L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-32638 improved file browser access to submission_content and submission_attachment areas

Browse Source 
The user has to have viewallsubmissions capability to be able to see the
submission files in the browser. Additionally, in the separate groups
mode, the user has to have accessallgroups or share at least one group
with the submission author to view their files.
This commit is contained in:
David Mudrak
2012-04-27 14:56:14 +02:00
parent 76966a0058
commit b7a5e3d603
1 changed files with 57 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/workshop/lib.php
+57 -11
View File
@@ -1321,8 +1321,11 @@ function workshop_pluginfile($course, $cm, $context, $filearea, array $args, $fo
* @return file_info instance or null if not found
*/
function workshop_get_file_info($browser, $areas, $course, $cm, $context, $filearea, $itemid, $filepath, $filename) {
global $CFG, $DB;
global $CFG, $DB, $USER;
/** @var array internal cache for author names */
static $submissionauthors = array();
// this is enforced by {@link file_info_context_course} currently
if (!has_capability('moodle/course:managefiles', $context)) {
return null;
}
@@ -1331,12 +1334,37 @@ function workshop_get_file_info($browser, $areas, $course, $cm, $context, $filea
if ($filearea === 'content' or $filearea === 'attachment') {
if (!has_capability('mod/workshop:viewallsubmissions', $context)) {
return null;
}
if (is_null($itemid)) {
// no itemid (submissionid) passed, display the list of all submissions
require_once($CFG->dirroot . '/mod/workshop/fileinfolib.php');
return new workshop_file_info_submissions_container($browser, $course, $cm, $context, $areas, $filearea);
}
// we are inside the submission container
// make sure the user can see the particular submission in separate groups mode
$gmode = groups_get_activity_groupmode($cm, $course);
if ($gmode == SEPARATEGROUPS and !has_capability('moodle/site:accessallgroups', $context)) {
// check there is at least one common group with both the $USER
// and the submission author (this is not expected to be a frequent
// usecase so we can live with pretty ineffective one query per submission here...)
$sql = "SELECT 'x'
FROM {workshop_submissions} s
JOIN {user} a ON (a.id = s.authorid)
JOIN {groups_members} agm ON (a.id = agm.userid)
JOIN {user} u ON (u.id = ?)
JOIN {groups_members} ugm ON (u.id = ugm.userid)
WHERE s.example = 0 AND s.workshopid = ? AND s.id = ? AND agm.groupid = ugm.groupid";
$params = array($USER->id, $cm->instance, $itemid);
if (!$DB->record_exists_sql($sql, $params)) {
return null;
}
}
// we are inside some particular submission container
$filepath = is_null($filepath) ? '/' : $filepath;
$filename = is_null($filename) ? '.' : $filename;
@@ -1351,16 +1379,34 @@ function workshop_get_file_info($browser, $areas, $course, $cm, $context, $filea
}
// let us display the author's name instead of itemid (submission id)
// todo some sort of caching should happen here
$sql = "SELECT s.id, u.lastname, u.firstname
FROM {workshop_submissions} s
INNER JOIN {user} u ON (s.authorid = u.id)
WHERE s.workshopid = ?";
$params = array($cm->instance);
$authors = $DB->get_records_sql($sql, $params);
$urlbase = $CFG->wwwroot . '/pluginfile.php';
$topvisiblename = fullname($authors[$itemid]);
if (isset($submissionauthors[$itemid])) {
$topvisiblename = $submissionauthors[$itemid];
} else {
$sql = "SELECT s.id, u.lastname, u.firstname
FROM {workshop_submissions} s
JOIN {user} u ON (s.authorid = u.id)
WHERE s.example = 0 AND s.workshopid = ?";
$params = array($cm->instance);
$rs = $DB->get_recordset_sql($sql, $params);
foreach ($rs as $submissionauthor) {
$title = s(fullname($submissionauthor)); // this is generally not unique...
$submissionauthors[$submissionauthor->id] = $title;
}
$rs->close();
if (!isset($submissionauthors[$itemid])) {
// should not happen
return null;
} else {
$topvisiblename = $submissionauthors[$itemid];
}
}
$urlbase = $CFG->wwwroot . '/pluginfile.php';
// do not allow manual modification of any files!
return new file_info_stored($browser, $context, $storedfile, $urlbase, $topvisiblename, true, true, false, false);
}