L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-71918 Calendar: Improve capability checks when fetching events

Browse Source
This commit is contained in:
Huong Nguyen
2021-11-05 13:15:41 +08:00
committed by Jun Pataleta
parent 91a51bbf24
commit 7293a38647
2 changed files with 52 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
calendar/externallib.php
+4
View File
@@ -448,6 +448,10 @@ class core_calendar_external extends external_api {
$context = \context_user::instance($user->id);
self::validate_context($context);
if ($params['userid'] && $USER->id !== $params['userid'] && !has_capability('moodle/calendar:manageentries', $context)) {
throw new \required_capability_exception($context, 'moodle/calendar:manageentries', 'nopermission', '');
}
if (empty($params['aftereventid'])) {
$params['aftereventid'] = null;
}
calendar/tests/externallib_test.php
+48
View File
@@ -1035,6 +1035,54 @@ class core_calendar_externallib_testcase extends externallib_advanced_testcase {
$this->assertEquals('Lesson 1 closes', $result->events[0]->name);
}
/**
* Check that it is possible to get other user's events without the permission.
*/
public function test_get_calendar_action_events_by_timesort_for_other_users() {
$this->resetAfterTest();
// Create test users.
$user1 = $this->getDataGenerator()->create_user(['email' => '[email protected]']);
$user2 = $this->getDataGenerator()->create_user(['email' => '[email protected]']);
// Create test course.
$course = $this->getDataGenerator()->create_course();
$this->setAdminUser();
// Create test activity and make it available only for student2.
$lesson = $this->getDataGenerator()->create_module('lesson', [
'name' => 'Lesson 1',
'course' => $course->id,
'available' => time(),
'deadline' => (time() + (60 * 60 * 24 * 5)),
'availability' => '{"op":"&","c":[{"type":"profile","sf":"email","op":"isequalto","v":"[email protected]"}],"showc":[true]}'
]
);
// Enrol.
$this->getDataGenerator()->enrol_user($user1->id, $course->id);
$this->getDataGenerator()->enrol_user($user2->id, $course->id);
// Student2 can see the event.
$this->setUser($user2);
$result = core_calendar_external::get_calendar_action_events_by_timesort(0, null, 0, 20, true);
$this->assertCount(1, $result->events);
$this->assertEquals('Lesson 1 closes', $result->events[0]->name);
// Student1 cannot see the event.
$this->setUser($user1);
$result = core_calendar_external::get_calendar_action_events_by_timesort(0, null, 0, 20, true);
$this->assertEmpty($result->events);
// Admin, Manager, Teacher can view student2's data.
$this->setAdminUser();
$result = core_calendar_external::get_calendar_action_events_by_timesort(0, null, 0, 20, true, $user2->id);
$this->assertCount(1, $result->events);
$this->assertEquals('Lesson 1 closes', $result->events[0]->name);
// Student1 will see an exception if he/she trying to view student2's data.
$this->setUser($user1);
$this->expectException(required_capability_exception::class);
$this->expectExceptionMessage('error/nopermission');
$result = core_calendar_external::get_calendar_action_events_by_timesort(0, null, 0, 20, true, $user2->id);
}
/**
* Requesting calendar events from a given course and time should return all
* events with a sort time at or after the requested time. All events prior