L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-69797 core_grades: Implement authorization into fetch method

Browse Source
This commit is contained in:
Juan Segarra Montesinos
2021-01-08 05:18:21 +01:00
committed by Jenkins
parent 38a5690419
commit fdf9d2c0d7
2 changed files with 56 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
grade/classes/grades/grader/gradingpanel/point/external/fetch.php
Vendored
+7 -1
View File
@@ -128,7 +128,13 @@ class fetch extends external_api {
}
// Fetch the actual data.
$gradeduser = \core_user::get_user($gradeduserid);
$gradeduser = \core_user::get_user($gradeduserid, '*', MUST_EXIST);
// One can access its own grades. Others just if they're graders.
if ($gradeduserid != $USER->id) {
$gradeitem->require_user_can_grade($gradeduser, $USER);
}
$hasgrade = $gradeitem->user_has_grade($gradeduser);
$grade = $gradeitem->get_grade_for_user($gradeduser, $USER);
$maxgrade = (int) $gradeitem->get_grade_item()->grademax;
grade/tests/grades_grader_gradingpanel_point_external_fetch_test.php
+49 -3
View File
@@ -149,14 +149,60 @@ class fetch_test extends advanced_testcase {
$course = $forum->get_course_record();
$teacher = $this->getDataGenerator()->create_and_enrol($course, 'teacher');
$student = $this->getDataGenerator()->create_and_enrol($course, 'student');
$this->setUser($teacher);
$this->execute_and_assert_fetch($forum, $teacher, $teacher, $student);
}
/**
* Class mates should not get other's grades.
*/
public function test_execute_fetch_does_not_return_data_to_other_students(): void {
$this->resetAfterTest();
$forum = $this->get_forum_instance([
// Negative numbers mean a scale.
'grade_forum' => 5,
]);
$course = $forum->get_course_record();
$teacher = $this->getDataGenerator()->create_and_enrol($course, 'teacher');
$student = $this->getDataGenerator()->create_and_enrol($course, 'student');
$evilstudent = $this->getDataGenerator()->create_and_enrol($course, 'student');
$this->expectException(\required_capability_exception::class);
$this->execute_and_assert_fetch($forum, $evilstudent, $teacher, $student);
}
/**
* Grades can be returned to graded user.
*/
public function test_execute_fetch_return_data_to_graded_user(): void {
$this->resetAfterTest();
$forum = $this->get_forum_instance([
// Negative numbers mean a scale.
'grade_forum' => 5,
]);
$course = $forum->get_course_record();
$teacher = $this->getDataGenerator()->create_and_enrol($course, 'teacher');
$student = $this->getDataGenerator()->create_and_enrol($course, 'student');
$this->execute_and_assert_fetch($forum, $student, $teacher, $student);
}
/**
* Executes the fetch method with the given users and returns the result.
*/
private function execute_and_assert_fetch ($forum, $fetcheruser, $grader, $gradeduser) {
$this->setUser($grader);
$gradeitem = component_gradeitem::instance('mod_forum', $forum->get_context(), 'forum');
$gradeitem->store_grade_from_formdata($student, $teacher, (object) [
$gradeitem->store_grade_from_formdata($gradeduser, $grader, (object) [
'grade' => 4,
]);
$result = fetch::execute('mod_forum', (int) $forum->get_context()->id, 'forum', (int) $student->id);
$this->setUser($fetcheruser);
$result = fetch::execute('mod_forum', (int) $forum->get_context()->id, 'forum', (int) $gradeduser->id);
$result = external_api::clean_returnvalue(fetch::execute_returns(), $result);
$this->assertIsArray($result);