L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-65584 blog: safer deletion of associations in privacy provider.

Browse Source 
It's possible that the given context list contains no posts, which caused
an exception to be thrown when passing an empty array to get_in_or_equal.
This commit is contained in:
Paul Holden
2019-10-08 00:23:40 +01:00
parent 31f8f75672
commit 958b331ada
2 changed files with 32 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
blog/classes/privacy/provider.php
+1 -2
View File
@@ -460,8 +460,7 @@ class provider implements
$params = array_merge($inparams, ['userid' => $userid]);
$associds = $DB->get_fieldset_sql($sql, $params);
list($insql, $inparams) = $DB->get_in_or_equal($associds, SQL_PARAMS_NAMED, 'param', true);
$DB->delete_records_select('blog_association', "id $insql", $inparams);
$DB->delete_records_list('blog_association', 'id', $associds);
}
}
blog/tests/privacy_test.php
+31
View File
@@ -370,6 +370,37 @@ class core_blog_privacy_testcase extends provider_testcase {
$this->assertTrue($DB->record_exists('post', ['courseid' => $c1->id, 'userid' => $u1->id, 'module' => 'notes']));
}
/**
* Test provider delete_data_for_user with a context that contains no entries
*
* @return void
*/
public function test_delete_data_for_user_empty_context() {
global $DB;
$user = $this->getDataGenerator()->create_user();
$course = $this->getDataGenerator()->create_course();
$context = context_course::instance($course->id);
// Create a blog entry for user, associated with course.
$entry = new blog_entry($this->create_post(['userid' => $user->id, 'courseid' => $course->id])->id);
$entry->add_association($context->id);
// Generate list of contexts for user.
$contexts = provider::get_contexts_for_userid($user->id);
$this->assertContains($context->id, $contexts->get_contextids());
// Now delete the blog entry.
$entry->delete();
// Try to delete user data using contexts obtained prior to entry deletion.
$contextlist = new approved_contextlist($user, 'core_blog', $contexts->get_contextids());
provider::delete_data_for_user($contextlist);
// Sanity check to ensure blog_associations is really empty.
$this->assertEmpty($DB->get_records('blog_association', ['contextid' => $context->id]));
}
public function test_delete_data_for_all_users_in_context() {
global $DB;