From ba224fb42c41a5b14309adb6c609715c467116a3 Mon Sep 17 00:00:00 2001
From: Damyon Wiese <damyon@moodle.com>
Date: Thu, 16 Jul 2015 14:14:33 +0800
Subject: [PATCH] MDL-50783 Ajax: Configure how to call a webservice through
 db/service.php

Now the db/service.php array can contain these extra keys to provide information
on how a webservice may be called:

    'ajax' => true (Default is false)

Replaces the xx_is_allowed_from_ajax callback.

    'loginrequired' => false (Default is true)

Means that this webservice can be called through lib/ajax/service-nosession.php
which sets NO_MOODLE_COOKIES to true (faster). This is only safe for webservices returning
static public data (e.g. get_string).
---
 .../templatelibrary/amd/build/display.min.js  |  2 +-
 .../templatelibrary/amd/build/search.min.js   |  2 +-
 admin/tool/templatelibrary/amd/src/display.js |  2 +-
 admin/tool/templatelibrary/amd/src/search.js  |  2 +-
 .../tool/templatelibrary/classes/external.php | 18 -----------
 admin/tool/templatelibrary/db/services.php    |  6 +++-
 lib/ajax/service-nologin.php                  | 31 +++++++++++++++++++
 lib/ajax/service.php                          |  5 +--
 lib/amd/build/ajax.min.js                     |  2 +-
 lib/amd/build/str.min.js                      |  2 +-
 lib/amd/build/templates.min.js                |  2 +-
 lib/amd/src/ajax.js                           | 15 +++++++--
 lib/amd/src/str.js                            |  2 +-
 lib/amd/src/templates.js                      |  2 +-
 lib/classes/output/external.php               | 10 ------
 lib/db/services.php                           | 14 ++++++---
 lib/external/externallib.php                  | 31 -------------------
 lib/externallib.php                           |  3 ++
 tag/classes/external.php                      | 20 +-----------
 19 files changed, 74 insertions(+), 97 deletions(-)
 create mode 100644 lib/ajax/service-nologin.php

diff --git a/admin/tool/templatelibrary/amd/build/display.min.js b/admin/tool/templatelibrary/amd/build/display.min.js
index a5bf8ab0ec3..49c0afe59a3 100644
--- a/admin/tool/templatelibrary/amd/build/display.min.js
+++ b/admin/tool/templatelibrary/amd/build/display.min.js
@@ -1 +1 @@
-define(["jquery","core/ajax","core/log","core/notification","core/templates","core/config","core/str"],function(a,b,c,d,e,f,g){var h=function(a,b){var c="@template "+b,d=0,e=[];if(e=a.match(/{{!([\s\S]*?)}}/g),null!==e)for(d=0;d<e.length;d++){var f=e[d],g=f.indexOf(c);if(-1!==g){var h=g+c.length+1;return f=f.substr(h,f.length-2-h)}}return!1},i=function(b,f,i){g.get_string("templateselected","tool_templatelibrary",b).done(function(b){a('[data-region="displaytemplateheader"]').text(b)}).fail(d.exception);var j=h(f,b);j===!1&&(j=h(i,b)),j&&(f=j),a('[data-region="displaytemplatesource"]').text(f);var k=f.match(/Example context \(json\):([\s\S]*)/),l=!1;if(k){var m=k[1].trim();try{l=a.parseJSON(m)}catch(n){c.debug("Could not parse json example context for template."),c.debug(n)}}l?e.render(b,l).done(function(b,c){a('[data-region="displaytemplateexample"]').empty(),a('[data-region="displaytemplateexample"]').append(b),e.runTemplateJS(c)}).fail(d.exception):g.get_string("templatehasnoexample","tool_templatelibrary").done(function(b){a('[data-region="displaytemplateexample"]').text(b)}).fail(d.exception)},j=function(c){var e=c.split("/"),g=e.shift(),h=e.shift(),j=b.call([{methodname:"core_output_load_template",args:{component:g,template:h,themename:f.theme}},{methodname:"tool_templatelibrary_load_canonical_template",args:{component:g,template:h}}]);a.when.apply(a,j).done(function(a,b){i(c,a,b)}).fail(d.exception)};return a('[data-region="list-templates"]').on("click","[data-templatename]",function(){var b=a(this).data("templatename");j(b)}),{}});
\ No newline at end of file
+define(["jquery","core/ajax","core/log","core/notification","core/templates","core/config","core/str"],function(a,b,c,d,e,f,g){var h=function(a,b){var c="@template "+b,d=0,e=[];if(e=a.match(/{{!([\s\S]*?)}}/g),null!==e)for(d=0;d<e.length;d++){var f=e[d],g=f.indexOf(c);if(-1!==g){var h=g+c.length+1;return f=f.substr(h,f.length-2-h)}}return!1},i=function(b,f,i){g.get_string("templateselected","tool_templatelibrary",b).done(function(b){a('[data-region="displaytemplateheader"]').text(b)}).fail(d.exception);var j=h(f,b);j===!1&&(j=h(i,b)),j&&(f=j),a('[data-region="displaytemplatesource"]').text(f);var k=f.match(/Example context \(json\):([\s\S]*)/),l=!1;if(k){var m=k[1].trim();try{l=a.parseJSON(m)}catch(n){c.debug("Could not parse json example context for template."),c.debug(n)}}l?e.render(b,l).done(function(b,c){a('[data-region="displaytemplateexample"]').empty(),a('[data-region="displaytemplateexample"]').append(b),e.runTemplateJS(c)}).fail(d.exception):g.get_string("templatehasnoexample","tool_templatelibrary").done(function(b){a('[data-region="displaytemplateexample"]').text(b)}).fail(d.exception)},j=function(c){var e=c.split("/"),g=e.shift(),h=e.shift(),j=b.call([{methodname:"core_output_load_template",args:{component:g,template:h,themename:f.theme}},{methodname:"tool_templatelibrary_load_canonical_template",args:{component:g,template:h}}],!0,!1);a.when.apply(a,j).done(function(a,b){i(c,a,b)}).fail(d.exception)};return a('[data-region="list-templates"]').on("click","[data-templatename]",function(){var b=a(this).data("templatename");j(b)}),{}});
\ No newline at end of file
diff --git a/admin/tool/templatelibrary/amd/build/search.min.js b/admin/tool/templatelibrary/amd/build/search.min.js
index 062e585ab92..869d27b9dcc 100644
--- a/admin/tool/templatelibrary/amd/build/search.min.js
+++ b/admin/tool/templatelibrary/amd/build/search.min.js
@@ -1 +1 @@
-define(["jquery","core/ajax","core/log","core/notification","core/templates"],function(a,b,c,d,e){var f=function(b){e.render("tool_templatelibrary/search_results",{templates:b}).done(function(b){a('[data-region="searchresults"]').replaceWith(b)}).fail(d.exception)},g=function(){var c=a('[data-field="component"]').val(),e=a('[data-field="search"]').val();b.call([{methodname:"tool_templatelibrary_list_templates",args:{component:c,search:e},done:f,fail:d.exception}])},h=null,i=function(a,b){null!==h&&window.clearTimeout(h),h=window.setTimeout(function(){a(),h=null},b)},j=function(){i(g,400)};return a('[data-region="list-templates"]').on("change",'[data-field="component"]',j),a('[data-region="list-templates"]').on("input",'[data-field="search"]',j),g(),{}});
\ No newline at end of file
+define(["jquery","core/ajax","core/log","core/notification","core/templates"],function(a,b,c,d,e){var f=function(b){e.render("tool_templatelibrary/search_results",{templates:b}).done(function(b){a('[data-region="searchresults"]').replaceWith(b)}).fail(d.exception)},g=function(){var c=a('[data-field="component"]').val(),e=a('[data-field="search"]').val();b.call([{methodname:"tool_templatelibrary_list_templates",args:{component:c,search:e},done:f,fail:d.exception}],!0,!1)},h=null,i=function(a,b){null!==h&&window.clearTimeout(h),h=window.setTimeout(function(){a(),h=null},b)},j=function(){i(g,400)};return a('[data-region="list-templates"]').on("change",'[data-field="component"]',j),a('[data-region="list-templates"]').on("input",'[data-field="search"]',j),g(),{}});
\ No newline at end of file
diff --git a/admin/tool/templatelibrary/amd/src/display.js b/admin/tool/templatelibrary/amd/src/display.js
index 1585a180bf1..bb2f77a1e4e 100644
--- a/admin/tool/templatelibrary/amd/src/display.js
+++ b/admin/tool/templatelibrary/amd/src/display.js
@@ -133,7 +133,7 @@ define(['jquery', 'core/ajax', 'core/log', 'core/notification', 'core/templates'
                     component: component,
                     template: name
             }
-        }]);
+        }], true, false);
 
         // When returns a new promise that is resolved when all the passed in promises are resolved.
         // The arguments to the done become the values of each resolved promise.
diff --git a/admin/tool/templatelibrary/amd/src/search.js b/admin/tool/templatelibrary/amd/src/search.js
index d4eefe66c3d..efefb268074 100644
--- a/admin/tool/templatelibrary/amd/src/search.js
+++ b/admin/tool/templatelibrary/amd/src/search.js
@@ -53,7 +53,7 @@ define(['jquery', 'core/ajax', 'core/log', 'core/notification', 'core/templates'
               args: { component: componentStr, search: searchStr },
               done: reloadListTemplate,
               fail: notification.exception }
-        ]);
+        ], true, false);
     };
 
     var throttle = null;
diff --git a/admin/tool/templatelibrary/classes/external.php b/admin/tool/templatelibrary/classes/external.php
index 100172b15be..be583a27a4e 100644
--- a/admin/tool/templatelibrary/classes/external.php
+++ b/admin/tool/templatelibrary/classes/external.php
@@ -63,14 +63,6 @@ class external extends external_api {
         return new external_function_parameters($params);
     }
 
-    /**
-     * Expose to AJAX
-     * @return boolean
-     */
-    public static function list_templates_is_allowed_from_ajax() {
-        return true;
-    }
-
     /**
      * Loads the list of templates.
      * @param string $component Limit the search to a component.
@@ -108,16 +100,6 @@ class external extends external_api {
             );
     }
 
-    /**
-     * Can this function be called directly from ajax?
-     *
-     * @return boolean
-     * @since Moodle 2.9
-     */
-    public static function load_canonical_template_is_allowed_from_ajax() {
-        return true;
-    }
-
     /**
      * Return a mustache template.
      * Note - this function differs from the function core_output_load_template
diff --git a/admin/tool/templatelibrary/db/services.php b/admin/tool/templatelibrary/db/services.php
index c1a9479180d..9dda64761ff 100644
--- a/admin/tool/templatelibrary/db/services.php
+++ b/admin/tool/templatelibrary/db/services.php
@@ -32,12 +32,16 @@ $functions = array(
         'description' => 'List/search templates by component.',
         'type'        => 'read',
         'capabilities'=> '',
+        'ajax'        => true,
+        'loginrequired' => false,
     ),
     'tool_templatelibrary_load_canonical_template' => array(
         'classname'   => 'tool_templatelibrary\external',
         'methodname'  => 'load_canonical_template',
         'description' => 'Load a canonical template by name (not the theme overidden one).',
-        'type'        => 'read'
+        'type'        => 'read',
+        'ajax'        => true,
+        'loginrequired' => false,
     ),
 
 );
diff --git a/lib/ajax/service-nologin.php b/lib/ajax/service-nologin.php
new file mode 100644
index 00000000000..7120adec7f2
--- /dev/null
+++ b/lib/ajax/service-nologin.php
@@ -0,0 +1,31 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * This file is used to call any registered externallib function in Moodle.
+ *
+ * It will process more than one request and return more than one response if required.
+ * It is recommended to add webservice functions and re-use this script instead of
+ * writing any new custom ajax scripts.
+ *
+ * @since Moodle 2.9
+ * @package core
+ * @copyright 2015 Damyon Wiese
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+define('NO_MOODLE_COOKIES', true);
+require_once('service.php');
diff --git a/lib/ajax/service.php b/lib/ajax/service.php
index 166b8a84e59..366f1ad16ff 100644
--- a/lib/ajax/service.php
+++ b/lib/ajax/service.php
@@ -32,8 +32,6 @@ define('AJAX_SCRIPT', true);
 require_once(dirname(__FILE__) . '/../../config.php');
 require_once($CFG->libdir . '/externallib.php');
 
-require_sesskey();
-
 $rawjson = file_get_contents('php://input');
 
 $requests = json_decode($rawjson, true);
@@ -54,6 +52,7 @@ foreach ($requests as $request) {
         $externalfunctioninfo = external_function_info($methodname);
 
         if (!$externalfunctioninfo->allowed_from_ajax) {
+            error_log('This external function is not available to ajax. Failed to call "' . $methodname . '"');
             throw new moodle_exception('servicenotavailable', 'webservice');
         }
 
@@ -62,6 +61,8 @@ foreach ($requests as $request) {
             if (!isloggedin()) {
                 error_log('This external function is not available to public users. Failed to call "' . $methodname . '"');
                 throw new moodle_exception('servicenotavailable', 'webservice');
+            } else {
+                require_sesskey();
             }
         }
 
diff --git a/lib/amd/build/ajax.min.js b/lib/amd/build/ajax.min.js
index 2a80dfe3166..7ed899b1709 100644
--- a/lib/amd/build/ajax.min.js
+++ b/lib/amd/build/ajax.min.js
@@ -1 +1 @@
-define(["jquery","core/config"],function(a,b){var c=function(a){var b,c,d=this,e=null,f=0;for(f=0;f<d.length;f++){if(b=d[f],c=a[f],"undefined"==typeof c){e=new Error("missing response");break}if(c.error!==!1){e=c.exception;break}b.deferred.resolve(c.data)}if(null!==e)for(;f<d.length;f++)b=d[f],b.deferred.reject(e)},d=function(a,b){var c=this,d=0;for(d=0;d<c.length;d++){var e=c[d];"undefined"!=typeof e.fail&&e.deferred.reject(b)}};return{call:function(e,f){var g,h=[],i=[];for("undefined"==typeof f&&(f=!0),g=0;g<e.length;g++){var j=e[g];h.push({index:g,methodname:j.methodname,args:j.args}),j.deferred=a.Deferred(),i.push(j.deferred.promise()),"undefined"!=typeof j.done&&j.deferred.done(j.done),"undefined"!=typeof j.fail&&j.deferred.fail(j.fail),j.index=g}h=JSON.stringify(h);var k={type:"POST",data:h,context:e,dataType:"json",processData:!1,async:f};return f?a.ajax(b.wwwroot+"/lib/ajax/service.php?sesskey="+b.sesskey,k).done(c).fail(d):(k.success=c,k.error=d,a.ajax(b.wwwroot+"/lib/ajax/service.php?sesskey="+b.sesskey,k)),i}}});
\ No newline at end of file
+define(["jquery","core/config"],function(a,b){var c=function(a){var b,c,d=this,e=null,f=0;for(f=0;f<d.length;f++){if(b=d[f],c=a[f],"undefined"==typeof c){e=new Error("missing response");break}if(c.error!==!1){e=c.exception;break}b.deferred.resolve(c.data)}if(null!==e)for(;f<d.length;f++)b=d[f],b.deferred.reject(e)},d=function(a,b){var c=this,d=0;for(d=0;d<c.length;d++){var e=c[d];"undefined"!=typeof e.fail&&e.deferred.reject(b)}};return{call:function(e,f,g){var h,i=[],j=[];for("undefined"==typeof f&&(f=!0),h=0;h<e.length;h++){var k=e[h];i.push({index:h,methodname:k.methodname,args:k.args}),k.deferred=a.Deferred(),j.push(k.deferred.promise()),"undefined"!=typeof k.done&&k.deferred.done(k.done),"undefined"!=typeof k.fail&&k.deferred.fail(k.fail),k.index=h}i=JSON.stringify(i);var l={type:"POST",data:i,context:e,dataType:"json",processData:!1,async:f},m=b.wwwroot+"/lib/ajax/service.php?sesskey="+b.sesskey;return g||(m=b.wwwroot+"/lib/ajax/service-nologin.php?sesskey="+b.sesskey),f?a.ajax(m,l).done(c).fail(d):(l.success=c,l.error=d,a.ajax(m,l)),j}}});
\ No newline at end of file
diff --git a/lib/amd/build/str.min.js b/lib/amd/build/str.min.js
index ace0e9383c0..33d26c9937f 100644
--- a/lib/amd/build/str.min.js
+++ b/lib/amd/build/str.min.js
@@ -1 +1 @@
-define(["jquery","core/ajax","core/localstorage"],function(a,b,c){return{get_string:function(b,d,e,f){var g=a.Deferred();if("undefined"!=typeof M.str[d]&&"undefined"!=typeof M.str[d][b])return g.resolve(M.util.get_string(b,d,e)),g.promise();var h=c.get("core_str/"+b+"/"+d+"/"+f);if(h)return"undefined"==typeof M.str[d]&&(M.str[d]=[]),M.str[d][b]=h,g.resolve(M.util.get_string(b,d,e)),g.promise();var i=this.get_strings([{key:b,component:d,param:e,lang:f}]);return i.done(function(a){c.set("core_str/"+b+"/"+d+"/"+f,a[0]),g.resolve(a[0])}).fail(function(a){g.reject(a)}),g.promise()},get_strings:function(d){var e,f=a.Deferred(),g=[],h=0,i=!1;for(h=0;h<d.length;h++)if(e=d[h],"undefined"==typeof e.lang&&(e.lang=a("html").attr("lang")),"undefined"==typeof M.str[e.component]||"undefined"==typeof M.str[e.component][e.key]){var j=c.get("core_str/"+e.key+"/"+e.component+"/"+e.lang);j?("undefined"==typeof M.str[e.component]&&(M.str[e.component]=[]),M.str[e.component][e.key]=j):i=!0}if(i){var k=[];for(h=0;h<d.length;h++)e=d[h],k.push({methodname:"core_get_string",args:{stringid:e.key,component:e.component,lang:e.lang,stringparams:[]}});var l=b.call(k);a.when.apply(null,l).done(function(){var a=0;for(a=0;a<arguments.length;a++)e=d[a],"undefined"==typeof M.str[e.component]&&(M.str[e.component]=[]),M.str[e.component][e.key]=arguments[a],c.set("core_str/"+e.key+"/"+e.component+"/"+e.lang,arguments[a]),g[a]=M.util.get_string(e.key,e.component,e.param).trim();f.resolve(g)}).fail(function(a){f.reject(a)})}else{for(h=0;h<d.length;h++)e=d[h],g[h]=M.util.get_string(e.key,e.component,e.param);f.resolve(g)}return f.promise()}}});
\ No newline at end of file
+define(["jquery","core/ajax","core/localstorage"],function(a,b,c){return{get_string:function(b,d,e,f){var g=a.Deferred();if("undefined"!=typeof M.str[d]&&"undefined"!=typeof M.str[d][b])return g.resolve(M.util.get_string(b,d,e)),g.promise();var h=c.get("core_str/"+b+"/"+d+"/"+f);if(h)return"undefined"==typeof M.str[d]&&(M.str[d]=[]),M.str[d][b]=h,g.resolve(M.util.get_string(b,d,e)),g.promise();var i=this.get_strings([{key:b,component:d,param:e,lang:f}]);return i.done(function(a){c.set("core_str/"+b+"/"+d+"/"+f,a[0]),g.resolve(a[0])}).fail(function(a){g.reject(a)}),g.promise()},get_strings:function(d){var e,f=a.Deferred(),g=[],h=0,i=!1;for(h=0;h<d.length;h++)if(e=d[h],"undefined"==typeof e.lang&&(e.lang=a("html").attr("lang")),"undefined"==typeof M.str[e.component]||"undefined"==typeof M.str[e.component][e.key]){var j=c.get("core_str/"+e.key+"/"+e.component+"/"+e.lang);j?("undefined"==typeof M.str[e.component]&&(M.str[e.component]=[]),M.str[e.component][e.key]=j):i=!0}if(i){var k=[];for(h=0;h<d.length;h++)e=d[h],k.push({methodname:"core_get_string",args:{stringid:e.key,component:e.component,lang:e.lang,stringparams:[]}});var l=b.call(k,!0,!1);a.when.apply(null,l).done(function(){var a=0;for(a=0;a<arguments.length;a++)e=d[a],"undefined"==typeof M.str[e.component]&&(M.str[e.component]=[]),M.str[e.component][e.key]=arguments[a],c.set("core_str/"+e.key+"/"+e.component+"/"+e.lang,arguments[a]),g[a]=M.util.get_string(e.key,e.component,e.param).trim();f.resolve(g)}).fail(function(a){f.reject(a)})}else{for(h=0;h<d.length;h++)e=d[h],g[h]=M.util.get_string(e.key,e.component,e.param);f.resolve(g)}return f.promise()}}});
\ No newline at end of file
diff --git a/lib/amd/build/templates.min.js b/lib/amd/build/templates.min.js
index ed4aa324e9a..c75432be2aa 100644
--- a/lib/amd/build/templates.min.js
+++ b/lib/amd/build/templates.min.js
@@ -1 +1 @@
-define(["core/mustache","jquery","core/ajax","core/str","core/notification","core/url","core/config","core/localstorage"],function(a,b,c,d,e,f,g,h){var i={},j=[],k=[],l=1,m="",n=function(b,c){var d,e=b.split(","),g="",h="",j="";e.length>0&&(g=e.shift().trim()),e.length>0&&(h=e.shift().trim()),e.length>0&&(j=e.join(",").trim());var k=f.imageUrl(g,h),l={attributes:[{name:"src",value:k},{name:"alt",value:c(j)},{name:"class",value:"smallicon"}]},n=i[m+"/core/pix_icon"];return d=a.render(n,l,o),d.trim()},o=function(a){var b="";return u(a,!1).done(function(a){b=a}).fail(e.exception),b},p=function(a,b){return k.push(b(a,this)),""},q=function(a,b){var c=a.split(","),d="",e="",f="";c.length>0&&(d=c.shift().trim()),c.length>0&&(e=c.shift().trim()),c.length>0&&(f=c.join(",").trim()),""!==f&&(f=b(f,this)),0===f.indexOf("{")&&0!==f.indexOf("{{")&&(f=JSON.parse(f));var g=j.length;return j.push({key:d,component:e,param:f}),"{{_s"+g+"}}"},r=function(a,b){m=b,j=[],k=[],a.uniqid=l++,a.str=function(){return q},a.pix=function(){return n},a.js=function(){return p},a.globals={config:g},a.currentTheme=b},s=function(a){var b="";k.length>0&&(b=k.join(";\n"));var c=0;for(c=0;c<a.length;c++)b=b.replace("{{_s"+c+"}}",a[c]);return b},t=function(c,e,f){var g=b.Deferred();m=f;var h=u("core/pix_icon",!0);return h.done(function(){r(e,f);var b="";try{b=a.render(c,e,o)}catch(h){g.reject(h)}j.length>0?d.get_strings(j).done(function(a){var c;for(c=0;c<a.length;c++)b=b.replace("{{_s"+c+"}}",a[c]);g.resolve(b.trim(),s(a))}).fail(function(a){g.reject(a)}):g.resolve(b.trim(),s([]))}).fail(function(a){g.reject(a)}),g.promise()},u=function(a,d){var e=b.Deferred(),f=a.split("/"),g=f.shift(),j=f.shift(),k=m+"/"+a;if(k in i)return e.resolve(i[k]),e.promise();var l=h.get("core_template/"+k);if(l)return e.resolve(l),i[k]=l,e.promise();var n=c.call([{methodname:"core_output_load_template",args:{component:g,template:j,themename:m}}],d);return n[0].done(function(a){h.set("core_template/"+k,a),i[k]=a,e.resolve(a)}).fail(function(a){e.reject(a)}),e.promise()};return{render:function(a,c,d){var e=b.Deferred();"undefined"==typeof d&&(d=g.theme),m=d;var f=u(a,!0);return f.done(function(a){var b=t(a,c,d);b.done(function(a,b){e.resolve(a,b)}).fail(function(a){e.reject(a)})}).fail(function(a){e.reject(a)}),e.promise()},runTemplateJS:function(a){var c=b("<script>").attr("type","text/javascript").html(a);b("head").append(c)}}});
\ No newline at end of file
+define(["core/mustache","jquery","core/ajax","core/str","core/notification","core/url","core/config","core/localstorage"],function(a,b,c,d,e,f,g,h){var i={},j=[],k=[],l=1,m="",n=function(b,c){var d,e=b.split(","),g="",h="",j="";e.length>0&&(g=e.shift().trim()),e.length>0&&(h=e.shift().trim()),e.length>0&&(j=e.join(",").trim());var k=f.imageUrl(g,h),l={attributes:[{name:"src",value:k},{name:"alt",value:c(j)},{name:"class",value:"smallicon"}]},n=i[m+"/core/pix_icon"];return d=a.render(n,l,o),d.trim()},o=function(a){var b="";return u(a,!1).done(function(a){b=a}).fail(e.exception),b},p=function(a,b){return k.push(b(a,this)),""},q=function(a,b){var c=a.split(","),d="",e="",f="";c.length>0&&(d=c.shift().trim()),c.length>0&&(e=c.shift().trim()),c.length>0&&(f=c.join(",").trim()),""!==f&&(f=b(f,this)),0===f.indexOf("{")&&0!==f.indexOf("{{")&&(f=JSON.parse(f));var g=j.length;return j.push({key:d,component:e,param:f}),"{{_s"+g+"}}"},r=function(a,b){m=b,j=[],k=[],a.uniqid=l++,a.str=function(){return q},a.pix=function(){return n},a.js=function(){return p},a.globals={config:g},a.currentTheme=b},s=function(a){var b="";k.length>0&&(b=k.join(";\n"));var c=0;for(c=0;c<a.length;c++)b=b.replace("{{_s"+c+"}}",a[c]);return b},t=function(c,e,f){var g=b.Deferred();m=f;var h=u("core/pix_icon",!0);return h.done(function(){r(e,f);var b="";try{b=a.render(c,e,o)}catch(h){g.reject(h)}j.length>0?d.get_strings(j).done(function(a){var c;for(c=0;c<a.length;c++)b=b.replace("{{_s"+c+"}}",a[c]);g.resolve(b.trim(),s(a))}).fail(function(a){g.reject(a)}):g.resolve(b.trim(),s([]))}).fail(function(a){g.reject(a)}),g.promise()},u=function(a,d){var e=b.Deferred(),f=a.split("/"),g=f.shift(),j=f.shift(),k=m+"/"+a;if(k in i)return e.resolve(i[k]),e.promise();var l=h.get("core_template/"+k);if(l)return e.resolve(l),i[k]=l,e.promise();var n=c.call([{methodname:"core_output_load_template",args:{component:g,template:j,themename:m}}],d,!1);return n[0].done(function(a){h.set("core_template/"+k,a),i[k]=a,e.resolve(a)}).fail(function(a){e.reject(a)}),e.promise()};return{render:function(a,c,d){var e=b.Deferred();"undefined"==typeof d&&(d=g.theme),m=d;var f=u(a,!0);return f.done(function(a){var b=t(a,c,d);b.done(function(a,b){e.resolve(a,b)}).fail(function(a){e.reject(a)})}).fail(function(a){e.reject(a)}),e.promise()},runTemplateJS:function(a){var c=b("<script>").attr("type","text/javascript").html(a);b("head").append(c)}}});
\ No newline at end of file
diff --git a/lib/amd/src/ajax.js b/lib/amd/src/ajax.js
index 2966cb4d877..6b497c35f44 100644
--- a/lib/amd/src/ajax.js
+++ b/lib/amd/src/ajax.js
@@ -104,9 +104,13 @@ define(['jquery', 'core/config'], function($, config) {
          *                   can be attached to the promises returned by this function.
          * @param {Boolean} async Optional, defaults to true.
          *                  If false - this function will not return until the promises are resolved.
+         * @param {Boolean} loginrequired Optional, defaults to true.
+         *                  If false - this function will call the faster nologin ajax script - but
+         *                  will fail unless all functions have been marked as 'loginrequired' => false
+         *                  in services.php
          * @return {Promise[]} Array of promises that will be resolved when the ajax call returns.
          */
-        call: function(requests, async) {
+        call: function(requests, async, loginrequired) {
             var ajaxRequestData = [],
                 i,
                 promises = [];
@@ -144,15 +148,20 @@ define(['jquery', 'core/config'], function($, config) {
                 async: async
             };
 
+            var script = config.wwwroot + '/lib/ajax/service.php?sesskey=' + config.sesskey;
+            if (!loginrequired) {
+                script = config.wwwroot + '/lib/ajax/service-nologin.php?sesskey=' + config.sesskey;
+            }
+
             // Jquery deprecated done and fail with async=false so we need to do this 2 ways.
             if (async) {
-                $.ajax(config.wwwroot + '/lib/ajax/service.php?sesskey=' + config.sesskey, settings)
+                $.ajax(script, settings)
                     .done(requestSuccess)
                     .fail(requestFail);
             } else {
                 settings.success = requestSuccess;
                 settings.error = requestFail;
-                $.ajax(config.wwwroot + '/lib/ajax/service.php?sesskey=' + config.sesskey, settings);
+                $.ajax(script, settings);
             }
 
             return promises;
diff --git a/lib/amd/src/str.js b/lib/amd/src/str.js
index d66c164777f..76830d380fd 100644
--- a/lib/amd/src/str.js
+++ b/lib/amd/src/str.js
@@ -140,7 +140,7 @@ define(['jquery', 'core/ajax', 'core/localstorage'], function($, ajax, storage)
                     });
                 }
 
-                var deferreds = ajax.call(ajaxrequests);
+                var deferreds = ajax.call(ajaxrequests, true, false);
                 $.when.apply(null, deferreds).done(
                     function() {
                         // Turn the list of arguments (unknown length) into a real array.
diff --git a/lib/amd/src/templates.js b/lib/amd/src/templates.js
index 93ed7d111bc..a152e03fd94 100644
--- a/lib/amd/src/templates.js
+++ b/lib/amd/src/templates.js
@@ -310,7 +310,7 @@ define([ 'core/mustache',
                 template: name,
                 themename: currentThemeName
             }
-        }], async);
+        }], async, false);
 
         promises[0].done(
             function (templateSource) {
diff --git a/lib/classes/output/external.php b/lib/classes/output/external.php
index 17b1ca74712..a76248edf96 100644
--- a/lib/classes/output/external.php
+++ b/lib/classes/output/external.php
@@ -55,16 +55,6 @@ class external extends external_api {
             );
     }
 
-    /**
-     * Can this function be called directly from ajax?
-     *
-     * @return boolean
-     * @since Moodle 2.9
-     */
-    public static function load_template_is_allowed_from_ajax() {
-        return true;
-    }
-
     /**
      * Return a mustache template, and all the strings it requires.
      *
diff --git a/lib/db/services.php b/lib/db/services.php
index 415f0fd5d94..5c2ad25e1ce 100644
--- a/lib/db/services.php
+++ b/lib/db/services.php
@@ -975,7 +975,8 @@ $functions = array(
         'classpath'   => 'lib/external/externallib.php',
         'description' => 'Return a translated string - similar to core get_string() call',
         'type'        => 'read',
-        'loginrequired' => false
+        'loginrequired' => false,
+        'ajax'        => true,
     ),
 
     'core_get_strings' => array(
@@ -984,7 +985,8 @@ $functions = array(
         'classpath'   => 'lib/external/externallib.php',
         'description' => 'Return some translated strings - like several core get_string() calls',
         'type'        => 'read',
-        'loginrequired' => false
+        'loginrequired' => false,
+        'ajax'        => true,
     ),
 
     'core_get_component_strings' => array(
@@ -994,7 +996,8 @@ $functions = array(
         'description' => 'Return all raw strings (with {$a->xxx}) for a specific component
             - similar to core get_component_strings() call',
         'type'        => 'read',
-        'loginrequired' => false
+        'loginrequired' => false,
+        'ajax'        => true,
     ),
 
 
@@ -1033,7 +1036,8 @@ $functions = array(
         'methodname'  => 'load_template',
         'description' => 'Load a template for a renderable',
         'type'        => 'read',
-        'loginrequired' => false
+        'loginrequired' => false,
+        'ajax'        => true,
     ),
 
     // Completion related functions.
@@ -1075,6 +1079,7 @@ $functions = array(
         'methodname'  => 'update_tags',
         'description' => 'Updates tags',
         'type'        => 'write',
+        'ajax'        => true
     ),
 
     'core_tag_get_tags' => array(
@@ -1082,6 +1087,7 @@ $functions = array(
         'methodname'  => 'get_tags',
         'description' => 'Gets tags by their ids',
         'type'        => 'read',
+        'ajax'        => true
     ),
 
 );
diff --git a/lib/external/externallib.php b/lib/external/externallib.php
index 1909c2f3fc7..a0526c53379 100644
--- a/lib/external/externallib.php
+++ b/lib/external/externallib.php
@@ -77,16 +77,6 @@ class core_external extends external_api {
         return $strparams;
     }
 
-    /**
-     * Can this function be called directly from ajax?
-     *
-     * @return boolean
-     * @since Moodle 2.9
-     */
-    public static function get_string_is_allowed_from_ajax() {
-        return true;
-    }
-
     /**
      * Returns description of get_string parameters
      *
@@ -163,17 +153,6 @@ class core_external extends external_api {
         );
     }
 
-    /**
-     * Can this function be called directly from ajax?
-     *
-     * @return boolean
-     * @since Moodle 2.9
-     */
-    public static function get_strings_is_allowed_from_ajax() {
-        return true;
-    }
-
-
     /**
      * Return multiple call to core get_string()
      *
@@ -237,16 +216,6 @@ class core_external extends external_api {
         );
     }
 
-    /**
-     * Can this function be called directly from ajax?
-     *
-     * @return boolean
-     * @since Moodle 2.9
-     */
-    public static function get_component_strings_is_allowed_from_ajax() {
-        return true;
-    }
-
     /**
      * Return all lang strings of a component - call to core get_component_strings().
      *
diff --git a/lib/externallib.php b/lib/externallib.php
index d392cf1cf2b..951f215636c 100644
--- a/lib/externallib.php
+++ b/lib/externallib.php
@@ -115,6 +115,9 @@ function external_function_info($function, $strictness=MUST_EXIST) {
         if (isset($functions[$function->name]['type'])) {
             $function->type = $functions[$function->name]['type'];
         }
+        if (isset($functions[$function->name]['ajax'])) {
+            $function->allowed_from_ajax = $functions[$function->name]['ajax'];
+        }
         if (isset($functions[$function->name]['loginrequired'])) {
             $function->loginrequired = $functions[$function->name]['loginrequired'];
         } else {
diff --git a/tag/classes/external.php b/tag/classes/external.php
index ee8f1a0e3b6..2bb564f335b 100644
--- a/tag/classes/external.php
+++ b/tag/classes/external.php
@@ -59,15 +59,6 @@ class core_tag_external extends external_api {
         );
     }
 
-    /**
-     * Expose to AJAX
-     *
-     * @return boolean
-     */
-    public static function update_tags_is_allowed_from_ajax() {
-        return true;
-    }
-
     /**
      * Update tags
      *
@@ -194,15 +185,6 @@ class core_tag_external extends external_api {
         );
     }
 
-    /**
-     * Expose to AJAX
-     *
-     * @return boolean
-     */
-    public static function get_tags_is_allowed_from_ajax() {
-        return true;
-    }
-
     /**
      * Get tags by their ids
      *
@@ -281,4 +263,4 @@ class core_tag_external extends external_api {
             )
         );
     }
-}
\ No newline at end of file
+}