From 86cbf2a6433a5bd72beddf02fdc60c633679e9b9 Mon Sep 17 00:00:00 2001
From: Andrew Nicols <andrew@nicols.co.uk>
Date: Thu, 18 Jul 2019 11:09:40 +0800
Subject: [PATCH] MDL-66181 course: Only assign roles that the user is allowed
 to assign

---
 course/edit.php                            |  6 ++-
 course/tests/behat/course_creation.feature | 45 ++++++++++++++++++++++
 2 files changed, 50 insertions(+), 1 deletion(-)

diff --git a/course/edit.php b/course/edit.php
index 727a1f70c82..336238ca1db 100644
--- a/course/edit.php
+++ b/course/edit.php
@@ -161,7 +161,11 @@ if ($editform->is_cancelled()) {
 
         if (!empty($CFG->creatornewroleid) and !is_viewing($context, NULL, 'moodle/role:assign') and !is_enrolled($context, NULL, 'moodle/role:assign')) {
             // Deal with course creators - enrol them internally with default role.
-            enrol_try_internal_enrol($course->id, $USER->id, $CFG->creatornewroleid);
+            if (user_can_assign($context, $CFG->creatornewroleid)) {
+                enrol_try_internal_enrol($course->id, $USER->id, $CFG->creatornewroleid);
+            } else {
+                enrol_try_internal_enrol($course->id, $USER->id);
+            }
         }
 
         // The URL to take them to if they chose save and display.
diff --git a/course/tests/behat/course_creation.feature b/course/tests/behat/course_creation.feature
index cdf5ea81e80..eb46c55b8ca 100644
--- a/course/tests/behat/course_creation.feature
+++ b/course/tests/behat/course_creation.feature
@@ -68,3 +68,48 @@ Feature: Managers can create courses
       | id_enddate_day | 24 |
       | id_enddate_month | October |
       | id_enddate_year | 2016 |
+
+  Scenario: Create a course as a custom course creator
+    Given the following "users" exist:
+      | username  | firstname | lastname | email          |
+      | kevin  | Kevin   | the        | kevin@example.com |
+    And the following "roles" exist:
+      | shortname | name    | archetype |
+      | creator   | Creator |           |
+    And the following "system role assigns" exist:
+      | user   | role    | contextlevel |
+      | kevin  | creator | System       |
+    And I log in as "admin"
+    And I set the following system permissions of "Creator" role:
+      | capability | permission |
+      | moodle/course:create | Allow |
+      | moodle/course:manageactivities | Allow |
+      | moodle/course:viewparticipants | Allow |
+      | moodle/role:assign | Allow |
+    And I log out
+    And I log in as "kevin"
+    And I am on site homepage
+    When I press "Add a new course"
+    And I set the following fields to these values:
+      | Course full name  | My first course |
+      | Course short name | myfirstcourse |
+    And I press "Save and display"
+    And I follow "Participants"
+    Then I should see "Kevin the"
+    And I should not see "Teacher"
+    And I log out
+    Given I log in as "admin"
+    And I define the allowed role assignments for the "Creator" role as:
+      | Teacher | Assignable |
+    And I log out
+    And I log in as "kevin"
+    And I am on site homepage
+    And I turn editing mode on
+    When I press "Add a new course"
+    And I set the following fields to these values:
+      | Course full name  | My second course |
+      | Course short name | mysecondcourse |
+    And I press "Save and display"
+    And I follow "Participants"
+    Then I should see "Kevin the"
+    And I should see "Teacher"