}
protected static function get_node_children_values(DOMDocument $dom, $path, $tagname) {
$children = self::get_node_children($dom, $path, $tagname);
if ($children === null) {
return null;
}
$return = array();
foreach ($children as $child) {
$return[] = $child->nodeValue;
}
return $return;
}
}
admin/roles/classes/preset_form.php
+123
View File
@@ -0,0 +1,123 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* Role add/reset selection form.
*
* @package core_role
* @copyright 2013 Petr Skoda {@link http://skodak.org}
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
defined('MOODLE_INTERNAL') || die();
require_once("$CFG->libdir/formslib.php");
/**
* Role add/reset selection form.
*
* @package core_role
* @copyright 2013 Petr Skoda {@link http://skodak.org}
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
class core_role_preset_form extends moodleform {
/**
* Definition of this form.
*/
protected function definition() {
$mform = $this->_form;
$data = $this->_customdata;
$options = array();
$group = get_string('other');
$options[$group] = array();
$options[$group][0] = get_string('norole', 'core_role');
$group = get_string('role', 'core');
$options[$group] = array();
foreach (role_get_names(null, ROLENAME_BOTH) as $role) {
if ($data['roleid'] == $role->id) {
// Do not reset to self.
continue;
}
$options[$group][$role->id] = $role->localname;
}
$group = get_string('archetype', 'core_role');
$options[$group] = array();
foreach (get_role_archetypes() as $type) {
$options[$group][$type] = get_string('archetype'.$type, 'core_role');
}
$mform->addElement('header', 'presetheader', get_string('roleresetdefaults', 'core_role'));
$mform->addElement('selectgroups', 'resettype', get_string('roleresetrole', 'core_role'), $options);
$mform->addElement('filepicker', 'rolepreset', get_string('rolerepreset', 'core_role'));
if ($data['roleid']) {
$mform->addElement('header', 'resetheader', get_string('resetrole', 'core_role'));
$mform->addElement('advcheckbox', 'shortname', get_string('roleshortname', 'core_role'));
$mform->addElement('advcheckbox', 'name', get_string('customrolename', 'core_role'));
$mform->addElement('advcheckbox', 'description', get_string('customroledescription', 'core_role'));
$mform->addElement('advcheckbox', 'archetype', get_string('archetype', 'core_role'));
$mform->addElement('advcheckbox', 'contextlevels', get_string('maybeassignedin', 'core_role'));
$mform->addElement('advcheckbox', 'allowassign', get_string('allowassign', 'core_role'));
$mform->addElement('advcheckbox', 'allowoverride', get_string('allowoverride', 'core_role'));
$mform->addElement('advcheckbox', 'allowswitch', get_string('allowswitch', 'core_role'));
$mform->addElement('advcheckbox', 'permissions', get_string('permissions', 'core_role'));
}
$mform->addElement('hidden', 'roleid');
$mform->setType('roleid', PARAM_INT);
$mform->addElement('hidden', 'action');
$mform->setType('action', PARAM_ALPHA);
$mform->addElement('hidden', 'return');
$mform->setType('return', PARAM_ALPHA);
$this->add_action_buttons(true, get_string('continue', 'core'));
$this->set_data($data);
}
/**
* Validate this form.
*
* @param array $data submitted data
* @param array $files not used
* @return array errors
*/
public function validation($data, $files) {
$errors = parent::validation($data, $files);
if ($files = $this->get_draft_files('rolepreset')) {
/** @var stored_file $file */
$file = reset($files);
$xml = $file->get_content();
if (!core_role_preset::is_valid_preset($xml)) {
$errors['rolepreset'] = get_string('invalidpresetfile', 'core_role');
}
}
return $errors;
}
}
admin/roles/define.php
+149 -56
View File
@@ -1,5 +1,4 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
@@ -19,13 +18,12 @@
* Lets the user edit role definitions.
*
* Responds to actions:
* add - add a new role
* duplicate - like add, only initialise the new role by using an existing one.
* add - add a new role (allows import, duplicate, archetype)
* export - save xml role definition
* edit - edit the definition of a role
* view - view the definition of a role
*
* @package core
* @subpackage role
* @package core_role
* @copyright 1999 onwards Martin Dougiamas (http://dougiamas.com)
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
@@ -34,7 +32,7 @@
require_once($CFG->dirroot . '/' . $CFG->admin . '/roles/lib.php');
$action = required_param('action', PARAM_ALPHA);
if (!in_array($action, array('add', 'duplicate', 'edit', 'view'))) {
if (!in_array($action, array('add', 'export', 'edit', 'reset', 'view'))) {
throw new moodle_exception('invalidaccess');
}
if ($action != 'add') {
@@ -42,28 +40,28 @@
} else {
$roleid = 0;
}
$resettype = optional_param('resettype', '', PARAM_RAW);
$return = optional_param('return', 'manage', PARAM_ALPHA);
/// Get the base URL for this and related pages into a convenient variable.
$manageurl = $CFG->wwwroot . '/' . $CFG->admin . '/roles/manage.php';
$defineurl = $CFG->wwwroot . '/' . $CFG->admin . '/roles/define.php';
if ($action == 'duplicate') {
$baseurl = $defineurl . '?action=add';
$baseurl = new moodle_url('/admin/roles/define.php', array('action'=>$action, 'roleid'=>$roleid));
$manageurl = new moodle_url('/admin/roles/manage.php');
if ($return === 'manage') {
$returnurl = $manageurl;
} else {
$baseurl = $defineurl . '?action=' . $action;
if ($roleid) {
$baseurl .= '&amp;roleid=' . $roleid;
}
$returnurl = new moodle_url('/admin/roles/define.php', array('action'=>'view', 'roleid'=>$roleid));;
}
/// Check access permissions.
$systemcontext = context_system::instance();
require_login();
require_capability('moodle/role:manage', $systemcontext);
admin_externalpage_setup('defineroles', '', array('action' => $action, 'roleid' => $roleid), $defineurl);
admin_externalpage_setup('defineroles', '', array('action' => $action, 'roleid' => $roleid), new moodle_url('/admin/roles/define.php'));
/// Handle the cancel button.
if (optional_param('cancel', false, PARAM_BOOL)) {
redirect($manageurl);
/// Export role.
if ($action === 'export') {
core_role_preset::send_export_xml($roleid);
die;
}
/// Handle the toggle advanced mode button.
@@ -78,17 +76,121 @@
$rolenames = role_fix_names($roles, $systemcontext, ROLENAME_ORIGINAL);
$rolescount = count($roles);
/// Create the table object.
if ($action == 'view') {
$definitiontable = new view_role_definition_table($systemcontext, $roleid);
} else if ($showadvanced) {
$definitiontable = new define_role_table_advanced($systemcontext, $roleid);
if ($action == 'add') {
$title = get_string('addinganewrole', 'role');
} else if ($action == 'view') {
$title = get_string('viewingdefinitionofrolex', 'role', $rolenames[$roleid]->localname);
} else if ($action == 'reset') {
$title = get_string('resettingrole', 'role', $rolenames[$roleid]->localname);
} else {
$definitiontable = new define_role_table_basic($systemcontext, $roleid);
$title = get_string('editingrolex', 'role', $rolenames[$roleid]->localname);
}
$definitiontable->read_submitted_permissions();
if ($action == 'duplicate') {
$definitiontable->make_copy();
/// Decide how to create new role.
if ($action === 'add' and $resettype !== 'none') {
$mform = new core_role_preset_form(null, array('action'=>'add', 'roleid'=>0, 'resettype'=>'0', 'return'=>'manage'));
if ($mform->is_cancelled()) {
redirect($manageurl);
} else if ($data = $mform->get_data()) {
$resettype = $data->resettype;
$options = array(
'shortname' => 1,
'name' => 1,
'description' => 1,
'permissions' => 1,
'archetype' => 1,
'contextlevels' => 1,
'allowassign' => 1,
'allowoverride' => 1,
'allowswitch' => 1);
if ($showadvanced) {
$definitiontable = new define_role_table_advanced($systemcontext, 0);
} else {
$definitiontable = new define_role_table_basic($systemcontext, 0);
}
if (is_number($resettype)) {
// Duplicate the role.
$definitiontable->force_duplicate($resettype, $options);
} else {
// Must be an archetype.
$definitiontable->force_archetype($resettype, $options);
}
if ($xml = $mform->get_file_content('rolepreset')) {
$definitiontable->force_preset($xml, $options);
}
} else {
echo $OUTPUT->header();
echo $OUTPUT->heading_with_help($title, 'roles', 'role');
$mform->display();
echo $OUTPUT->footer();
die;
}
} else if ($action === 'reset' and $resettype !== 'none') {
if (!$role = $DB->get_record('role', array('id'=>$roleid))) {
redirect($manageurl);
}
$resettype = empty($role->archetype) ? '0' : $role->archetype;
$mform = new core_role_preset_form(null,
array('action'=>'reset', 'roleid'=>$roleid, 'resettype'=>$resettype , 'permissions'=>1, 'archetype'=>1, 'contextlevels'=>1, 'return'=>$return));
if ($mform->is_cancelled()) {
redirect($returnurl);
} else if ($data = $mform->get_data()) {
$resettype = $data->resettype;
$options = array(
'shortname' => $data->shortname,
'name' => $data->name,
'description' => $data->description,
'permissions' => $data->permissions,
'archetype' => $data->archetype,
'contextlevels' => $data->contextlevels,
'allowassign' => $data->allowassign,
'allowoverride' => $data->allowoverride,
'allowswitch' => $data->allowswitch);
if ($showadvanced) {
$definitiontable = new define_role_table_advanced($systemcontext, $roleid);
} else {
$definitiontable = new define_role_table_basic($systemcontext, $roleid);
}
if (is_number($resettype)) {
// Duplicate the role.
$definitiontable->force_duplicate($resettype, $options);
} else {
// Must be an archetype.
$definitiontable->force_archetype($resettype, $options);
}
if ($xml = $mform->get_file_content('rolepreset')) {
$definitiontable->force_preset($xml, $options);
}
} else {
echo $OUTPUT->header();
echo $OUTPUT->heading_with_help($title, 'roles', 'role');
$mform->display();
echo $OUTPUT->footer();
die;
}
} else {
/// Create the table object.
if ($action == 'view') {
$definitiontable = new view_role_definition_table($systemcontext, $roleid);
} else if ($showadvanced) {
$definitiontable = new define_role_table_advanced($systemcontext, $roleid);
} else {
$definitiontable = new define_role_table_basic($systemcontext, $roleid);
}
$definitiontable->read_submitted_permissions();
}
/// Handle the cancel button.
if (optional_param('cancel', false, PARAM_BOOL)) {
redirect($returnurl);
}
/// Process submission in necessary.
@@ -96,7 +198,11 @@
$definitiontable->save_changes();
add_to_log(SITEID, 'role', $action, 'admin/roles/define.php?action=view&roleid=' .
$definitiontable->get_role_id(), $definitiontable->get_role_name(), '', $USER->id);
redirect($manageurl);
if ($action === 'add') {
redirect(new moodle_url('/admin/roles/define.php', array('action'=>'view', 'roleid'=>$definitiontable->get_role_id())));
} else {
redirect($returnurl);
}
}
/// Print the page header and tabs.
@@ -105,40 +211,25 @@
$currenttab = 'manage';
include('managetabs.php');
if ($action == 'add') {
$title = get_string('addinganewrole', 'role');
} else if ($action == 'duplicate') {
$title = get_string('addingrolebycopying', 'role', $rolenames[$roleid]->localname);
} else if ($action == 'view') {
$title = get_string('viewingdefinitionofrolex', 'role', $rolenames[$roleid]->localname);
} else if ($action == 'edit') {
$title = get_string('editingrolex', 'role', $rolenames[$roleid]->localname);
}
echo $OUTPUT->heading_with_help($title, 'roles', 'role');
/// Work out some button labels.
if ($action == 'add' || $action == 'duplicate') {
if ($action === 'add') {
$submitlabel = get_string('createthisrole', 'role');
} else {
$submitlabel = get_string('savechanges');
}
/// On the view page, show some extra controls at the top.
if ($action == 'view') {
if ($action === 'view') {
echo $OUTPUT->container_start('buttons');
$options = array();
$options['roleid'] = $roleid;
$options['action'] = 'edit';
echo $OUTPUT->single_button(new moodle_url($defineurl, $options), get_string('edit'));
$options['action'] = 'reset';
if ($definitiontable->get_archetype()) {
echo $OUTPUT->single_button(new moodle_url($manageurl, $options), get_string('resetrole', 'role'));
} else {
echo $OUTPUT->single_button(new moodle_url($manageurl, $options), get_string('resetrolenolegacy', 'role'));
}
$options['action'] = 'duplicate';
echo $OUTPUT->single_button(new moodle_url($defineurl, $options), get_string('duplicaterole', 'role'));
echo $OUTPUT->single_button(new moodle_url($manageurl), get_string('listallroles', 'role'));
$url = new moodle_url('/admin/roles/define.php', array('action'=>'edit', 'roleid'=>$roleid, 'return'=>'define'));
echo $OUTPUT->single_button(new moodle_url($url), get_string('edit'));
$url = new moodle_url('/admin/roles/define.php', array('action'=>'reset', 'roleid'=>$roleid, 'return'=>'define'));
echo $OUTPUT->single_button(new moodle_url($url), get_string('resetrole', 'role'));
$url = new moodle_url('/admin/roles/define.php', array('action'=>'export', 'roleid'=>$roleid));
echo $OUTPUT->single_button(new moodle_url($url), get_string('export', 'core_role'));
echo $OUTPUT->single_button($manageurl, get_string('listallroles', 'role'));
echo $OUTPUT->container_end();
}
@@ -148,10 +239,12 @@
echo '<div class="mform">';
} else {
?>
<form id="rolesform" class="mform" action="<?php echo $baseurl; ?>" method="post"><div>
<form id="rolesform" class="mform" action="<?php p($baseurl->out(false)); ?>" method="post"><div>
<input type="hidden" name="sesskey" value="<?php p(sesskey()) ?>" />
<input type="hidden" name="return" value="<?php p($return); ?>" />
<input type="hidden" name="resettype" value="none" />
<div class="submit buttons">
<input type="submit" name="savechanges" value="<?php echo $submitlabel; ?>" />
<input type="submit" name="savechanges" value="<?php p($submitlabel); ?>" />
<input type="submit" name="cancel" value="<?php print_string('cancel'); ?>" />
</div>
<?php
@@ -166,7 +259,7 @@
} else {
?>
<div class="submit buttons">
<input type="submit" name="savechanges" value="<?php echo $submitlabel; ?>" />
<input type="submit" name="savechanges" value="<?php p($submitlabel); ?>" />
<input type="submit" name="cancel" value="<?php print_string('cancel'); ?>" />
</div>
</div></form>
@@ -176,7 +269,7 @@
/// Print a link back to the all roles list.
echo '<div class="backlink">';
echo '<p><a href="' . $manageurl . '">' . get_string('backtoallroles', 'role') . '</a></p>';
echo '<p><a href="' . s($manageurl->out(false)) . '">' . get_string('backtoallroles', 'role') . '</a></p>';
echo '</div>';
echo $OUTPUT->footer();
admin/roles/lib.php
+319 -24
View File
@@ -1,5 +1,4 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
@@ -20,16 +19,16 @@
*
* Responds to actions:
* add - add a new role
* duplicate - like add, only initialise the new role by using an existing one.
* edit - edit the definition of a role
* view - view the definition of a role
*
* @package core
* @subpackage role
* @package core_role
* @copyright 1999 onwards Martin Dougiamas (http://dougiamas.com)
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
defined('MOODLE_INTERNAL') || die();
require_once($CFG->libdir.'/adminlib.php');
require_once($CFG->dirroot.'/user/selector/lib.php');
@@ -544,6 +543,10 @@ class define_role_table_advanced extends capability_table_with_risks {
protected $allcontextlevels;
protected $disabled = '';
protected $allowassign;
protected $allowoverride;
protected $allowswitch;
public function __construct($context, $roleid) {
$this->roleid = $roleid;
parent::__construct($context, 'defineroletable', $roleid);
@@ -573,6 +576,10 @@ class define_role_table_advanced extends capability_table_with_risks {
} else {
$this->contextlevels = array();
}
$this->allowassign = array_keys($this->get_allow_roles_list('assign'));
$this->allowoverride = array_keys($this->get_allow_roles_list('override'));
$this->allowswitch = array_keys($this->get_allow_roles_list('switch'));
} else {
$this->role = new stdClass;
$this->role->name = '';
@@ -580,6 +587,9 @@ class define_role_table_advanced extends capability_table_with_risks {
$this->role->description = '';
$this->role->archetype = '';
$this->contextlevels = array();
$this->allowassign = array();
$this->allowoverride = array();
$this->allowswitch = array();
}
parent::load_current_permissions();
}
@@ -646,6 +656,20 @@ class define_role_table_advanced extends capability_table_with_risks {
}
}
// Allowed roles.
$allow = optional_param_array('allowassign', null, PARAM_INT);
if (!is_null($allow)) {
$this->allowassign = $allow;
}
$allow = optional_param_array('allowoverride', null, PARAM_INT);
if (!is_null($allow)) {
$this->allowoverride = $allow;
}
$allow = optional_param_array('allowswitch', null, PARAM_INT);
if (!is_null($allow)) {
$this->allowswitch = $allow;
}
// Now read the permissions for each capability.
parent::read_submitted_permissions();
}
@@ -655,14 +679,228 @@ class define_role_table_advanced extends capability_table_with_risks {
}
/**
* Call this after the table has been initialised, so to indicate that
* when save is called, we want to make a duplicate role.
* Call this after the table has been initialised,
* this resets everything to that role.
*
* @param int $roleid role id or 0 for no role
* @param array $options array with following keys:
* 'name', 'shortname', 'description', 'permissions', 'archetype',
* 'contextlevels', 'allowassign', 'allowoverride', 'allowswitch'
*/
public function make_copy() {
$this->roleid = 0;
unset($this->role->id);
$this->role->name = role_get_name($this->role, null, ROLENAME_ORIGINAL) . ' ' . get_string('copyasnoun');
$this->role->shortname .= 'copy';
public function force_duplicate($roleid, array $options) {
global $DB;
if ($roleid == 0) {
// This means reset to nothing == remove everything.
if ($options['shortname']) {
$this->role->shortname = '';
}
if ($options['name']) {
$this->role->name = '';
}
if ($options['description']) {
$this->role->description = '';
}
if ($options['archetype']) {
$this->role->archetype = '';
}
if ($options['contextlevels']) {
$this->contextlevels = array();
}
if ($options['allowassign']) {
$this->allowassign = array();
}
if ($options['allowoverride']) {
$this->allowoverride = array();
}
if ($options['allowswitch']) {
$this->allowswitch = array();
}
if ($options['permissions']) {
foreach ($this->capabilities as $capid => $cap) {
$this->permissions[$cap->name] = CAP_INHERIT;
}
}
return;
}
$role = $DB->get_record('role', array('id'=>$roleid), '*', MUST_EXIST);
if ($options['shortname']) {
$this->role->shortname = $role->shortname;
}
if ($options['name']) {
$this->role->name = $role->name;
}
if ($options['description']) {
$this->role->description = $role->description;
}
if ($options['archetype']) {
$this->role->archetype = $role->archetype;
}
if ($options['contextlevels']) {
$this->contextlevels = array();
$levels = get_role_contextlevels($roleid);
foreach ($levels as $cl) {
$this->contextlevels[$cl] = $cl;
}
}
if ($options['allowassign']) {
$this->allowassign = array_keys($this->get_allow_roles_list('assign', $roleid));
}
if ($options['allowoverride']) {
$this->allowoverride = array_keys($this->get_allow_roles_list('override', $roleid));
}
if ($options['allowswitch']) {
$this->allowswitch = array_keys($this->get_allow_roles_list('switch', $roleid));
}
if ($options['permissions']) {
$this->permissions = $DB->get_records_menu('role_capabilities',
array('roleid' => $roleid, 'contextid' => context_system::instance()->id),
'', 'capability,permission');
foreach ($this->capabilities as $capid => $cap) {
if (!isset($this->permissions[$cap->name])) {
$this->permissions[$cap->name] = CAP_INHERIT;
}
}
}
}
/**
* Change the role definition to match given archetype.
*
* @param string $archetype
* @param array $options array with following keys:
* 'name', 'shortname', 'description', 'permissions', 'archetype',
* 'contextlevels', 'allowassign', 'allowoverride', 'allowswitch'
*/
public function force_archetype($archetype, array $options) {
$archetypes = get_role_archetypes();
if (!isset($archetypes[$archetype])) {
throw new coding_exception('Unknown archetype: '.$archetype);
}
if ($options['shortname']) {
$this->role->shortname = '';
}
if ($options['name']) {
$this->role->name = '';
}
if ($options['description']) {
$this->role->description = '';
}
if ($options['archetype']) {
$this->role->archetype = $archetype;
}
if ($options['contextlevels']) {
$this->contextlevels = array();
$defaults = get_default_contextlevels($archetype);
foreach ($defaults as $cl) {
$this->contextlevels[$cl] = $cl;
}
}
if ($options['allowassign']) {
$this->allowassign = get_default_role_archetype_allows('assign', $archetype);
}
if ($options['allowoverride']) {
$this->allowoverride = get_default_role_archetype_allows('override', $archetype);
}
if ($options['allowswitch']) {
$this->allowswitch = get_default_role_archetype_allows('switch', $archetype);
}
if ($options['permissions']) {
$defaultpermissions = get_default_capabilities($archetype);
foreach ($this->permissions as $k => $v) {
if (isset($defaultpermissions[$k])) {
$this->permissions[$k] = $defaultpermissions[$k];
continue;
}
$this->permissions[$k] = CAP_INHERIT;
}
}
}
/**
* Change the role definition to match given preset.
*
* @param string $xml
* @param array $options array with following keys:
* 'name', 'shortname', 'description', 'permissions', 'archetype',
* 'contextlevels', 'allowassign', 'allowoverride', 'allowswitch'
*/
public function force_preset($xml, array $options) {
if (!$info = core_role_preset::parse_preset($xml)) {
throw new coding_exception('Invalid role preset');
}
if ($options['shortname']) {
if (isset($info['shortname'])) {
$this->role->shortname = $info['shortname'];
}
}
if ($options['name']) {
if (isset($info['name'])) {
$this->role->name = $info['name'];
}
}
if ($options['description']) {
if (isset($info['description'])) {
$this->role->description = $info['description'];
}
}
if ($options['archetype']) {
if (isset($info['archetype'])) {
$this->role->archetype = $info['archetype'];
}
}
if ($options['contextlevels']) {
if (isset($info['contextlevels'])) {
$this->contextlevels = $info['contextlevels'];
}
}
foreach (array('assign', 'override', 'switch') as $type) {
if ($options['allow'.$type]) {
if (isset($info['allow'.$type])) {
$this->{'allow'.$type} = $info['allow'.$type];
}
}
}
if ($options['permissions']) {
foreach ($this->permissions as $k => $v) {
// Note: do not set everything else to CAP_INHERIT here
// because the xml file might not contain all capabilities.
if (isset($info['permissions'][$k])) {
$this->permissions[$k] = $info['permissions'][$k];
}
}
}
}
public function get_role_name() {
@@ -696,10 +934,42 @@ class define_role_table_advanced extends capability_table_with_risks {
// Assignable contexts.
set_role_contextlevels($this->role->id, $this->contextlevels);
// Set allowed roles.
$this->save_allow('assign');
$this->save_allow('override');
$this->save_allow('switch');
// Permissions.
parent::save_changes();
}
protected function save_allow($type) {
global $DB;
$current = array_keys($this->get_allow_roles_list($type));
$wanted = $this->{'allow'.$type};
$addfunction = 'allow_'.$type;
$deltable = 'role_allow_'.$type;
$field = 'allow'.$type;
foreach ($current as $roleid) {
if (!in_array($roleid, $wanted)) {
$DB->delete_records($deltable, array('roleid'=>$this->roleid, $field=>$roleid));
continue;
}
$key = array_search($roleid, $wanted);
unset($wanted[$key]);
}
foreach ($wanted as $roleid) {
if ($roleid == -1) {
$roleid = $this->roleid;
}
$addfunction($this->roleid, $roleid);
}
}
protected function get_name_field($id) {
return '<input type="text" id="' . $id . '" name="' . $id . '" maxlength="254" value="' . s($this->role->name) . '" />';
}
@@ -742,9 +1012,10 @@ class define_role_table_advanced extends capability_table_with_risks {
* Returns an array of roles of the allowed type.
*
* @param string $type Must be one of: assign, switch, or override.
* @param int $roleid (null means current role)
* @return array
*/
protected function get_allow_roles_list($type) {
protected function get_allow_roles_list($type, $roleid = null) {
global $DB;
if ($type !== 'assign' and $type !== 'switch' and $type !== 'override') {
@@ -752,7 +1023,11 @@ class define_role_table_advanced extends capability_table_with_risks {
return array();
}
if (empty($this->roleid)) {
if ($roleid === null) {
$roleid = $this->roleid;
}
if (empty($roleid)) {
return array();
}
@@ -761,7 +1036,7 @@ class define_role_table_advanced extends capability_table_with_risks {
JOIN {role_allow_{$type}} a ON a.allow{$type} = r.id
WHERE a.roleid = :roleid
ORDER BY r.sortorder ASC";
return $DB->get_records_sql($sql, array('roleid'=>$this->roleid));
return $DB->get_records_sql($sql, array('roleid'=>$roleid));
}
/**
@@ -771,12 +1046,22 @@ class define_role_table_advanced extends capability_table_with_risks {
* @return array Am array of role names with the allowed type
*/
protected function get_allow_role_control($type) {
if ($roles = $this->get_allow_roles_list($type)) {
$roles = role_fix_names($roles, null, ROLENAME_ORIGINAL, true);
return implode(', ', $roles);
} else {
return get_string('none');
if ($type !== 'assign' and $type !== 'switch' and $type !== 'override') {
debugging('Invalid role allowed type specified', DEBUG_DEVELOPER);
return '';
}
$property = 'allow'.$type;
$selected = $this->$property;
$options = array();
foreach (role_get_names(null, ROLENAME_ALIAS) as $role) {
$options[$role->id] = $role->localname;
}
if ($this->roleid == 0) {
$options[-1] = get_string('thisnewrole', 'core_role');
}
return html_writer::select($options, 'allow'.$type.'[]', $selected, false, array('multiple'=>'multiple', 'size'=>10));
}
/**
@@ -807,10 +1092,10 @@ class define_role_table_advanced extends capability_table_with_risks {
$extraclass = '';
}
echo '<div class="felement' . $extraclass . '">';
echo $field;
if (isset($this->errors[$name])) {
echo $OUTPUT->error_text($this->errors[$name]);
}
echo $field;
echo '</div>';
echo '</div>';
}
@@ -831,9 +1116,9 @@ class define_role_table_advanced extends capability_table_with_risks {
$this->print_field('edit-description', get_string('customroledescription', 'role').'&nbsp;'.$OUTPUT->help_icon('customroledescription', 'role'), $this->get_description_field('description'));
$this->print_field('menuarchetype', get_string('archetype', 'role').'&nbsp;'.$OUTPUT->help_icon('archetype', 'role'), $this->get_archetype_field('archetype'));
$this->print_field('', get_string('maybeassignedin', 'role'), $this->get_assignable_levels_control());
$this->print_field('', get_string('allowassign', 'role'), $this->get_allow_role_control('assign'));
$this->print_field('', get_string('allowoverride', 'role'), $this->get_allow_role_control('override'));
$this->print_field('', get_string('allowswitch', 'role'), $this->get_allow_role_control('switch'));
$this->print_field('menuallowassign', get_string('allowassign', 'role'), $this->get_allow_role_control('assign'));
$this->print_field('menuallowoverride', get_string('allowoverride', 'role'), $this->get_allow_role_control('override'));
$this->print_field('menuallowswitch', get_string('allowswitch', 'role'), $this->get_allow_role_control('switch'));
if ($risks = $this->get_role_risks_info()) {
$this->print_field('', get_string('rolerisks', 'role'), $risks);
}
@@ -934,6 +1219,16 @@ class view_role_definition_table extends define_role_table_advanced {
}
}
protected function get_allow_role_control($type) {
if ($roles = $this->get_allow_roles_list($type)) {
$roles = role_fix_names($roles, null, ROLENAME_ORIGINAL, true);
return implode(', ', $roles);
} else {
return get_string('none');
}
}
protected function print_show_hide_advanced_button() {
// Do nothing.
}
@@ -1856,4 +2151,4 @@ class admins_existing_selector extends user_selector_base {
$options['file'] = $CFG->admin . '/roles/lib.php';
return $options;
}
}
}
admin/roles/manage.php
-40
View File
@@ -140,42 +140,6 @@
redirect($baseurl);
break;
case 'reset':
if (!$confirmed) {
// show confirmation
echo $OUTPUT->header();
$optionsyes = array('action'=>'reset', 'roleid'=>$roleid, 'sesskey'=>sesskey(), 'confirm'=>1);
$optionsno = array('action'=>'view', 'roleid'=>$roleid);
$a = new stdClass();
$a->id = $roleid;
$a->name = $roles[$roleid]->name;
$a->shortname = $roles[$roleid]->shortname;
$a->legacytype = $roles[$roleid]->archetype;
if (empty($a->legacytype)) {
$warning = get_string('resetrolesurenolegacy', 'role', $a);
} else {
$warning = get_string('resetrolesure', 'role', $a);
}
$formcontinue = new single_button(new moodle_url('manage.php', $optionsyes), get_string('yes'));
$formcancel = new single_button(new moodle_url('manage.php', $optionsno), get_string('no'), 'get');
echo $OUTPUT->confirm($warning, $formcontinue, $formcancel);
echo $OUTPUT->footer();
die;
}
// Reset context levels for standard archetypes
if ($roles[$roleid]->archetype) {
set_role_contextlevels($roleid, get_default_contextlevels($roles[$roleid]->archetype));
}
//reset or delete the capabilities
reset_role_capabilities($roleid);
// Mark context dirty, log and redirect.
mark_context_dirty($systemcontext->path);
add_to_log(SITEID, 'role', 'reset', 'admin/roles/manage.php?action=reset&roleid=' . $roleid, $roles[$roleid]->localname, '', $USER->id);
redirect($defineurl . '?action=view&roleid=' . $roleid);
break;
}
/// Print the page header and tabs.
@@ -198,7 +162,6 @@
/// Get some strings outside the loop.
$stredit = get_string('edit');
$strduplicate = get_string('duplicate');
$strdelete = get_string('delete');
$strmoveup = get_string('moveup');
$strmovedown = get_string('movedown');
@@ -233,9 +196,6 @@
// edit
$row[3] .= get_action_icon($defineurl . '?action=edit&amp;roleid=' . $role->id,
'edit', $stredit, get_string('editxrole', 'role', $role->localname));
// duplicate
$row[3] .= get_action_icon($defineurl . '?action=duplicate&amp;roleid=' . $role->id,
'copy', $strduplicate, get_string('createrolebycopying', 'role', $role->localname));
// delete
if (isset($undeletableroles[$role->id])) {
$row[3] .= get_spacer();
admin/roles/role_schema.xml
+69
View File
@@ -0,0 +1,69 @@
<?xml version="1.0" encoding="UTF-8"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified">
<xs:element name="role">
<xs:complexType>
<xs:sequence>
<xs:element ref="shortname" minOccurs="0"/>
<xs:element ref="name" minOccurs="0"/>
<xs:element ref="description" minOccurs="0"/>
<xs:element ref="archetype" minOccurs="0"/>
<xs:element ref="contextlevels" minOccurs="0"/>
<xs:element ref="allowassign" minOccurs="0"/>
<xs:element ref="allowoverride" minOccurs="0"/>
<xs:element ref="allowswitch" minOccurs="0"/>
<xs:element ref="permissions" minOccurs="0"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="name">
<xs:complexType/>
</xs:element>
<xs:element name="description">
<xs:complexType/>
</xs:element>
<xs:element name="archetype" type="xs:string"/>
<xs:element name="contextlevels">
<xs:complexType>
<xs:sequence>
<xs:element minOccurs="0" maxOccurs="unbounded" ref="level"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="level" type="xs:string"/>
<xs:element name="allowassign">
<xs:complexType>
<xs:sequence>
<xs:element maxOccurs="unbounded" minOccurs="0" ref="shortname"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="allowoverride">
<xs:complexType>
<xs:sequence>
<xs:element maxOccurs="unbounded" minOccurs="0" ref="shortname"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="allowswitch">
<xs:complexType>
<xs:sequence>
<xs:element maxOccurs="unbounded" minOccurs="0" ref="shortname"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="permissions">
<xs:complexType>
<xs:sequence>
<xs:element ref="inherit" minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="allow" minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="prevent" minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="prohibit" minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="inherit" type="xs:string"/>
<xs:element name="allow" type="xs:string"/>
<xs:element name="prevent" type="xs:string"/>
<xs:element name="prohibit" type="xs:string"/>
<xs:element name="shortname" type="xs:string"/>
</xs:schema>
admin/roles/tests/preset_test.php
+72
View File
@@ -0,0 +1,72 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* Role XML presets test case.
*
* @package core_role
* @category phpunit
* @copyright 2013 Petr Skoda {@link http://skodak.org}
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
defined('MOODLE_INTERNAL') || die();
class core_role_preset_testcase extends advanced_testcase {
public function test_xml() {
global $DB;
$roles = $DB->get_records('role');
foreach ($roles as $role) {
$xml = core_role_preset::get_export_xml($role->id);
$this->assertTrue(core_role_preset::is_valid_preset($xml));
$info = core_role_preset::parse_preset($xml);
$this->assertSame($role->shortname, $info['shortname']);
$this->assertSame($role->name, $info['name']);
$this->assertSame($role->description, $info['description']);
$this->assertSame($role->archetype, $info['archetype']);
$contextlevels = get_role_contextlevels($role->id);
$this->assertEquals(array_values($contextlevels), array_values($info['contextlevels']));
foreach (array('assign', 'override', 'switch') as $type) {
$records = $DB->get_records('role_allow_'.$type, array('roleid'=>$role->id), "allow$type ASC");
$allows = array();
foreach ($records as $record) {
if ($record->{'allow'.$type} == $role->id) {
array_unshift($allows, -1);
}
$allows[] = $record->{'allow'.$type};
}
$this->assertEquals($allows, $info['allow'.$type], "$type $role->shortname does not match");
}
$capabilities = $DB->get_records_sql(
"SELECT *
FROM {role_capabilities}
WHERE contextid = :syscontext AND roleid = :roleid
ORDER BY capability ASC",
array('syscontext'=>context_system::instance()->id, 'roleid'=>$role->id));
$this->assertEquals(count($capabilities), count($info['permissions']));
foreach ($capabilities as $cap) {
$this->assertEquals($cap->permission, $info['permissions'][$cap->capability]);
}
}
}
}
lang/en/role.php
+9 -5
View File
@@ -24,7 +24,6 @@
*/
$string['addinganewrole'] = 'Adding a new role';
$string['addingrolebycopying'] = 'Adding a new role based on {$a}';
$string['addrole'] = 'Add a new role';
$string['advancedoverride'] = 'Advanced role override';
$string['allow'] = 'Allow';
@@ -185,6 +184,7 @@ $string['errorexistsroleshortname'] = 'Role name already exists';
$string['existingadmins'] = 'Current site administrators';
$string['existingusers'] = '{$a} existing users';
$string['explanation'] = 'Explanation';
$string['export'] = 'Export';
$string['extusers'] = 'Existing users';
$string['extusersmatching'] = 'Existing users matching \'{$a}\'';
$string['filter:manage'] = 'Manage local filter settings';
@@ -222,6 +222,7 @@ $string['chooseroletoassign'] = 'Please choose a role to assign';
$string['inactiveformorethan'] = 'inactive for more than {$a->timeperiod}';
$string['ingroup'] = 'in the group "{$a->group}"';
$string['inherit'] = 'Inherit';
$string['invalidpresetfile'] = 'Invalid role definition file';
$string['legacy:admin'] = 'LEGACY ROLE: Administrator';
$string['legacy:coursecreator'] = 'LEGACY ROLE: Course creator';
$string['legacy:editingteacher'] = 'LEGACY ROLE: Teacher (editing)';
@@ -247,6 +248,7 @@ $string['neededroles'] = 'Roles with permission';
$string['nocapabilitiesincontext'] = 'No capabilities available in this context';
$string['noneinthisx'] = 'None in this {$a}';
$string['noneinthisxmatching'] = 'No users matching \'{$a->search}\' in this {$a->contexttype}';
$string['norole'] = 'No role';
$string['noroles'] = 'No roles';
$string['noroleassignments'] = 'This user does not have any role assignments anywhere in this site.';
$string['notabletoassignroleshere'] = 'You are not able to assign any roles here';
@@ -298,10 +300,8 @@ $string['rating:rate'] = 'Add ratings to items';
$string['rating:view'] = 'View the total rating you received';
$string['rating:viewany'] = 'View total ratings that anyone received';
$string['rating:viewall'] = 'View all raw ratings given by individuals';
$string['resetrole'] = 'Reset to defaults';
$string['resetrolenolegacy'] = 'Clear permissions';
$string['resetrolesure'] = 'Are you sure that you want to reset role "{$a->name} ({$a->shortname})" to defaults?<p></p>The defaults are taken from the selected archetype ({$a->legacytype}).';
$string['resetrolesurenolegacy'] = 'Are you sure that you want to clear all permissions defined in this role "{$a->name} ({$a->shortname})"?';
$string['resetrole'] = 'Reset';
$string['resettingrole'] = 'Resetting role \'{$a}\'';
$string['restore:configure'] = 'Configure restore options';
$string['restore:createuser'] = 'Create users on restore';
$string['restore:restoreactivity'] = 'Restore activities';
@@ -370,6 +370,7 @@ $string['tag:editblocks'] = 'Edit blocks in tags pages';
$string['tag:manage'] = 'Manage all tags';
$string['tag:flag'] = 'Flag tags as inappropriate';
$string['thisusersroles'] = 'This user\'s role assignments';
$string['thisnewrole'] = 'This new role';
$string['unassignarole'] = 'Unassign role {$a}';
$string['unassignerror'] = 'Error while unassigning the role {$a->role} from user {$a->user}.';
$string['unassignconfirm'] = 'Do you really want to unassign "{$a->role}" role from user "{$a->user}"?';
@@ -394,6 +395,9 @@ $string['user:viewdetails'] = 'View user profiles';
$string['user:viewhiddendetails'] = 'View hidden details of users';
$string['user:viewuseractivitiesreport'] = 'See user activity reports';
$string['user:viewusergrades'] = 'View user grades';
$string['roleresetdefaults'] = 'Defaults';
$string['roleresetrole'] = 'Use role or archetype';
$string['rolerepreset'] = 'Use role preset';
$string['usersfrom'] = 'Users from {$a}';
$string['usersfrommatching'] = 'Users from {$a->contextname} matching \'{$a->search}\'';
$string['usersinthisx'] = 'Users in this {$a}';
lib/accesslib.php
+73
View File
@@ -2456,6 +2456,79 @@ function get_default_capabilities($archetype) {
return $defaults;
}
/**
* Return default roles that can be assigned, overridden or switched
* by give role archetype.
*
* @param string $type assign|override|switch
* @param string $archetype
* @return array of role ids
*/
function get_default_role_archetype_allows($type, $archetype) {
global $DB;
if (empty($archetype)) {
return array();
}
$roles = $DB->get_records('role');
$archetypemap = array();
foreach ($roles as $role) {
if ($role->archetype) {
$archetypemap[$role->archetype][$role->id] = $role->id;
}
}
$defaults = array(
'assign' => array(
'manager' => array('manager', 'coursecreator', 'editingteacher', 'teacher', 'student'),
'coursecreator' => array(),
'editingteacher' => array('teacher', 'student'),
'teacher' => array(),
'student' => array(),
'guest' => array(),
'user' => array(),
'frontpage' => array(),
),
'override' => array(
'manager' => array('manager', 'coursecreator', 'editingteacher', 'teacher', 'student', 'guest', 'user', 'frontpage'),
'coursecreator' => array(),
'editingteacher' => array('teacher', 'student', 'guest'),
'teacher' => array(),
'student' => array(),
'guest' => array(),
'user' => array(),
'frontpage' => array(),
),
'switch' => array(
'manager' => array('editingteacher', 'teacher', 'student', 'guest'),
'coursecreator' => array(),
'editingteacher' => array('teacher', 'student', 'guest'),
'teacher' => array('student', 'guest'),
'student' => array(),
'guest' => array(),
'user' => array(),
'frontpage' => array(),
),
);
if (!isset($defaults[$type][$archetype])) {
debugging("Unknown type '$type'' or archetype '$archetype''");
return array();
}
$return = array();
foreach ($defaults[$type][$archetype] as $at) {
if (isset($archetypemap[$at])) {
foreach ($archetypemap[$at] as $roleid) {
$return[$roleid] = $roleid;
}
}
}
return $return;
}
/**
* Reset role capabilities to default according to selected role archetype.
* If no archetype selected, removes all capabilities.
lib/db/install.php
+9 -52
View File
@@ -259,59 +259,16 @@ function xmldb_main_install() {
// Now is the correct moment to install capabilities - after creation of legacy roles, but before assigning of roles
update_capabilities('moodle');
// Default allow assign
$defaultallowassigns = array(
array($managerrole, $managerrole),
array($managerrole, $coursecreatorrole),
array($managerrole, $editteacherrole),
array($managerrole, $noneditteacherrole),
array($managerrole, $studentrole),
array($editteacherrole, $noneditteacherrole),
array($editteacherrole, $studentrole),
);
foreach ($defaultallowassigns as $allow) {
list($fromroleid, $toroleid) = $allow;
allow_assign($fromroleid, $toroleid);
}
// Default allow override
$defaultallowoverrides = array(
array($managerrole, $managerrole),
array($managerrole, $coursecreatorrole),
array($managerrole, $editteacherrole),
array($managerrole, $noneditteacherrole),
array($managerrole, $studentrole),
array($managerrole, $guestrole),
array($managerrole, $userrole),
array($managerrole, $frontpagerole),
array($editteacherrole, $noneditteacherrole),
array($editteacherrole, $studentrole),
array($editteacherrole, $guestrole),
);
foreach ($defaultallowoverrides as $allow) {
list($fromroleid, $toroleid) = $allow;
allow_override($fromroleid, $toroleid); // There is a rant about this in MDL-15841.
}
// Default allow switch.
$defaultallowswitch = array(
array($managerrole, $editteacherrole),
array($managerrole, $noneditteacherrole),
array($managerrole, $studentrole),
array($managerrole, $guestrole),
array($editteacherrole, $noneditteacherrole),
array($editteacherrole, $studentrole),
array($editteacherrole, $guestrole),
array($noneditteacherrole, $studentrole),
array($noneditteacherrole, $guestrole),
);
foreach ($defaultallowswitch as $allow) {
list($fromroleid, $toroleid) = $allow;
allow_switch($fromroleid, $toroleid);
// Default allow role matrices.
foreach ($DB->get_records('role') as $role) {
foreach (array('assign', 'override', 'switch') as $type) {
$function = 'allow_'.$type;
$allows = get_default_role_archetype_allows($type, $role->archetype);
foreach ($allows as $allowid) {
$function($role->id, $allowid);
}
}
}
// Set up the context levels where you can assign each role.
lib/tests/accesslib_test.php
+39
View File
@@ -822,6 +822,45 @@ class accesslib_testcase extends advanced_testcase {
}
}
/**
* Test role default allows.
*/
public function test_get_default_role_archetype_allows() {
$archetypes = get_role_archetypes();
foreach ($archetypes as $archetype) {
$result = get_default_role_archetype_allows('assign', $archetype);
$this->assertTrue(is_array($result));
$result = get_default_role_archetype_allows('override', $archetype);
$this->assertTrue(is_array($result));
$result = get_default_role_archetype_allows('switch', $archetype);
$this->assertTrue(is_array($result));
}
$result = get_default_role_archetype_allows('assign', '');
$this->assertSame(array(), $result);
$result = get_default_role_archetype_allows('override', '');
$this->assertSame(array(), $result);
$result = get_default_role_archetype_allows('switch', '');
$this->assertSame(array(), $result);
$result = get_default_role_archetype_allows('assign', 'wrongarchetype');
$this->assertSame(array(), $result);
$this->assertDebuggingCalled();
$result = get_default_role_archetype_allows('override', 'wrongarchetype');
$this->assertSame(array(), $result);
$this->assertDebuggingCalled();
$result = get_default_role_archetype_allows('switch', 'wrongarchetype');
$this->assertSame(array(), $result);
$this->assertDebuggingCalled();
}
/**
* Test allowing of role assignments.
* @return void
phpunit.xml.dist
+3
View File
@@ -43,6 +43,9 @@
<testsuite name="core_files">
<directory suffix="_test.php">lib/filestorage/tests</directory>
</testsuite>
<testsuite name="core_role">
<directory suffix="_test.php">admin/roles/tests</directory>
</testsuite>
<testsuite name="core_cohort">
<directory suffix="_test.php">cohort/tests</directory>
</testsuite>