L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-62430 privacy: validate context when deleting all user data

Browse Source
This commit is contained in:
Marina Glancy
2018-05-14 18:13:52 +08:00
parent 374387c563
commit e58797fb4c
10 changed files with 66 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
blocks/rss_client/classes/privacy/provider.php
+3 -1
View File
@@ -108,7 +108,9 @@ class provider implements \core_privacy\local\metadata\provider, \core_privacy\l
* @param context $context A user context.
*/
public static function delete_data_for_all_users_in_context(\context $context) {
static::delete_data($context->instanceid);
if ($context instanceof \context_user) {
static::delete_data($context->instanceid);
}
}
/**
calendar/classes/privacy/provider.php
+6 -4
View File
@@ -188,12 +188,14 @@ class provider implements
}
// Delete all Calendar Events in the specified context in batches.
$eventids = array_keys(self::get_calendar_event_ids_by_context($context));
self::delete_batch_records('event', 'id', $eventids);
if ($eventids = array_keys(self::get_calendar_event_ids_by_context($context))) {
self::delete_batch_records('event', 'id', $eventids);
}
// Delete all Calendar Subscriptions in the specified context in batches.
$subscriptionids = array_keys(self::get_calendar_subscription_ids_by_context($context));
self::delete_batch_records('event_subscriptions', 'id', $subscriptionids);
if ($subscriptionids = array_keys(self::get_calendar_subscription_ids_by_context($context))) {
self::delete_batch_records('event_subscriptions', 'id', $subscriptionids);
}
}
/**
mod/assign/classes/privacy/provider.php
+2 -12
View File
@@ -246,18 +246,8 @@ class provider implements metadataprovider, pluginprovider, preference_provider
global $DB;
if ($context->contextlevel == CONTEXT_MODULE) {
// Apparently we can't trust anything that comes via the context.
// Go go mega query to find out it we have an assign context that matches an existing assignment.
$sql = "SELECT a.id
FROM {assign} a
JOIN {course_modules} cm ON a.id = cm.instance
JOIN {modules} m ON m.id = cm.module AND m.name = :modulename
JOIN {context} ctx ON ctx.instanceid = cm.id AND ctx.contextlevel = :contextmodule
WHERE ctx.id = :contextid";
$params = ['modulename' => 'assign', 'contextmodule' => CONTEXT_MODULE, 'contextid' => $context->id];
$count = $DB->get_field_sql($sql, $params);
// If we have a count over zero then we can proceed.
if ($count > 0) {
$cm = get_coursemodule_from_id('assign', $context->instanceid);
if ($cm) {
// Get the assignment related to this context.
$assign = new \assign($context, null, null);
// What to do first... Get sub plugins to delete their stuff.
mod/choice/classes/privacy/provider.php
+3 -6
View File
@@ -182,16 +182,13 @@ class provider implements
public static function delete_data_for_all_users_in_context(\context $context) {
global $DB;
if (empty($context)) {
return;
}
if (!$context instanceof \context_module) {
return;
}
$instanceid = $DB->get_field('course_modules', 'instance', ['id' => $context->instanceid], MUST_EXIST);
$DB->delete_records('choice_answers', ['choiceid' => $instanceid]);
if ($cm = get_coursemodule_from_id('choice', $context->instanceid)) {
$DB->delete_records('choice_answers', ['choiceid' => $cm->instance]);
}
}
/**
mod/forum/classes/privacy/provider.php
+12 -9
View File
@@ -754,19 +754,22 @@ class provider implements
}
// Get the course module.
$cm = $DB->get_record('course_modules', ['id' => $context->instanceid]);
$forum = $DB->get_record('forum', ['id' => $cm->instance]);
if (!$cm = get_coursemodule_from_id('forum', $context->instanceid)) {
return;
}
$DB->delete_records('forum_track_prefs', ['forumid' => $forum->id]);
$DB->delete_records('forum_subscriptions', ['forum' => $forum->id]);
$DB->delete_records('forum_read', ['forumid' => $forum->id]);
$forumid = $cm->instance;
$DB->delete_records('forum_track_prefs', ['forumid' => $forumid]);
$DB->delete_records('forum_subscriptions', ['forum' => $forumid]);
$DB->delete_records('forum_read', ['forumid' => $forumid]);
// Delete all discussion items.
$DB->delete_records_select(
'forum_queue',
"discussionid IN (SELECT id FROM {forum_discussions} WHERE forum = :forum)",
[
'forum' => $forum->id,
'forum' => $forumid,
]
);
@@ -774,12 +777,12 @@ class provider implements
'forum_posts',
"discussion IN (SELECT id FROM {forum_discussions} WHERE forum = :forum)",
[
'forum' => $forum->id,
'forum' => $forumid,
]
);
$DB->delete_records('forum_discussion_subs', ['forum' => $forum->id]);
$DB->delete_records('forum_discussions', ['forum' => $forum->id]);
$DB->delete_records('forum_discussion_subs', ['forum' => $forumid]);
$DB->delete_records('forum_discussions', ['forum' => $forumid]);
// Delete all files from the posts.
$fs = get_file_storage();
mod/glossary/classes/privacy/provider.php
+29 -33
View File
@@ -248,39 +248,36 @@ class provider implements
return;
}
$instanceid = $DB->get_field('course_modules', 'instance', ['id' => $context->instanceid], MUST_EXIST);
$DB->record_exists('glossary', ['id' => $context->instanceid]);
$DB->delete_records('glossary_entries', ['glossaryid' => $instanceid]);
if ($context->contextlevel == CONTEXT_MODULE) {
$instanceid = $DB->get_field('course_modules', 'instance', ['id' => $context->instanceid], MUST_EXIST);
$DB->record_exists('glossary', ['id' => $context->instanceid]);
$entries = $DB->get_records('glossary_entries', ['glossaryid' => $instanceid]);
foreach ($entries as $entry) {
// Delete related entry categories.
$DB->delete_records('glossary_entries_categories', ['entryid' => $entry->id]);
// Delete related entry aliases.
$DB->delete_records('glossary_alias', ['entryid' => $entry->id]);
}
// Delete entry and attachment files.
get_file_storage()->delete_area_files($context->id, 'mod_glossary', 'entry');
get_file_storage()->delete_area_files($context->id, 'mod_glossary', 'attachment');
// Delete related ratings.
\core_rating\privacy\provider::delete_ratings($context, 'mod_glossary', 'entry');
// Delete comments.
\core_comment\privacy\provider::delete_comments_for_all_users($context, 'mod_glossary', 'glossary_entry');
// Delete tags.
\core_tag\privacy\provider::delete_item_tags($context, 'mod_glossary', 'glossary_entries');
// Now delete all user related entries.
$DB->delete_records('glossary_entries', ['glossaryid' => $instanceid]);
if (!$cm = get_coursemodule_from_id('glossary', $context->instanceid)) {
return;
}
$instanceid = $cm->instance;
$entries = $DB->get_records('glossary_entries', ['glossaryid' => $instanceid]);
foreach ($entries as $entry) {
// Delete related entry categories.
$DB->delete_records('glossary_entries_categories', ['entryid' => $entry->id]);
// Delete related entry aliases.
$DB->delete_records('glossary_alias', ['entryid' => $entry->id]);
}
// Delete entry and attachment files.
get_file_storage()->delete_area_files($context->id, 'mod_glossary', 'entry');
get_file_storage()->delete_area_files($context->id, 'mod_glossary', 'attachment');
// Delete related ratings.
\core_rating\privacy\provider::delete_ratings($context, 'mod_glossary', 'entry');
// Delete comments.
\core_comment\privacy\provider::delete_comments_for_all_users($context, 'mod_glossary', 'glossary_entry');
// Delete tags.
\core_tag\privacy\provider::delete_item_tags($context, 'mod_glossary', 'glossary_entries');
// Now delete all user related entries.
$DB->delete_records('glossary_entries', ['glossaryid' => $instanceid]);
}
/**
@@ -300,7 +297,6 @@ class provider implements
if ($context->contextlevel == CONTEXT_MODULE) {
$instanceid = $DB->get_field('course_modules', 'instance', ['id' => $context->instanceid], MUST_EXIST);
$DB->record_exists('glossary', ['id' => $context->instanceid]);
$entries = $DB->get_records('glossary_entries', ['glossaryid' => $instanceid, 'userid' => $userid]);
foreach ($entries as $entry) {
mod/lesson/classes/privacy/provider.php
+3 -1
View File
@@ -382,7 +382,9 @@ class provider implements
return;
}
$lessonid = static::get_lesson_id_from_context($context);
if (!$lessonid = static::get_lesson_id_from_context($context)) {
return;
}
$DB->delete_records('lesson_attempts', ['lessonid' => $lessonid]);
$DB->delete_records('lesson_branch', ['lessonid' => $lessonid]);
mod/lti/classes/privacy/provider.php
+3 -2
View File
@@ -163,8 +163,9 @@ class provider implements
return;
}
$instanceid = $DB->get_field('course_modules', 'instance', ['id' => $context->instanceid], MUST_EXIST);
$DB->delete_records('lti_submission', ['ltiid' => $instanceid]);
if ($cm = get_coursemodule_from_id('lti', $context->instanceid)) {
$DB->delete_records('lti_submission', ['ltiid' => key($ltiidstocmids)]);
}
}
/**
mod/survey/classes/privacy/provider.php
+4 -3
View File
@@ -229,9 +229,10 @@ class provider implements
return;
}
$surveyid = static::get_survey_id_from_context($context);
$DB->delete_records('survey_answers', ['survey' => $surveyid]);
$DB->delete_records('survey_analysis', ['survey' => $surveyid]);
if ($surveyid = static::get_survey_id_from_context($context)) {
$DB->delete_records('survey_answers', ['survey' => $surveyid]);
$DB->delete_records('survey_analysis', ['survey' => $surveyid]);
}
}
/**
notes/classes/privacy/provider.php
+1 -1
View File
@@ -184,7 +184,7 @@ class provider implements \core_privacy\local\metadata\provider, \core_privacy\l
public static function delete_data_for_all_users_in_context(\context $context) {
global $DB;
if (empty($context)) {
if ($context->contextlevel != CONTEXT_COURSE) {
return;
}