MDL-74078 core: Add the ability to lock all blocks on a page

lib/pagelib.php

@@ -422,6 +422,11 @@ class moodle_page {
      */
     protected $_navigationoverflow = true;
 
+    /**
+     * @var bool Whether to override/remove all editing capabilities for blocks on the page.
+     */
+    protected $_forcelockallblocks = false;
+
     /**
      * Force the settings menu to be displayed on this page. This will only force the
      * settings menu on an activity / resource page that is being displayed on a theme that
@@ -1052,10 +1057,12 @@ class moodle_page {
 
     /**
      * Does the user have permission to edit blocks on this page.
+     * Can be forced to false by calling the force_lock_all_blocks() method.
+     *
      * @return bool
      */
     public function user_can_edit_blocks() {
-        return has_capability($this->_blockseditingcap, $this->_context);
+        return $this->_forcelockallblocks ? false : has_capability($this->_blockseditingcap, $this->_context);
     }
 
     /**
@@ -1596,6 +1603,17 @@ class moodle_page {
         }
     }
 
+    /**
+     * Remove access to editing/moving on all blocks on a page.
+     * This overrides any capabilities and is intended only for pages where no user (including admins) should be able to
+     * modify blocks on the page (eg My Courses).
+     *
+     * @return void
+     */
+    public function force_lock_all_blocks(): void {
+        $this->_forcelockallblocks = true;
+    }
+
     /**
      * @deprecated since Moodle 3.4
      */

lib/tests/moodle_page_test.php

@@ -21,6 +21,7 @@
  * @category  phpunit
  * @copyright 2009 Tim Hunt
  * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @coversDefaultClass \moodle_page
  */
 
 defined('MOODLE_INTERNAL') || die();
@@ -763,6 +764,47 @@ class core_moodle_page_testcase extends advanced_testcase {
             ],
         ];
     }
+
+    /**
+     * Tests user_can_edit_blocks() returns the expected response.
+     * @covers ::user_can_edit_blocks()
+     */
+    public function test_user_can_edit_blocks() {
+        global $DB;
+
+        $systemcontext = context_system::instance();
+        $this->testpage->set_context($systemcontext);
+
+        $user = $this->getDataGenerator()->create_user();
+        $role = $DB->get_record('role', ['shortname' => 'teacher']);
+        role_assign($role->id, $user->id, $systemcontext->id);
+        $this->setUser($user);
+
+        // Confirm expected response (false) when user does not have access to edit blocks.
+        $capability = $this->testpage->all_editing_caps()[0];
+        assign_capability($capability, CAP_PROHIBIT, $role->id, $systemcontext, true);
+        $this->assertFalse($this->testpage->user_can_edit_blocks());
+
+        // Give capability and confirm expected response (true) now user has access to edit blocks.
+        assign_capability($capability, CAP_ALLOW, $role->id, $systemcontext, true);
+        $this->assertTrue($this->testpage->user_can_edit_blocks());
+    }
+
+    /**
+     * Tests that calling force_lock_all_blocks() will cause user_can_edit_blocks() to return false, regardless of capabilities.
+     * @covers ::force_lock_all_blocks()
+     */
+    public function test_force_lock_all_blocks() {
+        $this->testpage->set_context(context_system::instance());
+        $this->setAdminUser();
+
+        // Confirm admin user has access to edit blocks.
+        $this->assertTrue($this->testpage->user_can_edit_blocks());
+
+        // Force lock and confirm user can no longer edit, despite having the capability.
+        $this->testpage->force_lock_all_blocks();
+        $this->assertFalse($this->testpage->user_can_edit_blocks());
+    }
 }
 
 /**

lib/upgrade.txt

@@ -224,6 +224,9 @@ defined or can't be applied.
     * Calendar, Timeline - Center
     * Recently accessed courses - Side bar/blocks drawer
 * Flat navigation classes have been marked for deprecation with the introduction of primary and secondary navigation concepts.
+* A new method, force_lock_all_blocks(), has been added to the moodle_page class to allow pages to force the value of
+  user_can_edit_blocks() to return false where necessary. This makes it possible to remove block editing on a page
+  from ALL users, including admins, where required on pages with multi region layouts exist, such as "My courses".
 
 === 3.11.4 ===
 * A new option dontforcesvgdownload has been added to the $options parameter of the send_file() function.