L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-82502 courseformat: align module action capability checks.

Browse Source 
The "Hide/Show/Duplicate" actions should be considered self-contained,
and not also require "manageactivities" capability (per existing docs)
in addition to the specific capability that controls the action itself.

Also ensure the "Duplicate" capability checks are in the course context.
This commit is contained in:
Paul Holden
2024-08-02 10:01:11 +01:00
parent 8a6e8563fd
commit bf8f0c19a2
2 changed files with 23 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
course/format/classes/stateactions.php
+21 -7
View File
@@ -521,7 +521,7 @@ class stateactions {
$course,
$ids,
__FUNCTION__,
['moodle/course:manageactivities', 'moodle/course:activityvisibility']
['moodle/course:activityvisibility']
);
$format = course_get_format($course->id);
@@ -577,7 +577,8 @@ class stateactions {
$course,
$ids,
__FUNCTION__,
['moodle/course:manageactivities', 'moodle/backup:backuptargetimport', 'moodle/restore:restoretargetimport']
['moodle/backup:backuptargetimport', 'moodle/restore:restoretargetimport'],
false
);
$modinfo = get_fast_modinfo($course);
@@ -1141,10 +1142,17 @@ class stateactions {
* @param stdClass $course The course where given $cmids belong.
* @param array $cmids List of course module ids to validate.
* @param string $info additional information in case of error.
* @param array $capabilities optional capabilities checks per each cm context.
* @param array $capabilities optional capabilities checks to require.
* @param bool $usemodcontext whether to use each module context, or the course context
* @throws moodle_exception if any id is not valid
*/
protected function validate_cms(stdClass $course, array $cmids, ?string $info = null, array $capabilities = []): void {
protected function validate_cms(
stdClass $course,
array $cmids,
?string $info = null,
array $capabilities = [],
bool $usemodcontext = true,
): void {
if (empty($cmids)) {
throw new moodle_exception('emptycmids', 'core', null, $info);
@@ -1155,10 +1163,16 @@ class stateactions {
if (count($cmids) != count($intersect)) {
throw new moodle_exception('unexistingcmid', 'core', null, $info);
}
if (!empty($capabilities)) {
foreach ($cmids as $cmid) {
$modcontext = context_module::instance($cmid);
require_all_capabilities($capabilities, $modcontext);
if ($usemodcontext) {
foreach ($cmids as $cmid) {
$modcontext = context_module::instance($cmid);
require_all_capabilities($capabilities, $modcontext);
}
} else {
$coursecontext = context_course::instance($course->id);
require_all_capabilities($capabilities, $coursecontext);
}
}
}
course/mod.php
+2 -2
View File
@@ -122,8 +122,8 @@ if (!empty($add)) {
$course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
require_login($course, false, $cm);
$modcontext = context_module::instance($cm->id);
require_capability('moodle/course:manageactivities', $modcontext);
$coursecontext = context_course::instance($course->id);
require_all_capabilities(['moodle/backup:backuptargetimport', 'moodle/restore:restoretargetimport'], $coursecontext);
// Duplicate the module.
$newcm = duplicate_module($course, $cm);