L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-85421 cohort: limit requests for all cohorts to system context.

Browse Source
This commit is contained in:
Paul Holden
2025-09-29 13:34:09 +07:00
committed by Huong Nguyen
parent 596f290ca7
commit ccb94debcf
2 changed files with 22 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cohort/externallib.php
+6
View File
@@ -380,6 +380,12 @@ class core_cohort_external extends external_api {
$results = array_merge($results, cohort_get_available_cohorts($context, COHORT_ALL, $limitfrom, $limitnum, $query));
}
} else if ($includes == 'all') {
$contextsystem = context_system::instance();
if (!$context instanceof context_system &&
!has_any_capability(['moodle/cohort:view', 'moodle/cohort:manage'], $contextsystem)) {
throw new required_capability_exception($contextsystem, 'moodle/cohort:view', 'nopermissions', '');
}
$results = cohort_get_all_cohorts($limitfrom, $limitnum, $query);
$results = $results['cohorts'];
} else {
cohort/tests/externallib_test.php
+16 -6
View File
@@ -555,6 +555,7 @@ final class externallib_test extends externallib_advanced_testcase {
role_assign($userrole, $catuser->id, $catcontext->id);
// Enrol user in the course.
$this->getDataGenerator()->enrol_user($creator->id, $course->id);
$this->getDataGenerator()->enrol_user($courseuser->id, $course->id, 'courserole');
$syscontext = array('contextid' => \context_system::instance()->id);
@@ -612,18 +613,27 @@ final class externallib_test extends externallib_advanced_testcase {
$this->assertEquals(3, count($result['cohorts']));
// A user in the course context with the system cohort:view capability. Check that all the system cohorts are returned.
$this->setUser($courseuser);
$result = core_cohort_external::search_cohorts("Cohortsearch", $coursecontext, 'all');
$this->assertEquals(1, count($result['cohorts']));
$this->assertEquals('Cohortsearch 1', $result['cohorts'][$cohort1->id]->name);
$this->assertEquals(3, count($result['cohorts']));
// A user in the course context without the ability to view system cohorts.
$this->setUser($courseuser);
try {
$result = core_cohort_external::search_cohorts("Cohortsearch", $coursecontext, 'all');
$this->fail('Exception expected');
} catch (\Throwable $e) {
$this->assertInstanceOf(\required_capability_exception::class, $e);
$this->assertStringContainsString('(View site-wide cohorts)', $e->getMessage());
}
// Detect invalid parameter $includes.
$this->setUser($creator);
try {
$result = core_cohort_external::search_cohorts("Cohortsearch", $syscontext, 'invalid');
$this->fail('Invalid parameter includes');
} catch (\coding_exception $e) {
// All good.
$this->fail('Exception expected');
} catch (\Throwable $e) {
$this->assertInstanceOf(\coding_exception::class, $e);
$this->assertStringContainsString('Invalid parameter value for \'includes\'', $e->getMessage());
}
}
}