From 9678041d7d8537ae56c295065820022de6a5e9d4 Mon Sep 17 00:00:00 2001
From: Mark Nelson <markn@moodle.com>
Date: Wed, 2 Dec 2015 18:22:02 +0800
Subject: [PATCH] MDL-52017 enrol_self: always check password before
 re-enabling

---
 enrol/self/edit_form.php | 20 +++++++++++---------
 enrol/self/lib.php       | 23 ++++++++++++++++++++++-
 2 files changed, 33 insertions(+), 10 deletions(-)

diff --git a/enrol/self/edit_form.php b/enrol/self/edit_form.php
index b035bd31252..6c65c6f5e9d 100644
--- a/enrol/self/edit_form.php
+++ b/enrol/self/edit_form.php
@@ -163,15 +163,17 @@ class enrol_self_edit_form extends moodleform {
         $checkpassword = false;
 
         if ($instance->id) {
-            if ($data['status'] == ENROL_INSTANCE_ENABLED) {
-                if ($instance->password !== $data['password']) {
-                    $checkpassword = true;
-                }
-            }
-        } else {
-            if ($data['status'] == ENROL_INSTANCE_ENABLED) {
+            // Check the password if we are enabling the plugin again.
+            if (($instance->status == ENROL_INSTANCE_DISABLED) && ($data['status'] == ENROL_INSTANCE_ENABLED)) {
                 $checkpassword = true;
             }
+
+            // Check the password if the instance is enabled and the password has changed.
+            if (($data['status'] == ENROL_INSTANCE_ENABLED) && ($instance->password !== $data['password'])) {
+                $checkpassword = true;
+            }
+        } else {
+            $checkpassword = true;
         }
 
         if ($checkpassword) {
@@ -179,8 +181,8 @@ class enrol_self_edit_form extends moodleform {
             $policy  = $plugin->get_config('usepasswordpolicy');
             if ($require and trim($data['password']) === '') {
                 $errors['password'] = get_string('required');
-            } else if ($policy) {
-                $errmsg = '';//prevent eclipse warning
+            } else if (!empty($data['password'] && $policy)) {
+                $errmsg = '';
                 if (!check_password_policy($data['password'], $errmsg)) {
                     $errors['password'] = $errmsg;
                 }
diff --git a/enrol/self/lib.php b/enrol/self/lib.php
index 6c1364b4a3b..7a3e5a4c52b 100644
--- a/enrol/self/lib.php
+++ b/enrol/self/lib.php
@@ -685,6 +685,27 @@ class enrol_self_plugin extends enrol_plugin {
      */
     public function can_hide_show_instance($instance) {
         $context = context_course::instance($instance->courseid);
-        return has_capability('enrol/self:config', $context);
+
+        if (!has_capability('enrol/self:config', $context)) {
+            return false;
+        }
+
+        // If the instance is currently disabled, before it can be enabled,
+        // we must check whether the password meets the password policies.
+        if ($instance->status == ENROL_INSTANCE_DISABLED) {
+            if ($this->get_config('requirepassword')) {
+                if (empty($instance->password)) {
+                    return false;
+                }
+            }
+            // Only check the password if it is set.
+            if (!empty($instance->password) && $this->get_config('usepasswordpolicy')) {
+                if (!check_password_policy($instance->password, $errmsg)) {
+                    return false;
+                }
+            }
+        }
+
+        return true;
     }
 }