MDL-82567 core: Add has_capability method

Co-authored-by: David Woloszyn <[email protected]>
Co-authored-by: Jun Pataleta <[email protected]>

admin/classes/table/plugin_management_table.php

@@ -500,4 +500,15 @@ abstract class plugin_management_table extends flexible_table implements dynamic
     protected function supports_ordering(): bool {
         return $this->plugininfoclass::plugintype_supports_ordering();
     }
+
+    /**
+     * Check if the user has the capability to access this table.
+     *
+     * Default implementation for plugin management tables is to require 'moodle/site:config' capability
+     *
+     * @return bool Return true if capability check passed.
+     */
+    public function has_capability(): bool {
+        return has_capability('moodle/site:config', $this->get_context());
+    }
 }

lib/table/classes/dynamic.php

@@ -41,4 +41,7 @@ namespace core_table;
  * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 interface dynamic {
+    // Classes implementing this interface must define function `public has_capability(): bool`
+    // If it is not defined, the web service `core_table_get_dynamic_table_content` will check capability
+    // 'moodle/site:config' in the system context, allowing only admins to access the table data.
 }

lib/table/classes/external/dynamic/get.php

@@ -227,6 +227,13 @@ class get extends external_api {
         $instance = new $tableclass($uniqueid);
         $instance->set_filterset($filterset);
         self::validate_context($instance->get_context());
+        if (!method_exists($instance, 'has_capability')) {
+            // Method \core_table\dynamic::has_capability() will be added in Moodle 4.5. Until then if it is not
+            // implemented, we will require the admin capability.
+            require_capability('moodle/site:config', \context_system::instance());
+        } else if (!$instance->has_capability()) {
+            throw new \moodle_exception('nopermissiontoaccesspage');
+        }
 
         $instance->set_sortdata($sortdata);
         $alphabet = get_string('alphabet', 'langconfig');

lib/tablelib.php

@@ -211,6 +211,21 @@ class flexible_table {
             TABLE_VAR_RESET  => 'treset',
             TABLE_VAR_DIR    => 'tdir',
         );
+
+        static $notified = [];
+        if (!(defined('AJAX_SCRIPT') && AJAX_SCRIPT) &&
+                $this instanceof \core_table\dynamic &&
+                !method_exists($this, 'has_capability') &&
+                empty($notified[get_class($this)])) {
+            // Classes implementing \core_table\dynamic must have a method has_capability():bool .
+            // This will be enforced in Moodle 4.5.
+            \core\notification::add(
+                get_string('codingerror', 'debug',
+                'Error in class '.get_class($this).'. Some functionality may be available to admins only.'),
+                \core\notification::WARNING
+            );
+            $notified[get_class($this)] = true;
+        }
     }
 
     /**

reportbuilder/classes/table/custom_report_table.php

@@ -389,4 +389,13 @@ class custom_report_table extends base_report_table {
 
         return !empty($CFG->customreportsliveediting);
     }
+
+    /**
+     * Check if the user has the capability to access this table.
+     *
+     * @return bool Return true if capability check passed.
+     */
+    public function has_capability(): bool {
+        return \core_reportbuilder\permission::can_edit_report($this->persistent);
+    }
 }

reportbuilder/classes/table/custom_report_table_view.php

@@ -74,4 +74,13 @@ class custom_report_table_view extends custom_report_table {
 
         return '';
     }
+
+    /**
+     * Check if the user has the capability to access this table.
+     *
+     * @return bool Return true if capability check passed.
+     */
+    public function has_capability(): bool {
+        return \core_reportbuilder\permission::can_view_report($this->persistent);
+    }
 }

reportbuilder/classes/table/system_report_table.php

@@ -299,4 +299,18 @@ class system_report_table extends base_report_table {
 
         return '';
     }
+
+    /**
+     * Check if the user has the capability to access this table.
+     *
+     * @return bool Return true if capability check passed.
+     */
+    public function has_capability(): bool {
+        try {
+            $this->report->require_can_view();
+            return true;
+        } catch (\core_reportbuilder\report_access_exception $e) {
+            return false;
+        }
+    }
 }

user/classes/table/participants.php

@@ -483,4 +483,17 @@ class participants extends \table_sql implements dynamic_table {
     public function get_context(): context {
         return $this->context;
     }
+
+    /**
+     * Check if the user has the capability to access this table.
+     *
+     * @return bool Return true if capability check passed.
+     */
+    public function has_capability(): bool {
+        global $CFG;
+        require_once($CFG->dirroot . '/course/lib.php');
+
+        $context = $this->course->id == SITEID ? \context_system::instance() : $this->get_context();
+        return course_can_view_participants($context);
+    }
 }