L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-74370 reportbuilder: fix permission check to edit own reports.

Browse Source
This commit is contained in:
Paul Holden
2022-03-30 16:26:33 +01:00
parent 7ce003b666
commit 7ca314023a
2 changed files with 41 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
reportbuilder/classes/permission.php
+6 -1
View File
@@ -125,9 +125,14 @@ class permission {
return false;
}
// To edit their own reports, users must have either of the 'edit' or 'editall' capabilities. For reports belonging
// to other users, they must have the specific 'editall' capability.
$userid = $userid ?: (int) $USER->id;
if ($report->get('usercreated') === $userid) {
return has_capability('moodle/reportbuilder:edit', context_system::instance(), $userid);
return has_any_capability([
'moodle/reportbuilder:edit',
'moodle/reportbuilder:editall',
], context_system::instance(), $userid);
} else {
return has_capability('moodle/reportbuilder:editall', context_system::instance(), $userid);
}
reportbuilder/tests/permission_test.php
+35 -22
View File
@@ -178,6 +178,24 @@ class permission_test extends advanced_testcase {
permission::require_can_edit_report($systemreport->get_report_persistent());
}
/**
* Test that user cannot edit any reports without capabilities
*/
public function test_require_can_edit_report_none(): void {
$this->resetAfterTest();
$user = $this->getDataGenerator()->create_user();
$this->setUser($user);
/** @var core_reportbuilder_generator $generator */
$generator = $this->getDataGenerator()->get_plugin_generator('core_reportbuilder');
$report = $generator->create_report(['name' => 'User', 'source' => users::class]);
$this->expectException(report_access_exception::class);
$this->expectExceptionMessage('You cannot edit this report');
permission::require_can_edit_report($report);
}
/**
* Test that user can edit their own reports
*/
@@ -194,14 +212,13 @@ class permission_test extends advanced_testcase {
/** @var core_reportbuilder_generator $generator */
$generator = $this->getDataGenerator()->get_plugin_generator('core_reportbuilder');
$reportuser = $generator->create_report(['name' => 'User', 'source' => users::class]);
$reportadmin = $generator->create_report(['name' => 'Admin', 'source' => users::class, 'usercreated' => get_admin()->id]);
try {
permission::require_can_edit_report($reportuser);
} catch (Throwable $exception) {
$this->fail($exception->getMessage());
}
// Confirm user can edit their own report.
$reportuser = $generator->create_report(['name' => 'User', 'source' => users::class]);
permission::require_can_edit_report($reportuser);
// Create a report by another user, confirm current user cannot edit it.
$reportadmin = $generator->create_report(['name' => 'Admin', 'source' => users::class, 'usercreated' => get_admin()->id]);
$this->expectException(report_access_exception::class);
$this->expectExceptionMessage('You cannot edit this report');
@@ -212,29 +229,25 @@ class permission_test extends advanced_testcase {
* Test that user can edit any reports
*/
public function test_require_can_edit_report_all(): void {
global $DB;
$this->resetAfterTest();
$this->setAdminUser();
$user = $this->getDataGenerator()->create_user();
$this->setUser($user);
$userrole = $DB->get_field('role', 'id', ['shortname' => 'user']);
assign_capability('moodle/reportbuilder:editall', CAP_ALLOW, $userrole, context_system::instance());
/** @var core_reportbuilder_generator $generator */
$generator = $this->getDataGenerator()->get_plugin_generator('core_reportbuilder');
$reportuser = $generator->create_report(['name' => 'User', 'source' => users::class, 'usercreated' => $user->id]);
$reportadmin = $generator->create_report(['name' => 'Admin', 'source' => users::class]);
// User with permission.
$this->setAdminUser();
try {
permission::require_can_edit_report($reportuser);
} catch (Throwable $exception) {
$this->fail($exception->getMessage());
}
// Confirm user can edit their own report.
$reportuser = $generator->create_report(['name' => 'User', 'source' => users::class]);
permission::require_can_edit_report($reportuser);
// User without permission.
$this->setUser($user);
$this->expectException(report_access_exception::class);
$this->expectExceptionMessage('You cannot edit this report');
// Create a report by another user, confirm current user can edit it.
$reportadmin = $generator->create_report(['name' => 'Admin', 'source' => users::class, 'usercreated' => get_admin()->id]);
permission::require_can_edit_report($reportadmin);
}