Moodle release 4.3.4

Fixes the current behavior where the last row in the grader report is
always 'pinned', ensuring it is pinned only when necessary.

.github/workflows/push.yml

@@ -7,6 +7,12 @@ on:
       - MOODLE_[0-9]+_STABLE
     tags-ignore:
       - v[0-9]+.[0-9]+.[0-9]+*
+  workflow_dispatch:
+    inputs:
+      phpunit_extra_options:
+        description: Additional options to apply to PHPUnit
+        required: false
+        default: ''
 
 env:
   php: 8.2
@@ -17,10 +23,10 @@ jobs:
 
     steps:
       - name: Checking out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Configuring node & npm
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
 
@@ -99,7 +105,7 @@ jobs:
           coverage: none
 
       - name: Checking out code from ${{ env.GITHUB_REF_SLUG }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setting up PHPUnit
         env:
@@ -115,4 +121,4 @@ jobs:
         env:
           dbtype: ${{ matrix.db }}
           phpunit_options: ${{ secrets.phpunit_options }}
-        run: vendor/bin/phpunit $phpunit_options
+        run: vendor/bin/phpunit $phpunit_options ${{ inputs.phpunit_extra_options }}

.github/workflows/windows.yml

@@ -1,7 +1,12 @@
 name: Windows Testing
 
 on:
-  workflow_dispatch
+  workflow_dispatch:
+    inputs:
+      phpunit_extra_options:
+        description: Additional options to apply to PHPUnit
+        required: false
+        default: ''
 env:
   php: 8.2
 
@@ -16,10 +21,10 @@ jobs:
           git config --global core.eol lf
 
       - name: Checking out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Configuring node & npm
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
 
@@ -112,7 +117,7 @@ jobs:
           git config --global core.eol lf
 
       - name: Checking out code from ${{ env.GITHUB_REF_SLUG }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       # Needs to be done after php is available, git configured and Moodle checkout has happened.
       - name: Setting up moodle-exttests service
@@ -141,4 +146,4 @@ jobs:
         env:
           dbtype: ${{ matrix.db }}
           phpunit_options: ${{ secrets.phpunit_options }}
-        run: vendor/bin/phpunit $phpunit_options
+        run: vendor/bin/phpunit $phpunit_options ${{ inputs.phpunit_extra_options }}

.grunt/tasks/javascript.js

@@ -21,7 +21,7 @@
  */
 
 /**
- * Function to generate the destination for the uglify task
+ * Function to generate the destination for the minification task
  * (e.g. build/file.min.js). This function will be passed to
  * the rename property of files array when building dynamically:
  * http://gruntjs.com/configuring-tasks#building-the-files-object-dynamically
@@ -60,7 +60,6 @@ module.exports = grunt => {
     grunt.registerTask('js', ['amd', 'yui']);
 
     // Register NPM tasks.
-    grunt.loadNpmTasks('grunt-contrib-uglify');
     grunt.loadNpmTasks('grunt-contrib-watch');
     grunt.loadNpmTasks('grunt-rollup');
 
@@ -104,6 +103,7 @@ module.exports = grunt => {
         // The queue runner will run the next `size` items in the queue.
         const runQueue = (size = 1) => {
             queue.splice(0, size).forEach(resolve => {
+                grunt.log.debug(`Item resolved. Kicking off next one.`);
                 resolve();
             });
         };
@@ -113,15 +113,17 @@ module.exports = grunt => {
 
             // The options hook is run in parallel.
             // We can return an unresolved Promise which is queued for later resolution.
-            options: async() => {
+            options: async(options) => {
                 return new Promise(resolve => {
                     queue.push(resolve);
                     startQueue();
+                    return options;
                 });
             },
 
             // When an item in the queue completes, start the next item in the queue.
-            buildEnd: () => {
+            generateBundle: (options, bundle) => {
+                grunt.log.debug(`Finished output phase for ${Object.keys(bundle).join(', ')}`);
                 runQueue();
             },
         };
@@ -155,16 +157,6 @@ module.exports = grunt => {
                         ],
                         presets: [
                             ['@babel/preset-env', {
-                                targets: {
-                                    browsers: [
-                                        ">0.3%",
-                                        "last 2 versions",
-                                        "not ie >= 0",
-                                        "not op_mini all",
-                                        "not Opera > 0",
-                                        "not dead"
-                                    ]
-                                },
                                 modules: false,
                                 useBuiltIns: false
                             }]

.grunt/tasks/jsdoc.js

@@ -20,17 +20,33 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 
-module.exports = grunt => {
-    // Project configuration.
-    grunt.config.merge({
-        jsdoc: {
-            dist: {
-                options: {
-                    configure: ".grunt/jsdoc/jsdoc.conf.js",
-                },
-            },
-        },
-    });
+module.exports = (grunt) => {
+    const path = require('path');
 
-    grunt.loadNpmTasks('grunt-jsdoc');
+    grunt.registerTask('jsdoc', 'Generate JavaScript documentation using jsdoc', function() {
+        const done = this.async();
+        const configuration = path.resolve('.grunt/jsdoc/jsdoc.conf.js');
+
+        grunt.util.spawn({
+            cmd: 'jsdoc',
+            args: [
+                '--configure',
+                configuration,
+            ]
+        }, function(error, result, code) {
+            if (result.stdout) {
+                grunt.log.write(result.stdout);
+            }
+
+            if (result.stderr) {
+                grunt.log.error(result.stderr);
+            }
+            if (error) {
+                grunt.fail.fatal(`JSDoc failed with error code ${code}`);
+            } else {
+                grunt.log.write('JSDoc completed successfully'.green);
+            }
+            done();
+        });
+    });
 };

.grunt/tasks/stylelint.js

@@ -29,6 +29,7 @@ module.exports = grunt => {
                     // Use a fully-qualified path.
                     src: files,
                     options: {
+                        quietDeprecationWarnings: true,
                         configOverrides: {
                             rules: {
                                 // These rules have to be disabled in .stylelintrc for scss compat.
@@ -45,7 +46,10 @@ module.exports = grunt => {
         return {
             stylelint: {
                 scss: {
-                    options: {syntax: 'scss'},
+                    options: {
+                        quietDeprecationWarnings: true,
+                        customSyntax: 'postcss-scss',
+                    },
                     src: files,
                 },
             },

.nvmrc

@@ -1 +1 @@
-lts/gallium
+lts/iron

.stylelintrc

@@ -1,9 +1,14 @@
 {
+    "customSyntax": "postcss-scss",
     "plugins": [
         "stylelint-csstree-validator"
     ],
     "rules": {
-        "csstree/validator": true,
+        "csstree/validator": {
+          "syntaxExtensions": [
+            "sass"
+          ]
+        },
         "at-rule-empty-line-before": [ "always",
           {"except": [ "blockless-after-blockless"], ignore: ["after-comment", "inside-block"]}
         ],
@@ -45,7 +50,7 @@
         "function-name-case": "lower",
         "function-parentheses-newline-inside": "always-multi-line",
         "function-parentheses-space-inside": "never-single-line",
-        "function-url-scheme-blacklist": ["data"],
+        "function-url-scheme-disallowed-list": ["data"],
         "function-whitespace-after": "always",
         "indentation": 4,
         "keyframe-declaration-no-important": true,
@@ -84,12 +89,19 @@
         "selector-type-no-unknown": true,
         "string-no-newline": true,
         "time-min-milliseconds": 100,
-        "unit-blacklist": ["pt"],
+        "unit-disallowed-list": ["pt"],
         "unit-case": "lower",
         "unit-no-unknown": true,
         "value-keyword-case": ["lower", {"ignoreKeywords": ["/(@|$)/"]}],
         "value-list-comma-newline-after": "always-multi-line",
         "value-list-comma-space-after": "always-single-line",
         "value-list-comma-space-before": "never",
-  }
+  },
+  "overrides": [
+    {
+      "files": ["**/yui/**/*.css"],
+      "rules": {
+      }
+    }
+  ]
 }

admin/classes/table/tool_plugin_management_table.php

@@ -19,7 +19,7 @@ namespace core_admin\table;
 use moodle_url;
 
 /**
- * Tiny admin settings.
+ * Admin tool settings.
  *
  * @package core_admin
  * @copyright 2023 Andrew Lyons <andrew@nicols.co.uk>
@@ -30,12 +30,6 @@ class tool_plugin_management_table extends \core_admin\table\plugin_management_t
         return 'tool';
     }
 
-    public function guess_base_url(): void {
-        $this->define_baseurl(
-            new moodle_url('/admin/tools.php')
-        );
-    }
-
     protected function get_column_list(): array {
         $columns = parent::get_column_list();
 
@@ -45,6 +39,6 @@ class tool_plugin_management_table extends \core_admin\table\plugin_management_t
     }
 
     protected function get_action_url(array $params = []): moodle_url {
-        return new moodle_url('/admin/tool.php', $params);
+        return new moodle_url('/admin/settings.php', array_merge(['section' => 'toolsmanagement'], $params));
     }
 }

admin/cli/restore_backup.php

@@ -80,8 +80,8 @@ if (!$category = $DB->get_record('course_categories', ['id' => $options['categor
     throw new \moodle_exception('invalidcategoryid');
 }
 
-$backupdir = "restore_" . uniqid();
-$path = $CFG->tempdir . DIRECTORY_SEPARATOR . "backup" . DIRECTORY_SEPARATOR . $backupdir;
+$backupdir = restore_controller::get_tempdir_name(SITEID, $USER->id);
+$path = make_backup_temp_directory($backupdir);
 
 cli_heading(get_string('extractingbackupfileto', 'backup', $path));
 $fp = get_file_packer('application/vnd.moodle.backup');

admin/environment.xml

@@ -3923,6 +3923,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.2" requires="3.11.8">
@@ -3939,6 +3941,7 @@
       <VENDOR name="oracle" version="19" />
     </DATABASE>
     <PHP version="8.0.0" level="required">
+      <RESTRICT function="restrict_php_version_83" message="unsupportedphpversion83" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -4112,6 +4115,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.3" requires="3.11.8">
@@ -4128,6 +4133,7 @@
       <VENDOR name="oracle" version="19" />
     </DATABASE>
     <PHP version="8.0.0" level="required">
+      <RESTRICT function="restrict_php_version_83" message="unsupportedphpversion83" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -4303,6 +4309,201 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="4.4" requires="4.1.2">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="10.6.7" />
+      <VENDOR name="mysql" version="8.0" />
+      <VENDOR name="postgres" version="13" />
+      <VENDOR name="mssql" version="14.0" />
+      <VENDOR name="oracle" version="19" />
+    </DATABASE>
+    <PHP version="8.1.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="mbstringrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+      <PHP_EXTENSION name="sodium" level="required"/>
+      <PHP_EXTENSION name="exif" level="optional"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_sixtyfour_bits" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="sixtyfourbitsrequired" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_max_input_vars" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_admin_dir_usage" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iscustomadminwarnings" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/presets/classes/manager.php

@@ -761,8 +761,8 @@ class manager {
     public function delete_preset(int $presetid): void {
         global $DB;
 
-        // Check the preset exists.
-        $preset = $DB->get_record('adminpresets', ['id' => $presetid]);
+        // Check the preset exists (cannot delete the pre-installed core "Starter" and "Full" presets).
+        $preset = $DB->get_record('adminpresets', ['id' => $presetid, 'iscore' => self::NONCORE_PRESET]);
         if (!$preset) {
             throw new moodle_exception('errordeleting', 'core_adminpresets');
         }

admin/presets/tests/manager_test.php

@@ -16,6 +16,7 @@
 
 namespace core_adminpresets;
 
+use moodle_exception;
 use stdClass;
 
 /**
@@ -599,10 +600,28 @@ class manager_test extends \advanced_testcase {
 
         $manager = new manager();
 
-        $this->expectException(\moodle_exception::class);
+        $this->expectException(moodle_exception::class);
+        $this->expectExceptionMessage('Error deleting from database');
         $manager->delete_preset($unexistingid);
     }
 
+    /**
+     * Test trying to delete the core/pre-defined presets
+     *
+     * @covers ::delete_preset
+     */
+    public function test_delete_preset_core(): void {
+        global $DB;
+
+        $this->resetAfterTest();
+
+        $starterpreset = $DB->get_record('adminpresets', ['iscore' => manager::STARTER_PRESET]);
+
+        $this->expectException(moodle_exception::class);
+        $this->expectExceptionMessage('Error deleting from database');
+        (new manager())->delete_preset($starterpreset->id);
+    }
+
     /**
      * Test the behaviour of delete_preset() method.
      *

admin/repository.php

@@ -49,26 +49,11 @@ if ($action == 'newon') {
 
 admin_externalpage_setup($pagename);
 
-$sesskeyurl = $CFG->wwwroot.'/'.$CFG->admin.'/repository.php?sesskey=' . sesskey();
-$baseurl    = $CFG->wwwroot.'/'.$CFG->admin.'/repository.php';
-
-$configstr  = get_string('manage', 'repository');
+// The URL used for redirection, and that all edit related URLs will be based off.
+$baseurl = new moodle_url('/admin/repository.php');
 
 $return = true;
 
-if (!empty($action)) {
-    require_sesskey();
-}
-
-/**
- * Helper function that generates a moodle_url object
- * relevant to the repository
- */
-function repository_action_url($repository) {
-    global $baseurl;
-    return new moodle_url($baseurl, array('sesskey'=>sesskey(), 'repos'=>$repository));
-}
-
 if (($action == 'edit') || ($action == 'new')) {
     $pluginname = '';
     if ($action == 'edit') {
@@ -182,16 +167,12 @@ if (($action == 'edit') || ($action == 'new')) {
         }
     }
 } else if ($action == 'show') {
-    if (!confirm_sesskey()) {
-        throw new \moodle_exception('confirmsesskeybad', '', $baseurl);
-    }
+    require_sesskey();
     $class = \core_plugin_manager::resolve_plugininfo_class('repository');
     $class::enable_plugin($repository, 1);
     $return = true;
 } else if ($action == 'hide') {
-    if (!confirm_sesskey()) {
-        throw new \moodle_exception('confirmsesskeybad', '', $baseurl);
-    }
+    require_sesskey();
     $class = \core_plugin_manager::resolve_plugininfo_class('repository');
     $class::enable_plugin($repository, 0);
     $return = true;
@@ -199,9 +180,7 @@ if (($action == 'edit') || ($action == 'new')) {
     $repositorytype = repository::get_type_by_typename($repository);
     if ($sure) {
         $PAGE->set_pagetype('admin-repository-' . $repository);
-        if (!confirm_sesskey()) {
-            throw new \moodle_exception('confirmsesskeybad', '', $baseurl);
-        }
+        require_sesskey();
 
         if ($repositorytype->delete($downloadcontents)) {
             // Include this information into config changes table.
@@ -220,20 +199,15 @@ if (($action == 'edit') || ($action == 'new')) {
         $output = $OUTPUT->box_start('generalbox', 'notice');
         $output .= html_writer::tag('p', $message);
 
-        $removeurl = new moodle_url($sesskeyurl);
-        $removeurl->params(array(
+        $removeurl = new moodle_url($baseurl, [
             'action' =>'delete',
             'repos' => $repository,
             'sure' => 'yes',
-        ));
+        ]);
 
-        $removeanddownloadurl = new moodle_url($sesskeyurl);
-        $removeanddownloadurl->params(array(
-            'action' =>'delete',
-            'repos'=> $repository,
-            'sure' => 'yes',
+        $removeanddownloadurl = new moodle_url($removeurl, [
             'downloadcontents' => 1,
-        ));
+        ]);
 
         $output .= $OUTPUT->single_button($removeurl, get_string('continueuninstall', 'repository'));
         $output .= $OUTPUT->single_button($removeanddownloadurl, get_string('continueuninstallanddownload', 'repository'));
@@ -245,9 +219,11 @@ if (($action == 'edit') || ($action == 'new')) {
         $return = false;
     }
 } else if ($action == 'moveup') {
+    require_sesskey();
     $repositorytype = repository::get_type_by_typename($repository);
     $repositorytype->move_order('up');
 } else if ($action == 'movedown') {
+    require_sesskey();
     $repositorytype = repository::get_type_by_typename($repository);
     $repositorytype->move_order('down');
 } else {
@@ -339,8 +315,7 @@ if (($action == 'edit') || ($action == 'new')) {
                     $userinstancenumbertext = "";
                 }
 
-                $settings .= '<a href="' . $sesskeyurl . '&amp;action=edit&amp;repos=' . $typename . '">' . $settingsstr .'</a>';
-
+                $settings = html_writer::link(new moodle_url($baseurl, ['action' => 'edit', 'repos' => $typename]), $settingsstr);
                 $settings .= $OUTPUT->container_start('mdl-left');
                 $settings .= '<br/>';
                 $settings .= $admininstancenumbertext;
@@ -357,22 +332,34 @@ if (($action == 'edit') || ($action == 'new')) {
                 $currentaction = 'hide';
             }
 
-            $select = new single_select(repository_action_url($typename, 'repos'), 'action', $actionchoicesforexisting, $currentaction, null, 'applyto' . basename($typename));
+            // Active toggle.
+            $selectaction = new moodle_url($baseurl, ['sesskey' => sesskey(), 'repos' => $typename]);
+            $select = new single_select($selectaction, 'action', $actionchoicesforexisting, $currentaction, null,
+                'applyto' . basename($typename));
             $select->set_label(get_string('action'), array('class' => 'accesshide'));
+
             // Display up/down link
             $updown = '';
             $spacer = $OUTPUT->spacer(array('height'=>15, 'width'=>15)); // should be done with CSS instead
 
             if ($updowncount > 1) {
-                $updown .= "<a href=\"$sesskeyurl&amp;action=moveup&amp;repos=".$typename."\">";
-                $updown .= $OUTPUT->pix_icon('t/up', get_string('moveup')) . "</a>&nbsp;";
+                $moveupaction = new moodle_url($baseurl, [
+                    'sesskey' => sesskey(),
+                    'action' => 'moveup',
+                    'repos' => $typename,
+                ]);
+                $updown .= html_writer::link($moveupaction, $OUTPUT->pix_icon('t/up', get_string('moveup'))) . '&nbsp;';
             }
             else {
                 $updown .= $spacer;
             }
             if ($updowncount < $totalrepositorytypes) {
-                $updown .= "<a href=\"$sesskeyurl&amp;action=movedown&amp;repos=".$typename."\">";
-                $updown .= $OUTPUT->pix_icon('t/down', get_string('movedown')) . "</a>&nbsp;";
+                $movedownaction = new moodle_url($baseurl, [
+                    'sesskey' => sesskey(),
+                    'action' => 'movedown',
+                    'repos' => $typename,
+                ]);
+                $updown .= html_writer::link($movedownaction, $OUTPUT->pix_icon('t/down', get_string('movedown'))) . '&nbsp;';
             }
             else {
                 $updown .= $spacer;
@@ -400,7 +387,9 @@ if (($action == 'edit') || ($action == 'new')) {
         foreach ($plugins as $plugin => $dir) {
             // Check that it has not already been listed
             if (!in_array($plugin, $alreadyplugins)) {
-                $select = new single_select(repository_action_url($plugin, 'repos'), 'action', $actionchoicesfornew, 'delete', null, 'applyto' . basename($plugin));
+                $selectaction = new moodle_url($baseurl, ['sesskey' => sesskey(), 'repos' => $plugin]);
+                $select = new single_select($selectaction, 'action', $actionchoicesfornew, 'delete', null,
+                    'applyto' . basename($plugin));
                 $select->set_label(get_string('action'), array('class' => 'accesshide'));
                 $uninstall = '';
                 if ($uninstallurl = core_plugin_manager::instance()->get_uninstall_url('repository_' . $plugin, 'manage')) {

admin/repositoryinstance.php

@@ -18,8 +18,6 @@ require_once(__DIR__ . '/../config.php');
 require_once($CFG->dirroot . '/repository/lib.php');
 require_once($CFG->libdir . '/adminlib.php');
 
-require_sesskey();
-
 // id of repository
 $edit    = optional_param('edit', 0, PARAM_INT);
 $new     = optional_param('new', '', PARAM_PLUGIN);
@@ -43,12 +41,8 @@ if ($edit){
 
 admin_externalpage_setup($pagename, '', null, new moodle_url('/admin/repositoryinstance.php'));
 
-$baseurl = new moodle_url("/$CFG->admin/repositoryinstance.php", array('sesskey'=>sesskey()));
-
-$parenturl = new moodle_url("/$CFG->admin/repository.php", array(
-    'sesskey'=>sesskey(),
-    'action'=>'edit',
-));
+// The URL used for redirection, and that all edit related URLs will be based off.
+$parenturl = new moodle_url('/admin/repository.php', ['action' => 'edit']);
 
 if ($new) {
     $parenturl->param('repos', $new);
@@ -116,6 +110,7 @@ if (!empty($edit) || !empty($new)) {
         $return = false;
     }
 } else if (!empty($hide)) {
+    require_sesskey();
     $instance = repository::get_type_by_typename($hide);
     $instance->hide();
     core_plugin_manager::reset_caches();
@@ -129,6 +124,7 @@ if (!empty($edit) || !empty($new)) {
         throw new repository_exception('nopermissiontoaccess', 'repository');
     }
     if ($sure) {
+        require_sesskey();
         if ($instance->delete($downloadcontents)) {
             $deletedstr = get_string('instancedeleted', 'repository');
             core_plugin_manager::reset_caches();
@@ -141,14 +137,17 @@ if (!empty($edit) || !empty($new)) {
 
     echo $OUTPUT->header();
     echo $OUTPUT->box_start('generalbox', 'notice');
-    $continueurl = new moodle_url($baseurl, array(
+
+    $continueurl = new moodle_url($PAGE->url, [
         'type' => $type,
         'delete' => $delete,
         'sure' => 'yes',
-    ));
+    ]);
+
     $continueanddownloadurl = new moodle_url($continueurl, array(
         'downloadcontents' => 1
     ));
+
     $message = get_string('confirmdelete', 'repository', $instance->name);
     echo html_writer::tag('p', $message);
 

admin/roles/admins.php

@@ -38,6 +38,19 @@ if (!is_siteadmin()) {
 }
 
 $admisselector = new core_role_admins_existing_selector();
+
+if (array_key_exists('siteadmins', $CFG->config_php_settings)) {
+    echo $OUTPUT->header();
+    echo $OUTPUT->heading(get_string('manageadmins', 'core_role'), 3);
+    echo $OUTPUT->notification(get_string('siteadministratorsconfigphp', 'core_role'), \core\output\notification::NOTIFY_INFO);
+    echo $OUTPUT->box_start();
+    echo $OUTPUT->paragraph(get_string('existingadmins', 'core_role'));
+    $admisselector->display();
+    echo $OUTPUT->box_end();
+    echo $OUTPUT->footer();
+    die();
+}
+
 $potentialadmisselector = new core_role_admins_potential_selector();
 
 if ($addusersaction) {

admin/roles/classes/reportbuilder/local/entities/role.php

@@ -97,7 +97,7 @@ class role extends base {
             ->set_type(column::TYPE_TEXT)
             ->add_fields("{$rolealias}.name, {$rolealias}.shortname, {$rolealias}.id, {$contextalias}.id AS contextid")
             ->add_fields(context_helper::get_preload_record_columns_sql($contextalias))
-            ->set_is_sortable(true)
+            ->set_is_sortable(true, ["CASE WHEN {$rolealias}.name = '' THEN {$rolealias}.shortname ELSE {$rolealias}.name END"])
             ->set_callback(static function($name, stdClass $role): string {
                 if ($name === null) {
                     return '';

admin/roles/manage.php

@@ -76,7 +76,7 @@ switch ($action) {
             $optionsyes = array('action'=>'delete', 'roleid'=>$roleid, 'sesskey'=>sesskey(), 'confirm'=>1);
             $a = new stdClass();
             $a->id = $roleid;
-            $a->name = $roles[$roleid]->name;
+            $a->name = $roles[$roleid]->localname;
             $a->shortname = $roles[$roleid]->shortname;
             $a->count = $DB->count_records_select('role_assignments',
                 'roleid = ?', array($roleid), 'COUNT(DISTINCT userid)');

admin/settings/appearance.php

@@ -200,14 +200,14 @@ reports,core_reportbuilder|/reportbuilder/index.php',
     ));
 
     $choices = [HOMEPAGE_SITE => new lang_string('home')];
-    if (!empty($CFG->enabledashboard)) {
+    if (!isset($CFG->enabledashboard) || $CFG->enabledashboard) {
         $choices[HOMEPAGE_MY] = new lang_string('mymoodle', 'admin');
     }
     $choices[HOMEPAGE_MYCOURSES] = new lang_string('mycourses', 'admin');
     $choices[HOMEPAGE_USER] = new lang_string('userpreference', 'admin');
     $temp->add(new admin_setting_configselect('defaulthomepage', new lang_string('defaulthomepage', 'admin'),
             new lang_string('configdefaulthomepage', 'admin'), get_default_home_page(), $choices));
-    if (!empty($CFG->enabledashboard)) {
+    if (!isset($CFG->enabledashboard) || $CFG->enabledashboard) {
         $temp->add(new admin_setting_configcheckbox(
             'allowguestmymoodle',
             new lang_string('allowguestmymoodle', 'admin'),

admin/settings/h5p.php

@@ -41,4 +41,18 @@ if (!empty($defaulth5plib)) {
 
     $settings->add(new admin_settings_h5plib_handler_select('h5plibraryhandler', new lang_string('h5plibraryhandler', 'core_h5p'),
         new lang_string('h5plibraryhandler_help', 'core_h5p'), $defaulth5plib));
+
+    $setting = new admin_setting_configtextarea(
+        'core_h5p/h5pcustomcss',
+        new lang_string('h5pcustomcss', 'core_h5p'),
+        new lang_string('h5pcustomcss_help', 'core_h5p'),
+        '',
+        PARAM_NOTAGS
+    );
+    $setting->set_updatedcallback(function () {
+        // Enables use of file_storage constants.
+        \core_h5p\local\library\autoloader::register();
+        \core_h5p\file_storage::generate_custom_styles();
+    });
+    $settings->add($setting);
 }

admin/templates/setting_configmulticheckbox.mustache

@@ -23,12 +23,15 @@
     * name - form element name
     * hasoptions - there are some options
     * options - list of options containing name, key, id, checked, label
+    * readonly - bool
 
     Example context (json):
     {
         "name": "test",
         "hasoptions": true,
-        "options": [ { "name": "Option", "key": "k1", "id": "id0", "checked": true, "label": "Option label"} ]
+        "options": [ { "name": "Option", "key": "k1", "id": "id0", "checked": true, "label": "Option label"} ],
+        "readonly": false
+
     }
 }}
 <div class="form-multicheckbox">
@@ -37,7 +40,7 @@
         <ul>
             {{#options}}
                 <li>
-                    <input type="checkbox" name="{{name}}[{{key}}]" value="1" id="{{id}}_{{key}}" {{#checked}}checked{{/checked}}>
+                    <input type="checkbox" name="{{name}}[{{key}}]" value="1" id="{{id}}_{{key}}" {{#readonly}}disabled{{/readonly}} {{#checked}}checked{{/checked}}>
                     <label for="{{id}}_{{key}}">{{{label}}}</label>
                 </li>
             {{/options}}

admin/tool/admin_presets/classes/local/action/delete.php

@@ -16,6 +16,7 @@
 
 namespace tool_admin_presets\local\action;
 
+use core_adminpresets\manager;
 use moodle_exception;
 
 /**
@@ -34,8 +35,8 @@ class delete extends base {
     public function show(): void {
         global $DB, $OUTPUT;
 
-        // Getting the preset name.
-        $presetdata = $DB->get_record('adminpresets', ['id' => $this->id], 'name');
+        // Check the preset exists (cannot delete the pre-installed core "Starter" and "Full" presets).
+        $presetdata = $DB->get_record('adminpresets', ['id' => $this->id, 'iscore' => manager::NONCORE_PRESET], 'name');
 
         if ($presetdata) {
             $deletetext = get_string('deletepreset', 'tool_admin_presets', $presetdata->name);
@@ -64,7 +65,7 @@ class delete extends base {
      * Delete the DB preset
      */
     public function execute(): void {
-        confirm_sesskey();
+        require_sesskey();
 
         $this->manager->delete_preset($this->id);
 

admin/tool/admin_presets/classes/local/action/export.php

@@ -52,8 +52,6 @@ class export extends base {
      * Stores a preset into the DB.
      */
     public function execute(): void {
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'export', 'mode' => 'execute']);
         $this->moodleform = new export_form($url);
 
@@ -87,7 +85,7 @@ class export extends base {
      * @throws xml_writer_exception
      */
     public function download_xml(): void {
-        confirm_sesskey();
+        require_sesskey();
 
         list($xmlstr, $filename) = $this->manager->download_preset($this->id);
 

admin/tool/admin_presets/classes/local/action/import.php

@@ -40,8 +40,6 @@ class import extends base {
      * Imports the xmlfile into DB
      */
     public function execute(): void {
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'import', 'mode' => 'execute']);
         $this->moodleform = new import_form($url);
 

admin/tool/admin_presets/classes/local/action/load.php

@@ -38,8 +38,6 @@ class load extends base {
     public function execute(): void {
         global $OUTPUT;
 
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'load', 'mode' => 'execute']);
         $this->moodleform = new load_form($url);
 

admin/tool/admin_presets/classes/local/action/rollback.php

@@ -73,7 +73,7 @@ class rollback extends base {
     public function execute(): void {
         global $OUTPUT;
 
-        confirm_sesskey();
+        require_sesskey();
 
         list($presetapp, $rollback, $failures) = $this->manager->revert_preset($this->id);
 

admin/tool/analytics/model.php

@@ -97,28 +97,28 @@ if ($onlycli === false) {
 switch ($action) {
 
     case 'enable':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->enable();
         redirect($returnurl);
         break;
 
     case 'disable':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->update(0, false, false);
         redirect($returnurl);
         break;
 
     case 'delete':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->delete();
         redirect($returnurl);
         break;
 
     case 'edit':
-        confirm_sesskey();
+        require_sesskey();
 
         $invalidcurrenttimesplitting = $model->invalid_timesplitting_selected();
         $potentialtimesplittings = $model->get_potential_timesplittings();
@@ -183,7 +183,7 @@ switch ($action) {
         break;
 
     case 'evaluate':
-        confirm_sesskey();
+        require_sesskey();
 
         if ($model->is_static()) {
             throw new moodle_exception('errornostaticevaluate', 'tool_analytics');
@@ -226,7 +226,7 @@ switch ($action) {
         break;
 
     case 'scheduledanalysis':
-        confirm_sesskey();
+        require_sesskey();
 
         if ($onlycli) {
             throw new moodle_exception('erroronlycli', 'tool_analytics');
@@ -292,7 +292,7 @@ switch ($action) {
         break;
 
     case 'clear':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->clear();
         redirect($returnurl);

admin/tool/behat/tests/behat/tabs.feature

@@ -0,0 +1,34 @@
+@tool_behat
+Feature: Confirm that we can open multiple browser tabs
+  In order to use multiple browser tabs
+  As a test writer
+  I need the relevant Behat steps to work
+
+  @javascript @_switch_window
+  Scenario: Open multiple browser tabs
+    Given the following "courses" exist:
+      | fullname | shortname |
+      | Course 1 | C1        |
+      | Course 2 | C2        |
+      | Course 3 | C3        |
+    And I am on the "C1" "Course" page logged in as "admin"
+
+    # Open a new tab on the same page.
+    When I open a tab named "CourseViewer1" on the current page
+    And I should see "Course 1" in the "h1" "css_element"
+    And I am on the "C2" "Course" page
+
+    # Open new tab for specified page with identifier.
+    And I open a tab named "CourseViewer2" on the "C3" "Course" page
+
+    # And for a specified page without identifier.
+    And I open a tab named "CourseViewer4" on the "My courses" page
+
+    # Switch between all the tabs and confirm their different contents.
+    Then I should see "You're not enrolled in any course"
+    And I switch to "CourseViewer2" tab
+    And "Course 3" "heading" should exist
+    And I switch to "CourseViewer1" tab
+    And "Course 2" "heading" should exist
+    And I switch to the main tab
+    And "Course 1" "heading" should exist

admin/tool/brickfield/classes/local/htmlchecker/common/brickfield_accessibility_color_test.php

@@ -170,6 +170,19 @@ class brickfield_accessibility_color_test extends brickfield_accessibility_test
         'yellowgreen' => '9acd32'
     ];
 
+    /** @var string[] Define estimated relative font-size codes to pt values. */
+    public $fontsizenames = [
+        'xx-small' => 9,
+        'x-small' => 10,
+        'small' => 11,
+        'smaller' => 11,
+        'medium' => 12,
+        'large' => 14,
+        'larger' => 14,
+        'x-large' => 18,
+        'xx-large' => 24,
+    ];
+
     /**
      * Helper method that finds the luminosity between the provided
      * foreground and background parameters.
@@ -227,7 +240,8 @@ class brickfield_accessibility_color_test extends brickfield_accessibility_test
             $l2 = (.2126 * $r4 + 0.7152 * $g4 + 0.0722 * $b4);
         }
 
-        $luminosity = round(($l1 + 0.05) / ($l2 + 0.05), 2);
+        // Increase round to 4 to avoid a 4.49 contrast being round up to a false pass of 4.5.
+        $luminosity = round(($l1 + 0.05) / ($l2 + 0.05), 4);
         return $luminosity;
     }
 
@@ -362,4 +376,35 @@ class brickfield_accessibility_color_test extends brickfield_accessibility_test
             : $backrgb['b'] - $forergb['b'];
         return ['red' => $reddiff, 'green' => $greendiff, 'blue' => $bluediff];
     }
+
+    /**
+     * Helper method that finds the estimated font-size for the provided
+     * string font-size parameter.
+     * @param string $fontsize The css font-size, in various formats
+     * @return int The estimated font-size
+     */
+    public function get_fontsize(string $fontsize): int {
+        $newfontsize = 12; // Default value, in pt, equivalent to 16px.
+
+        // Search for rem, em, and px initially, typical font-size values.
+        $pos1 = stripos($fontsize, 'rem');
+        $pos2 = stripos($fontsize, 'em');
+        $pos3 = stripos($fontsize, 'px');
+        if ($pos1 !== false) {
+            $rem = substr($fontsize, 0, -3);
+            $newfontsize = $newfontsize * $rem;
+        } else if ($pos2 !== false) {
+            $em = substr($fontsize, 0, -2);
+            $newfontsize = $newfontsize * $em;
+        } else if ($pos3 !== false) {
+            $px = substr($fontsize, 0, -2);
+            $newfontsize = 0.75 * $px;
+        } else if (in_array($fontsize, array_keys($this->fontsizenames))) {
+            $newfontsize = $this->fontsizenames[$fontsize];
+        } else {
+            preg_match_all('!\d+!', $fontsize, $matches);
+            $newfontsize = $matches[0][0] ?? $newfontsize;
+        }
+        return (int) $newfontsize;
+    }
 }

admin/tool/brickfield/classes/local/htmlchecker/common/checks/css_text_has_contrast.php

@@ -92,8 +92,7 @@ class css_text_has_contrast extends brickfield_accessibility_color_test {
                     $italic = false;
 
                     if (isset($style['font-size'])) {
-                        preg_match_all('!\d+!', $style['font-size'], $matches);
-                        $fontsize = $matches[0][0];
+                        $fontsize = $this->get_fontsize($style['font-size']);
                     }
 
                     if (isset($style['font-weight'])) {

admin/tool/brickfield/tests/local/htmlchecker/common/checks/css_text_has_contrast_test.php

@@ -178,6 +178,54 @@ EOD;
     </html>
 EOD;
 
+    /** @var string HTML with px18 fail colour values. */
+    private $px18 = <<<EOD
+    <body><p style="color:#EF0000; background-color:white; font-size: 18px">
+    This is not contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with px19bold pass colour values. */
+    private $px19bold = <<<EOD
+    <body><p style="color:#EF0000; background-color:white; font-size: 19px; font-weight: bold;">
+    This is contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with px18 pass colour values. */
+    private $px18pass = <<<EOD
+    <body><p style="color:#E60000; background-color:white; font-size: 18px">
+    This is contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with medium size colour values. */
+    private $mediumfail = <<<EOD
+    <body><p style="color:#EF0000; background-color:white; font-size: medium">
+    This is not contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with px18 colour values. */
+    private $mediumpass = <<<EOD
+    <body><p style="color:#E60000; background-color:white; font-size: medium">
+    This is contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with larger fail colour values. */
+    private $largerfail = <<<EOD
+    <body><p style="color:#FF6161; background-color:white; font-size: larger">
+    This is not contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with px18 colour values. */
+    private $largerpass = <<<EOD
+    <body><p style="color:#FF5C5C; background-color:white; font-size: larger;">
+    This is contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with px18 colour values. */
+    private $largerboldpass = <<<EOD
+    <body><p style="color:#FF5C5C; background-color:white; font-size: larger; font-weight: bold;">
+    This is contrasty enough.</p></body>
+EOD;
+
     /**
      * Test for the area assign intro
      */
@@ -235,4 +283,68 @@ EOD;
         $results = $this->get_checker_results($this->emptyvalue);
         $this->assertEmpty($results);
     }
+
+    /**
+     * Test for text px18 with insufficient contrast of 4.49.
+     */
+    public function test_check_for_px18_fail() {
+        $results = $this->get_checker_results($this->px18);
+        $this->assertTrue($results[0]->element->tagName == 'p');
+    }
+
+    /**
+     * Test for text px19 bold with sufficient contrast of 4.49.
+     */
+    public function test_check_for_px19bold_pass() {
+        $results = $this->get_checker_results($this->px19bold);
+        $this->assertEmpty($results);
+    }
+
+    /**
+     * Test for text px18 with sufficient contrast of 4.81.
+     */
+    public function test_check_for_px18_pass() {
+        $results = $this->get_checker_results($this->px18pass);
+        $this->assertEmpty($results);
+    }
+
+    /**
+     * Test for medium (12pt) text with insufficient contrast of 4.49.
+     */
+    public function test_check_for_medium_fail() {
+        $results = $this->get_checker_results($this->mediumfail);
+        $this->assertTrue($results[0]->element->tagName == 'p');
+    }
+
+    /**
+     * Test for medium (12pt) text with sufficient contrast of 4.81.
+     */
+    public function test_check_for_medium_pass() {
+        $results = $this->get_checker_results($this->mediumpass);
+        $this->assertEmpty($results);
+    }
+
+    /**
+     * Test for larger (14pt) text with insufficient contrast of 2.94.
+     */
+    public function test_check_for_larger_fail() {
+        $results = $this->get_checker_results($this->largerfail);
+        $this->assertTrue($results[0]->element->tagName == 'p');
+    }
+
+    /**
+     * Test for larger (14pt) text with insufficient contrast of 3.02.
+     */
+    public function test_check_for_larger_pass() {
+        $results = $this->get_checker_results($this->largerpass);
+        $this->assertTrue($results[0]->element->tagName == 'p');
+    }
+
+    /**
+     * Test for larger (14pt) bold text with sufficient contrast of 3.02.
+     */
+    public function test_check_for_largerbold_pass() {
+        $results = $this->get_checker_results($this->largerboldpass);
+        $this->assertEmpty($results);
+    }
 }

admin/tool/cohortroles/db/upgrade.php

@@ -61,5 +61,8 @@ function xmldb_tool_cohortroles_upgrade($oldversion) {
         upgrade_plugin_savepoint(true, 2023042401, 'tool', 'cohortroles');
     }
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

admin/tool/componentlibrary/content/moodle/javascript/confirm.md

@@ -24,7 +24,7 @@ The confirmation AMD module is loaded automatically, so the only thing you need
 to the target element:
 {{< highlight html >}}
 <button type="button" class="btn btn-primary" data-confirmation="modal" data-confirmation-title-str='["delete", "core"]'
-data-confirmation-question-str='["areyousure"]' data-confirmation-yes-button-str='["delete", "core"]'>Show confirmation modal</button>
+data-confirmation-content-str='["areyousure"]' data-confirmation-yes-button-str='["delete", "core"]'>Show confirmation modal</button>
 {{< /highlight >}}
 
 You can also use it on PHP, you just need to set the attributes parameter to any moodle output component that takes attributes:
@@ -32,7 +32,7 @@ You can also use it on PHP, you just need to set the attributes parameter to any
 echo $OUTPUT->single_button('#', get_string('delete'), 'get', [
     'data-confirmation' => 'modal',
     'data-confirmation-title-str' => json_encode(['delete', 'core']),
-    'data-confirmation-question-str' => json_encode(['areyousure']),
+    'data-confirmation-content-str' => json_encode(['areyousure']),
     'data-confirmation-yes-button-str' => json_encode(['delete', 'core'])
 ]);
 {{< / php >}}
@@ -56,8 +56,8 @@ echo $OUTPUT->single_button('#', get_string('delete'), 'get', [
       <td>The modal title language string identifier, must be provided in JSON encoded format.</td>
     </tr>
     <tr>
-      <td>data-confirmation-question-str</td>
-      <td>The confirmation question language string identifier, must be provided in JSON encoded format.</td>
+      <td>data-confirmation-content-str</td>
+      <td>The modal main content language string identifier, must be provided in JSON encoded format.</td>
     </tr>
     <tr>
       <td>data-confirmation-yes-button-str</td>
@@ -86,14 +86,14 @@ echo $OUTPUT->single_button('#', get_string('delete'), 'get', [
 
 {{< example >}}
 <button type="button" class="btn btn-primary" data-confirmation="modal" data-confirmation-title-str='["ok", "core"]'
-data-confirmation-question-str='["areyousure"]' data-confirmation-yes-button-str='["ok", "core"]'>Show confirmation modal</button>
+data-confirmation-content-str='["areyousure"]' data-confirmation-yes-button-str='["ok", "core"]'>Show confirmation modal</button>
 {{< /example >}}
 
 #### Delete Modal
 
 {{< example >}}
 <button type="button" class="btn btn-primary" data-confirmation="modal" data-confirmation-type="delete" data-confirmation-title-str='["delete", "core"]'
-data-confirmation-question-str='["areyousure"]' data-confirmation-yes-button-str='["delete", "core"]'>Show delete modal</button>
+data-confirmation-content-str='["areyousure"]' data-confirmation-yes-button-str='["delete", "core"]'>Show delete modal</button>
 {{< /example >}}
 
 
@@ -101,7 +101,7 @@ data-confirmation-question-str='["areyousure"]' data-confirmation-yes-button-str
 
 {{< example >}}
 <button type="button" class="btn btn-primary" data-confirmation="modal" data-confirmation-title-str='["save", "core"]'
-data-confirmation-question-str='["areyousure"]' data-confirmation-yes-button-str='["save", "core"]' data-confirmation-toast="true"
+data-confirmation-content-str='["areyousure"]' data-confirmation-yes-button-str='["save", "core"]' data-confirmation-toast="true"
 data-confirmation-toast-confirmation-str='["saved", "core_question", "My question"]'>Show confirmation modal</button>
 {{< /example >}}
 
@@ -109,6 +109,6 @@ data-confirmation-toast-confirmation-str='["saved", "core_question", "My questio
 
 {{< example >}}
 <button type="button" class="btn btn-primary" data-confirmation="modal" data-confirmation-title-str='["save", "core"]'
-data-confirmation-question-str='["areyousure"]' data-confirmation-yes-button-str='["save", "core"]'
+data-confirmation-content-str='["areyousure"]' data-confirmation-yes-button-str='["save", "core"]'
 data-confirmation-destination="http://moodle.com">Show confirmation modal</button>
 {{< /example >}}

admin/tool/customlang/db/upgrade.php

@@ -41,5 +41,8 @@ function xmldb_tool_customlang_upgrade($oldversion) {
     // Automatically generated Moodle v4.2.0 release upgrade line.
     // Put any upgrade step following this.
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

admin/tool/customlang/tests/behat/customisation_create.feature

@@ -22,12 +22,12 @@ Feature: Within a moodle instance, an administrator should be able to modify lan
   Scenario: Edit an string but don't save it to lang pack.
     When I press "Apply changes and continue editing"
     Then I should not see "moodle documents" in the "page-footer" "region"
-    And I should see "Help and documentation" in the "page-footer" "region"
+    And I should see "Documentation for this page" in the "page-footer" "region"
 
   @javascript
   Scenario: Customize an string as admin and save it to lang pack.
     Given I press "Save changes to the language pack"
     And I should see "There are 1 modified strings."
     When I click on "Continue" "button"
-    Then I should not see "Help and documentation" in the "page-footer" "region"
+    Then I should not see "Documentation for this page" in the "page-footer" "region"
     And I should see "moodle documents" in the "page-footer" "region"

admin/tool/dataprivacy/db/upgrade.php

@@ -152,5 +152,8 @@ function xmldb_tool_dataprivacy_upgrade($oldversion) {
         upgrade_plugin_savepoint(true, 2023062700, 'tool', 'dataprivacy');
     }
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

admin/tool/dataprivacy/lang/en/tool_dataprivacy.php

@@ -47,7 +47,7 @@ $string['cachedef_purpose'] = 'Data purposes';
 $string['cachedef_purpose_overrides'] = 'Purpose overrides in the Data privacy tool';
 $string['cachedef_contextlevel'] = 'Context levels purpose and category';
 $string['cancelrequest'] = 'Cancel request';
-$string['cancelrequestconfirmation'] = 'Do you really want cancel this data request?';
+$string['cancelrequestconfirmation'] = 'Do you want to cancel this data request?';
 $string['cannotreset'] = 'Unable to reset this request. Only rejected requests can be reset.';
 $string['categories'] = 'Categories';
 $string['category'] = 'Category';

admin/tool/dataprivacy/tests/task/task_test.php

@@ -16,6 +16,7 @@
 
 namespace tool_dataprivacy\task;
 
+use core\task\task_trait;
 use tool_dataprivacy\api;
 
 defined('MOODLE_INTERNAL') || die();
@@ -30,6 +31,8 @@ require_once(__DIR__ . '/../data_privacy_testcase.php');
  */
 class task_test extends \data_privacy_testcase {
 
+    use task_trait;
+
     /**
      * Test tearDown.
      */
@@ -215,17 +218,4 @@ class task_test extends \data_privacy_testcase {
         $this->assertCount(1, \tool_dataprivacy\api::get_data_requests($user->id,
                 [api::DATAREQUEST_STATUS_CANCELLED], [api::DATAREQUEST_TYPE_DELETE]));
     }
-
-    /**
-     * Helper to execute a particular task.
-     *
-     * @param string $task The task.
-     */
-    private function execute_task($task) {
-        // Run the scheduled task.
-        ob_start();
-        $task = \core\task\manager::get_scheduled_task($task);
-        $task->execute();
-        ob_end_clean();
-    }
 }

admin/tool/filetypes/tests/behat/add_filetypes.feature

@@ -120,8 +120,7 @@ Feature: Add customised file types
       | Custom description | Froggy file                               |
     And I press "Save changes"
     # Create a resource activity and add it to a course
-    And I am on "Course 1" course homepage with editing mode on
-    When I add a "File" to section "1"
+    When I add a resource activity to course "Course 1" section "1"
     And I set the following fields to these values:
       | Name        | An example of customised file type |
       | Description | File description                   |

admin/tool/filetypes/tests/tool_filetypes_test.php

@@ -82,12 +82,24 @@ class tool_filetypes_test extends advanced_testcase {
     }
 
     /**
-     * Test get_file_icons() function to confirm no file icons are removed/added by mistake.
+     * Test get_file_icons() function to confirm no file icons are removed by mistake.
      *
      * @covers ::get_file_icons
      */
     public function test_get_file_icons() {
         $icons = utils::get_file_icons();
-        $this->assertCount(31, $icons);
+        $filetypes = core_filetypes::get_types();
+
+        $requiredicons = array_column($filetypes, 'icon');
+        $requireduniqueicons = array_unique($requiredicons);
+
+        // The 'folder' icon is not a file, however the test validates no
+        // file icons are removed by mistake from the directory pix/f.
+        // Adding the folder icon manually completes the scope of this test.
+        $requireduniqueicons[] = 'folder';
+
+        foreach ($requireduniqueicons as $requiredicon) {
+            $this->assertArrayHasKey($requiredicon, $icons, "Icon '$requiredicon' is missing.");
+        }
     }
 }

admin/tool/generator/classes/course_backend.php

@@ -216,7 +216,7 @@ class tool_generator_course_backend extends tool_generator_backend {
      * @return int Course id
      */
     public function make() {
-        global $DB, $CFG;
+        global $DB, $CFG, $USER;
         require_once($CFG->dirroot . '/lib/phpunit/classes/util.php');
 
         raise_memory_limit(MEMORY_EXTRA);
@@ -252,6 +252,12 @@ class tool_generator_course_backend extends tool_generator_backend {
             }
         }
 
+        // We are checking 'enroladminnewcourse' setting to decide to enrol admins or not.
+        if (!empty($CFG->creatornewroleid) && !empty($CFG->enroladminnewcourse) && is_siteadmin($USER->id)) {
+            // Deal with course creators - enrol them internally with default role.
+            enrol_try_internal_enrol($this->course->id, $USER->id, $CFG->creatornewroleid);
+        }
+
         // Log total time.
         $this->log('coursecompleted', round(microtime(true) - $entirestart, 1));
 

admin/tool/generator/tests/behat/make_test_course.feature

@@ -0,0 +1,33 @@
+@core @core_course @tool_generator
+Feature: Admins can create test courses
+  In order to create testing information
+  As an admin
+  I need to create testing courses quickly
+
+  @javascript
+  Scenario: 'Auto-enrol admin in new courses' setting when creating a test course as admin
+    Given I log in as "admin"
+    And the following config values are set as admin:
+      | enroladminnewcourse | 0 |
+    And I navigate to "Development > Make test course" in site administration
+    And I set the following fields to these values:
+      | Size of course    | XS                      |
+      | Course full name  | Fake course for testing |
+      | Course short name | fake                    |
+    And I press "Create course"
+    And I click on "Continue" "link"
+    And I navigate to course participants
+    Then I should not see "Teacher"
+    And I should not see "Nothing to display"
+    And the following config values are set as admin:
+      | enroladminnewcourse | 1 |
+    And I navigate to "Courses > Add a new course" in site administration
+    And I navigate to "Development > Make test course" in site administration
+    And I set the following fields to these values:
+      | Size of course    | XS                          |
+      | Course full name  | New fake course for testing |
+      | Course short name | newfake                     |
+    And I press "Create course"
+    And I click on "Continue" "link"
+    And I navigate to course participants
+    And I should see "Teacher"

admin/tool/generator/tests/maketestcourse_test.php

@@ -68,9 +68,14 @@ class maketestcourse_test extends \advanced_testcase {
         $this->assertEquals(2, count($modinfo->get_section_info_all()));
 
         // Check user is enrolled.
+        // enroladminnewcourse is enabled by default, so admin is also enrolled as teacher.
         $users = get_enrolled_users($context);
-        $this->assertEquals(1, count($users));
-        $this->assertEquals('tool_generator_000001', reset($users)->username);
+        $this->assertEquals(2, count($users));
+        $usernames = array_map(function($user) {
+            return $user->username;
+        }, $users);
+        $this->assertTrue(in_array('admin', $usernames));
+        $this->assertTrue(in_array('tool_generator_000001', $usernames));
 
         // Check there's a page on the course.
         $pages = $modinfo->get_instances_of('page');

admin/tool/langimport/index.php

@@ -114,7 +114,7 @@ if ($mode == DELETION_OF_SELECTED_LANG and (!empty($uninstalllang) or !empty($co
     }
 }
 
-if ($mode == UPDATE_ALL_LANG) {
+if ($mode == UPDATE_ALL_LANG && confirm_sesskey()) {
     core_php_time_limit::raise();
     $controller->update_all_installed_languages();
 }

admin/tool/langimport/templates/langimport.mustache

@@ -87,6 +87,7 @@
                 <div>
                     <form id="updateform" action="{{updateurl}}" method="post">
                         <fieldset>
+                            <input type="hidden" name="sesskey" value="{{sesskey}}">
                             <input type="submit" value="{{#str}}updatelangs, tool_langimport{{/str}}" class="btn btn-secondary">
                             {{#hasmanyinstalledlanguages}}
                                 <p class="mt-2 small">{{#str}} updatelangsnote, tool_langimport, {"taskname": {{#quote}}{{updatelangstaskname}}{{/quote}} }{{/str}}</p>

admin/tool/log/classes/helper/reader.php

@@ -82,7 +82,7 @@ trait reader {
      */
     public static function decode_other(?string $other) {
         if ($other === 'N;' || preg_match('~^.:~', $other ?? '')) {
-            return unserialize($other);
+            return unserialize($other, ['allowed_classes' => [stdClass::class]]);
         } else {
             return json_decode($other ?? '', true);
         }

admin/tool/log/db/upgrade.php

@@ -45,5 +45,8 @@ function xmldb_tool_log_upgrade($oldversion) {
     // Automatically generated Moodle v4.2.0 release upgrade line.
     // Put any upgrade step following this.
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

admin/tool/log/store/database/db/upgrade.php

@@ -39,5 +39,8 @@ function xmldb_logstore_database_upgrade($oldversion) {
     // Automatically generated Moodle v4.2.0 release upgrade line.
     // Put any upgrade step following this.
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

admin/tool/log/store/standard/db/upgrade.php

@@ -66,5 +66,8 @@ function xmldb_logstore_standard_upgrade($oldversion) {
     // Automatically generated Moodle v4.2.0 release upgrade line.
     // Put any upgrade step following this.
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

admin/tool/lp/classes/output/manage_competency_frameworks_page.php

@@ -75,7 +75,7 @@ class manage_competency_frameworks_page implements renderable, templatable {
             );
             $this->navigation[] = $addpage;
             $competenciesrepository = new single_button(
-                new moodle_url('https://archive.moodle.net/competencies'),
+                new moodle_url('https://moodle.net/search', ['q' => 'competency frameworks']),
                 get_string('competencyframeworksrepository', 'tool_lp'),
                 'get'
             );

admin/tool/lp/templates/course_competencies_page.mustache

@@ -102,7 +102,7 @@
         <strong>{{#str}}activities{{/str}}</strong>
         <ul class="inline list-inline p-2">
         {{#coursemodules}}
-            <li class="list-inline-item"><a href="{{url}}"><img src="{{iconurl}}"> {{name}} </a></li>
+            <li class="list-inline-item"><a href="{{url}}"><img class="icon" src="{{iconurl}}"> {{name}} </a></li>
         {{/coursemodules}}
         {{^coursemodules}}
             <li class="list-inline-item">{{#str}}noactivities, tool_lp{{/str}}</li>

admin/tool/lp/templates/form-user-selector-suggestion.mustache

@@ -49,7 +49,7 @@
     }
 }}
 <span>
-    <img height="12" src="{{profileimageurlsmall}}" alt="" role="presentation">
+    <img height="12" src="{{profileimageurlsmall}}" alt="">
     <span>{{fullname}}</span>
     {{#hasidentity}}
     <span><small>{{identity}}</small></span>

admin/tool/lp/templates/user_competency_summary_in_course.mustache

@@ -49,7 +49,7 @@
         <p>
         <ul class="inline list-inline">
         {{#coursemodules}}
-            <li class="list-inline-item"><a href="{{url}}"><img src="{{iconurl}}"> {{name}} </a></li>
+            <li class="list-inline-item"><a href="{{url}}"><img class="icon" src="{{iconurl}}" alt=""> {{name}} </a></li>
         {{/coursemodules}}
         {{^coursemodules}}
             <li class="list-inline-item"><span class="alert">{{#str}}noactivities, tool_lp{{/str}}</span></li>

admin/tool/lp/templates/user_summary.mustache

@@ -50,7 +50,7 @@
 }}
 <span>
     <a href="{{profileurl}}" title="{{#str}}viewprofile{{/str}}">
-    <img height="18" src="{{profileimageurlsmall}}" alt="" role="presentation">
+    <img height="18" src="{{profileimageurlsmall}}" alt="">
     <span>{{fullname}}</span>
     {{#hasidentity}}
     <span><small>{{identity}}</small></span>

admin/tool/mfa/auth.php

@@ -42,7 +42,20 @@ $PAGE->set_title($pagetitle);
 
 // Logout if it was requested.
 $logout = optional_param('logout', false, PARAM_BOOL);
+$sesskey = optional_param('sesskey', '_none_', PARAM_RAW);
+
 if ($logout) {
+    if (!confirm_sesskey($sesskey)) {
+        echo $OUTPUT->header();
+        echo $OUTPUT->confirm(
+            get_string('logoutconfirm'),
+            new moodle_url($PAGE->url, ['logout' => 1, 'sesskey' => sesskey()]),
+            new moodle_url('/'),
+        );
+        echo $OUTPUT->footer();
+        die;
+    }
+
     if (!empty($SESSION->wantsurl)) {
         // If we have the wantsurl, we should redirect there, to keep it intact.
         $wantsurl = $SESSION->wantsurl;

admin/tool/mfa/classes/hook/after_user_passed_mfa.php

@@ -0,0 +1,51 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_mfa\hook;
+
+use core\hook\described_hook;
+use core\hook\stoppable_trait;
+
+/**
+ * Allow plugins to callback as soon possible after user has passed MFA.
+ *
+ * @package    tool_mfa
+ * @copyright  2024 Juan Leyva
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class after_user_passed_mfa implements
+    described_hook,
+    \Psr\EventDispatcher\StoppableEventInterface {
+    use stoppable_trait;
+
+    /**
+     * Describes the hook purpose.
+     *
+     * @return string
+     */
+    public static function get_hook_description(): string {
+        return 'Allow plugins to callback as soon possible after user has passed MFA.';
+    }
+
+    /**
+     * List of tags that describe this hook.
+     *
+     * @return string[]
+     */
+    public static function get_hook_tags(): array {
+        return ['login'];
+    }
+}

admin/tool/mfa/classes/manager.php

@@ -332,6 +332,10 @@ class manager {
             $event = \tool_mfa\event\user_passed_mfa::user_passed_mfa_event($USER);
             $event->trigger();
 
+            // Allow plugins to callback as soon possible after user has passed MFA.
+            $hook = new \tool_mfa\hook\after_user_passed_mfa();
+            \core\hook\manager::get_instance()->dispatch($hook);
+
             // Add/update record in DB for users last mfa auth.
             self::update_pass_time();
 

admin/tool/mfa/classes/output/renderer.php

@@ -16,6 +16,7 @@
 
 namespace tool_mfa\output;
 
+use core\context\system;
 use tool_mfa\local\factor\object_factor;
 use tool_mfa\local\form\login_form;
 use \html_writer;
@@ -222,7 +223,8 @@ class renderer extends \plugin_renderer_base {
         // Support link.
         $supportemail = $CFG->supportemail;
         if (!empty($supportemail)) {
-            $subject = get_string('email:subject', 'tool_mfa', $SITE->fullname);
+            $subject = get_string('email:subject', 'tool_mfa',
+                format_string($SITE->fullname, true, ['context' => system::instance()]));
             $maillink = \html_writer::link("mailto:$supportemail?Subject=$subject", $supportemail);
             $notification .= get_string('error:support', 'tool_mfa');
             $notification .= \html_writer::tag('p', $maillink);
@@ -333,8 +335,8 @@ class renderer extends \plugin_renderer_base {
 
         // Auth rows.
         $authtypes = get_enabled_auth_plugins(true);
-        $row = [];
         foreach ($authtypes as $authtype) {
+            $row = [];
             $row[] = \html_writer::tag('b', $authtype);
 
             // Setup the overall totals columns.
@@ -635,6 +637,7 @@ class renderer extends \plugin_renderer_base {
                 'hasadditionalfactors' => $hasadditionalfactors,
                 'additionalfactors' => $alladitionalfactors,
                 'authurl' => $authurl->out(),
+                'sesskey' => sesskey(),
                 'supportlink' => $this->get_support_link(),
                 'disablefactor' => $disablefactor
         ];

admin/tool/mfa/factor/auth/db/upgrade.php

@@ -46,5 +46,8 @@ function xmldb_factor_auth_upgrade($oldversion) {
         upgrade_plugin_savepoint(true, 2021020500, 'factor', 'auth');
     }
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

admin/tool/mfa/factor/email/email.php

@@ -24,7 +24,7 @@
  */
 // Ignore coding standards for login check, this page does not require login.
 // @codingStandardsIgnoreStart
-require_once(__DIR__ . '../../../../../../config.php');
+require_once(__DIR__ . '/../../../../../config.php');
 $instanceid = required_param('instance', PARAM_INT);
 $pass = optional_param('pass', '0', PARAM_INT);
 $secret = optional_param('secret', 0, PARAM_INT);

admin/tool/mfa/factor/totp/lang/en/factor_totp.php

@@ -34,7 +34,7 @@ $string['error:futurecode'] = 'This code is invalid. Please verify the time on y
     Current system time is {$a}.';
 $string['error:oldcode'] = 'This code is too old. Please verify the time on your authenticator device is correct and try again.
     Current system time is {$a}.';
-$string['error:wrongverification'] = 'Incorrect verification code';
+$string['error:wrongverification'] = 'Incorrect verification code.';
 $string['factorsetup'] = 'App setup';
 $string['info'] = '<p>Use any time-based one-time password (TOTP) authenticator app on your device to generate a verification code, even when it is offline.</p>
 

admin/tool/mfa/index.php

@@ -31,8 +31,7 @@ require_once($CFG->libdir.'/tablelib.php');
 require_login(null, false);
 require_capability('moodle/site:config', context_system::instance());
 
-global $_SERVER;
-$returnurl = $_SERVER['HTTP_REFERER'];
+$returnurl = get_local_referer(false);
 
 $PAGE->set_url('/admin/tool/mfa/index.php');
 

admin/tool/mfa/lib.php

@@ -112,6 +112,10 @@ function tool_mfa_after_config(): void {
  * @return array
  */
 function tool_mfa_bulk_user_actions(): array {
+    if (!has_capability('moodle/site:config', context_system::instance())) {
+        return [];
+    }
+
     return [
         'tool_mfa_reset_factors' => new action_link(
             new moodle_url('/admin/tool/mfa/reset_factor.php'),

admin/tool/mfa/templates/verification_form.mustache

@@ -83,6 +83,7 @@
     <div class="d-flex justify-content-center">
         <form id="cancelmfa" method="POST" action="{{{authurl}}}">
             <input type="hidden" id="{{uniqid}}-logout" name="logout" value="true">
+            <input type="hidden" name="sesskey" value="{{sesskey}}">
             <input type="submit" class="btn btn-secondary"
                    name="cancelmfa" id="cancelmfa_button"
                    value="{{#str}} cancellogin, tool_mfa {{/str}}">

admin/tool/mobile/classes/api.php

@@ -384,7 +384,16 @@ class api {
             $settings->searchhideallcategory = $CFG->searchhideallcategory;
             $settings->searchmaxtopresults = $CFG->searchmaxtopresults;
             $settings->searchbannerenable = $CFG->searchbannerenable;
-            $settings->searchbanner = $CFG->searchbanner;
+            $settings->searchbanner = \core_external\util::format_text(
+                $CFG->searchbanner, FORMAT_HTML, $context)[0];
+        }
+
+        if (empty($section) || $section === 'h5psettings') {
+            \core_h5p\local\library\autoloader::register();
+            $customcss = \core_h5p\file_storage::get_custom_styles();
+            if (!empty($customcss)) {
+                $settings->h5pcustomcssurl = $customcss['cssurl']->out() . '?ver=' . $customcss['cssversion'];
+            }
         }
 
         return $settings;
@@ -515,6 +524,7 @@ class api {
             'comments' => 'CoreBlockDelegate_AddonBlockComments',
             'completionstatus' => 'CoreBlockDelegate_AddonBlockCompletionStatus',
             'feedback' => 'CoreBlockDelegate_AddonBlockFeedback',
+            'globalsearch' => 'CoreBlockDelegate_AddonBlockGlobalSearch',
             'glossary_random' => 'CoreBlockDelegate_AddonBlockGlossaryRandom',
             'html' => 'CoreBlockDelegate_AddonBlockHtml',
             'lp' => 'CoreBlockDelegate_AddonBlockLp',
@@ -523,6 +533,7 @@ class api {
             'private_files' => 'CoreBlockDelegate_AddonBlockPrivateFiles',
             'recent_activity' => 'CoreBlockDelegate_AddonBlockRecentActivity',
             'rss_client' => 'CoreBlockDelegate_AddonBlockRssClient',
+            'search_forums' => 'CoreBlockDelegate_AddonBlockSearchForums',
             'selfcompletion' => 'CoreBlockDelegate_AddonBlockSelfCompletion',
             'tags' => 'CoreBlockDelegate_AddonBlockTags',
         );

admin/tool/mobile/classes/hook_callbacks.php

@@ -0,0 +1,55 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_mobile;
+
+use core\session\utility\cookie_helper;
+
+/**
+ * Allows plugins to add any elements to the footer.
+ *
+ * @package    tool_mobile
+ * @copyright  2024 Juan Leyva
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class hook_callbacks {
+    /**
+     * Callback to recover $SESSION->wantsurl.
+     *
+     * @param \core_user\hook\after_login_completed $hook
+     */
+    public static function after_login_completed(
+        \core_user\hook\after_login_completed $hook,
+    ): void {
+        global $SESSION, $CFG;
+
+        // Check if the user is doing a mobile app launch, if that's the case, ensure $SESSION->wantsurl is correctly set.
+        if (!NO_MOODLE_COOKIES && !empty($_COOKIE['tool_mobile_launch'])) {
+            if (empty($SESSION->wantsurl) || strpos($SESSION->wantsurl, '/tool/mobile/launch.php') === false) {
+                $params = json_decode($_COOKIE['tool_mobile_launch'], true);
+                $SESSION->wantsurl = (new \moodle_url("/$CFG->admin/tool/mobile/launch.php", $params))->out(false);
+            }
+        }
+
+        // Set Partitioned and Secure attributes to the MoodleSession cookie if the user is using the Moodle app.
+        if (\core_useragent::is_moodle_app()) {
+            cookie_helper::add_attributes_to_cookie_response_header(
+                'MoodleSession' . $CFG->sessioncookie,
+                ['Secure', 'Partitioned'],
+            );
+        }
+    }
+}

admin/tool/mobile/classes/local/hooks/user/after_user_passed_mfa.php

@@ -0,0 +1,49 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_mobile\local\hooks\user;
+
+/**
+ * Handles mobile app launches when third-party auth plugins are put in front of MFA.
+ *
+ * @package    tool_mobile
+ * @copyright  2024 Juan Leyva
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class after_user_passed_mfa {
+    /**
+     * Callback to recover $SESSION->wantsurl.
+     *
+     * @param \tool_mfa\hook\after_user_passed_mfa $hook
+     */
+    public static function callback(\tool_mfa\hook\after_user_passed_mfa $hook): void {
+        global $SESSION, $CFG;
+
+        // Check if the user is doing a mobile app launch, if that's the case, ensure $SESSION->wantsurl is correctly set.
+        if (!NO_MOODLE_COOKIES && !empty($_COOKIE['tool_mobile_launch'])) {
+            if (empty($SESSION->wantsurl) || strpos($SESSION->wantsurl, '/tool/mobile/launch.php') === false) {
+                $params = json_decode($_COOKIE['tool_mobile_launch'], true);
+                $SESSION->wantsurl = (new \moodle_url("/$CFG->admin/tool/mobile/launch.php", $params))->out(false);
+                $SESSION->tool_mfa_has_been_redirected = true;  // Indicate MFA that they need to follow $SESSION->wantsurl.
+            }
+            // Invalidate cookie as we won't be needing it anymore.
+            unset($_COOKIE['tool_mobile_launch']);
+            if (!headers_sent()) {  // Just be very cautios as this is a critical code.
+                setcookie('tool_mobile_launch', '', -1, $CFG->sessioncookiepath);
+            }
+        }
+    }
+}

admin/tool/mobile/db/hooks.php

@@ -0,0 +1,38 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Hook callbacks for Moodle app tools
+ *
+ * @package    tool_mobile
+ * @copyright  2024 Juan Leyva
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$callbacks = [
+    [
+        'hook' => \core_user\hook\after_login_completed::class,
+        'callback' => \tool_mobile\hook_callbacks::class . '::after_login_completed',
+        'priority' => 500,
+    ],
+    [
+        'hook' => tool_mfa\hook\after_user_passed_mfa::class,
+        'callback' => 'tool_mobile\local\hooks\user\after_user_passed_mfa::callback',
+        'priority' => 500,
+    ],
+];

admin/tool/mobile/db/upgrade.php

@@ -47,5 +47,8 @@ function xmldb_tool_mobile_upgrade($oldversion) {
     // Automatically generated Moodle v4.2.0 release upgrade line.
     // Put any upgrade step following this.
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

admin/tool/mobile/launch.php

@@ -44,6 +44,18 @@ if (!$CFG->enablewebservices) {
     throw new moodle_exception('enablewsdescription', 'webservice');
 }
 
+// Check if the service exists and is enabled.
+$service = $DB->get_record('external_services', ['shortname' => $serviceshortname, 'enabled' => 1]);
+if (empty($service)) {
+    throw new moodle_exception('servicenotavailable', 'webservice');
+}
+
+// Set a cookie indicating that there was a launch to authenticate via the site from the app.
+$ldata = json_encode(['service' => $serviceshortname, 'passport' => $passport,
+    'urlscheme' => $urlscheme, 'confirmed' => (int) $confirmed, 'oauthsso' => $oauthsso]);
+$expires = time() + (15 * MINSECS); // 15 minutes for authentication should be enough.
+setcookie('tool_mobile_launch', $ldata, $expires, $CFG->sessioncookiepath, $CFG->sessioncookiedomain);
+
 // We have been requested to start a SSO process via OpenID.
 if (!empty($oauthsso) && is_enabled_auth('oauth2')) {
     $wantsurl = new moodle_url('/admin/tool/mobile/launch.php',
@@ -56,23 +68,22 @@ if (!empty($oauthsso) && is_enabled_auth('oauth2')) {
 
 // Check if the plugin is properly configured.
 $typeoflogin = get_config('tool_mobile', 'typeoflogin');
-if (empty($SESSION->justloggedin) and
-        $typeoflogin != tool_mobile\api::LOGIN_VIA_BROWSER and
+if (empty($SESSION->justloggedin) &&
+        !is_enabled_auth('oauth2') &&
+        $typeoflogin != tool_mobile\api::LOGIN_VIA_BROWSER &&
         $typeoflogin != tool_mobile\api::LOGIN_VIA_EMBEDDED_BROWSER) {
     throw new moodle_exception('pluginnotenabledorconfigured', 'tool_mobile');
 }
 
-// Check if the service exists and is enabled.
-$service = $DB->get_record('external_services', array('shortname' => $serviceshortname, 'enabled' => 1));
-if (empty($service)) {
-    throw new moodle_exception('servicenotavailable', 'webservice');
-}
-
 require_login(0, false);
 
 // Require an active user: not guest, not suspended.
 core_user::require_active_user($USER);
 
+// Remove cookie.
+unset($_COOKIE['tool_mobile_launch']);
+setcookie('tool_mobile_launch', '', -1, $CFG->sessioncookiepath);
+
 // Get an existing token or create a new one.
 $timenow = time();
 $token = \core_external\util::generate_token_for_current_user($service);
@@ -125,7 +136,7 @@ if ($confirmed or $isios) {
     }
 
     $notice = get_string('clickheretolaunchtheapp', 'tool_mobile');
-    echo html_writer::link($location, $notice, array('id' => 'launchapp'));
+    echo $OUTPUT->box(html_writer::link($location, $notice, ['id' => 'launchapp']), 'generalbox warning centerpara');
     echo html_writer::script(
         "window.onload = function() {
             document.getElementById('launchapp').click();

admin/tool/mobile/lib.php

@@ -271,3 +271,15 @@ function tool_mobile_pre_processor_message_send($procname, $data) {
         $data->fullmessagehtml .= html_writer::tag('p', get_string('readingthisemailgettheapp', 'tool_mobile', $url->out()));
     }
 }
+/**
+ * Callback to add headers before the HTTP headers are sent.
+ *
+ */
+function tool_mobile_before_http_headers() {
+    global $CFG;
+
+    // Set Partitioned and Secure attributes to the MoodleSession cookie if the user is using the Moodle app.
+    if (\core_useragent::is_moodle_app()) {
+        \core\session\utility\cookie_helper::add_attributes_to_cookie_response_header('MoodleSession'.$CFG->sessioncookie, ['Secure', 'Partitioned']);
+    }
+}

admin/tool/mobile/tests/externallib_test.php

@@ -270,6 +270,18 @@ class externallib_test extends externallib_advanced_testcase {
         $this->assertCount(0, $result['warnings']);
         $this->assertEquals($expected, $result['settings']);
 
+        // H5P custom CSS.
+        set_config('h5pcustomcss', '.debug { color: #fab; }', 'core_h5p');
+        \core_h5p\local\library\autoloader::register();
+        \core_h5p\file_storage::generate_custom_styles();
+        $result = external::get_config();
+        $result = external_api::clean_returnvalue(external::get_config_returns(), $result);
+
+        $customcss = \core_h5p\file_storage::get_custom_styles();
+        $expected[] = ['name' => 'h5pcustomcssurl', 'value' => $customcss['cssurl']->out() . '?ver=' . $customcss['cssversion']];
+        $this->assertCount(0, $result['warnings']);
+        $this->assertEquals($expected, $result['settings']);
+
         // Change a value and retrieve filtering by section.
         set_config('commentsperpage', 1);
         $expected[10]['value'] = 1;

admin/tool/monitor/db/upgrade.php

@@ -75,5 +75,8 @@ function xmldb_tool_monitor_upgrade($oldversion) {
     // Automatically generated Moodle v4.2.0 release upgrade line.
     // Put any upgrade step following this.
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

admin/tool/moodlenet/db/upgrade.php

@@ -155,5 +155,8 @@ function xmldb_tool_moodlenet_upgrade(int $oldversion) {
     // Automatically generated Moodle v4.2.0 release upgrade line.
     // Put any upgrade step following this.
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

admin/tool/phpunit/cli/util.php

@@ -50,12 +50,10 @@ list($options, $unrecognized) = cli_get_params(
     )
 );
 
-if (file_exists(__DIR__.'/../../../../vendor/phpunit/phpunit/composer.json')) {
-    // Composer packages present.
-    require_once(__DIR__.'/../../../../vendor/autoload.php');
-
-} else {
-    // Note: installation via PEAR is not supported any more.
+// Basic check to see if phpunit is installed.
+if (!file_exists(__DIR__.'/../../../../vendor/phpunit/phpunit/composer.json') ||
+        !file_exists(__DIR__.'/../../../../vendor/bin/phpunit') ||
+        !file_exists(__DIR__.'/../../../../vendor/autoload.php')) {
     phpunit_bootstrap_error(PHPUNIT_EXITCODE_PHPUNITMISSING);
 }
 
@@ -74,12 +72,13 @@ if ($options['run']) {
         }
     }
     $_SERVER['argv'] = array_values($_SERVER['argv']);
-    PHPUnit\TextUI\Command::main();
+    require(__DIR__ . '/../../../../vendor/bin/phpunit');
     exit(0);
 }
 
 define('PHPUNIT_UTIL', true);
 
+require(__DIR__.'/../../../../vendor/autoload.php');
 require(__DIR__ . '/../../../../lib/phpunit/bootstrap.php');
 
 // from now on this is a regular moodle CLI_SCRIPT

admin/tool/policy/db/upgrade.php

@@ -46,5 +46,8 @@ function xmldb_tool_policy_upgrade($oldversion) {
     // Automatically generated Moodle v4.2.0 release upgrade line.
     // Put any upgrade step following this.
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

admin/tool/task/adhoctasks.php

@@ -35,7 +35,7 @@ $renderer = $PAGE->get_renderer('tool_task');
 if ($classname) {
     $pageurl = new moodle_url('/admin/tool/task/adhoctasks.php');
     $PAGE->navbar->add(get_string('adhoctasks', 'tool_task'), $pageurl);
-    $PAGE->navbar->add($classname, $PAGE->url);
+    $PAGE->navbar->add(s($classname), $PAGE->url);
 
     $tasks = core\task\manager::get_adhoc_tasks($classname, $failedonly);
 

admin/tool/task/lang/en/tool_task.php

@@ -80,6 +80,9 @@ $string['runnow'] = 'Run now';
 $string['runagain'] = 'Run again';
 $string['runadhoc_confirm'] = 'Tasks will run on the web server and may take some time to complete.';
 $string['runadhoc'] = 'Run ad hoc tasks now?';
+$string['runadhoctask'] = 'Run \'{$a->task}\' task ID {$a->taskid}';
+$string['runadhoctasks'] = 'Run all \'{$a}\' tasks';
+$string['runadhoctasksfailed'] = 'Run failed \'{$a}\' tasks';
 $string['runnow_confirm'] = 'Are you sure you want to run this task \'{$a}\' now? The task will run on the web server and may take some time to complete.';
 $string['runclassname'] = 'Run all';
 $string['runclassnamefailedonly'] = 'Run all failed';

admin/tool/task/lib.php

@@ -45,5 +45,6 @@ function tool_task_status_checks() : array {
  * @param string $eol End of line character
  */
 function tool_task_mtrace_wrapper(string $message, string $eol): void {
-    echo s($message . $eol);
+    $message = s($message);
+    echo $message . $eol;
 }

admin/tool/task/renderer.php

@@ -82,7 +82,7 @@ class tool_task_renderer extends plugin_renderer_base {
                 );
                 $classcell = new html_table_cell($classcontent);
                 $classcell->header = true;
-                $classcell->class = "task-class-summary text-ltr";
+                $classcell->attributes['class'] = "task-class-summary text-ltr";
 
                 $duecontent = $stats['due'];
                 if ($canruntasks && ($stats['due'] > 0 || $stats['failed'] > 0)) {
@@ -166,7 +166,7 @@ class tool_task_renderer extends plugin_renderer_base {
         // Main tasks table.
         $table = $this->generate_adhoc_tasks_simple_table($tasks, $canruntasks);
 
-        $table->caption = "$classname "
+        $table->caption = s($classname) . " "
             . get_string($failedonly ? 'adhoctasksfailed' : 'adhoctasks', 'tool_task');
         $table->head[3] .= " $failedorall"; // Spice up faildelay heading.
 

admin/tool/task/run_adhoctasks.php

@@ -54,13 +54,19 @@ if ($taskid) {
         throw new \moodle_exception('invalidtaskid');
     }
     $classname = $record->classname;
-    $heading = "Run $classname task Id $taskid";
+    $heading = get_string('runadhoctask', 'tool_task', ['task' => $classname, 'taskid' => $taskid]);
     $tasks = [core\task\manager::adhoc_task_from_record($record)];
 } else {
     if (!$classname) {
         throw new \moodle_exception('noclassname', 'tool_task');
     }
-    $heading = "Run $classname " . ($failedonly ? "failed" : "all")." tasks";
+
+    $heading = get_string(
+        $failedonly ? 'runadhoctasksfailed' : 'runadhoctasks',
+        'tool_task',
+        s($classname),
+    );
+
     $now = time();
     $tasks = array_filter(
         core\task\manager::get_adhoc_tasks($classname, $failedonly, true),
@@ -111,6 +117,7 @@ require_sesskey();
 \core\session\manager::write_close();
 
 // Prepare to handle output via mtrace.
+require_once("{$CFG->dirroot}/{$CFG->admin}/tool/task/lib.php");
 $CFG->mtrace_wrapper = 'tool_task_mtrace_wrapper';
 
 // Run the specified tasks.

admin/tool/task/schedule_task.php

@@ -89,6 +89,8 @@ echo $OUTPUT->select_element_for_append();
 
 // Prepare to handle output via mtrace.
 echo html_writer::start_tag('pre', ['style' => 'color: #fff; background: #333; padding: 1em; min-height: 24lh']);
+
+require_once("{$CFG->dirroot}/{$CFG->admin}/tool/task/lib.php");
 $CFG->mtrace_wrapper = 'tool_task_mtrace_wrapper';
 
 // Run the specified task (this will output an error if it doesn't exist).

admin/tool/task/tests/form_test.php

@@ -236,6 +236,8 @@ class form_test extends \advanced_testcase {
         $checker->set_day_of_week('6');
         $this->assertTrue($checker->is_valid($checker::FIELD_DAYOFWEEK));
         $checker->set_day_of_week('7');
+        $this->assertTrue($checker->is_valid($checker::FIELD_DAYOFWEEK));
+        $checker->set_day_of_week('8');
         $this->assertFalse($checker->is_valid($checker::FIELD_DAYOFWEEK));
         $checker->set_day_of_week('20');
         $this->assertFalse($checker->is_valid($checker::FIELD_DAYOFWEEK));
@@ -247,7 +249,7 @@ class form_test extends \advanced_testcase {
         $checker->set_day_of_week('*/6');
         $this->assertTrue($checker->is_valid($checker::FIELD_DAYOFWEEK));
         $checker->set_day_of_week('*/7');
-        $this->assertFalse($checker->is_valid($checker::FIELD_DAYOFWEEK));
+        $this->assertTrue($checker->is_valid($checker::FIELD_DAYOFWEEK));
         $checker->set_day_of_week('*/13');
         $this->assertFalse($checker->is_valid($checker::FIELD_DAYOFWEEK));
         $checker->set_day_of_week('*/35');
@@ -271,6 +273,8 @@ class form_test extends \advanced_testcase {
         $checker->set_day_of_week('65-2');
         $this->assertFalse($checker->is_valid($checker::FIELD_DAYOFWEEK));
         $checker->set_day_of_week('3-7');
+        $this->assertTrue($checker->is_valid($checker::FIELD_DAYOFWEEK));
+        $checker->set_day_of_week('3-8');
         $this->assertFalse($checker->is_valid($checker::FIELD_DAYOFWEEK));
     }
 }

admin/tool/uploaduser/classes/cli_helper.php

@@ -367,6 +367,11 @@ class cli_helper {
                     $firstoption = reset($selectoptions);
                     $default = $firstoption['attr']['value'];
                 }
+
+                // The menu profile field type allows for an empty default value, handle that here.
+                if (preg_match('/^profile_field_/', $name) && $default === '') {
+                    $possiblevalues[] = $default;
+                }
             }
 
             if ($element instanceof \HTML_QuickForm_checkbox) {

admin/tool/uploaduser/classes/process.php

@@ -461,9 +461,22 @@ class process {
             return;
         }
 
-        $matchparam = $this->get_match_on_email() ? ['email' => $user->email] : ['username' => $user->username];
-        if ($existinguser = $DB->get_records('user', $matchparam + ['mnethostid' => $user->mnethostid])) {
-            if (is_array($existinguser) && count($existinguser) !== 1) {
+        if ($this->get_match_on_email()) {
+            // Case-insensitive query for the given email address.
+            $userselect = $DB->sql_equal('email', ':email', false);
+            $userparams = ['email' => $user->email];
+        } else {
+            $userselect = 'username = :username';
+            $userparams = ['username' => $user->username];
+        }
+
+        // Match the user, also accounting for multiple records by email.
+        $existinguser = $DB->get_records_select('user', "{$userselect} AND mnethostid = :mnethostid",
+            $userparams + ['mnethostid' => $user->mnethostid]);
+        $existingusercount = count($existinguser);
+
+        if ($existingusercount > 0) {
+            if ($existingusercount !== 1) {
                 $this->upt->track('status', get_string('duplicateemail', 'tool_uploaduser', $user->email), 'warning');
                 $this->userserrors++;
                 return;
@@ -675,6 +688,17 @@ class process {
                 break;
 
             case UU_USER_ADD_UPDATE:
+                if ($this->get_match_on_email()) {
+                    if ($usersbyname = $DB->get_records('user', ['username' => $user->username])) {
+                        foreach ($usersbyname as $userbyname) {
+                            if (strtolower($userbyname->email) != strtolower($user->email)) {
+                                $this->usersskipped++;
+                                $this->upt->track('status', get_string('usernotaddedusernameexists', 'error'), 'warning');
+                                $skip = true;
+                            }
+                        }
+                    }
+                }
                 break;
 
             case UU_USER_UPDATE:
@@ -1371,8 +1395,14 @@ class process {
                 }
             }
         }
+
+        // Warn user about invalid data values.
         if (($invalid = \core_user::validate($user)) !== true) {
-            $this->upt->track('status', get_string('invaliduserdata', 'tool_uploaduser', s($user->username)), 'warning');
+            $listseparator = get_string('listsep', 'langconfig') . ' ';
+            $this->upt->track('status', get_string('invaliduserdatavalues', 'tool_uploaduser', [
+                'username' => s($user->username),
+                'values' => implode($listseparator, array_keys($invalid)),
+            ]), 'warning');
         }
     }
 

admin/tool/uploaduser/lang/en/tool_uploaduser.php

@@ -50,6 +50,7 @@ The example text file may also be used for testing, as you are able to preview u
 $string['infoprefix'] = 'Info:';
 $string['invalidupdatetype'] = 'This option cannot be selected with the chosen upload type.';
 $string['invaliduserdata'] = 'Invalid data detected for user {$a} and it has been automatically cleaned.';
+$string['invaliduserdatavalues'] = 'Incorrect data ({$a->values}) found for user {$a->username}. This data has been corrected or deleted.';
 $string['invalidtheme'] = 'Theme "{$a}" is not installed and will be ignored.';
 $string['linex'] = 'Line {$a}';
 $string['matchemail'] = 'Match on email address';

admin/tool/uploaduser/tests/behat/upload_users.feature

@@ -296,3 +296,25 @@ Feature: Upload users
     And I navigate to "Users > Accounts > Browse list of users" in site administration
     And I should see "Bilbo Baggins"
     And I should not see "Frodo Baggins"
+
+  @javascript
+  Scenario: Create a new user when matching them on email where where the username already exists
+    Given the following "users" exist:
+      | username | firstname | lastname | email               |
+      | bilbob   | Samwise   | Gamgee   | samwise@example.com |
+      | frodob   | Frodeo    | Baspins  | frodo@example.com   |
+    And I log in as "admin"
+    And I navigate to "Users > Accounts > Upload users" in site administration
+    When I upload "lib/tests/fixtures/upload_users_email_matching.csv" file to "File" filemanager
+    And I press "Upload users"
+    Then I should see "Upload users preview"
+    And I set the following fields to these values:
+      | Upload type            | Add new and update existing users |
+      | Existing user details  | Override with file                |
+      | Match on email address | Yes                               |
+    And I press "Upload users"
+    And I should see "User not added - username already exists under a different email"
+    And I press "Continue"
+    And I navigate to "Users > Accounts > Browse list of users" in site administration
+    And I should see "Samwise Gamgee"
+    And I should see "Frodo Baggins"

admin/tool/uploaduser/tests/upload_users_test.php

@@ -186,6 +186,26 @@ EOF;
         $this->assertEquals('student1', reset($usersasdefaultrole)->username);
     }
 
+    /**
+     * Test that invalid data contained in uploaded CSV triggers appropriate warnings
+     */
+    public function test_user_upload_user_validate(): void {
+        $this->resetAfterTest();
+        $this->setAdminUser();
+
+        $csv = <<<EOF
+username,firstname,lastname,email,country
+student1,Student,One,s1@example.com,Wales
+EOF;
+
+        $output = $this->process_csv_upload($csv, ['--uutype=' . UU_USER_ADDNEW]);
+
+        // We should get the debugging from the user class itself, as well as warning in the output regarding the same.
+        $this->assertDebuggingCalled('The property \'country\' has invalid data and has been cleaned.');
+        $this->assertStringContainsString('Incorrect data (country) found for user student1. ' .
+            'This data has been corrected or deleted.', $output);
+    }
+
     /**
      * Generate cli_helper and mock $_SERVER['argv']
      *

admin/tool/uploaduser/user_form.php

@@ -97,9 +97,6 @@ class admin_uploaduser_form2 extends moodleform {
         $columns = $this->_customdata['columns'];
         $data    = $this->_customdata['data'];
 
-        // I am the template user, why should it be the administrator? we have roles now, other ppl may use this script ;-)
-        $templateuser = $USER;
-
         // upload settings and file
         $mform->addElement('header', 'settingsheader', get_string('settings'));
 
@@ -276,30 +273,19 @@ class admin_uploaduser_form2 extends moodleform {
         $mform->setDefault('autosubscribe', core_user::get_property_default('autosubscribe'));
 
         $mform->addElement('text', 'city', get_string('city'), 'maxlength="120" size="25"');
-        $mform->setType('city', PARAM_TEXT);
-        if (empty($CFG->defaultcity)) {
-            $mform->setDefault('city', $templateuser->city);
-        } else {
-            $mform->setDefault('city', core_user::get_property_default('city'));
-        }
+        $mform->setType('city', core_user::get_property_type('city'));
+        $mform->setDefault('city', core_user::get_property_default('city'));
 
-        $choices = get_string_manager()->get_list_of_countries();
-        $choices = array(''=>get_string('selectacountry').'...') + $choices;
-        $mform->addElement('select', 'country', get_string('selectacountry'), $choices);
-        if (empty($CFG->country)) {
-            $mform->setDefault('country', $templateuser->country);
-        } else {
-            $mform->setDefault('country', core_user::get_property_default('country'));
-        }
+        $mform->addElement('select', 'country', get_string('selectacountry'), core_user::get_property_choices('country'));
+        $mform->setDefault('country', core_user::get_property_default('country') ?: '');
         $mform->setAdvanced('country');
 
-        $choices = core_date::get_list_of_timezones($templateuser->timezone, true);
-        $mform->addElement('select', 'timezone', get_string('timezone'), $choices);
-        $mform->setDefault('timezone', $templateuser->timezone);
+        $mform->addElement('select', 'timezone', get_string('timezone'), core_date::get_list_of_timezones(null, true));
+        $mform->setDefault('timezone', core_user::get_property_default('timezone'));
         $mform->setAdvanced('timezone');
 
-        $mform->addElement('select', 'lang', get_string('preferredlanguage'), get_string_manager()->get_list_of_translations());
-        $mform->setDefault('lang', $templateuser->lang);
+        $mform->addElement('select', 'lang', get_string('preferredlanguage'), core_user::get_property_choices('lang'));
+        $mform->setDefault('lang', core_user::get_property_default('lang'));
         $mform->setAdvanced('lang');
 
         $editoroptions = array('maxfiles'=>0, 'maxbytes'=>0, 'trusttext'=>false, 'forcehttps'=>false);
@@ -313,25 +299,23 @@ class admin_uploaduser_form2 extends moodleform {
         $mform->setForceLtr('idnumber');
 
         $mform->addElement('text', 'institution', get_string('institution'), 'maxlength="255" size="25"');
-        $mform->setType('institution', PARAM_TEXT);
-        $mform->setDefault('institution', $templateuser->institution);
+        $mform->setType('institution', core_user::get_property_type('institution'));
 
         $mform->addElement('text', 'department', get_string('department'), 'maxlength="255" size="25"');
-        $mform->setType('department', PARAM_TEXT);
-        $mform->setDefault('department', $templateuser->department);
+        $mform->setType('department', core_user::get_property_type('department'));
 
         $mform->addElement('text', 'phone1', get_string('phone1'), 'maxlength="20" size="25"');
-        $mform->setType('phone1', PARAM_NOTAGS);
+        $mform->setType('phone1', core_user::get_property_type('phone1'));
         $mform->setAdvanced('phone1');
         $mform->setForceLtr('phone1');
 
         $mform->addElement('text', 'phone2', get_string('phone2'), 'maxlength="20" size="25"');
-        $mform->setType('phone2', PARAM_NOTAGS);
+        $mform->setType('phone2', core_user::get_property_type('phone2'));
         $mform->setAdvanced('phone2');
         $mform->setForceLtr('phone2');
 
         $mform->addElement('text', 'address', get_string('address'), 'maxlength="255" size="25"');
-        $mform->setType('address', PARAM_TEXT);
+        $mform->setType('address', core_user::get_property_type('address'));
         $mform->setAdvanced('address');
 
         // Next the profile defaults

admin/tool/usertours/classes/local/target/block.php

@@ -102,7 +102,7 @@ class block extends base {
      */
     public static function add_disabled_constraints_to_form(\MoodleQuickForm $mform) {
         $mform->hideIf('targetvalue_block', 'targettype', 'noteq',
-                \tool_usertours\target::get_target_constant_for_class(get_class()));
+                \tool_usertours\target::get_target_constant_for_class(self::class));
     }
 
     /**

admin/tool/usertours/classes/local/target/selector.php

@@ -92,7 +92,7 @@ class selector extends base {
      */
     public static function add_disabled_constraints_to_form(\MoodleQuickForm $mform) {
         $mform->hideIf('targetvalue_selector', 'targettype', 'noteq',
-                \tool_usertours\target::get_target_constant_for_class(get_class()));
+                \tool_usertours\target::get_target_constant_for_class(self::class));
     }
 
     /**

admin/tool/usertours/classes/local/target/unattached.php

@@ -81,7 +81,7 @@ class unattached extends base {
      * @param   MoodleQuickForm $mform      The form to add configuration to.
      */
     public static function add_disabled_constraints_to_form(\MoodleQuickForm $mform) {
-        $myvalue = \tool_usertours\target::get_target_constant_for_class(get_class());
+        $myvalue = \tool_usertours\target::get_target_constant_for_class(self::class);
 
         foreach (array_keys(self::$forcedsettings) as $settingname) {
             $mform->hideIf($settingname, 'targettype', 'eq', $myvalue);

admin/tool/usertours/classes/manager.php

@@ -283,7 +283,7 @@ class manager {
                 'title' => get_string('importtour', 'tool_usertours'),
             ],
             (object) [
-                'link'  => new \moodle_url('https://archive.moodle.net/tours'),
+                'link'  => new \moodle_url('https://moodle.net/search', ['q' => 'user tours']),
                 'linkproperties' => [
                         'target' => '_blank',
                     ],

admin/tool/usertours/db/upgrade.php

@@ -146,5 +146,8 @@ function xmldb_tool_usertours_upgrade($oldversion) {
         upgrade_plugin_savepoint(true, 2023053000, 'tool', 'usertours');
     }
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

admin/tool/xmldb/actions/edit_field_save/edit_field_save.class.php

@@ -91,12 +91,12 @@ class edit_field_save extends XMLDBAction {
         $comment = trim($comment);
 
         $type       = required_param('type', PARAM_INT);
-        $length     = strtolower(optional_param('length', NULL, PARAM_ALPHANUM));
+        $length     = optional_param('length', null, PARAM_INT);
         $decimals   = optional_param('decimals', NULL, PARAM_INT);
         $notnull    = optional_param('notnull', false, PARAM_BOOL);
         $sequence   = optional_param('sequence', false, PARAM_BOOL);
         $default    = optional_param('default', NULL, PARAM_PATH);
-        $default    = trim($default);
+        $default    = is_null($default) ? $default : trim($default);
 
         $editeddir = $XMLDB->editeddirs[$dirpath];
         $structure = $editeddir->xml_file->getStructure();

admin/webservice/service_user_settings.php

@@ -33,18 +33,17 @@ $userid = required_param('userid', PARAM_INT);
 admin_externalpage_setup('externalserviceusersettings');
 
 //define nav bar
-$PAGE->set_url('/' . $CFG->admin . '/webservice/service_user_settings.php',
-        array('id' => $serviceid, 'userid'  => $userid));
+$PAGE->set_url('/admin/webservice/service_user_settings.php', ['serviceid' => $serviceid, 'userid'  => $userid]);
 $node = $PAGE->settingsnav->find('externalservices', navigation_node::TYPE_SETTING);
 if ($node) {
     $node->make_active();
 }
-$PAGE->navbar->add(get_string('serviceusers', 'webservice'),
-        new moodle_url('/' . $CFG->admin . '/webservice/service_users.php', array('id' => $serviceid)));
+
+$returnurl = new moodle_url('/admin/webservice/service_users.php', ['id' => $serviceid]);
+$PAGE->navbar->add(get_string('serviceusers', 'webservice'), $returnurl);
 $PAGE->navbar->add(get_string('serviceusersettings', 'webservice'));
 
 $formaction = new moodle_url('', array('id' => $serviceid, 'userid' => $userid));
-$returnurl = new moodle_url('/' . $CFG->admin . '/webservice/service_users.php', array('id' => $serviceid));
 
 $webservicemanager = new webservice();
 $serviceuser = $webservicemanager->get_ws_authorised_user($serviceid, $userid);

auth/cas/db/upgrade.php

@@ -52,5 +52,8 @@ function xmldb_auth_cas_upgrade($oldversion) {
     // Automatically generated Moodle v4.2.0 release upgrade line.
     // Put any upgrade step following this.
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

auth/classes/output/login.php

@@ -90,7 +90,7 @@ class login implements renderable, templatable {
         $languagedata = new \core\output\language_menu($PAGE);
 
         $this->languagemenu = $languagedata->export_for_action_menu($OUTPUT);
-        $this->canloginasguest = $CFG->guestloginbutton and !isguestuser();
+        $this->canloginasguest = $CFG->guestloginbutton && !isguestuser();
         $this->canloginbyemail = !empty($CFG->authloginviaemail);
         $this->cansignup = $CFG->registerauth == 'email' || !empty($CFG->registerauth);
         if ($CFG->rememberusername == 0) {

auth/db/db/upgrade.php

@@ -44,5 +44,8 @@ function xmldb_auth_db_upgrade($oldversion) {
     // Automatically generated Moodle v4.2.0 release upgrade line.
     // Put any upgrade step following this.
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

auth/email/db/upgrade.php

@@ -44,5 +44,8 @@ function xmldb_auth_email_upgrade($oldversion) {
     // Automatically generated Moodle v4.2.0 release upgrade line.
     // Put any upgrade step following this.
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }

auth/ldap/db/upgrade.php

@@ -52,5 +52,8 @@ function xmldb_auth_ldap_upgrade($oldversion) {
     // Automatically generated Moodle v4.2.0 release upgrade line.
     // Put any upgrade step following this.
 
+    // Automatically generated Moodle v4.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
     return true;
 }