From b5d8bdcbe25ca9fa17e9d12c752aed1c40893fb4 Mon Sep 17 00:00:00 2001
From: David Woloszyn <david.woloszyn@moodle.com>
Date: Tue, 28 Jan 2025 14:25:46 +1100
Subject: [PATCH] MDL-84126 tiny_html: Capability check added

---
 lib/editor/tiny/plugins/html/db/access.php    | 35 ++++++++++++++++++
 .../tiny/plugins/html/lang/en/tiny_html.php   |  1 +
 .../plugins/html/tests/behat/html.feature     | 37 +++++++++++++++++++
 lib/editor/tiny/plugins/html/version.php      |  2 +-
 4 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 lib/editor/tiny/plugins/html/db/access.php

diff --git a/lib/editor/tiny/plugins/html/db/access.php b/lib/editor/tiny/plugins/html/db/access.php
new file mode 100644
index 00000000000..47562f4925d
--- /dev/null
+++ b/lib/editor/tiny/plugins/html/db/access.php
@@ -0,0 +1,35 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Capabilities for the tiny_html plugin.
+ *
+ * @package    tiny_html
+ * @copyright  2025 David Woloszyn <david.woloszyn@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$capabilities = [
+    'tiny/html:use' => [
+        'captype' => 'read',
+        'contextlevel' => CONTEXT_USER,
+        'archetypes' => [
+            'user' => CAP_ALLOW,
+        ],
+    ],
+];
diff --git a/lib/editor/tiny/plugins/html/lang/en/tiny_html.php b/lib/editor/tiny/plugins/html/lang/en/tiny_html.php
index 82af602d5a1..6c98d6580e3 100644
--- a/lib/editor/tiny/plugins/html/lang/en/tiny_html.php
+++ b/lib/editor/tiny/plugins/html/lang/en/tiny_html.php
@@ -25,6 +25,7 @@
 
 defined('MOODLE_INTERNAL') || die();
 
+$string['html:use'] = 'Use TinyMCE HTML';
 $string['pluginname'] = 'HTML';
 $string['privacy:metadata'] = 'The HTML formatter plugin for TinyMCE does not store any personal data.';
 
diff --git a/lib/editor/tiny/plugins/html/tests/behat/html.feature b/lib/editor/tiny/plugins/html/tests/behat/html.feature
index d9337eae70c..920e921c8f7 100644
--- a/lib/editor/tiny/plugins/html/tests/behat/html.feature
+++ b/lib/editor/tiny/plugins/html/tests/behat/html.feature
@@ -22,3 +22,40 @@ Feature: Edit HTML in TinyMCE
         <p>This is my draft</p>
       </div>
       """
+
+  Scenario: Permissions can be configured to control access to HTML features
+    Given the following "users" exist:
+      | username | firstname | lastname | email                |
+      | teacher1 | Teacher   | 1        | teacher1@example.com |
+      | teacher2 | Teacher   | 2        | teacher2@example.com |
+    And the following "courses" exist:
+      | fullname | shortname | format |
+      | Course 1 | C1        | topics |
+    And the following "roles" exist:
+      | name           | shortname | description         | archetype      |
+      | Custom teacher | custom1   | Limited permissions | editingteacher |
+    And the following "course enrolments" exist:
+      | user     | course | role           |
+      | teacher1 | C1     | editingteacher |
+      | teacher2 | C1     | custom1        |
+    And the following "activity" exists:
+      | activity | assign          |
+      | course   | C1              |
+      | name     | Test assignment |
+    And the following "permission overrides" exist:
+      | capability    | permission | role    | contextlevel | reference |
+      | tiny/html:use | Prohibit   | custom1 | Course       | C1        |
+    # Check plugin access as a role with prohibited permissions.
+    And I log in as "teacher2"
+    And I am on the "Test assignment" Activity page
+    And I navigate to "Settings" in current page administration
+    And I set the field "Activity instructions" to "<div><p>This is my draft</p></div>"
+    When I click on the "View > Source code" menu item for the "Activity instructions" TinyMCE editor
+    Then "#id_activityeditor_codeMirrorContainer" "css_element" should not exist
+    # Check plugin access as a role with allowed permissions.
+    And I log in as "teacher1"
+    And I am on the "Test assignment" Activity page
+    And I navigate to "Settings" in current page administration
+    And I set the field "Activity instructions" to "<div><p>This is my draft</p></div>"
+    And I click on the "View > Source code" menu item for the "Activity instructions" TinyMCE editor
+    And "#id_activityeditor_codeMirrorContainer" "css_element" should exist
diff --git a/lib/editor/tiny/plugins/html/version.php b/lib/editor/tiny/plugins/html/version.php
index 7467bc90895..e98ac693ddc 100644
--- a/lib/editor/tiny/plugins/html/version.php
+++ b/lib/editor/tiny/plugins/html/version.php
@@ -25,6 +25,6 @@
 defined('MOODLE_INTERNAL') || die();
 
 $plugin->component = 'tiny_html';
-$plugin->version = 2024121800;
+$plugin->version = 2025012300;
 $plugin->requires = 2024100100;
 $plugin->maturity = MATURITY_STABLE;