1.7.3

There are multiple issues with Moodle files containing empty or blank lines
(lines consisting of white spaces or tabs only) and/or white space before or
after the PHP open and close tags, notably with config.php and theme files.

admin/cron.php

@@ -62,6 +62,9 @@
         @header('Content-Type: text/plain; charset='.current_charset());
     }
 
+/// increase memory limit (PHP 5.2 does different calculation, we need more memory now)
+    @raise_memory_limit('128M');
+
 /// Start output log
 
     $timenow  = time();
@@ -84,6 +87,8 @@
                             mtrace("Error: could not update timestamp for $mod->fullname");
                         }
                     }
+                /// Reset possible changes by modules to time_limit. MDL-11597
+                    @set_time_limit(0);
                     mtrace("done.");
                 }
             }
@@ -108,19 +113,35 @@
                             mtrace('Error: could not update timestamp for '.$block->name);
                         }
                     }
+                /// Reset possible changes by blocks to time_limit. MDL-11597
+                    @set_time_limit(0);
                     mtrace('done.');
                 }
             }
 
         }
     }
-    mtrace("Finished blocks");
+    mtrace('Finished blocks');
 
     if (!empty($CFG->langcache)) {
         mtrace('Updating languages cache');
         get_list_of_languages();
     }
 
+    mtrace('Removing expired enrolments ...', '');     // See MDL-8785
+    $timenow = time();
+    if ($oldenrolments = get_records_select('role_assignments', "timeend > 0 AND timeend < '$timenow'")) {
+        mtrace(count($oldenrolments).' to delete');
+        foreach ($oldenrolments as $oldenrolment) {
+            if (role_unassign($oldenrolment->roleid, $oldenrolment->userid, 0, $oldenrolment->contextid)) {
+                mtrace("Deleted expired role assignment $oldenrolment->roleid for user $oldenrolment->userid from context $oldenrolment->contextid");
+            }
+        }
+        mtrace('Done');
+    } else {
+        mtrace('none found');
+    }
+
 
 /// Run all core cron jobs, but not every time since they aren't too important.
 /// These don't have a timer to reduce load, so we'll use a random number 
@@ -235,7 +256,7 @@
         //Execute backup's cron
         //Perhaps a long time and memory could help in large sites
         @set_time_limit(0);
-        @raise_memory_limit("128M");
+        @raise_memory_limit("192M");
         if (function_exists('apache_child_terminate')) {
             // if we are running from Apache, give httpd a hint that 
             // it can recycle the process after it's done. Apache's 

admin/environment.xml

@@ -104,4 +104,73 @@
       </PHP_EXTENSION>
     </PHP_EXTENSIONS>
   </MOODLE>
+  <MOODLE version="1.9">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="4.1.16">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
+      </VENDOR>
+      <VENDOR name="postgres" version="8.0" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="9.0" />
+    </DATABASE>
+    <PHP version="4.3.0" level="required">
+      <RESTRICT function="restrict_php50_version" message="php50restricted" />
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+  </MOODLE>
+  <MOODLE version="2.0">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="4.1.16">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
+      </VENDOR>
+      <VENDOR name="postgres" version="8.0" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="9.0" />
+    </DATABASE>
+    <PHP version="5.2.0" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/filter.php

@@ -59,10 +59,10 @@
             // run through submitted data
             // reject if does not start with filter_
             foreach ($config as $name => $value) {
-                set_config( $name,$value );
+                set_config($name, stripslashes($value));
             }
         }
-        redirect( "$CFG->wwwroot/$CFG->admin/filters.php", get_string('changessaved'), 1);
+        redirect("$CFG->wwwroot/$CFG->admin/filters.php");
         exit;
     }
 
@@ -94,7 +94,5 @@
     <?php
     print_simple_box_end();
 
-    print_simple_box_end();
-
     admin_externalpage_print_footer($adminroot);
 ?>

admin/index.php

@@ -27,6 +27,7 @@
 
     $id             = optional_param('id', '', PARAM_ALPHANUM);
     $confirmupgrade = optional_param('confirmupgrade', 0, PARAM_BOOL);
+    $confirmrelease = optional_param('confirmrelease', 0, PARAM_BOOL);
     $agreelicence = optional_param('agreelicence',0, PARAM_BOOL);
     $ignoreupgradewarning = optional_param('ignoreupgradewarning', 0, PARAM_BOOL);
 
@@ -224,13 +225,36 @@
 
             if (empty($confirmupgrade)) {
 
-
                 print_header($strdatabasechecking, $stradministration, $strdatabasechecking,
                         "", "", false, " ", " ");
 
                 notice_yesno(get_string('upgradesure', 'admin', $a->newversion), 'index.php?confirmupgrade=yes', 'index.php');
                 exit;
 
+            } else if (empty($confirmrelease)) {
+                $strcurrentrelease = get_string("currentrelease");
+                print_header($strcurrentrelease, $strcurrentrelease, $strcurrentrelease, "", "", false, " ", " ");
+                print_heading("Moodle $release");
+                print_simple_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'), 'center');
+
+                require_once($CFG->libdir.'/environmentlib.php');
+                print_heading(get_string('environment', 'admin'));
+                if (!check_moodle_environment($release, $environment_results, true)) {
+                    notice_yesno(get_string('environmenterrorupgrade', 'admin'), 
+                                 'index.php?confirmupgrade=1&confirmrelease=1', 'index.php');
+                } else {
+                    notify(get_string('environmentok', 'admin'), 'notifysuccess');
+
+                    echo '<form action="index.php">';
+                    echo '<input type="hidden" name="confirmupgrade" value="1" />';
+                    echo '<input type="hidden" name="confirmrelease" value="1" />';
+                    echo '<div class="continuebutton"><input type="submit" value="'.get_string('continue').'" /></div>';
+                    echo '</form>';
+                }
+
+                print_footer('none');
+                exit;
+
             } else {
                 $strdatabasesuccess  = get_string("databasesuccess");
                 print_header($strdatabasechecking, $stradministration, $strdatabasechecking,
@@ -297,13 +321,9 @@
 /// Updated human-readable release version if necessary
 
     if ($release <> $CFG->release) {  // Update the release version
-        $strcurrentrelease = get_string("currentrelease");
-        print_header($strcurrentrelease, $strcurrentrelease, $strcurrentrelease, "", "", false, "&nbsp;", "&nbsp;");
-        print_heading("Moodle $release");
         if (!set_config("release", $release)) {
-            notify("ERROR: Could not update release version in database!!");
+            error("ERROR: Could not update release version in database!!");
         }
-        notice(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'), 'index.php', 'none');
     }
 
 /// Find and check all main modules and load them up or upgrade them if necessary
@@ -399,7 +419,7 @@
 
 /// Define the unique site ID code if it isn't already
     if (empty($CFG->siteidentifier)) {    // Unique site identification code
-        set_config('siteidentifier', random_string(32));
+        set_config('siteidentifier', random_string(32).$_SERVER['HTTP_HOST']);
     }
 
 /// Check if the guest user exists.  If not, create one.
@@ -528,15 +548,6 @@
         echo '</div>';
     }
 
-
-    if (optional_param('dbmigrate')) {               // ??? Is this actually used?
-        print_simple_box_start('center','60%');
-        require_once($CFG->dirroot.'/'.$CFG->admin.'/utfdbmigrate.php');
-        db_migrate2utf8();
-        print_simple_box_end();
-    }
-
-
     admin_externalpage_print_footer($adminroot);
 
 

admin/lang.php

@@ -4,6 +4,9 @@
     *
     * CHANGES
     *
+    * 2006/11/07 mudrd8mz
+    * Fixed bug MDL-7361. Thanks to Dan Poltawski for the patch proposal.
+    *
     * 2006/06/08 mudrd8mz
     * 1) Fixed bug 5745 reported by Harry Smith so now can edit en_utf8_local pack
     * 2) More notification messages included
@@ -133,13 +136,14 @@
 
     // Get a list of all the root files in the English directory
 
+    $langbase = $CFG->dataroot . '/lang';
     $enlangdir = "$CFG->dirroot/lang/en_utf8";
     if ($currentlang == 'en_utf8') {
         $langdir = $enlangdir;
     } else {
-        $langdir = "$CFG->dataroot/lang/$currentlang";
+        $langdir = "$langbase/$currentlang";
     }
-    $locallangdir = "$CFG->dataroot/lang/{$currentlang}_local";
+    $locallangdir = "$langbase/{$currentlang}_local";
 
     if (! $stringfiles = get_directory_list($enlangdir, "", false)) {
         error("Could not find English language pack!");
@@ -256,6 +260,14 @@
 
     } else if ($mode == "compare") {
    
+        if (!file_exists($langbase) ){
+            if (!lang_make_directory($langbase) ){
+                error('ERROR: Could not create base lang directory ' . $langbase);
+            } else {
+                echo '<div class="notifysuccess" align="center">Created directory '.
+                                                     $langbase .'</div>'."<br />\n";
+            }
+        } 
         if (!$uselocal && !file_exists($langdir)) {
             if (!lang_make_directory($langdir)) {
                 error('ERROR: Could not create directory '.$langdir);
@@ -573,7 +585,7 @@ function lang_fix_value_from_file($value='') {
  * Try and create a new language directory.
  *
  * @uses $CFG
- * @param string $directory  directory name under $CFG->dataroot/lang eg cs_utf8_local
+ * @param string $directory full path to the directory under $langbase
  * @return string|false Returns full path to directory if successful, false if not
  */
 function lang_make_directory($dir, $shownotices=true) {

admin/modules.php

@@ -168,7 +168,7 @@
             $settings = "";
         }
 
-        $count = count_records("$module->name");
+        $count = count_records_select("$module->name",'course<>0');
 
         if ($module->visible) {
             $visible = "<a href=\"modules.php?hide=$module->name&amp;sesskey=$USER->sesskey\" title=\"$strhide\">".

admin/oacleanup.php

@@ -46,7 +46,7 @@ function online_assignment_cleanup($output=false) {
 
 
     /// get a list of all courses on this site
-    $courses = get_courses();
+    $courses = get_records('course');
 
     /// cycle through each course
     foreach ($courses as $course) {

admin/report/courseoverview/reportsgraph.php

@@ -39,6 +39,8 @@
     $graph->parameter['legend_size'] = 10;
     $graph->parameter['x_axis_angle'] = 90;
     $graph->parameter['title'] = false; // moodle will do a nicer job.
+    $graph->y_tick_labels = null;
+    $graph->offset_relation = null;
     if ($report != STATS_REPORT_ACTIVE_COURSES) {
         $graph->parameter['y_decimal_left'] = 2;
     }

admin/roles/assign.html

@@ -23,14 +23,30 @@
                            document.assignform.remove.disabled=false;
                            document.assignform.addselect.selectedIndex=-1;" />
           <?php
-              foreach ($contextusers as $contextuser) {
-                  $fullname = fullname($contextuser, true);
-                  echo "<option value=\"$contextuser->id\">".$fullname.", ".$contextuser->email."</option>\n";
-              }
+            $i = 0;
+            foreach ($contextusers as $contextuser) {
+                $fullname = fullname($contextuser, true);
+                if ($contextuser->hidden) {
+                    $hidden=' ('.get_string('hiddenassign').') ';
+                } else {
+                    $hidden="";
+                }
+                echo "<option value=\"$contextuser->id\">".$fullname.", ".$contextuser->email.$hidden."</option>\n";
+                $i++;    
+            }
+            if ($i==0) {
+                echo '<option/>'; // empty select breaks xhtml strict
+            }
           ?>
 
           </select></td>
       <td valign="top">
+        <label title="<?php print_string('hiddenassign') ?>">
+            <input type="checkbox" name="hidden" value="1" />
+            <img src="<?php echo $CFG->pixpath; ?>/t/hide.gif" alt="<?php print_string('hiddenassign') ?>" class="hide-show-image" />            <? 
+            helpbutton ('hiddenassign', get_string('hiddenassign'));
+            ?>
+        </label>
         <br />
         <input name="add" type="submit" id="add" value="&larr;" />
         <br />
@@ -46,13 +62,11 @@
 
               if (!empty($searchtext)) {
                   echo "<optgroup label=\"$strsearchresults (" . $availableusers->_numOfRows . ")\">\n";
-                  while (! $availableusers->EOF) {
-                      $user = $availableusers->FetchObj();
+                  while ($user = rs_fetch_next_record($availableusers)) {
                       if (!isset($contextusers[$user->id])) {
                           $fullname = fullname($user, true);
                           echo "<option value=\"$user->id\">".$fullname.", ".$user->email."</option>\n";
                       }
-                      $availableusers->MoveNext();
                   }
                   echo "</optgroup>\n";
 
@@ -61,13 +75,11 @@
                       echo '<optgroup label="'.get_string('toomanytoshow').'"><option></option></optgroup>'."\n"
                           .'<optgroup label="'.get_string('trysearching').'"><option></option></optgroup>'."\n";
                   } else {
-                      while (! $availableusers->EOF) {
-                          $user = $availableusers->FetchObj();
+                      while ($user = rs_fetch_next_record($availableusers)) {
                           if (!isset($contextusers[$user->id])) {
                               $fullname = fullname($user, true);
                               echo "<option value=\"$user->id\">".$fullname.", ".$user->email."</option>\n";
                           }
-                          $availableusers->MoveNext();
                       }
                   }
               }

admin/roles/assign.php

@@ -157,8 +157,25 @@
 
         } else if ($remove and !empty($frm->removeselect) and confirm_sesskey()) {
 
+            $sitecontext = get_context_instance(CONTEXT_SYSTEM);
+            $topleveladmin = false;
+   
+            // we only worry about this if the role has doanything capability at site level
+            if ($context->id == $sitecontext->id && $adminroles = get_roles_with_capability('moodle/site:doanything', CAP_ALLOW, $sitecontext)) {
+                foreach ($adminroles as $adminrole) {
+                    if ($adminrole->id == $roleid) {
+                        $topleveladmin = true;
+                    }
+                }
+            }
+ 
             foreach ($frm->removeselect as $removeuser) {
                 $removeuser = clean_param($removeuser, PARAM_INT);
+
+                if ($topleveladmin && ($removeuser == $USER->id)) {   // Prevent unassigning oneself from being admin
+                    continue;
+                }
+
                 if (! role_unassign($roleid, $removeuser, 0, $context->id)) {
                     $errors[] = "Could not remove user with id $removeuser from this role!";
                 } else if ($inmeta) {
@@ -181,12 +198,16 @@
 
     print_heading_with_help(get_string('assignroles', 'role'), 'assignroles');
 
+    if ($context->contextlevel==CONTEXT_SYSTEM) {
+        print_simple_box(get_string('globalroleswarning', 'role'));
+    }
+
     if ($roleid) {        /// prints a form to swap roles
 
     /// Get all existing participants in this context.
         // Why is this not done with get_users???
 
-        if (!$contextusers = get_role_users($roleid, $context, false, 'u.id, u.firstname, u.lastname, u.email')) {
+        if (!$contextusers = get_role_users($roleid, $context, false, 'u.id, u.firstname, u.lastname, u.email, r.hidden')) {
             $contextusers = array();
         }
 

admin/roles/manage.php

@@ -16,6 +16,7 @@
     $cancel      = optional_param('cancel', 0, PARAM_BOOL);
 
     $sitecontext = get_context_instance(CONTEXT_SYSTEM, SITEID);
+    require_capability('moodle/role:manage', $sitecontext);
 
     if ($cancel) {
         redirect('manage.php');
@@ -224,9 +225,9 @@
             if (array_key_exists($roleid, $roles) and confirm_sesskey()) {
                 $role = $roles[$roleid];
                 if ($role->sortorder + 1 < $rolescount) {
-                    $bellow = $roles[$rolesort[$role->sortorder + 1]];
+                    $below = $roles[$rolesort[$role->sortorder + 1]];
 
-                    if (!switch_roles($role, $bellow)) {
+                    if (!switch_roles($role, $below)) {
                         error("Cannot move role with ID $roleid");
                     }
                 }

admin/search.php

@@ -18,17 +18,17 @@ $CFG->adminsearchquery = $query;  // So we can reference it in search boxes late
 $statusmsg = '';
 
 if ($data = data_submitted()) {
-    $data = (array)$data;
+    $unslashed = (array)stripslashes_recursive($data);
     if (confirm_sesskey()) {
         $olddbsessions = !empty($CFG->dbsessions);
         $changedsettings = search_settings(admin_get_root(), $query);
         $errors = '';
 
         foreach($changedsettings as $changedsetting) {
-            if (!isset($data['s_' . $changedsetting->name])) {
-                $data['s_' . $changedsetting->name] = ''; // needed for checkboxes
+            if (!isset($unslashed['s_' . $changedsetting->name])) {
+                $unslashed['s_' . $changedsetting->name] = ''; // needed for checkboxes
             }
-            $errors .= $changedsetting->write_setting($data['s_' . $changedsetting->name]);
+            $errors .= $changedsetting->write_setting($unslashed['s_' . $changedsetting->name]);
         }
 
         if ($olddbsessions != !empty($CFG->dbsessions)) {
@@ -69,6 +69,7 @@ if ($resultshtml != '') {
 } else {
     echo get_string('noresults','admin');
 }
+echo '</fieldset>';
 echo '</form>';
 
 admin_externalpage_print_footer($adminroot);

admin/settings.php

@@ -58,7 +58,8 @@ $statusmsg = '';
 if ($data = data_submitted()) {
     if (confirm_sesskey()) {
         $olddbsessions = !empty($CFG->dbsessions);
-        $errors = $root->write_settings((array)$data);
+        $unslashed = (array)stripslashes_recursive($data);
+        $errors = $root->write_settings($unslashed);
         //force logout if dbsession setting changes
         if ($olddbsessions != !empty($CFG->dbsessions)) {
             require_logout();

admin/settings/appearance.php

@@ -123,6 +123,10 @@ $temp = new admin_settingpage('gradebook', get_string('gradebook', 'admin'));
 $temp->add(new admin_setting_special_gradebookroles());
 $ADMIN->add('appearance', $temp);
 
+// new CFG variable for coursemanager (what roles to display)
+$temp = new admin_settingpage('coursemanager', get_string('coursemanager', 'admin'));
+$temp->add(new admin_setting_special_coursemanager());
+$ADMIN->add('appearance', $temp);
 
 $ADMIN->add('appearance', new admin_externalpage('stickyblocks', get_string('stickyblocks', 'admin'), "$CFG->wwwroot/$CFG->admin/stickyblocks.php"));
 

admin/settings/location.php

@@ -5,7 +5,6 @@ $temp = new admin_settingpage('locationsettings', get_string('locationsettings',
 $options = get_list_of_timezones();
 $options[99] = get_string('serverlocaltime');
 $temp->add(new admin_setting_configselect('timezone', get_string('timezone','admin'), get_string('configtimezone', 'admin'), 99, $options));
-$options = get_list_of_timezones();
 $options[99] = get_string('timezonenotforced', 'admin');
 $temp->add(new admin_setting_configselect('forcetimezone', get_string('forcetimezone', 'admin'), get_string('helpforcetimezone', 'admin'), 99, $options));
 $options = get_list_of_countries();

admin/settings/security.php

@@ -6,7 +6,7 @@
 $temp = new admin_settingpage('sitepolicies', get_string('sitepolicies', 'admin'));
 $temp->add(new admin_setting_configcheckbox('protectusernames', get_string('protectusernames', 'admin'), get_string('configprotectusernames', 'admin'), 1));
 $temp->add(new admin_setting_configcheckbox('forcelogin', get_string('forcelogin', 'admin'), get_string('configforcelogin', 'admin'), 0));
-$temp->add(new admin_setting_configcheckbox('forceloginforprofiles', get_string('forceloginforprofiles', 'admin'), get_string('configforceloginforprofiles', 'admin'), 0));
+$temp->add(new admin_setting_configcheckbox('forceloginforprofiles', get_string('forceloginforprofiles', 'admin'), get_string('configforceloginforprofiles', 'admin'), 1));
 $temp->add(new admin_setting_configcheckbox('opentogoogle', get_string('opentogoogle', 'admin'), get_string('configopentogoogle', 'admin'), 0));
 $temp->add(new admin_setting_configtext('maxbytes', get_string('maxbytes', 'admin'), get_string('configmaxbytes', 'admin'), 0, PARAM_INT));
 $temp->add(new admin_setting_configcheckbox('messaging', get_string('messaging', 'admin'), get_string('configmessaging','admin'), 1));
@@ -87,8 +87,8 @@ $ADMIN->add('security', $temp);
 // "antivirus" settingpage
 $temp = new admin_settingpage('antivirus', get_string('antivirus', 'admin'));
 $temp->add(new admin_setting_configcheckbox('runclamonupload', get_string('runclamavonupload', 'admin'), get_string('configrunclamavonupload', 'admin'), 0));
-$temp->add(new admin_setting_configtext('pathtoclam', get_string('pathtoclam', 'admin'), get_string('configpathtoclam', 'admin'), '', PARAM_PATH));
-$temp->add(new admin_setting_configtext('quarantinedir', get_string('quarantinedir', 'admin'), get_string('configquarantinedir', 'admin'), '', PARAM_PATH));
+$temp->add(new admin_setting_configtext('pathtoclam', get_string('pathtoclam', 'admin'), get_string('configpathtoclam', 'admin'), '', PARAM_RAW)); // TODO: add path validation
+$temp->add(new admin_setting_configtext('quarantinedir', get_string('quarantinedir', 'admin'), get_string('configquarantinedir', 'admin'), '', PARAM_RAW)); // TODO: add path validation
 $temp->add(new admin_setting_configselect('clamfailureonupload', get_string('clamfailureonupload', 'admin'), get_string('configclamfailureonupload', 'admin'), 'donothing', array('donothing' => get_string('configclamdonothing', 'admin'),
                                                                                                                                                                                   'actlikevirus' => get_string('configclamactlikevirus', 'admin'))));
 $ADMIN->add('security', $temp);

admin/settings/server.php

@@ -7,10 +7,10 @@ $temp = new admin_settingpage('systempaths', get_string('systempaths','admin'));
 $temp->add(new admin_setting_configselect('gdversion', get_string('gdversion','admin'), get_string('configgdversion', 'admin'), check_gd_version(), array('0' => get_string('gdnot'),
                                                                                                                                                           '1' => get_string('gd1'),
                                                                                                                                                           '2' => get_string('gd2'))));
-$temp->add(new admin_setting_configtext('zip', get_string('pathtozip','admin'), get_string('configzip', 'admin'), '', PARAM_PATH));
-$temp->add(new admin_setting_configtext('unzip', get_string('pathtounzip','admin'), get_string('configunzip', 'admin'), '', PARAM_PATH));
-$temp->add(new admin_setting_configtext('pathtodu', get_string('pathtodu', 'admin'), get_string('configpathtodu', 'admin'), '', PARAM_PATH));
-$temp->add(new admin_setting_configtext('aspellpath', get_string('aspellpath', 'admin'), get_string('edhelpaspellpath'), '', PARAM_PATH));
+$temp->add(new admin_setting_configtext('zip', get_string('pathtozip','admin'), get_string('configzip', 'admin'), '', PARAM_RAW)); // TODO: add path validation
+$temp->add(new admin_setting_configtext('unzip', get_string('pathtounzip','admin'), get_string('configunzip', 'admin'), '', PARAM_RAW)); // TODO: add path validation
+$temp->add(new admin_setting_configtext('pathtodu', get_string('pathtodu', 'admin'), get_string('configpathtodu', 'admin'), '', PARAM_RAW)); // TODO: add path validation
+$temp->add(new admin_setting_configtext('aspellpath', get_string('aspellpath', 'admin'), get_string('edhelpaspellpath'), '', PARAM_RAW)); // TODO: add path validation
 $ADMIN->add('server', $temp, 0);
 
 

admin/settings/users.php

@@ -17,7 +17,7 @@ $ADMIN->add('accounts', new admin_externalpage('uploadusers', get_string('upload
 $ADMIN->add('users', new admin_category('roles', get_string('permissions', 'role')));
 $ADMIN->add('roles', new admin_externalpage('defineroles', get_string('defineroles', 'role'), "$CFG->wwwroot/$CFG->admin/roles/manage.php"));
 $sitecontext = get_context_instance(CONTEXT_SYSTEM);
-$ADMIN->add('roles', new admin_externalpage('assignroles', get_string('assignroles', 'role'), "$CFG->wwwroot/$CFG->admin/roles/assign.php?contextid=" . $sitecontext->id));
+$ADMIN->add('roles', new admin_externalpage('assignroles', get_string('assignglobalroles', 'role'), "$CFG->wwwroot/$CFG->admin/roles/assign.php?contextid=" . $sitecontext->id));
 
 
 // "userpolicies" settingpage

admin/upgradesettings.php

@@ -24,14 +24,14 @@ if ($newsettingshtml == '') {
 
 // now we'll deal with the case that the admin has submitted the form with new settings
 if ($data = data_submitted()) {
-    $data = (array)$data;
+    $unslashed = (array)stripslashes_recursive($data);
     if (confirm_sesskey()) {
         $newsettings = find_new_settings(admin_get_root());
         $errors = '';
 
         foreach($newsettings as $newsetting) {
-            if (isset($data['s_' . $newsetting->name])) {
-                $errors .= $newsetting->write_setting($data['s_' . $newsetting->name]);
+            if (isset($unslashed['s_' . $newsetting->name])) {
+                $errors .= $newsetting->write_setting($unslashed['s_' . $newsetting->name]);
             } else {
                 $errors .= $newsetting->write_setting($newsetting->defaultsetting);
             }

admin/uploaduser.php

@@ -270,7 +270,6 @@ if ($um->preprocess_files() && confirm_sesskey()) {
                             //This can be used to obtain a list of userids for existing users
                             notify("$olduser->id ".get_string('usernotaddedregistered', 'error', $username));
                             $userserrors++;
-                            continue;
                         }
 
                     } else { // new user
@@ -424,4 +423,3 @@ function my_file_get_contents($filename, $use_include_path = 0) {
 }
 
 ?>
-

admin/user.php

@@ -86,6 +86,11 @@
         admin_externalpage_setup('editusers', $adminroot);
     }
 
+    if (empty($CFG->loginhttps)) {
+        $securewwwroot = $CFG->wwwroot;
+    } else {
+        $securewwwroot = str_replace('http:','https:',$CFG->wwwroot);
+    }
 
     if ($newuser) {                 // Create a new user
 
@@ -111,7 +116,7 @@
             }
         }
 
-        redirect("$CFG->wwwroot/user/edit.php?id=$user->id&course=$site->id");
+        redirect("$securewwwroot/user/edit.php?id=$user->id&course=$site->id");
 
     } else {                        // List all users for editing
 
@@ -330,7 +335,7 @@
                 }
 
                 if (has_capability('moodle/user:update', $sitecontext)) {
-                    $editbutton = "<a href=\"../user/edit.php?id=$user->id&amp;course=$site->id\">$stredit</a>";
+                    $editbutton = "<a href=\"$securewwwroot/user/edit.php?id=$user->id&amp;course=$site->id\">$stredit</a>";
                     if ($user->confirmed == 0) {
                         $confirmbutton = "<a href=\"user.php?confirmuser=$user->id&amp;sesskey=$USER->sesskey\">" . get_string('confirm') . "</a>";
                     } else {

admin/xmldb/actions/test/test.class.php

@@ -114,6 +114,8 @@ class test extends XMLDBAction {
         $table->addIndexInfo('course', XMLDB_INDEX_NOTUNIQUE, array('course'));
         $table->addIndexInfo('rsstype', XMLDB_INDEX_UNIQUE, array('rsstype'));
 
+        $table->setComment("This is a test'n drop table. You can drop it safely");
+
     /// Get SQL code and execute it
         $test = new stdClass;
         $test->sql = $table->getCreateTableSQL($CFG->dbtype, $CFG->prefix, true);
@@ -275,7 +277,7 @@ class test extends XMLDBAction {
         /// Get SQL code and execute it
             $test = new stdClass;
             $field = new XMLDBField('grade');
-            $field->setAttributes(XMLDB_TYPE_CHAR, '20', null, XMLDB_NOTNULL, null, null, null, 'test');
+            $field->setAttributes(XMLDB_TYPE_CHAR, '20', null, XMLDB_NOTNULL, null, null, null, "test'n drop");
 
             $test->sql = $table->getAlterFieldSQL($CFG->dbtype, $CFG->prefix, $field, true);
             $test->status = change_field_type($table, $field, false, false);
@@ -775,7 +777,7 @@ class test extends XMLDBAction {
                 if ($new = get_record('newnameforthetable', 'id', $rec->id)) {
                     delete_records('newnameforthetable', 'id', $new->id);
                     $newtextlen = $textlib->strlen($new->intro, current_charset());
-                    if ($rec->intro === $new->intro) {
+                    if ($fulltext === $new->intro) {
                         $test->sql = array($newtextlen . ' cc. (text) sent and received ok');
                         $test->status = true;
                     } else {
@@ -804,7 +806,7 @@ class test extends XMLDBAction {
             if ($rec->id = insert_record('newnameforthetable', $rec)) {
                 if ($new = get_record('newnameforthetable', 'id', $rec->id)) {
                     $newtextlen = strlen($new->avatar);
-                    if ($rec->avatar === $new->avatar) {
+                    if ($fulltext === $new->avatar) {
                         $test->sql = array($newtextlen . ' bytes (binary) sent and received ok');
                         $test->status = true;
                     } else {
@@ -837,7 +839,7 @@ class test extends XMLDBAction {
                 if ($new = get_record('newnameforthetable', 'id', $rec->id)) {
                     $newtextlen = $textlib->strlen($new->intro, current_charset());
                     $newimglen = strlen($new->avatar);
-                    if ($rec->avatar === $new->avatar && $rec->intro === $new->intro) {
+                    if ($basetext === $new->avatar && $basetext === $new->intro) {
                         $test->sql = array($newtextlen . ' cc. (text) sent and received ok',
                                            $newimglen . ' bytes (binary) sent and received ok');
                         $test->status = true;
@@ -874,7 +876,7 @@ class test extends XMLDBAction {
             if (set_field('newnameforthetable', 'intro', $rec->intro, 'name', $rec->name)) {
                 if ($new = get_record('newnameforthetable', 'id', $rec->id)) {
                     $newtextlen = $textlib->strlen($new->intro);
-                    if ($rec->intro === $new->intro) {
+                    if ($fulltext === $new->intro) {
                         $test->sql = array($newtextlen . ' cc. (text) sent and received ok');
                         $test->status = true;
                     } else {
@@ -904,7 +906,7 @@ class test extends XMLDBAction {
             if (set_field('newnameforthetable', 'avatar', $rec->avatar, 'name', $rec->name)) {
                 if ($new = get_record('newnameforthetable', 'id', $rec->id)) {
                     $newtextlen = strlen($new->avatar);
-                    if ($rec->avatar === $new->avatar) {
+                    if ($fulltext === $new->avatar) {
                         $test->sql = array($newtextlen . ' bytes (binary) sent and received ok');
                         $test->status = true;
                     } else {

admin/xmldb/actions/view_reserved_words/view_reserved_words.class.php

@@ -133,7 +133,7 @@ class view_reserved_words extends XMLDBAction {
 
     /// The textarea showing all the reserved words
         $o.= '    <table id="formelements" align="center" cellpadding="5">';
-        $o.= '      <tr><td align="center">' . $this->str['listreservedwords'];
+        $o.= '      <tr><td align="center">' . $this->str['listreservedwords'].'</td></tr>';
         $o.= '      <tr><td><textarea cols="80" rows="32">';
         $o.= s(implode(', ', $reserved_words));
         $o.= '</textarea></td></tr>';

admin/xmldb/actions/view_structure_php/view_structure_php.class.php

@@ -211,7 +211,7 @@ class view_structure_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch create table for ' . $table->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && create_table($table);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && create_table($table);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -249,7 +249,7 @@ class view_structure_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch drop table for ' . $table->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && drop_table($table);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && drop_table($table);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -287,7 +287,7 @@ class view_structure_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch rename table for ' . $table->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && rename_table($table, ' . "'NEWNAMEGOESHERE'" . ');' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && rename_table($table, ' . "'NEWNAMEGOESHERE'" . ');' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;

admin/xmldb/actions/view_table_php/view_table_php.class.php

@@ -336,7 +336,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch add field ' . $field->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && add_field($table, $field);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && add_field($table, $field);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -379,7 +379,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch drop field ' . $field->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && drop_field($table, $field);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && drop_field($table, $field);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -422,7 +422,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch rename field ' . $field->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && rename_field($table, $field, ' . "'" . 'NEWNAMEGOESHERE' . "'" . ');' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && rename_field($table, $field, ' . "'" . 'NEWNAMEGOESHERE' . "'" . ');' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -475,7 +475,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch change of type for field ' . $field->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && change_field_type($table, $field);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && change_field_type($table, $field);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -525,7 +525,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch change of precision for field ' . $field->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && change_field_precision($table, $field);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && change_field_precision($table, $field);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -571,7 +571,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch change of sign for field ' . $field->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && change_field_unsigned($table, $field);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && change_field_unsigned($table, $field);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -617,7 +617,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch change of nullability for field ' . $field->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && change_field_notnull($table, $field);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && change_field_notnull($table, $field);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -664,7 +664,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch change of list of values for field ' . $field->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && change_field_enum($table, $field);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && change_field_enum($table, $field);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -710,7 +710,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch change of default for field ' . $field->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && change_field_default($table, $field);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && change_field_default($table, $field);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -754,7 +754,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch add key ' . $key->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && add_key($table, $key);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && add_key($table, $key);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -798,7 +798,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch drop key ' . $key->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && drop_key($table, $key);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && drop_key($table, $key);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -845,7 +845,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch rename key ' . $key->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && rename_key($table, $key, ' . "'" . 'NEWNAMEGOESHERE' . "'" . ');' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && rename_key($table, $key, ' . "'" . 'NEWNAMEGOESHERE' . "'" . ');' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -889,7 +889,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch add index ' . $index->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && add_index($table, $index);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && add_index($table, $index);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -933,7 +933,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch drop index ' . $index->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && drop_index($table, $index);' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && drop_index($table, $index);' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;
@@ -980,7 +980,7 @@ class view_table_php extends XMLDBAction {
     /// Launch the proper DDL
         $result .= XMLDB_LINEFEED;
         $result .= '    /// Launch rename index ' . $index->getName() . XMLDB_LINEFEED;
-        $result .= '        $status = $status && rename_index($table, $index, ' . "'" . 'NEWNAMEGOESHERE' . "'" . ');' . XMLDB_LINEFEED;
+        $result .= '        $result = $result && rename_index($table, $index, ' . "'" . 'NEWNAMEGOESHERE' . "'" . ');' . XMLDB_LINEFEED;
 
     /// Add standard PHP footer
         $result .= XMLDB_PHP_FOOTER;

admin/xmldb/index.php

@@ -52,6 +52,7 @@
 /// getting "incomplete" objects
     require_once('../../config.php');
     require_once($CFG->libdir.'/adminlib.php');
+    require_once($CFG->libdir.'/ddllib.php'); // Install/upgrade related db functions
     $adminroot = admin_get_root();
     admin_externalpage_setup('xmldbeditor', $adminroot);
 

auth/cas/config.html

@@ -112,7 +112,3 @@
 <?php
     include($CFG->dirroot.'/auth/ldap/config.html');
 ?>
-
-
-
-

auth/cas/forbidden.php

@@ -15,4 +15,3 @@
     print_footer();
     exit;
 ?>
-

auth/db/lib.php

@@ -22,7 +22,8 @@ function auth_user_login ($username, $password) {
 
     // Connect to the external database
     $authdb = &ADONewConnection($CFG->auth_dbtype); 
-    $authdb->PConnect($CFG->auth_dbhost,$CFG->auth_dbuser,$CFG->auth_dbpass,$CFG->auth_dbname); 
+    $authdb->PConnect($CFG->auth_dbhost,$CFG->auth_dbuser,$CFG->auth_dbpass,$CFG->auth_dbname);
+    $authdb->SetFetchMode(ADODB_FETCH_ASSOC); ///Set Assoc mode always after DB connection
 
     if ($CFG->auth_dbpasstype === 'internal') { 
         // lookup username externally, but resolve
@@ -92,6 +93,7 @@ function auth_get_userinfo($username){
     ADOLoadCode($CFG->auth_dbtype);          
     $authdb = &ADONewConnection();         
     $authdb->PConnect($CFG->auth_dbhost,$CFG->auth_dbuser,$CFG->auth_dbpass,$CFG->auth_dbname); 
+    $authdb->SetFetchMode(ADODB_FETCH_ASSOC); ///Set Assoc mode always after DB connection
 
     $fields = array("firstname", "lastname", "email", "phone1", "phone2", 
                     "department", "address", "city", "country", "description", 
@@ -101,15 +103,17 @@ function auth_get_userinfo($username){
 
     foreach ($fields as $field) {
         if ($pcfg["field_map_$field"]) {
-            if ($rs = $authdb->Execute("SELECT ".$pcfg["field_map_$field"]." FROM $CFG->auth_dbtable
+            if ($rs = $authdb->Execute("SELECT ".$pcfg["field_map_$field"]." as myfield FROM $CFG->auth_dbtable
                                         WHERE $CFG->auth_dbfielduser = '$username'")) {
                 if ( $rs->RecordCount() == 1 ) {
+                    $fields_obj = rs_fetch_record($rs);
                     if (!empty($CFG->unicodedb)) {
-                        $result["$field"] = addslashes(stripslashes($rs->fields[0]));
+                        $result["$field"] = addslashes(stripslashes($fields_obj->myfield));
                     } else {
-                        $result["$field"] = addslashes(stripslashes(utf8_decode($rs->fields[0])));
+                        $result["$field"] = addslashes(stripslashes(utf8_decode($fields_obj->myfield)));
                     }
                 }
+                rs_close($rs);
             }
         }
     }
@@ -302,6 +306,7 @@ function auth_user_exists ($username) {
     global $CFG;
     $authdb = &ADONewConnection($CFG->auth_dbtype); 
     $authdb->PConnect($CFG->auth_dbhost,$CFG->auth_dbuser,$CFG->auth_dbpass,$CFG->auth_dbname); 
+    $authdb->SetFetchMode(ADODB_FETCH_ASSOC); ///Set Assoc mode always after DB connection
 
     $rs = $authdb->Execute("SELECT * FROM $CFG->auth_dbtable 
                                  WHERE $CFG->auth_dbfielduser = '$username' ");
@@ -334,6 +339,7 @@ function auth_get_userlist() {
     // Connect to the external database
     $authdb = &ADONewConnection($CFG->auth_dbtype); 
     $authdb->PConnect($CFG->auth_dbhost,$CFG->auth_dbuser,$CFG->auth_dbpass,$CFG->auth_dbname); 
+    $authdb->SetFetchMode(ADODB_FETCH_ASSOC); ///Set Assoc mode always after DB connection
 
     // fetch userlist
     $rs = $authdb->Execute("SELECT $CFG->auth_dbfielduser AS username
@@ -347,9 +353,10 @@ function auth_get_userlist() {
     
     if ( $rs->RecordCount() ) {
         $userlist = array();
-        while ($rec = $rs->FetchRow()) {
-            array_push($userlist, $rec['username']);
+        while ($rec = rs_fetch_next_record($rs)) {
+            array_push($userlist, $rec->username);
         }
+        rs_close($rs);
         return $userlist;
     } else {
         return array();
@@ -459,4 +466,4 @@ function auth_validate_form(&$form, &$err) {
     return true;
 }
 
-?>
+?>

auth/ldap/lib.php

@@ -713,7 +713,7 @@ function auth_ldap_bulk_insert($users){
     // bulk insert -- superfast with $bulk_insert_records
     $sql = 'INSERT INTO '.$CFG->prefix.'extuser (idnumber) VALUES ';
     // make those values safe
-    array_map('addslashes', $users);
+    $users = array_map('addslashes', $users);
     // join and quote the whole lot
     $sql = $sql . '(\'' . join('\'),(\'', $users) . '\')';
     print "+ " . count($users) . " users\n";
@@ -1002,15 +1002,33 @@ function auth_user_update_password($username, $newpassword) {
                           . ldap_err2str(ldap_errno($ldapconnection)));
             }    
             break;
+
+        case 'ad':
+            // Passwords in Active Directory must be encoded as Unicode
+            // strings (UCS-2 Little Endian format) and surrounded with
+            // double quotes. See http://support.microsoft.com/?kbid=269190
+            if (!function_exists('mb_convert_encoding')) {
+                error_log ('You need the mbstring extension to change passwords in Active Directory');
+                return false;
+            }
+            $newpassword = mb_convert_encoding('"'.$newpassword.'"', "UCS-2LE", "auto");
+            $result = ldap_modify($ldapconnection, $user_dn, array('unicodePwd' => $newpassword));
+            if(!$result){
+                error_log('LDAP Error in auth_user_update_password(). Error code: ' 
+                          . ldap_errno($ldapconnection) . '; Error string : '
+                          . ldap_err2str(ldap_errno($ldapconnection)));
+            }
+            break;
+
         default:
             $usedconnection = &$ldapconnection;
             // send ldap the password in cleartext, it will md5 it itself
             $result = ldap_modify($ldapconnection, $user_dn, array('userPassword' => $newpassword));
-    if(!$result){
-        error_log('LDAP Error in auth_user_update_password(). Error code: ' 
-                  . ldap_errno($ldapconnection) . '; Error string : '
-                  . ldap_err2str(ldap_errno($ldapconnection)));
-    }
+            if(!$result){
+                error_log('LDAP Error in auth_user_update_password(). Error code: ' 
+                          . ldap_errno($ldapconnection) . '; Error string : '
+                          . ldap_err2str(ldap_errno($ldapconnection)));
+            }
     
     }
 
@@ -1162,8 +1180,10 @@ function auth_ldap_init () {
         }
     }   
     //hack prefix to objectclass
-    if ('objectClass=' != substr($CFG->ldap_objectclass, 0, 12)) {
-       $CFG->ldap_objectclass = 'objectClass='.$CFG->ldap_objectclass;
+    if (empty($CFG->ldap_objectclass)) {        // Can't send empty filter
+        $CFG->ldap_objectclass = 'objectClass=*';
+    } else if (stripos($CFG->ldap_objectclass, 'objectClass=') !== 0) {
+        $CFG->ldap_objectclass = 'objectClass='.$CFG->ldap_objectclass;
     }
    
     //all chages go in $CFG , no need to return value
@@ -1318,6 +1338,11 @@ function auth_ldap_connect($binddn='',$bindpwd=''){
             ldap_set_option($connresult, LDAP_OPT_PROTOCOL_VERSION, $CFG->ldap_version);
         }
 
+        // Fix MDL-10921
+        if ($this->config->user_type == 'ad') {
+             ldap_set_option($connresult, LDAP_OPT_REFERRALS, 0);
+        }
+
         if (!empty($binddn)){
             //bind with search-user
             //$debuginfo .= 'Using bind user'.$binddn.'and password:'.$bindpwd; 

auth/radius/lib.php

@@ -47,4 +47,3 @@ function auth_user_login ($username, $password) {
     $rauth->close();
 }
 ?>
-

auth/shibboleth/README.txt

@@ -14,7 +14,7 @@ Changes:
 - 10. 2005: Added better error messages and moved text to language directories
 - 02. 2006: Simplified authentication so that authorization works properly
             Added instructions for IIS
-            
+- 11. 2006: User capabilities are now loaded properly as of Moodle 1.7+
 
 
 Moodle Configuration with Dual login
@@ -164,11 +164,6 @@ Example file:
 ?>
 --
 
-Bugs
---------------------------------------------------------------------------------
-Please send bug reports concerning the Shibboleth part to 
-Lukas Haemmerle <haemmerle@switch.ch>
-
 --------------------------------------------------------------------------------
 In case of problems and questions with Shibboleth authentication, contact 
 Lukas Haemmerle <haemmerle@switch.ch> or Markus Hagman <hagman@hytti.uku.fi>

auth/shibboleth/index.php

@@ -56,6 +56,15 @@
                 $urltogo = $CFG->wwwroot.'/';      /// Go to the standard home page
                 unset($SESSION->wantsurl);         /// Just in case
             }
+            
+            /// Go to my-moodle page instead of homepage if mymoodleredirect enabled
+            if (!has_capability('moodle/site:config',get_context_instance(CONTEXT_SYSTEM, SITEID)) and !empty($CFG->mymoodleredirect) and !isguest()) {
+                if ($urltogo == $CFG->wwwroot or $urltogo == $CFG->wwwroot.'/' or $urltogo == $CFG->wwwroot.'/index.php') {
+                    $urltogo = $CFG->wwwroot.'/my/';
+                }
+            }
+            
+            load_all_capabilities();     /// This is what lets the user do anything on the site  :-)
 
             redirect($urltogo);
         }

backup/backuplib.php

@@ -170,25 +170,10 @@
         return get_users_by_capability(get_context_instance(CONTEXT_COURSE, $courseid), 'moodle/course:view');
     }
 
-    //Returns all users (every record in users table)
-
+    //Returns all users ids (every record in users table)
     function backup_get_all_users() {
 
-        global $CFG;
-
-        $result = false;
-
-        //Get users
-        $users = get_records_sql("SELECT DISTINCT id,id
-                                  FROM {$CFG->prefix}user");
-        //Add users
-        if ($users) {
-            foreach ($users as $user) {
-                $result[$user->id]->id = $user->id;
-            }
-        }
-
-        return $result;
+        return get_records('user', '', '', '', 'id, id'); 
     }
 
     //Calculate the number of log entries to backup
@@ -1751,6 +1736,16 @@
 
         global $CFG,$preferences;
 
+        //Use one static variable to cache all the require_once calls that,
+        //under PHP5 seems to increase load too much, and we are requiring
+        //them here thousands of times (one per content). MDL-8700. 
+        //Once fixed by PHP, we'll delete this hack
+
+        static $includedfiles;
+        if (!isset($includedfiles)) {
+            $includedfiles = array();
+        }
+
         //Check if preferences is ok. If it isn't set, we are 
         //in a scheduled_backup to we are able to get a copy
         //from CFG->backup_preferences
@@ -1770,8 +1765,14 @@
         $result = str_replace($search,$replace,$content);
 
         foreach ($mypreferences->mods as $name => $info) {
+        /// We only include the corresponding backuplib.php if it hasn't been included before
+        /// This will save some load under PHP5. MDL-8700.
+        /// Once fixed by PHP, we'll delete this hack
+            if (!in_array($name, $includedfiles)) {
+                include_once("$CFG->dirroot/mod/$name/backuplib.php");
+                $includedfiles[] = $name;
+            }
             //Check if the xxxx_encode_content_links exists
-            include_once("$CFG->dirroot/mod/$name/backuplib.php");
             $function_name = $name."_encode_content_links";
             if (function_exists($function_name)) {
                 $result = $function_name($result,$mypreferences);
@@ -2222,4 +2223,4 @@
         }   
         fwrite ($bf, end_tag("ROLES_ASSIGNMENTS", $startlevel, true));     
     }
-?>
+?>

backup/lib.php

@@ -7,10 +7,11 @@
     //Sets a name/value pair in backup_config table
     function backup_set_config($name, $value) {
         if (get_field("backup_config", "name", "name", $name)) {
-            return set_field("backup_config", "value", $value, "name", $name);
+            return set_field("backup_config", "value", addslashes($value), "name", $name);
         } else {
+            $config = new object();
             $config->name = $name;
-            $config->value = $value;
+            $config->value = addslashes($value);
             return insert_record("backup_config", $config);
         }
     }

backup/restore_check.html

@@ -19,13 +19,24 @@
 
     if ($form1 = data_submitted()) {
         $currentcourseshortname = $course_header->course_shortname; //"store_ShortName";
-        $course_header->course_shortname =  $form1->shortname;  //"update_ShortName";    
-        $course_header->course_fullname =   $form1->fullname;   //"update_FullName";  
-        $form1->startdate = make_timestamp($form1->startyear, $form1->startmonth, $form1->startday);          
-        $currentcoursestartdate = $course_header->course_startdate;
-        $coursestartdatedateoffset = $form1->startdate - $currentcoursestartdate;
-        $restore->course_startdateoffset = $coursestartdatedateoffset; //change to restore
-    } 
+        $course_header->course_shortname =  $form1->shortname;  //"update_ShortName";
+        $course_header->course_fullname =   $form1->fullname;   //"update_FullName";
+    /// Roll dates only if the backup course has a start date
+    /// (some formats like main page, social..., haven't it and rolling dates
+    /// from 0 produces crazy dates. MDL-10125
+        if ($course_header->course_startdate) {
+            $form1->startdate = make_timestamp($form1->startyear, $form1->startmonth, $form1->startday);
+            $currentcoursestartdate = $course_header->course_startdate;
+            $coursestartdatedateoffset = $form1->startdate - $currentcoursestartdate;
+            $restore->course_startdateoffset = $coursestartdatedateoffset; //change to restore
+        } else { // don't roll if the course hasn't start date
+            $coursestartdatedateoffset = 0;
+            $restore->course_startdateoffset = 0;
+        }
+    }
+
+    ///Enforce SESSION->course_header rewrite (PHP 4.x needed because assigns are by value) MDL-8298
+    $SESSION->course_header = $course_header;
 
     //If restore session info exists, but we are coming from the form
     //it has prioriry

backup/restore_execute.html

@@ -54,6 +54,15 @@
         print_simple_box(get_string("restorefinished"),"center");
     } else {
         print_simple_box(get_string("importdatafinished"),"center");
+        $file = $CFG->dataroot . '/'
+            . $SESSION->import_preferences->backup_course
+            . '/backupdata/' . $SESSION->import_preferences->backup_name;
+        if (is_readable($file)) {
+            unlink($file);
+        }
+        else {
+            error_log("import course data: couldn't unlink $file");
+        }
         unset($SESSION->restore);
     }
     print_continue("$CFG->wwwroot/course/view.php?id=".$restore->course_id);

backup/restore_form.html

@@ -169,15 +169,16 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
     echo "<td align=\"right\"><b>";
     echo get_string("restoreto").":</b>";
     echo "</td><td colspan=\"3\">";
-    if (!has_capability('moodle/course:create', get_context_instance(CONTEXT_COURSE, $id))) {
-        $restore_restoreto_options[0] = get_string("currentcoursedeleting");
-        $restore_restoreto_options[1] = get_string("currentcourseadding");
-    } 
+    
     if (has_capability('moodle/course:create', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
         $restore_restoreto_options[0] = get_string("existingcoursedeleting");
         $restore_restoreto_options[1] = get_string("existingcourseadding");
         $restore_restoreto_options[2] = get_string("newcourse"); 
+    } else { // fix for MDL-7773
+        $restore_restoreto_options[0] = get_string("currentcoursedeleting");
+        $restore_restoreto_options[1] = get_string("currentcourseadding");
     }
+   
     choose_from_menu($restore_restoreto_options, "restore_restoreto", $restore_restoreto, "");
     echo "</td></tr>";
     if (iscreator()) {  //display these fields conditionally
@@ -200,7 +201,17 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo "<td align=\"right\"> ";
         print_string("startdate"); 
         echo ":</td><td>"; 
-        print_date_selector("startday", "startmonth", "startyear", $form1->startdate);
+    /// Show the roll dates option only if the backup course has a start date
+    /// (some formats like main page, social..., haven't it and rolling dates
+    /// from 0 produces crazy dates. MDL-10125
+        if ($form1->startdate) {
+            print_date_selector("startday", "startmonth", "startyear", $form1->startdate);
+        } else {
+            print_string('notavailable');
+            echo '<input type="hidden" name="startyear" value="0" />';
+            echo '<input type="hidden" name="startmonth" value="0" />';
+            echo '<input type="hidden" name="startday" value="0" />';
+        }
         helpbutton("coursestartdate", get_string("startdate"));
         echo "</td></tr>";
     }

backup/restorelib.php

@@ -70,6 +70,8 @@
         if (!defined('RESTORE_SILENTLY')) {
             echo "<ul>";
         }
+
+        // Restore links in modules.
         foreach ($restore->mods as $name => $info) {
             //If the module is being restored
             if (isset($info->restore) && $info->restore == 1) {
@@ -85,12 +87,23 @@
                 }
             }
         }
+
+        // TODO: process all html text also in blocks too
+
+        // Restore links in questions.
+        require_once("$CFG->dirroot/question/restorelib.php");
+        if (!defined('RESTORE_SILENTLY')) {
+            echo '<li>' . get_string('from') . ' ' . get_string('questions', 'quiz');
+        }
+        $status = question_decode_content_links_caller($restore);
+        if (!defined('RESTORE_SILENTLY')) {
+            echo '</li>';
+        }
+
         if (!defined('RESTORE_SILENTLY')) {
             echo "</ul>";
         }
-        
-        // TODO: process all html text also in blocks too
-        
+
         return $status;
     }
     
@@ -901,14 +914,18 @@
                             // Yu: This part is called repeatedly for every instance, 
                             // so it is necessary to set the granular flag and check isset() 
                             // when the first instance of this type of mod is processed.
-                            if (!isset($restore->mods[$mod->type]->granular) && isset($restore->mods[$mod->type]->instances) && is_array($restore->mods[$mod->type]->instances)) {
-                                // This defines whether we want to restore specific
-                                // instances of the modules (granular restore), or
-                                // whether we don't care and just want to restore
-                                // all module instances (non-granular).
-                                $restore->mods[$mod->type]->granular = true;
-                            } else {
-                                $restore->mods[$mod->type]->granular = false;
+                            //if (!isset($restore->mods[$mod->type]->granular) && isset($restore->mods[$mod->type]->instances) && is_array($restore->mods[$mod->type]->instances)) {
+                            
+                            if (!isset($restore->mods[$mod->type]->granular)) {
+                                if (isset($restore->mods[$mod->type]->instances) && is_array($restore->mods[$mod->type]->instances)) {                              
+                                    // This defines whether we want to restore specific
+                                    // instances of the modules (granular restore), or
+                                    // whether we don't care and just want to restore
+                                    // all module instances (non-granular).
+                                    $restore->mods[$mod->type]->granular = true;
+                                } else {
+                                    $restore->mods[$mod->type]->granular = false;
+                                }
                             }
                           
                             //Check if we've to restore this module (and instance) 
@@ -1111,7 +1128,7 @@
                     if (!$preferencescount) {
                         $continue = false;
                         if (!defined('RESTORE_SILENTLY')) {
-                            echo '<li>'.get_string('backupwithoutgradebook','grade').'</li>';
+                            echo '<li>'.get_string('backupwithoutgradebook','grades').'</li>';
                         }
                     }
 
@@ -1122,7 +1139,7 @@
                             if ($pref_rec->value == 0) {
                                 $continue = false;
                                 if (!defined('RESTORE_SILENTLY')) {
-                                    echo '<li>'.get_string('respectingcurrentdata','grade').'</li>';
+                                    echo '<li>'.get_string('respectingcurrentdata','grades').'</li>';
                                 }
                             }
                         }
@@ -1138,7 +1155,7 @@
                             //Fetch recordset_size records in each iteration
                             $recs = get_records_select("backup_ids","table_name = 'grade_preferences' AND backup_code = '$restore->backup_unique_code'",
                                                        "old_id",
-                                                       "old_id, old_id",
+                                                       "old_id",
                                                        $counter,
                                                        $recordset_size);
                             if ($recs) {
@@ -1192,7 +1209,7 @@
                             //Fetch recordset_size records in each iteration
                             $recs = get_records_select("backup_ids","table_name = 'grade_letter' AND backup_code = '$restore->backup_unique_code'",
                                                        "old_id",
-                                                       "old_id, old_id",
+                                                       "old_id",
                                                        $counter,
                                                        $recordset_size);
                             if ($recs) {
@@ -1242,7 +1259,7 @@
                             //Fetch recordset_size records in each iteration
                             $recs = get_records_select("backup_ids","table_name = 'grade_category' AND backup_code = '$restore->backup_unique_code'",
                                                        "old_id",
-                                                       "old_id, old_id",
+                                                       "old_id",
                                                        $countercat,
                                                        $recordset_size);
                             if ($recs) {
@@ -1693,7 +1710,7 @@
                         $counter = 0;
                         while ($counter < $unreadcount) {
                             //Fetch recordset_size records in each iteration
-                            $recs = get_records_select("backup_ids","table_name = 'message' AND backup_code = '$restore->backup_unique_code'","old_id","old_id, old_id",$counter,$recordset_size);
+                            $recs = get_records_select("backup_ids","table_name = 'message' AND backup_code = '$restore->backup_unique_code'","old_id","old_id",$counter,$recordset_size);
                             if ($recs) {
                                 foreach ($recs as $rec) {
                                     //Get the full record from backup_ids
@@ -1758,7 +1775,7 @@
                         $counter = 0;
                         while ($counter < $readcount) {
                             //Fetch recordset_size records in each iteration
-                            $recs = get_records_select("backup_ids","table_name = 'message_read' AND backup_code = '$restore->backup_unique_code'","old_id","old_id, old_id",$counter,$recordset_size);
+                            $recs = get_records_select("backup_ids","table_name = 'message_read' AND backup_code = '$restore->backup_unique_code'","old_id","old_id",$counter,$recordset_size);
                             if ($recs) {
                                 foreach ($recs as $rec) {
                                     //Get the full record from backup_ids
@@ -1825,7 +1842,7 @@
                         $counter = 0;
                         while ($counter < $contactcount) {
                             //Fetch recordset_size records in each iteration
-                            $recs = get_records_select("backup_ids","table_name = 'message_contacts' AND backup_code = '$restore->backup_unique_code'","old_id","old_id, old_id",$counter,$recordset_size);
+                            $recs = get_records_select("backup_ids","table_name = 'message_contacts' AND backup_code = '$restore->backup_unique_code'","old_id","old_id",$counter,$recordset_size);
                             if ($recs) {
                                 foreach ($recs as $rec) {
                                     //Get the full record from backup_ids
@@ -1913,14 +1930,7 @@
                 foreach ($info as $category) {
                     //Skip empty categories (some backups can contain them)
                     if (!empty($category->id)) {
-                        $catrestore = "restore_question_categories";
-                        if (function_exists($catrestore)) {
-                            //print_object ($category);                                                //Debug
-                            $status = $catrestore($category,$restore);
-                        } else {
-                            //Something was wrong. Function should exist.
-                            $status = false;
-                        }
+                        $status = restore_question_categories($category,$restore);
                     }
                 }
 
@@ -2090,7 +2100,18 @@
                 
                         //Now search if that group exists (by name and description field) in 
                         //restore->course_id course 
-                        $gro_db = get_record("groups","courseid",$restore->course_id,"name",$gro->name,"description",$gro->description);
+                        //Going to compare LOB columns so, use the cross-db sql_compare_text() in both sides.
+                        $description_clause = '';
+                        if (!empty($gro->description)) { /// Only for groups having a description
+                            $literal_description = "'" . $gro->description . "'";
+                            $description_clause = " AND " . 
+                                                  sql_compare_text('description') . " = " . 
+                                                  sql_compare_text($literal_description);
+                        }
+                        $gro_db = get_record_sql("SELECT *
+                                                  FROM {$CFG->prefix}groups
+                                                  WHERE courseid = $restore->course_id AND
+                                                        name = '{$gro->name}'" . $description_clause);
                         //If it doesn't exist, create
                         if (!$gro_db) {
                             $create_group = true;
@@ -2599,7 +2620,7 @@
             while ($counter < $count_logs) {
                 //Get a chunk of records
                 //Take old_id twice to avoid adodb limitation
-                $logs = get_records_select("backup_ids","table_name = 'log' AND backup_code = '$restore->backup_unique_code'","old_id","old_id,old_id",$counter,$recordset_size);
+                $logs = get_records_select("backup_ids","table_name = 'log' AND backup_code = '$restore->backup_unique_code'","old_id","old_id",$counter,$recordset_size);
                 //We have logs
                 if ($logs) {
                     //Iterate
@@ -4411,7 +4432,7 @@
                             break;
                     }
                 }
-                if ($this->level == 6 && $this->tree[5]!="ROLE_ASSIGNMENTS" && $this->tree[5]!="ROLE_OVERRIDES") {
+                if ($this->level == 6 && $this->tree[5]!="ROLES_ASSIGNMENTS" && $this->tree[5]!="ROLES_OVERRIDES") {
                     switch ($tagName) {
                         case "ROLE":
                             //We've finalized a role, get it
@@ -4426,7 +4447,7 @@
                     }
                 }
                               
-                if ($this->level == 7 && $this->tree[5]!="ROLE_ASSIGNMENTS" && $this->tree[5]!="ROLE_OVERRIDES") {
+                if ($this->level == 7) {
                     switch ($tagName) {
                         case "TYPE":
                             $this->info->temprole->type = $this->getContents();
@@ -5825,9 +5846,9 @@
             }
             if (!$status = restore_decode_content_links($restore)) {
                 if (!defined('RESTORE_SILENTLY')) {
-                    notify("Could not refresh events for activities!");
+                    notify("Could not decode content links!");
                 } else {
-                    $errorstr = "Could not refresh events for activities!";
+                    $errorstr = "Could not decode content links!";
                     return false;
                 }
             }
@@ -6012,12 +6033,24 @@
         // the following code creates new roles
         // but we could use more intelligent detection, and role mapping
         // get role mapping info from $restore
+        $rolemappings = array();
 
-        $rolemappings = $restore->rolesmapping; // an array
-        if ($info->roles) {
-            foreach ($info->roles as $oldroleid=>$roledata) {
+        if (!empty($restore->rolesmapping)) {
+            $rolemappings = $restore->rolesmapping;
+        }
+        // $info->roles will be empty for backups pre 1.7
+        if (isset($info->roles) && $info->roles) {
             
-            /// first we check if the roles are in the mappings
+            foreach ($info->roles as $oldroleid=>$roledata) {
+                if (empty($restore->rolesmapping)) {                   
+                    // if this is empty altogether, we came from import or there's no roles used in course at all
+                    // in this case, write the same oldid as this is the same site
+                    // no need to do mapping
+                    $status = backup_putid($restore->backup_unique_code,"role",$oldroleid,
+                                     $oldroleid); // adding a new id                           
+                    continue;  // do not create additonal roles;
+                }
+            // first we check if the roles are in the mappings
             // if so, we just do a mapping i.e. update oldids table
                 if (isset($rolemappings[$oldroleid]) && $rolemappings[$oldroleid]) {
                     $status = backup_putid($restore->backup_unique_code,"role",$oldroleid,
@@ -6053,7 +6086,7 @@
             
                     // done finding a unique name
             
-                    $newroleid = create_role($roledata->name,$roledata->shortname,'');
+                    $newroleid = create_role(addslashes($roledata->name),addslashes($roledata->shortname),'');
                     $status = backup_putid($restore->backup_unique_code,"role",$oldroleid,
                                      $newroleid); // adding a new id
                     foreach ($roledata->capabilities as $capability) {
@@ -6069,7 +6102,6 @@
                 }
             }
         }
-    
         return true;
     }
     
@@ -6089,7 +6121,13 @@
         }
         $course = restore_read_xml_course_header($xmlfile);
         
-        if (!empty($course->roleassignments)) {
+        if (!isset($restore->rolesmapping)) {
+            $isimport = true; // course import from another course, or course with no role assignments
+        } else {
+            $isimport = false; // course restore with role assignments
+        }
+        
+        if (!empty($course->roleassignments) && !$isimport) {
             $courseassignments = $course->roleassignments;
 
             foreach ($courseassignments as $oldroleid => $courseassignment) {    
@@ -6100,14 +6138,12 @@
          * Restoring from course level overrides *
          *****************************************************/     
         
-        if (!empty($course->roleoverrides)) {
+        if (!empty($course->roleoverrides) && !$isimport) {
             $courseoverrides = $course->roleoverrides;
-            $rolemappings = $restore->rolesmapping;
             foreach ($courseoverrides as $oldroleid => $courseoverride) {
-            
                 // if not importing into exiting course, or creating new role, we are ok
                 // local course overrides to be respected (i.e. restored course overrides ignored)
-                if ($restore->restoreto != 1 || empty($rolemappings[$oldroleid])) {
+                if ($restore->restoreto != 1 || empty($restore->rolesmapping[$oldroleid])) {
                     restore_write_roleoverrides($restore, $courseoverride->overrides, "course", CONTEXT_COURSE, $course->course_id, $oldroleid);
                 }
             }
@@ -6127,11 +6163,12 @@
         foreach ($secs as $section) {
             if (isset($section->mods)) {
                 foreach ($section->mods as $modid=>$mod) {
-                    if (isset($mod->roleassignments)) {
+                    if (isset($mod->roleassignments) && !$isimport) {
                         foreach ($mod->roleassignments as $oldroleid=>$modassignment) {
                             restore_write_roleassignments($restore, $modassignment->assignments, "course_modules", CONTEXT_MODULE, $modid, $oldroleid);                       
                         }  
                     } 
+                    // role overrides always applies, in import or backup/restore
                     if (isset($mod->roleoverrides)) {
                         foreach ($mod->roleoverrides as $oldroleid=>$modoverride) {
                             restore_write_roleoverrides($restore, $modoverride->overrides, "course_modules", CONTEXT_MODULE, $modid, $oldroleid);
@@ -6153,13 +6190,14 @@
             $blocks = restore_read_xml_blocks($xmlfile);
             if (isset($blocks->instances)) {
                 foreach ($blocks->instances as $instance) {
-                    if (isset($instance->roleassignments)) {
+                    if (isset($instance->roleassignments) && !$isimport) {
                         foreach ($instance->roleassignments as $oldroleid=>$blockassignment) {
                             restore_write_roleassignments($restore, $blockassignment->assignments, "block_instance", CONTEXT_BLOCK, $instance->id, $oldroleid);
                       
                         }
                     }
-                    if (isset($instance->roleoverrides)) {
+                    // likewise block overrides should always be restored like mods
+                    if (isset($instance->roleoverrides)) {                    
                         foreach ($instance->roleoverrides as $oldroleid=>$blockoverride) {
                             restore_write_roleoverrides($restore, $blockoverride->overrides, "block_instance", CONTEXT_BLOCK, $instance->id, $oldroleid);
                         }
@@ -6175,7 +6213,7 @@
             echo "<li>".get_string("creatinguserroles").'</li>';
         }
         $info = restore_read_xml_users($restore, $xmlfile);
-        if (!empty($info->users)) {
+        if (!empty($info->users) && !$isimport) { // no need to restore user assignments for imports (same course)
             //For each user, take its info from backup_ids
             foreach ($info->users as $userid) {
                 $rec = backup_getid($restore->backup_unique_code,"user",$userid);
@@ -6221,7 +6259,7 @@
             $newcontext = get_context_instance($contextlevel, $oldinstance->new_id);
             $assignment->contextid = $newcontext->id; // new context id
             // might already have same assignment           
-            role_assign($assignment->roleid, $assignment->userid, 0, $assignment->contextid, $assignment->timestart, $assignment->timeend, $assignment->hidden, $assignment->enrol);
+            role_assign($assignment->roleid, $assignment->userid, 0, $assignment->contextid, $assignment->timestart, $assignment->timeend, $assignment->hidden, $assignment->enrol, $assignment->timemodified);
             
         }  
     }
@@ -6316,4 +6354,4 @@
            fclose($restorelog); 
         }
     }
-?>
+?>

blocks/admin_bookmarks/block_admin_bookmarks.php

@@ -57,7 +57,10 @@ class block_admin_bookmarks extends block_base {
             $bookmarks = array();
         }
 
-        if (($section = (isset($PAGE->section) ? $PAGE->section : '')) && (in_array($section, $bookmarks))) {
+	if(isset($PAGE->section) and $PAGE->section == 'search'){
+	  // the search page can't be properly bookmarked at present
+	  $this->content->footer = '';
+	}elseif (($section = (isset($PAGE->section) ? $PAGE->section : '')) && (in_array($section, $bookmarks))) {
             $this->content->footer = '<a href="' . $CFG->wwwroot . '/blocks/admin_bookmarks/delete.php?section=' . $section . '&amp;sesskey='.sesskey().'">' . get_string('unbookmarkthispage','admin') . '</a>';
         } elseif ($section = (isset($PAGE->section) ? $PAGE->section : '')) {
             $this->content->footer = '<a href="' . $CFG->wwwroot . '/blocks/admin_bookmarks/create.php?section=' . $section . '&amp;sesskey='.sesskey().'">' . get_string('bookmarkthispage','admin') . '</a>';

blocks/db/migrate2utf8.php

@@ -15,8 +15,13 @@ function migrate2utf8_block_instance_configdata($recordid){
             $fromenc = $globallang;
         } else {
             $sitelang   = $CFG->lang;
-            $courselang = get_course_lang($blockinstance->pageid);  //Non existing!
-            $userlang   = get_main_teacher_lang($blockinstance->pageid); //N.E.!!
+            if ($blockinstance->pagetype == 'course-view') {
+                $courselang = get_course_lang($blockinstance->pageid);  //Non existing!
+                $userlang   = get_main_teacher_lang($blockinstance->pageid); //N.E.!!
+            } else {
+                $courselang = false;
+                $userlang = false;
+            }
 
             $fromenc = get_original_encoding($sitelang, $courselang, $userlang);
         }
@@ -42,8 +47,13 @@ function migrate2utf8_block_instance_configdata($recordid){
             $fromenc = $globallang;
         } else {
             $sitelang   = $CFG->lang;
-            $courselang = get_course_lang($blockinstance->pageid);  //Non existing!
-            $userlang   = get_main_teacher_lang($blockinstance->pageid); //N.E.!!
+            if ($blockinstance->pagetype == 'course-view') {
+                $courselang = get_course_lang($blockinstance->pageid);  //Non existing!
+                $userlang   = get_main_teacher_lang($blockinstance->pageid); //N.E.!!
+            } else {
+                $courselang = false;
+                $userlang = false;
+            }
 
             $fromenc = get_original_encoding($sitelang, $courselang, $userlang);
         }
@@ -68,8 +78,13 @@ function migrate2utf8_block_instance_configdata($recordid){
             $fromenc = $globallang;
         } else {
             $sitelang   = $CFG->lang;
-            $courselang = get_course_lang($blockinstance->pageid);  //Non existing!
-            $userlang   = get_main_teacher_lang($blockinstance->pageid); //N.E.!!
+            if ($blockinstance->pagetype == 'course-view') {
+                $courselang = get_course_lang($blockinstance->pageid);  //Non existing!
+                $userlang   = get_main_teacher_lang($blockinstance->pageid); //N.E.!!
+            } else {
+                $courselang = false;
+                $userlang = false;
+            }
 
             $fromenc = get_original_encoding($sitelang, $courselang, $userlang);
         }
@@ -110,10 +125,7 @@ global $CFG, $globallang;
             $fromenc = $globallang;
         } else {
             $sitelang   = $CFG->lang;
-            $courselang = get_course_lang($blockpinned->pageid);  //Non existing!
-            $userlang   = get_main_teacher_lang($blockpinned->pageid); //N.E.!!
-
-            $fromenc = get_original_encoding($sitelang, $courselang, $userlang);
+            $fromenc = get_original_encoding($sitelang, false, false);
         }
 
         $blah = unserialize(base64_decode($blockpinned->configdata));
@@ -137,10 +149,7 @@ global $CFG, $globallang;
             $fromenc = $globallang;
         } else {
             $sitelang   = $CFG->lang;
-            $courselang = get_course_lang($blockpinned->pageid);  //Non existing!
-            $userlang   = get_main_teacher_lang($blockpinned->pageid); //N.E.!!
-
-            $fromenc = get_original_encoding($sitelang, $courselang, $userlang);
+            $fromenc = get_original_encoding($sitelang, false, false);
         }
 
         $blah = unserialize(base64_decode($blockpinned->configdata));
@@ -163,10 +172,7 @@ global $CFG, $globallang;
             $fromenc = $globallang;
         } else {
             $sitelang   = $CFG->lang;
-            $courselang = get_course_lang($blockpinned->pageid);  //Non existing!
-            $userlang   = get_main_teacher_lang($blockpinned->pageid); //N.E.!!
-
-            $fromenc = get_original_encoding($sitelang, $courselang, $userlang);
+            $fromenc = get_original_encoding($sitelang, false, false);
         }
 
         $blah = unserialize(base64_decode($blockpinned->configdata));

blocks/login/block_login.php

@@ -52,7 +52,7 @@ class block_login extends block_base {
             $this->content->text .= '<table align="center" cellpadding="2" cellspacing="0" class="logintable">';
 
             $this->content->text .= '<tr><td class="c0 r0" align="right">'.get_string('username').':</td>';
-            $this->content->text .= '<td class="c1 r0"><input type="text" name="username" size="10" value="'.$username.'" /></td></tr>';
+            $this->content->text .= '<td class="c1 r0"><input type="text" name="username" size="10" value="'.s($username).'" /></td></tr>';
 
             $this->content->text .= '<tr><td class="c0 r1" align="right">'.get_string('password').':</td>';
             $this->content->text .= '<td class="c1 r1"><input type="password" name="password" size="10" value="" /></td></tr>';

blocks/moodleblock.class.php

@@ -245,11 +245,6 @@ class block_base {
                 // The full treatment, please. Include the title text.
                 print_side_block($this->_title_html(), $this->content->text, NULL, NULL, $this->content->footer, $this->html_attributes(), $this->title);
             }
-            
-            //make a record of the block for the ajax course format to use
-            if (!empty($COURSE->javascriptportal)) {
-                $COURSE->javascriptportal->block_add('inst'.$this->instance->id,!$this->instance->visible);    
-            }
         }
     }
 
@@ -308,13 +303,7 @@ class block_base {
         
         switch ($this->instance->pagetype) {
             case 'course-view':
-                if ($this->instance->pageid == SITEID) {
-                      $context = get_context_instance(CONTEXT_SYSTEM, $this->instance->pageid);
-                } else {
-                    $context = get_context_instance(CONTEXT_COURSE, $this->instance->pageid);
-                }
-                
-                if (!has_capability('moodle/site:manageblocks', $context)) {
+                if (!has_capability('moodle/site:manageblocks', $blockcontext)) {
                     return null;
                 }
             break;
@@ -358,7 +347,7 @@ class block_base {
      
          // place holder for roles button
          $movebuttons .= '<a class="icon roles" title="'. $this->str->assignroles .'" href="'.$CFG->wwwroot.'/'.$CFG->admin.'/roles/assign.php?contextid='.$blockcontext->id.'">' .
-                        '<img src="'.$CFG->pixpath.'/i/roles.gif" alt="'.$this->str->assignroles.'" /></a>';
+                        '<img src="'.$CFG->pixpath.'/i/roles.gif" alt="'.$this->str->assignroles.'" height="11" width="11" border="0"/></a>';
      
         $movebuttons .= '<a class="icon hide" title="'. $title .'" href="'.$script.'&amp;blockaction=toggle">' .
                         '<img src="'. $CFG->pixpath.$icon .'" alt="'.$title.'" /></a>';
@@ -706,14 +695,9 @@ class block_list extends block_base {
                 print_side_block($this->_title_html(), '', $this->content->items, $this->content->icons, 
                                  $this->content->footer, $this->html_attributes(), $this->title);
             }
-            
-            //make a record of the block for the ajax course format to use
-            if (!empty($COURSE->javascriptportal)) {
-                $COURSE->javascriptportal->block_add('inst'.$this->instance->id,!$this->instance->visible);    
-            }
         }
     }
 
 }
 
-?>
+?>

blocks/rss_client/block_rss_client_action.php

@@ -273,8 +273,12 @@ if ($act == 'updfeed') {
             if (file_exists($CFG->dirroot .'/blog/lib.php')) {
                 //Blog module is installed - provide "blog this" link
                 print '<td align="right">'."\n";
-                print '<img src="'. $CFG->pixpath .'/blog/blog.gif" alt="'. get_string('blogthis', 'blog').'" title="'. get_string('blogthis', 'blog') .'" border="0" align="middle" />'."\n";
-                print '<a href="'. $CFG->wwwroot .'/blog/blogthis.php?userid='. $userid .'&act=use&item='. $y .'&rssid='. $rssid .'"><small><strong>'. get_string('blogthis', 'blog') .'</strong></small></a>'."\n";
+                
+                /// MDL-9291, blog this feature needs further discussion/implementation
+                /// temporarily disabling for now.
+                
+                // print '<img src="'. $CFG->pixpath .'/blog/blog.gif" alt="'. get_string('blogthis', 'blog').'" title="'. get_string('blogthis', 'blog') .'" border="0" align="middle" />'."\n";
+                //print '<a href="'. $CFG->wwwroot .'/blog/blogthis.php?userid='. $USER->id .'&act=use&item='. $y .'&rssid='. $rssid .'"><small><strong>'. get_string('blogthis', 'blog') .'</strong></small></a>'."\n";
             } else {
                 print '<td>&nbsp;';
             }

blocks/rss_client/db/access.php

@@ -40,7 +40,6 @@ $block_rss_client_capabilities = array(
         'legacy' => array(
             'teacher' => CAP_ALLOW,
             'editingteacher' => CAP_ALLOW,
-            'coursecreator' => CAP_ALLOW,
             'admin' => CAP_ALLOW
         )
     ),
@@ -51,7 +50,6 @@ $block_rss_client_capabilities = array(
         'contextlevel' => CONTEXT_SYSTEM,
         'legacy' => array(
             'editingteacher' => CAP_ALLOW,
-            'coursecreator' => CAP_ALLOW,
             'admin' => CAP_ALLOW
         )
     ),
@@ -63,7 +61,6 @@ $block_rss_client_capabilities = array(
         'legacy' => array(
             'teacher' => CAP_ALLOW,
             'editingteacher' => CAP_ALLOW,
-            'coursecreator' => CAP_ALLOW,
             'admin' => CAP_ALLOW
         )
     ),

blocks/social_activities/block_social_activities.php

@@ -38,7 +38,7 @@ class block_social_activities extends block_list {
         $groupbuttons = $course->groupmode;
         $groupbuttonslink = (!$course->groupmodeforce);
         $viewhiddenactivities = has_capability('moodle/course:viewhiddenactivities', $context);
-        $manageactivities = has_capability('moodle/course:manageactivities', $context);
+        $isediting = isediting($this->instance->pageid);
         $ismoving = ismoving($this->instance->pageid);
         if ($ismoving) {
             $strmovehere = get_string('movehere');
@@ -62,7 +62,7 @@ class block_social_activities extends block_list {
                     continue;
                 }
                 $mod = $mods[$modnumber];
-                if ($manageactivities && !$ismoving) {
+                if ($isediting && !$ismoving) {
                     if ($groupbuttons) {
                         if (! $mod->groupmodelink = $groupbuttonslink) {
                             $mod->groupmode = $course->groupmode;
@@ -116,7 +116,7 @@ class block_social_activities extends block_list {
             $this->content->icons[] = '';
         }
 
-        if ($manageactivities && $modnames) {
+        if ($isediting && $modnames) {
             $this->content->footer = print_section_add_menus($course, 0, $modnames, true, true);
         } else {
             $this->content->footer = '';

blog/edit.html

@@ -37,17 +37,44 @@
     </td>
 </tr>
 <tr valign="top">
-    <td align="right">
-        <strong><?php print_string('publishto', 'blog'); ?>:</strong>
-    </td>
-    <td colspan="2">
-     <?php
-        $options = blog_applicable_publish_states(); //$blogEntry may be null
-        choose_from_menu($options, 'publishstate', $post->publishstate, '');
-     ?>
+    <td align="right"><strong>
     <?php
-        helpbutton('publish_state', get_string('helppublish', 'blog'), 'blog');
+            print_string('entrybody', 'blog');
+    ?>:
+    </strong><br /><br />
+    <small><small>
+    <?php
+        helpbutton('writing', get_string('helpwriting'), 'moodle', true, true);
+        echo '<br />';
+        if ($usehtmleditor) {
+           helpbutton('richtext', get_string('helprichtext'), 'moodle', true, true);
+        } else {
+           emoticonhelpbutton('entry', 'body');
+        }
+    ?>
+    </small></small>
+    </td>
+    <td align="left" colspan="2">
+    <?php print_textarea($usehtmleditor, 25, 62, 500, 600, 'summary', $post->summary); ?>
+    </td>
+</tr>
+<tr valign="top">
+    <td align="right"><strong><?php print_string('formattexttype'); ?>:</strong></td>
+    <td colspan="2">
+    <?php
+        if ($usehtmleditor) {   /// Trying this out for a while
+            print_string('formathtml');
+            echo '<input type="hidden" name="format" value="'.FORMAT_HTML.'" />';
+        } else {
+            choose_from_menu(format_text_menu(), 'format', $post->format, '');
+        }
      ?>
+    <small><small>
+    <?php
+        helpbutton('textformat', get_string('helpformatting'));
+     ?>
+    </small></small>
+    <?php  if (isset($errors["summary"])) formerr($errors["summary"]); ?>
     </td>
 </tr>
 <tr valign="top">
@@ -100,48 +127,18 @@
         </table>
     </td>
 </tr>
-
-
-
 <tr valign="top">
-    <td align="right"><strong>
-    <?php
-            print_string('entrybody', 'blog');
-    ?>:
-    </strong><br /><br />
-    <small><small>
-    <?php
-        helpbutton('writing', get_string('helpwriting'), 'moodle', true, true);
-        echo '<br />';
-        if ($usehtmleditor) {
-           helpbutton('richtext', get_string('helprichtext'), 'moodle', true, true);
-        } else {
-           emoticonhelpbutton('entry', 'body');
-        }
-    ?>
-    </small></small>
+    <td align="right">
+        <strong><?php print_string('publishto', 'blog'); ?>:</strong>
     </td>
-    <td align="left" colspan="2">
-    <?php print_textarea($usehtmleditor, 25, 62, 500, 600, 'summary', $post->summary); ?>
-    </td>
-</tr>
-<tr valign="top">
-    <td align="right"><strong><?php print_string('formattexttype'); ?>:</strong></td>
     <td colspan="2">
-    <?php
-        if ($usehtmleditor) {   /// Trying this out for a while
-            print_string('formathtml');
-            echo '<input type="hidden" name="format" value="'.FORMAT_HTML.'" />';
-        } else {
-            choose_from_menu(format_text_menu(), 'format', $post->format, '');
-        }
+     <?php
+        $options = blog_applicable_publish_states(); //$blogEntry may be null
+        choose_from_menu($options, 'publishstate', $post->publishstate, '');
      ?>
-    <small><small>
     <?php
-        helpbutton('textformat', get_string('helpformatting'));
+        helpbutton('publish_state', get_string('helppublish', 'blog'), 'blog');
      ?>
-    </small></small>
-    <?php  if (isset($errors["summary"])) formerr($errors["summary"]); ?>
     </td>
 </tr>
 <tr>

blog/index.php

@@ -75,7 +75,7 @@ switch ($filtertype) {
         $courseid = $course->id;
         $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
         require_login($course->id);
-        if (!has_capability('moodle/blog:view', $sitecontext)) {
+        if (!has_capability('moodle/blog:view', $coursecontext)) {
             error('You do not have the required permissions to view blogs in this course');
         }
     break;
@@ -84,7 +84,8 @@ switch ($filtertype) {
         if ($CFG->bloglevel < BLOG_GROUP_LEVEL) {
             error('Group blogs is not enabled');
         }
-        if (!$group = get_record('groups','id',$groupid)) {
+        // fix for MDL-9268
+        if (!$group = get_record('groups','id',$filterselect)) {
             error('Incorrect group id specified');
         }
         if (!$course = get_record('course', 'id', $group->courseid)) {
@@ -115,7 +116,7 @@ switch ($filtertype) {
         if ($USER->id == $filterselect) {
             if (!has_capability('moodle/blog:create', $sitecontext)
               and !has_capability('moodle/blog:view', $sitecontext)) {
-                error('You do not have your own a blog, sorry.');
+                error('You do not have your own blog, sorry.');
             }
         } else {
             $personalcontext = get_context_instance(CONTEXT_USER, $filterselect);

blog/lib.php

@@ -327,10 +327,16 @@
         if (has_capability('moodle/blog:manageentries', $sitecontext)) {
             return true; // can manage all posts
         }
-
+        
+        // coming for 1 post, make sure it's not a draft
         if ($blogEntry and $blogEntry->publishstate == 'draft') {
             return false;  // can not view draft of others
         }
+        
+        // coming for 1 post, make sure user is logged in, if not a public blog
+        if ($blogEntry && $blogEntry->publishstate != 'public' && !isloggedin()) {
+            return false;  
+        }
 
         switch ($CFG->bloglevel) {
             case BLOG_GLOBAL_LEVEL:
@@ -345,7 +351,7 @@
             break;
 
             case BLOG_COURSE_LEVEL:
-                $mycourses = array_keys(get_my_courses($targetuserid));
+                $mycourses = array_keys(get_my_courses($USER->id));
                 $usercourses = array_keys(get_my_courses($targetuserid));
                 $shared = array_intersect($mycourses, $usercourses);
                 if (!empty($shared)) {
@@ -355,7 +361,7 @@
             break;
 
             case BLOG_GROUP_LEVEL:
-                $mycourses = array_keys(get_my_courses($targetuserid));
+                $mycourses = array_keys(get_my_courses($USER->id));
                 $usercourses = array_keys(get_my_courses($targetuserid));
                 $shared = array_intersect($mycourses, $usercourses);
                 foreach ($shared as $courseid) {
@@ -393,6 +399,8 @@
 
         global $CFG, $USER;
 
+        $typesql = " AND p.module = 'blog' ";   
+        
         /// set the tag id for searching
         if ($tagid) {
             $tag = $tagid;
@@ -411,7 +419,7 @@
 
             if ($post = get_record('post', 'id', $postid)) {
 
-                if (blog_user_can_view_user_post($post->userid)) {
+                if (blog_user_can_view_user_post($post->userid, $post)) {
 
                     if ($user = get_record('user', 'id', $post->userid)) {
                         $post->email = $user->email;
@@ -437,13 +445,19 @@
             $tagquerysql = '';
         }
 
-        if (isloggedin()) {
-            $permissionsql =  '(p.publishstate = \'site\' OR p.publishstate = \'public\' OR p.userid = '.$USER->id.')';
+        if (isloggedin() && !has_capability('moodle/legacy:guest', get_context_instance(CONTEXT_SYSTEM, SITEID), $USER->id, false)) {
+            $permissionsql =  'AND (p.publishstate = \'site\' OR p.publishstate = \'public\' OR p.userid = '.$USER->id.')';
         } else {
-            $permissionsql =  'p.publishstate = \'public\'';
+            $permissionsql =  'AND p.publishstate = \'public\'';
+        }
+        
+        // fix for MDL-9165, use with readuserblogs capability in a user context can read that user's private blogs
+        // admins can see all blogs regardless of publish states, as described on the help page
+        if (has_capability('moodle/user:readuserblogs', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
+            $permissionsql = ''; 
+        } else if ($filtertype=='user' && has_capability('moodle/user:readuserblogs', get_context_instance(CONTEXT_USER, $filterselect))) {
+            $permissionsql = '';  
         }
-
-
         /****************************************
          * depending on the type, there are 4   *
          * different possible sqls              *
@@ -463,7 +477,7 @@
                         .$CFG->prefix.'user u
                         WHERE p.userid = u.id '.$tagquerysql.'
                         AND u.deleted = 0
-                        AND '.$permissionsql;
+                        '.$permissionsql.$typesql;
 
             break;
 
@@ -477,20 +491,25 @@
                         AND ra.contextid '.get_related_contexts_string($context).'
                         AND u.id = p.userid
                         AND u.deleted = 0
-                        AND '.$permissionsql;
+                        '.$permissionsql.$typesql;
 
             break;
 
             case 'group':
-
                 $SQL = 'SELECT '.$requiredfields.' FROM '.$CFG->prefix.'post p, '.$tagtablesql
                         .$CFG->prefix.'groups_members m, '.$CFG->prefix.'user u
                         WHERE p.userid = m.userid '.$tagquerysql.'
                         AND u.id = p.userid
                         AND m.groupid = '.$filterselect.'
+                        AND (p.publishstate = \'site\' OR p.publishstate = \'public\' OR p.userid = '.$USER->id.')';
+                
+                /*$SQL = 'SELECT '.$requiredfields.' FROM '.$CFG->prefix.'post p, '.$tagtablesql
+                        .groups_members_from_sql().', '.$CFG->prefix.'user u
+                        WHERE '.groups_members_where_sql($filterselect, 'p.userid').'
+                        AND u.id = p.userid
                         AND u.deleted = 0
-                        AND '.$permissionsql;
-
+                        '.$permissionsql.$typesql;
+                */
             break;
 
             case 'user':
@@ -500,7 +519,7 @@
                         WHERE p.userid = u.id '.$tagquerysql.'
                         AND u.id = '.$filterselect.'
                         AND u.deleted = 0
-                        AND '.$permissionsql;
+                        '.$permissionsql.$typesql;
             break;
         }
 

calendar/event.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //

calendar/export_basic.html

@@ -3,13 +3,13 @@
 <form method="get" action="export_execute.php">
 <?php print_string('iwanttoexport', 'calendar'); ?>:
 <div class="indent">
-    <input type="radio" name="preset_what" id="pw_all" value="all" /><label for="pw_all"><?php print_string('eventsall', 'calendar'); ?></label><br />
+    <input type="radio" name="preset_what" id="pw_all" value="all" checked="checked"/><label for="pw_all"><?php print_string('eventsall', 'calendar'); ?></label><br />
     <input type="radio" name="preset_what" id="pw_course" value="courses" /><label for="pw_course"><?php print_string('eventsrelatedtocourses', 'calendar'); ?></label><br />
 </div>
 <?php print_string('for', 'calendar'); ?>:
 <div class="indent">
     <?php if($allowthisweek) { ?>
-    <input type="radio" name="preset_time" id="pt_wknow" value="weeknow" /><label for="pt_wknow"><?php print_string('weekthis', 'calendar'); ?></label><br />
+    <input type="radio" name="preset_time" id="pt_wknow" value="weeknow" checked="checked"/><label for="pt_wknow"><?php print_string('weekthis', 'calendar'); ?></label><br />
     <?php } ?>
     <?php if($allownextweek) { ?>
     <input type="radio" name="preset_time" id="pt_wknext" value="weeknext" /><label for="pt_wknext"><?php print_string('weeknext', 'calendar'); ?></label><br />

calendar/export_execute.php

@@ -16,8 +16,8 @@ $day  = optional_param('cal_d', 0, PARAM_INT);
 $mon  = optional_param('cal_m', 0, PARAM_INT);
 $yr   = optional_param('cal_y', 0, PARAM_INT);
 
-$what = optional_param('preset_what', '', PARAM_ALPHA);
-$time = optional_param('preset_time', '', PARAM_ALPHA);
+$what = optional_param('preset_what', 'all', PARAM_ALPHA);
+$time = optional_param('preset_time', 'weeknow', PARAM_ALPHA);
 
 $now = usergetdate(time());
 // Let's see if we have sufficient and correct data

calendar/lib.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //
@@ -242,7 +242,7 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
                     $popupicon = $CFG->pixpath.'/c/user.gif';
                     $popupalt  = '';
                 }
-                $popupcontent .= '<div><img height="16" width="16" src="'.$popupicon.'" style="vertical-align: middle; margin-right: 4px;" alt="'.$popupalt.'" /><a href="'.$dayhref.'">'.format_string($event->name,true).'</a></div>';
+                $popupcontent .= '<div><img height="16" width="16" src="'.$popupicon.'" style="vertical-align: middle; margin-right: 4px;" alt="'.$popupalt.'" /><a href="'.$dayhref.'#event_'.$event->id.'">'.format_string($event->name,true).'</a></div>';
             }
             
             //Accessibility: functionality moved to calendar_get_popup.
@@ -456,7 +456,7 @@ function calendar_print_event($event) {
     static $strftimetime;
 
     $event = calendar_add_event_metadata($event);
-    echo '<table class="event" cellspacing="0">';
+    echo '<a name="event_'.$event->id.'"></a><table class="event" cellspacing="0">';
     echo '<tr><td class="picture">';
     if (!empty($event->icon)) {
         echo $event->icon;
@@ -870,7 +870,7 @@ function calendar_get_sideblock_upcoming($events, $linkhref = NULL) {
             if(!empty($linkhref)) {
                 $ed = usergetdate($events[$i]->timestart);
                 $href = calendar_get_link_href(CALENDAR_URL.$linkhref, $ed['mday'], $ed['mon'], $ed['year']);
-                $content .= '<a href="'.$href.'">'.$events[$i]->name.'</a>';
+                $content .= '<a href="'.$href.'#event_'.$events[$i]->id.'">'.$events[$i]->name.'</a>';
             }
             else {
                 $content .= $events[$i]->name;
@@ -1095,10 +1095,11 @@ function calendar_set_filters(&$courses, &$group, &$user, $courseeventsfrom = NU
     else {
         $courses = false;
     }
-   //BUG 6130 clean $courses array as SESSION has bad entries. 
-   foreach ($courses as $index => $value) {
-       if (empty($value)) unset($courses[$index]);
-   }
+    //BUG 6130 clean $courses array as SESSION has bad entries. 
+    // [pj] TODO: See if this has to do with my new change in get_default_courses and can be taken out
+    foreach ($courses as $index => $value) {
+        if (empty($value)) unset($courses[$index]);
+    }
 
     if($SESSION->cal_show_user || $ignorefilters) {
         // This doesn't work for arrays yet (maybe someday it will)
@@ -1177,15 +1178,11 @@ function calendar_edit_event_allowed($event) {
     if (has_capability('moodle/calendar:manageentries', $sitecontext)) {
         return true;
     }
-
-    // editting userid account
-    if ($event->userid) {  
-        if ($event->userid == $USER->id) {
-            return (has_capability('moodle/calendar:manageownentries', $sitecontext));
-        }
-    } else if ($event->groupid) {
-        $group = get_record('groups', 'id', $event->groupid);
-        if($group === false) {
+    
+    // if groupid is set, it's definitely a group event
+    if ($event->groupid) {
+        //TODO:check.
+        if (! groups_group_exists($event->groupid)) {
             return false;
         } 
         
@@ -1193,10 +1190,15 @@ function calendar_edit_event_allowed($event) {
         // to edit group calendar too
         // there is no need to check membership, because if you have this capability
         // you will have a role in this group context
-        return has_capability('moodle/calendar:manageentries', get_context_instance(CONTEXT_GROUP, $group->id));  
+        return has_capability('moodle/calendar:manageentries', get_context_instance(CONTEXT_GROUP, $event->groupid)); 
     } else if ($event->courseid) {
-        return has_capability('moodle/calendar:manageentries', get_context_instance(CONTEXT_COURSE, $event->courseid)); 
-    }
+    // if groupid is not set, but course is set,
+    // it's definiely a course event
+        return has_capability('moodle/calendar:manageentries', get_context_instance(CONTEXT_COURSE, $event->courseid));  
+    } else if ($event->userid && $event->userid == $USER->id) {  
+    // if course is not set, but userid id set, it's a user event
+        return (has_capability('moodle/calendar:manageownentries', $sitecontext));
+    } 
     return false;
 }
 
@@ -1212,18 +1214,34 @@ function calendar_get_default_courses($ignoreref = false) {
     }
 
     $courses = array();
-    if(has_capability('moodle/calendar:manageentries', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
-        if(!empty($CFG->calendar_adminseesall)) {
+    if (has_capability('moodle/calendar:manageentries', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
+        if (!empty($CFG->calendar_adminseesall)) {
             $courses = get_records_sql('SELECT id, 1 FROM '.$CFG->prefix.'course');
             return $courses;
         }
     }
-    if(isset($USER->student) && is_array($USER->student)) {
-        $courses = $courses + $USER->student;
-    }
-    if(isset($USER->teacher) && is_array($USER->teacher)) {
-        $courses = $courses + $USER->teacher;
+    
+    // find all course this student can view
+    if ($allcourses = get_my_courses($USER->id,'visible DESC,sortorder ASC', '*', true)) {
+        foreach ($allcourses as $courseid=>$acourse) {
+            $auth = '';
+            $context = get_context_instance(CONTEXT_COURSE, $courseid);
+            if ($roleassign = get_records_sql("SELECT * FROM {$CFG->prefix}role_assignments
+                                               WHERE contextid = $context->id
+                                               AND userid = $USER->id")) {
+                foreach ($roleassign as $rid => $rs) {
+                    if (!empty($rs->enrol)) {
+                        $auth = $rs->enrol;
+                        break;
+                    }
+                }
+            } else {
+                $auth = '';
+            }
+            $courses[$courseid] = $auth;
+        }
     }
+
     return $courses;
 }
 
@@ -1347,4 +1365,4 @@ function calendar_set_filters_status($packed_bitfield) {
     return true;
 }
 
-?>
+?>

calendar/set.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //

calendar/view.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //
@@ -44,8 +44,8 @@
     require_once($CFG->dirroot.'/course/lib.php');
     require_once($CFG->dirroot.'/calendar/lib.php');
 
-    $course = optional_param('course', 0);
-    $view = optional_param('view', 'upcoming');
+    $courseid = optional_param('course', 0, PARAM_INT);
+    $view = optional_param('view', 'upcoming', PARAM_ALPHA);
     $day  = optional_param('cal_d', 0, PARAM_INT);
     $mon  = optional_param('cal_m', 0, PARAM_INT);
     $yr   = optional_param('cal_y', 0, PARAM_INT);
@@ -54,7 +54,9 @@
         redirect($CFG->wwwroot.'/'.$CFG->admin.'/index.php');
     }
 
-    if ($CFG->forcelogin) {
+    if ($courseid) {
+        require_login($courseid);
+    } else if ($CFG->forcelogin) {
         require_login();
     }
 
@@ -87,8 +89,8 @@
     }
 
     // If a course has been supplied in the URL, change the filters to show that one
-    if (!empty($course)) {
-        if ($course = get_record('course', 'id', $course)) {
+    if (!empty($courseid)) {
+        if ($course = get_record('course', 'id', $courseid)) {
             if ($course->id == SITEID) {
                 // If coming from the home page, show all courses
                 $SESSION->cal_courses_shown = calendar_get_default_courses(true);
@@ -100,6 +102,8 @@
                 calendar_set_referring_course($SESSION->cal_courses_shown);
             }
         }
+    } else {
+        $course = null;
     }
 
     if (empty($USER->id) or isguest()) {
@@ -302,9 +306,15 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
     list($d, $m, $y) = array($date['mday'], $date['mon'], $date['year']); // This is what we want to display
     $display->maxdays = calendar_days_in_month($m, $y);
 
-    // We 'll keep these values as GMT here, and offset them when the time comes to query the db
-    $display->tstart = gmmktime(0, 0, 0, $m, 1, $y); // This is GMT
-    $display->tend = gmmktime(23, 59, 59, $m, $display->maxdays, $y); // GMT
+    if (get_user_timezone_offset() < 99) {
+        // We 'll keep these values as GMT here, and offset them when the time comes to query the db
+        $display->tstart = gmmktime(0, 0, 0, $m, 1, $y); // This is GMT
+        $display->tend = gmmktime(23, 59, 59, $m, $display->maxdays, $y); // GMT
+    } else {
+        // no timezone info specified
+        $display->tstart = mktime(0, 0, 0, $m, 1, $y);
+        $display->tend = mktime(23, 59, 59, $m, $display->maxdays, $y);
+    }
 
     $startwday = gmdate('w', $display->tstart); // $display->tstart is already GMT, so don't use date(): messes with server's TZ
 
@@ -440,7 +450,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
         if(isset($eventsbyday[$day])) {
             echo '<ul class="events-new">';
             foreach($eventsbyday[$day] as $eventindex) {
-                echo '<li><a href="'.$dayhref.'">'.format_string($events[$eventindex]->name,true).'</a></li>';
+                echo '<li><a href="'.$dayhref.'#event_'.$events[$eventindex]->id.'">'.format_string($events[$eventindex]->name, true).'</a></li>';
             }
             echo '</ul>';
         }

course/category.php

@@ -32,12 +32,11 @@
         error("Category not known!");
     }
 
-    if (has_capability('moodle/course:create', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
+    if (has_capability('moodle/course:create', $context)) {
         if ($categoryedit !== -1) {
             $USER->categoryediting = $categoryedit;
         }
         $navbaritem = update_category_button($category->id);
-
         $creatorediting = !empty($USER->categoryediting);
         $adminediting = (has_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM, SITEID)) and $creatorediting);
 
@@ -51,7 +50,7 @@
     }
 
 
-    if (has_capability('moodle/category:update', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
+    if (has_capability('moodle/category:update', $context)) {
         /// Rename the category if requested
         if (!empty($rename) and confirm_sesskey()) {
             $category->name = $rename;
@@ -218,7 +217,7 @@
     if ($subcategories = get_records("course_categories", "parent", $category->id, "sortorder ASC")) {
         $firstentry = true;
         foreach ($subcategories as $subcategory) {
-            if ($subcategory->visible or has_capability('moodle/course:create', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
+            if ($subcategory->visible or has_capability('moodle/course:create', $context)) {
                 $subcategorieswereshown = true;
                 if ($firstentry) {
                     echo '<table align="center" border="0" cellspacing="2" cellpadding="4" class="generalbox">';
@@ -305,7 +304,7 @@
 
         foreach ($courses as $acourse) {
           
-            $context = get_context_instance(CONTEXT_COURSE, $acourse->id);
+            $coursecontext = get_context_instance(CONTEXT_COURSE, $acourse->id);
           
             $count++;
             $up = ($count > 1 || !$atfirstpage);
@@ -315,44 +314,46 @@
             echo '<tr>';
             echo '<td><a '.$linkcss.' href="view.php?id='.$acourse->id.'">'.$acourse->fullname.'</a></td>';
             if ($creatorediting) {
-                if ($adminediting) {
-                    echo "<td>";
+                echo "<td>";
+                if (has_capability('moodle/course:update', $coursecontext)) {
                     echo '<a title="'.$strsettings.'" href="'.$CFG->wwwroot.'/course/edit.php?id='.
                          $acourse->id.'">'.
-                         '<img src="'.$CFG->pixpath.'/t/edit.gif" height="11" width="11" border="0" alt="'.$stredit.'" /></a> ';
-                    // role assignment link     
-                    if (has_capability('moodle/role:assign', $context)) { 
-                        echo'<a title="'.get_string('assignroles', 'role').'" href="'.$CFG->wwwroot.'/'.$CFG->admin.'/roles/assign.php?contextid='.$context->id.'"><img src="'.$CFG->pixpath.'/i/roles.gif" height="11" width="11" alt="'.get_string('assignroles', 'role').'" /></a>';
-                    }                       
+                         '<img src="'.$CFG->pixpath.'/t/edit.gif" height="11" width="11" border="0" alt="'.$stredit.'" /></a> ';        }
+                
+                // role assignment link     
+                if (has_capability('moodle/role:assign', $coursecontext)) { 
+                    echo'<a title="'.get_string('assignroles', 'role').'" href="'.$CFG->wwwroot.'/'.$CFG->admin.'/roles/assign.php?contextid='.$coursecontext->id.'"><img src="'.$CFG->pixpath.'/i/roles.gif" height="11" width="11" alt="'.get_string('assignroles', 'role').'" /></a>';
+                }                       
                          
-                    if (has_capability('moodle/course:delete', $context)) {
-                        echo '<a title="'.$strdelete.'" href="delete.php?id='.$acourse->id.'">'.
-                             '<img src="'.$CFG->pixpath.'/t/delete.gif" height="11" width="11" border="0" alt="'.$strdelete.'" /></a> ';
-                    }
+                if (can_delete_course($acourse->id)) {
+                    echo '<a title="'.$strdelete.'" href="delete.php?id='.$acourse->id.'">'.
+                            '<img src="'.$CFG->pixpath.'/t/delete.gif" height="11" width="11" border="0" alt="'.$strdelete.'" /></a> ';
+                }
 
-                    if (has_capability('moodle/course:visibility', $context)) {
-                        if (!empty($acourse->visible)) {
-                            echo '<a title="'.$strhide.'" href="category.php?id='.$category->id.'&amp;page='.$page.
-                                '&amp;perpage='.$perpage.'&amp;hide='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
-                                '<img src="'.$CFG->pixpath.'/t/hide.gif" height="11" width="11" border="0" alt="'.$strhide.'" /></a> ';
-                        } else {
-                            echo '<a title="'.$strshow.'" href="category.php?id='.$category->id.'&amp;page='.$page.
-                                '&amp;perpage='.$perpage.'&amp;show='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
-                                '<img src="'.$CFG->pixpath.'/t/show.gif" height="11" width="11" border="0" alt="'.$strshow.'" /></a> ';
-                        }
+                if (has_capability('moodle/course:visibility', $coursecontext) && has_capability('moodle/course:viewhiddencourses', $coursecontext)) {
+                    if (!empty($acourse->visible)) {
+                        echo '<a title="'.$strhide.'" href="category.php?id='.$category->id.'&amp;page='.$page.
+                            '&amp;perpage='.$perpage.'&amp;hide='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
+                            '<img src="'.$CFG->pixpath.'/t/hide.gif" height="11" width="11" border="0" alt="'.$strhide.'" /></a> ';
+                    } else {
+                        echo '<a title="'.$strshow.'" href="category.php?id='.$category->id.'&amp;page='.$page.
+                            '&amp;perpage='.$perpage.'&amp;show='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
+                            '<img src="'.$CFG->pixpath.'/t/show.gif" height="11" width="11" border="0" alt="'.$strshow.'" /></a> ';
                     }
+                }
 
-                    if (has_capability('moodle/site:backup', $context)) {
-                        echo '<a title="'.$strbackup.'" href="../backup/backup.php?id='.$acourse->id.'">'.
-                             '<img src="'.$CFG->pixpath.'/t/backup.gif" height="11" width="11" border="0" alt="" /></a> ';
-                    }
+                if (has_capability('moodle/site:backup', $coursecontext)) {
+                    echo '<a title="'.$strbackup.'" href="../backup/backup.php?id='.$acourse->id.'">'.
+                            '<img src="'.$CFG->pixpath.'/t/backup.gif" height="11" width="11" border="0" alt="" /></a> ';
+                }
                     
-                    if (has_capability('moodle/site:restore', $context)) {
-                        echo '<a title="'.$strrestore.'" href="../files/index.php?id='.$acourse->id.
-                                 '&amp;wdir=/backupdata">'.
-                                 '<img src="'.$CFG->pixpath.'/t/restore.gif" height="11" width="11" border="0" alt="" /></a> ';
-                    }
+                if (has_capability('moodle/site:restore', $coursecontext)) {
+                    echo '<a title="'.$strrestore.'" href="../files/index.php?id='.$acourse->id.
+                         '&amp;wdir=/backupdata">'.
+                         '<img src="'.$CFG->pixpath.'/t/restore.gif" height="11" width="11" border="0" alt="" /></a> ';
+                }
 
+                if (has_capability('moodle/category:update', $context)) {
                     if ($up) {
                         echo '<a title="'.$strmoveup.'" href="category.php?id='.$category->id.'&amp;page='.$page.
                              '&amp;perpage='.$perpage.'&amp;moveup='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
@@ -368,20 +369,13 @@
                     } else {
                         echo '<img src="'.$CFG->wwwroot.'/pix/spacer.gif" height="11" width="11" border="0" alt="" /> ';
                     }
-
-                    echo '</td>';
-                    echo '<td align="center">';
-                    echo '<input type="checkbox" name="c'.$acourse->id.'" />';
                     $abletomovecourses = true;
-
-                } else if (has_capability('moodle/course:update', get_context_instance(CONTEXT_COURSE, $acourse->id))) {
-                    echo '<td>';
-                    echo '<a title="'.$strsettings.'" href="'.$CFG->wwwroot.'/course/edit.php?id='.$acourse->id.'">'.
-                         '<img src="'.$CFG->pixpath.'/t/edit.gif" height="11" width="11" border="0" alt="'.$strsettings.'" /></a> ';
-                    echo '<a title="'.$strassignteachers.'" href="'.$CFG->wwwroot.'/course/teacher.php?id='.$acourse->id.'">'.
-                         '<img src="'.$CFG->pixpath.'/t/user.gif" height="11" width="11" border="0" alt="'.$strassignteachers.'" /></a> ';
                 }
+                
                 echo '</td>';
+                echo '<td align="center">';
+                echo '<input type="checkbox" name="c'.$acourse->id.'" />';
+                            
             } else {
                 echo '<td align="right">';
                 if (!empty($acourse->guest)) {
@@ -417,8 +411,7 @@
         echo '</form>';
         echo '<br />';
     }
-
-
+    
     echo '<center>';
     if (has_capability('moodle/category:update', get_context_instance(CONTEXT_SYSTEM, SITEID)) and $numcourses > 1) {           /// Print button to re-sort courses by name
         unset($options);
@@ -428,7 +421,6 @@
         print_single_button('category.php', $options, get_string('resortcoursesbyname'), 'get');
     }
 
-    $context = get_context_instance(CONTEXT_SYSTEM, SITEID);
     if (has_capability('moodle/course:create', $context)) {         /// Print button to create a new course
         unset($options);
         $options['category'] = $category->id;
@@ -436,7 +428,6 @@
         echo '<br />';
     }
 
-    $context = get_context_instance(CONTEXT_COURSECAT, $id);
     if (has_capability('moodle/category:update', $context)) {           /// Print form to rename the category
         $strrename= get_string('rename');
         echo '<form name="renameform" action="category.php" method="post">';

course/delete.php

@@ -8,7 +8,9 @@
 
     require_login();
 
-    require_capability('moodle/course:delete', get_context_instance(CONTEXT_SYSTEM, SITEID));
+    if (!can_delete_course($id)) {
+        error('You do not have the permission to delete this course.');
+    }
 
     if (!$site = get_site()) {
         error("Site not found!");

course/edit.html

@@ -156,6 +156,11 @@
             }
 
             $choices = $choices + $roles;
+            
+            // fix for MDL-9197
+            foreach ($choices as $choiceid => $choice) {
+                $choices[$choiceid] = format_string($choice);
+            }
 
             choose_from_menu ($choices, 'defaultrole', $form->defaultrole, '');
             helpbutton("coursedefaultrole", get_string("defaultrole"));

course/edit.php

@@ -40,11 +40,15 @@
                 $disable_meta = get_string('metaalreadyhasenrolments');
             }
         }
-    } else {  // Admin is creating a new course
+    } else {  // Creating a new course
 
-        $context = get_context_instance(CONTEXT_SYSTEM, SITEID);
-        if (!has_capability('moodle/course:create',$context)) {
-            error("You do not currently have course creation privileges!");
+        $context = get_context_instance(CONTEXT_COURSECAT, $category);
+        // first check to see if user has site level course creation. 
+        // This is because it is possible that coursecat = 0 when an admin is adding a course
+        if (!has_capability('moodle/course:create', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
+            if (!has_capability('moodle/course:create',$context)) {
+                error("You do not currently have course creation privileges!");
+            }
         }
 
         $course = NULL;

course/edit2.php

@@ -1,177 +1,122 @@
 <?php // $Id$
       // Edit course settings
 
-    require_once("../config.php");
-    require_once("lib.php");
-    require_once("$CFG->libdir/blocklib.php");
-    require_once("$CFG->dirroot/enrol/enrol.class.php");
+    require_once('../config.php');
+    require_once($CFG->dirroot.'/enrol/enrol.class.php');
+    require_once($CFG->libdir.'/blocklib.php');
+    require_once('lib.php');
+    require_once('edit_form.php');
 
-    include_once $CFG->libdir.'/formslib.php';
+    $id         = optional_param('id', 0, PARAM_INT);       // course id
+    $categoryid = optional_param('category', 0, PARAM_INT); // course category - can be changed in edit form
 
     require_login();
 
-    $mform =& new moodleform('edit_course', 'post', 'edit2.php');
-
-    $mform->acceptGet('id', 'category');
-
-    $id       = $mform->optional_param('id', 0, PARAM_INT); // course id
-    $category = $mform->optional_param('category', 0, PARAM_INT); // possible default category
-
-   
-    $disable_meta = false;
-    $focus = "";
-
-    if ($id) {
-        if (! $course = get_record("course", "id", $id)) {
-            error("Course ID was incorrect");
+/// basic access control checks
+    if ($id) { // editing course
+        if (!$course = get_record('course', 'id', $id)) {
+            error('Course ID was incorrect');
         }
+        $category = get_record('course_categories', 'id', $course->category);
+        require_capability('moodle/course:update', get_context_instance(CONTEXT_COURSE, $course->id));
 
-		$context = get_context_instance(CONTEXT_COURSE, $course->id);
-		
-        if (!has_capability('moodle/course:update', $context)) {
-            error("You do not currently have editing privileges!");
+    } else if ($categoryid) { // creating new course in this category
+        $course = null;
+        if (!$category = get_record('course_categories', 'id', $categoryid)) {
+            error('Category ID was incorrect');
         }
-        
-        if (course_in_meta($course)) {
-            $disable_meta = get_string('metaalreadyinmeta');
-        } else if ($course->metacourse) {
-            if (count_records("course_meta","parent_course",$course->id) > 0) {
-                $disable_meta = get_string('metaalreadyhascourses');
-            }
-        } else {
-            $managers = count(get_users_by_capability($context, 'moodle/course:managemetacourse'));
-            $participants = count(get_users_by_capability($context, 'moodle/course:view'));
-            if ($participants > $managers) {
-                $disable_meta = get_string('metaalreadyhasenrolments');
-            }
-        }
-    } else {  // Admin is creating a new course
-
-		$context = get_context_instance(CONTEXT_SYSTEM, SITEID);
-		if (!has_capability('moodle/course:create',$context)) {
-            error("You do not currently have course creation privileges!");
-        }
-
-        $course = NULL;
+        require_capability('moodle/course:create', get_context_instance(CONTEXT_COURSECAT, $category->id));
+    } else {
+        error('Either course id or category must be specified');
     }
 
-    if (! $site = get_site()) {
-        redirect("$CFG->wwwroot/$CFG->admin/index.php");
-    }
-
-
-
-    include("edit_form.php");
-            
-
-
-/// If data submitted, then process and store.
-// data_submitted tries to validate form data and returns false if 
-// the user inputted data is invalid and the form should be redisplayed with 
-// feedback.
-
-    if ($fromform=$mform->data_submitted()) {
-
-        
-        if (!empty($fromform->enrolstartdisabled)){
-            $fromform->enrolstartdate = 0;
-        }
-
-        if (!empty($fromform->enrolenddisabled)) {
-            $fromform->enrolenddate = 0;
-        }
+/// prepare course
+    if (!empty($course)) {
         $allowedmods = array();
-        if (!empty($fromform->allowedmods)) {
-            $allowedmods = $fromform->allowedmods;
-            unset($fromform->allowedmods);
-        }
-        
-        $fromform->timemodified = time();
-
-        if ($fromform->defaultrole == -1) {   // Just leave it however it is
-            unset($fromform->defaultrole);
-        }        
         if (!empty($course)) {
-            // Test for and remove blocks which aren't appropriate anymore
-            $page = page_create_object(PAGE_COURSE_VIEW, $course->id);
-            blocks_remove_inappropriate($page);
-
-            // Update with the new data
-            if (update_record('course', $fromform)) {
-                add_to_log($course->id, "course", "update", "edit.php?id=$id", "");
-                if (has_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
-                    $course->restrictmodules = $fromform->restrictmodules;
-                    update_restricted_mods($course,$allowedmods);
+            if ($am = get_records('course_allowed_modules','course',$course->id)) {
+                foreach ($am as $m) {
+                    $allowedmods[] = $m->module;
                 }
-                fix_course_sortorder();
-                // everything ok, no need to display any message in redirect
-                redirect("view.php?id=$course->id");
             } else {
-                error("Serious Error! Could not update the course record! (id = $fromform->id)");
+                if (empty($course->restrictmodules)) {
+                    $allowedmods = explode(',',$CFG->defaultallowedmodules);
+                } // it'll be greyed out but we want these by default anyway.
             }
-        } else {
-            $fromform->timecreated = time();
-
-            // place at beginning of category
-            fix_course_sortorder();
-            $fromform->sortorder = get_field_sql("SELECT min(sortorder)-1 FROM {$CFG->prefix}course WHERE category=$fromform->category");                
-            if (empty($fromform->sortorder)) {
-                $fromform->sortorder = 100;
+            $course->allowedmods = $allowedmods;
+    
+            if ($course->enrolstartdate){
+                $course->enrolstartdisabled = 0;
             }
-            // fill in default teacher and student names to keep backwards compatibility
-            $fromform->teacher = addslashes(get_string('defaultcourseteacher'));
-            $fromform->teachers = addslashes(get_string('defaultcourseteachers'));
-            $fromform->student = addslashes(get_string('defaultcoursestudent'));
-            $fromform->students = addslashes(get_string('defaultcoursestudents'));
-
-            if ($newcourseid = insert_record('course', $fromform)) {  // Set up new course
-                
-                // Setup the blocks
-                $page = page_create_object(PAGE_COURSE_VIEW, $newcourseid);
-                blocks_repopulate_page($page); // Return value not checked because you can always edit later
-
-                if (has_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
-                    $course = get_record("course","id",$newcourseid);
-                    update_restricted_mods($course,$allowedmods);
-                }
-
-                $section = NULL;
-                $section->course = $newcourseid;   // Create a default section.
-                $section->section = 0;
-                $section->id = insert_record("course_sections", $section);
-
-                fix_course_sortorder();
-                add_to_log(SITEID, "course", "new", "view.php?id=$newcourseid", "$fromform->fullname (ID $newcourseid)")        ;
-                $context = get_context_instance(CONTEXT_COURSE, $newcourseid);
-
-                if ($fromform->metacourse and has_capability('moodle/course:managemetacourse', $context)) { // Redirect users with metacourse capability to student import
-                        redirect($CFG->wwwroot."/course/importstudents.php?id=$newcourseid");
-
-                } else if (has_capability('moodle/role:assign', $context)) { // Redirect users with assign capability to assign users to different roles
-                    redirect($CFG->wwwroot."/$CFG->admin/roles/assign.php?contextid=$context->id");
-
-                } else {          // Add current teacher and send to course
-
-                    // find a role with legacy:edittingteacher
-                    if ($teacherroles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW, $context)) {
-                        // assign the role to this user
-                        $teachereditrole = array_shift($teacherroles);
-                        role_assign($teachereditrole->id, $USER->id, 0, $context->id);
-                    }
-                    
-                    redirect("view.php?id=$newcourseid");
-                }
-
-
-            } else {
-                error("Serious Error! Could not create the new course!");
+    
+            if ($course->enrolenddate) {
+                $course->enrolenddisabled = 0;
             }
         }
-        die;
     }
 
 
-//print the form
+/// first create the form
+    $editform = new course_edit_form('edit.php', compact('course', 'category'));
+    // now override defaults if course already exists
+    if (!empty($course)) {
+        $editform->set_data($course);
+    }
+    if ($editform->is_cancelled()){
+        if (empty($course)) {
+            redirect($CFG->wwwroot);
+        } else {
+            redirect($CFG->wwwroot.'/course/view.php?id='.$course->id);
+        }
+
+    } else if ($data = $editform->get_data()) {
+    
+/// process data if submitted
+
+        //preprocess data
+        if ($data->enrolstartdisabled){
+            $data->enrolstartdate = 0;
+        }
+
+        if ($data->enrolenddisabled) {
+            $data->enrolenddate = 0;
+        }
+
+        $data->timemodified = time();
+
+        if (empty($course)) {
+            if (!$course = create_course($data)) {
+                print_error('coursenotcreated');
+            }
+
+            $context = get_context_instance(CONTEXT_COURSE, $course->id);
+
+            // assign default role to creator if not already having permission to manage course assignments
+            if (!has_capability('moodle/course:view', $context) or !has_capability('moodle/role:assign', $context)) {
+                role_assign($CFG->creatornewroleid, $USER->id, 0, $context->id);
+            }        
+
+            if ($data->metacourse and has_capability('moodle/course:managemetacourse', $context)) {
+                // Redirect users with metacourse capability to student import
+                redirect($CFG->wwwroot."/course/importstudents.php?id=$course->id");
+            } else {
+                // Redirect to roles assignment
+                redirect($CFG->wwwroot."/$CFG->admin/roles/assign.php?contextid=$context->id");
+            }
+            
+        } else {
+            if (!update_course($data)) {
+                print_error('coursenotupdated');
+            }
+
+            redirect($CFG->wwwroot."/course/view.php?id=$course->id");
+        }
+    }
+
+
+/// Print the form
+
+    $site = get_site();
 
     $streditcoursesettings = get_string("editcoursesettings");
     $straddnewcourse = get_string("addnewcourse");
@@ -179,20 +124,19 @@
     $strcategories = get_string("categories");
 
     if (!empty($course)) {
-        print_header($streditcoursesettings, "$course->fullname",
+        print_header($streditcoursesettings, $course->fullname,
                      "<a href=\"$CFG->wwwroot/course/view.php?id=$course->id\">$course->shortname</a>
-                      -> $streditcoursesettings", $focus);
+                      -> $streditcoursesettings", $editform->focus());
     } else {
-        print_header("$site->shortname: $straddnewcourse", "$site->fullname",
-                     "<a href=\"../$CFG->admin/index.php\">$stradministration</a> -> ".
-                     "<a href=\"index.php\">$strcategories</a> -> $straddnewcourse", $focus);
+        print_header("$site->shortname: $straddnewcourse", $site->fullname,
+                     "<a href=\"$CFG->wwwroot/$CFG->admin/index.php\">$stradministration</a> -> ".
+                     "<a href=\"index.php\">$strcategories</a> -> $straddnewcourse", $editform->focus());
     }
 
-
     print_heading($streditcoursesettings);
 
-    $mform->display();
-    
+    $editform->display();
+
     print_footer($course);
 
 ?>

course/edit_form.php

@@ -1,392 +1,382 @@
-<?php
-/// For moodleform we reconstruct all the data about the form after submission before we
-/// extract data submitted. So we can then tell for select, checkbox and radio fields what
-/// options could have been submitted by the form eg submitted value for a single selection
-/// select field must be one of the options of the select field.
+<?php  //$Id$
 
-// $toform will be used for the default value of a field if no data has been submitted.
+require_once($CFG->libdir.'/formslib.php');
 
-    if (!empty($course)) {
-        //this is what we do if we are editing a record from the db
-        $toform = $course;
-        $toform->allowedmods = array();
-        if ($am = get_records("course_allowed_modules","course",$course->id)) {
-            foreach ($am as $m) {
-                $toform->allowedmods[] = $m->module;
+class course_edit_form extends moodleform {
+
+    function definition() {
+        global $USER, $CFG;
+
+        $mform    =& $this->_form;
+
+        $course   = $this->_customdata['course'];
+        $category = $this->_customdata['category'];
+
+        $systemcontext = get_context_instance(CONTEXT_SYSTEM);
+        $categorycontext = get_context_instance(CONTEXT_COURSECAT, $category->id);
+
+        $disable_meta = false; // basic meta course state protection; server-side security checks not needed
+
+        if (!empty($course)) {
+            $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
+            $context = $coursecontext;
+
+            if (course_in_meta($course)) {
+                $disable_meta = get_string('metaalreadyinmeta');
+
+            } else if ($course->metacourse) {
+                if (count_records('course_meta', 'parent_course', $course->id) > 0) {
+                    $disable_meta = get_string('metaalreadyhascourses');
+                }
+
+            } else {
+                $managers = count(get_users_by_capability($coursecontext, 'moodle/course:managemetacourse'));
+                $participants = count(get_users_by_capability($coursecontext, 'moodle/course:view'));
+                if ($participants > $managers) {
+                    $disable_meta = get_string('metaalreadyhasenrolments');
+                }
             }
         } else {
-            if (empty($course->restrictmodules)) {
-                $toform->allowedmods = explode(',',$CFG->defaultallowedmodules);
-            } // it'll be greyed out but we want these by default anyway.
-        }        
-    } else {
-        //this is a brand new course!
-        $toform->startdate = time() + 3600 * 24;
-        $toform->fullname = get_string("defaultcoursefullname");
-        $toform->shortname = get_string("defaultcourseshortname");
-        $toform->summary = get_string("defaultcoursesummary");
-        $toform->format = "weeks";
-        $toform->password = "";
-        $toform->guest = 0;
-        $toform->numsections = 10;
-        $toform->idnumber = '';
-        $toform->cost = '';
-        $toform->currency = empty($CFG->enrol_currency) ? 'USD' : $CFG->enrol_currency;
-        $toform->newsitems = 5;
-        $toform->showgrades = 1;
-        $toform->groupmode = 0;
-        $toform->groupmodeforce = 0;
-        $toform->category = $category;
-        $toform->id = "";
-        $toform->visible = 1;
-        $toform->allowedmods = array();
-        if ($CFG->restrictmodulesfor == 'all') {
-            $toform->allowedmods = explode(',',$CFG->defaultallowedmodules);
-            if (!empty($CFG->restrictbydefault)) {
-                $toform->restrictmodules = 1;
-            }
+            $coursecontext = null;
+            $context = $categorycontext;
         }
 
+/// form definition with new course defaults
+//--------------------------------------------------------------------------------
+        $mform->addElement('header','general', get_string('general', 'form'));
 
-    }
+        //must have create course capability in both categories in order to move course
+        if (has_capability('moodle/course:create', $categorycontext)) {
+            $displaylist = array();
+            $parentlist = array();
+            make_categories_list($displaylist, $parentlist);
+            foreach ($displaylist as $key=>$val) {
+                if (!has_capability('moodle/course:create', get_context_instance(CONTEXT_COURSECAT, $key))) {
+                    unset($displaylist[$key]);
+                }
+            }
+            $mform->addElement('select', 'category', get_string('category'), $displaylist);
+        } else {
+            $mform->addElement('hidden', 'category', null);
+        }
+        $mform->setHelpButton('category', array('coursecategory', get_string('category')));
+        $mform->setDefault('category', $category->id);
+        $mform->setType('category', PARAM_INT);
 
-    $mform->addElement('header','general', get_string("general"));
-    if (has_capability('moodle/course:create', get_context_instance(CONTEXT_COURSECAT, $toform->category))) { 
-        $displaylist = array();
-        $parentlist = array();
-        make_categories_list($displaylist, $parentlist);
-        $mform->addElement('select', "category", get_string("category"), $displaylist );
-    }
-    $mform->setDefault('fullname', $toform->fullname);
-    $mform->addElement('text','fullname', get_string("fullname"),'maxlength="254" size="50"');
-    $mform->setDefault('shortname', $toform->shortname);
-    $mform->addElement('text','shortname', get_string("shortname"),'maxlength="15" size="10"');
-    $mform->setDefault('idnumber', $toform->idnumber);
-    $mform->addElement('text','idnumber', get_string("idnumbercourse"),'maxlength="100"  size="10"');
-    $mform->setDefault('summary', $toform->summary);
-    $mform->addElement('htmleditor','summary', get_string("summary"), array('rows'=>'10', 'cols'=>'65'));
+        $mform->addElement('text','fullname', get_string('fullname'),'maxlength="254" size="50"');
+        $mform->setHelpButton('fullname', array('coursefullname', get_string('fullname')), true);
+        $mform->setDefault('fullname', get_string('defaultcoursefullname'));
+        $mform->addRule('fullname', get_string('missingfullname'), 'required', null, 'client');
+        $mform->setType('fullname', PARAM_MULTILANG);
 
-    $mform->setDefault('format', $toform->format);
-    $courseformats = get_list_of_plugins("course/format");
-    $formcourseformats = array();
+        $mform->addElement('text','shortname', get_string('shortname'),'maxlength="15" size="10"');
+        $mform->setHelpButton('shortname', array('courseshortname', get_string('shortname')), true);
+        $mform->setDefault('shortname', get_string('defaultcourseshortname'));
+        $mform->addRule('shortname', get_string('missingshortname'), 'required', null, 'client');
+        $mform->setType('shortname', PARAM_MULTILANG);
 
-    foreach ($courseformats as $courseformat) {
-        $formcourseformats["$courseformat"] = get_string("format$courseformat");
-    }
+        $mform->addElement('text','idnumber', get_string('idnumbercourse'),'maxlength="100"  size="10"');
+        $mform->setHelpButton('idnumber', array('courseidnumber', get_string('idnumbercourse')), true);
+        $mform->setType('idnumber', PARAM_RAW);
 
-    $mform->addElement('select', 'format', get_string("format"), $formcourseformats );
+        $mform->addElement('htmleditor','summary', get_string('summary'), array('rows'=> '10', 'cols'=>'65'));
+        $mform->setHelpButton('summary', array('text', get_string('helptext')), true);
+        $mform->setDefault('summary', get_string('defaultcoursesummary'));
+        $mform->addRule('summary', get_string('missingsummary'), 'required', null, 'client');
+        $mform->setType('summary', PARAM_RAW);
 
-    $mform->setDefault('numsections', $toform->numsections);
-    for ($i=1; $i<=52; $i++) {
-      $sectionmenu[$i] = "$i";
-    } 
-    $mform->addElement('select', 'numsections', get_string("numberweeks"), $sectionmenu);
-    $mform->setDefault('startdate', $toform->startdate);
-    $mform->addElement('date_selector', 'startdate', get_string('startdate'));
+        $courseformats = get_list_of_plugins('course/format');
+        $formcourseformats = array();
+        foreach ($courseformats as $courseformat) {
+            $formcourseformats["$courseformat"] = get_string("format$courseformat","format_$courseformat");
+            if($formcourseformats["$courseformat"]=="[[format$courseformat]]") {
+                $formcourseformats["$courseformat"] = get_string("format$courseformat");
+            }
+        }
+        $mform->addElement('select', 'format', get_string('format'), $formcourseformats);
+        $mform->setHelpButton('format', array('courseformats', get_string('courseformats')), true);
+        $mform->setDefault('format', 'weeks');
 
-    $mform->setDefault('hiddensections',(isset($toform->hiddensections))?$toform->hiddensections:0);
-    unset($choices);
-    $choices["0"] = get_string("hiddensectionscollapsed");
-    $choices["1"] = get_string("hiddensectionsinvisible");
-    $mform->addElement('select', 'hiddensections', get_string("hiddensections"), $choices);
+        for ($i=1; $i<=52; $i++) {
+          $sectionmenu[$i] = "$i";
+        }
+        $mform->addElement('select', 'numsections', get_string('numberweeks'), $sectionmenu);
+        $mform->setDefault('numsections', 10);
 
-    $mform->setDefault('newsitems', $toform->newsitems);
-    $newsitem = get_string("newsitem");
-    $newsitems = get_string("newsitems");
-    $options = array("0" => "0 $newsitems",
-                    "1" => "1 $newsitem",
-                    "2" => "2 $newsitems",
-                    "3" => "3 $newsitems",
-                    "4" => "4 $newsitems",
-                    "5" => "5 $newsitems",
-                    "6" => "6 $newsitems",
-                    "7" => "7 $newsitems",
-                    "8" => "8 $newsitems",
-                    "9" => "9 $newsitems",
-                    "10" => "10 $newsitems");
-    $mform->addElement('select', 'newsitems', get_string("newsitemsnumber"), $options);
+        $mform->addElement('date_selector', 'startdate', get_string('startdate'));
+        $mform->setHelpButton('startdate', array('coursestartdate', get_string('startdate')), true);
+        $mform->setDefault('startdate', time() + 3600 * 24);
 
-    $mform->setDefault('showgrades', $toform->showgrades);
-    unset($choices);
-    $choices["0"] = get_string("no");
-    $choices["1"] = get_string("yes");
-    $mform->addElement('select', 'showgrades', get_string("showgrades"), $choices);
-    unset($choices);
-    $mform->setDefault('showreports',(isset($toform->showreports))?$toform->showreports:0);
-    $choices["0"] = get_string("no");
-    $choices["1"] = get_string("yes");
-    $mform->addElement('select', 'showreports', get_string("showreports"), $choices);
-    $mform->setDefault('maxbytes',(isset($toform->maxbytes))?$toform->maxbytes:0);
-    $choices = get_max_upload_sizes($CFG->maxbytes);
-    $mform->addElement('select', 'maxbytes', get_string("maximumupload"), $choices);
-    if (!empty($CFG->allowcoursethemes)) {
-        $mform->setDefault('theme',(isset($toform->theme))?$toform->theme:'');
-       
-        $themes=array();
-        $themes[''] = get_string("forceno");
-        $themes += get_list_of_themes();
-        $mform->addElement('select', 'theme', get_string("forcetheme"), $themes);
-    }
-    unset($choices);
-    $mform->setDefault('metacourse',(isset($toform->metacourse))?$toform->metacourse:0);
+        $choices = array();
+        $choices['0'] = get_string('hiddensectionscollapsed');
+        $choices['1'] = get_string('hiddensectionsinvisible');
+        $mform->addElement('select', 'hiddensections', get_string('hiddensections'), $choices);
+        $mform->setHelpButton('hiddensections', array('coursehiddensections', get_string('hiddensections')), true);
+        $mform->setDefault('hiddensections', 0);
+
+        $options = range(0, 10);
+        $mform->addElement('select', 'newsitems', get_string('newsitemsnumber'), $options);
+        $mform->setHelpButton('newsitems', array('coursenewsitems', get_string('newsitemsnumber')), true);
+        $mform->setDefault('newsitems', 5);
+
+        $mform->addElement('selectyesno', 'showgrades', get_string('showgrades'));
+        $mform->setHelpButton('showgrades', array('coursegrades', get_string('grades')), true);
+        $mform->setDefault('showgrades', 1);
+
+        $mform->addElement('selectyesno', 'showreports', get_string('showreports'));
+        $mform->setHelpButton('showreports', array('coursereports', get_string('activityreport')), true);
+        $mform->setDefault('showreports', 0);
+
+        $choices = get_max_upload_sizes($CFG->maxbytes);
+        $mform->addElement('select', 'maxbytes', get_string('maximumupload'), $choices);
+        $mform->setHelpButton('maxbytes', array('courseuploadsize', get_string('maximumupload')), true);
+
+        if (!empty($CFG->allowcoursethemes)) {
+            $themes=array();
+            $themes[''] = get_string('forceno');
+            $themes += get_list_of_themes();
+            $mform->addElement('select', 'theme', get_string('forcetheme'), $themes);
+        }
 
-    if (empty($disable_meta)) {
         $meta=array();
         $meta[0] = get_string('no');
         $meta[1] = get_string('yes');
-        $mform->addElement('select', 'metacourse', get_string("managemeta"), $meta);
-    }else{
-        $mform->addElement('static', 'metacourse', get_string("managemeta"), 
-            ((empty($toform->metacourse)) ? get_string("no") : get_string("yes"))
-                . " - $disable_meta ");
-        
-    }
-    
-    $mform->setDefault('defaultrole',(isset($toform->defaultrole))?$toform->defaultrole:0);
-    $roles = get_assignable_roles($context);
-    asort($roles);
-    $choices = array();
-
-    if ($sitedefaultrole = get_record('role', 'id', $CFG->defaultcourseroleid)) {
-        $choices[0] = get_string('sitedefault').' ('.$sitedefaultrole->name.')';
-    } else {
-        $choices[0] = get_string('sitedefault');
-    }
-
-    $choices = $choices + $roles;    
-    $defaultroleelement=$mform->addElement('select', 'defaultrole', get_string('defaultrole', 'role'), $choices );
-    if ($mform->exportValue('defaultrole') && !isset($roles[$mform->exportValue('defaultrole')])) {  // Existing setting is one we can't choose
-        if ($coursedefaultrole = get_record('role', 'id', $mform->exportValue('defaultrole'))) {
-            
-            $defaultroleelement->addOption(get_string('currentrole', 'role').' ('.$coursedefaultrole->name.')',-1);
+        if ($disable_meta === false) {
+            $mform->addElement('select', 'metacourse', get_string('managemeta'), $meta);
+            $mform->setHelpButton('metacourse', array('metacourse', get_string('metacourse')), true);
+            $mform->setDefault('metacourse', 0);
         } else {
-            $defaultroleelement->addOption(get_string('currentrole', 'role'),-1);
+            // no metacourse element - we do not want to change it anyway!
+            $mform->addElement('static', 'nometacourse', get_string('managemeta'),
+                ((empty($course->metacourse)) ? $meta[0] : $meta[1]) . " - $disable_meta ");
+            $mform->setHelpButton('nometacourse', array('metacourse', get_string('metacourse')), true);
         }
-    }
-    
 
-    $mform->addElement('header','enrolhdr', get_string("enrolment"));
-    $mform->setDefault('enrol',(isset($toform->enrol))?$toform->enrol:'');
-       
-    $modules = explode(',', $CFG->enrol_plugins_enabled);
-    foreach ($modules as $module) {
-        $name = get_string("enrolname", "enrol_$module");
-        $plugin = enrolment_factory::factory($module);
-        if (method_exists($plugin, 'print_entry')) {
-            $choices[$name] = $module;
+        $roles = get_assignable_roles($context);
+        if (!empty($course)) {
+            // add current default role, so that it is selectable even when user can not assign it
+            if ($current_role = get_record('role', 'id', $course->defaultrole)) {
+                $roles[$current_role->id] = strip_tags(format_string($current_role->name, true));
+            }
         }
-    }
-    asort($choices);
-    $choices = array_flip($choices);
-    $choices = array_merge(array('' => get_string('sitedefault').' ('.get_string("enrolname", "enrol_$CFG->enrol").')'), $choices);
-    $mform->addElement('select', 'enrol', get_string("enrolmentplugins"), $choices );
-    
-    $mform->setDefault('enrollable',(isset($toform->enrollable))?$toform->enrollable:1);
-    $radio = array();
-    $radio[] = &moodleform::createElement('radio', 'enrollable', null, get_string("no"), 0);
-    $radio[] = &moodleform::createElement('radio', 'enrollable', null, get_string("yes"), 1);
-    $radio[] = &moodleform::createElement('radio', 'enrollable', null, get_string("enroldate"), 2);
-    $mform->addGroup($radio, 'enrollable', get_string("enrollable"), ' ', false);
-    
-    $mform->setDefault('enrolstartdate',(isset($toform->enrolstartdate))?$toform->enrolstartdate:0);
-    $mform->setDefault('enrolstartdisabled',
-                            (!isset($toform->enrolstartdate)||
-                                (isset($toform->enrolstartdate)&&!$toform->enrolstartdate)
-                            ?1:0));
-    $enroldatestartgrp = array();
-    $enroldatestartgrp[] = &moodleform::createElement('date_selector', 'enrolstartdate');
-    $enroldatestartgrp[] = &moodleform::createElement('checkbox', 'enrolstartdisabled', null, get_string('disable'));
-    $mform->addGroup($enroldatestartgrp, '', get_string('enrolstartdate'), ' ', false);
-    
-    $mform->setDefault('enrolenddate',(isset($toform->enrolenddate))?$toform->enrolenddate:0);
-    $mform->setDefault('enrolenddisabled',
-                            (!isset($toform->enrolenddate)||
-                                (isset($toform->enrolenddate)&&!$toform->enrolenddate)
-                            ?1:0));
-    $enroldateendgrp = array();
-    $enroldateendgrp[] = &moodleform::createElement('date_selector', 'enrolenddate');
-    $enroldateendgrp[] = &moodleform::createElement('checkbox', 'enrolenddisabled', null, get_string('disable'));
-    $mform->addGroup($enroldateendgrp, 'enroldateendgrp', get_string('enrolenddate'), ' ', false);
-    
-    $mform->setDefault('enrolperiod',(isset($toform->enrolperiod))?$toform->enrolperiod:0);
-    $periodmenu=array();
-    $periodmenu[0] = get_string('unlimited');
-    for ($i=1; $i<=365; $i++) {
-        $seconds = $i * 86400;
-        $periodmenu[$seconds] = get_string('numdays', '', $i);
-    }
-    $mform->addElement('select', 'enrolperiod', get_string("enrolperiod"), $periodmenu);
-    
-    
-    $mform->addElement('header','expirynotifyhdr', get_string("expirynotify"));
-    
-    $mform->setDefault('expirynotify',(isset($toform->expirynotify))?$toform->expirynotify:0);
-    unset($choices);
-    $choices["0"] = get_string("no");
-    $choices["1"] = get_string("yes");
-    $mform->addElement('select', 'expirynotify', get_string("expirynotify"), $choices);
-    $mform->setDefault('notifystudents',(isset($toform->notifystudents))?$toform->notifystudents:0);
-    $mform->addElement('select', 'notifystudents', get_string("expirynotifystudents"), $choices);
-    $mform->setDefault('expirythreshold',(isset($toform->expirythreshold))?$toform->expirythreshold:10 * 86400);
-    $thresholdmenu=array();
-    for ($i=1; $i<=30; $i++) {
-        $seconds = $i * 86400;
-        $thresholdmenu[$seconds] = get_string('numdays', '', $i);
-    }
-    $mform->addElement('select', 'expirythreshold', get_string("expirythreshold"), $thresholdmenu);
-    
-    
-    $mform->addElement('header','', get_string("groupmode"));
+        $choices = array();
+        if ($sitedefaultrole = get_record('role', 'id', $CFG->defaultcourseroleid)) {
+            $choices[0] = get_string('sitedefault').' ('.$sitedefaultrole->name.')';
+        } else {
+            $choices[0] = get_string('sitedefault');
+        }
+        $choices = $choices + $roles;
+        $mform->addElement('select', 'defaultrole', get_string('defaultrole', 'role'), $choices);
+        $mform->setDefault('defaultrole', 0);
 
-    $mform->setDefault('groupmode', $toform->groupmode);
-    unset($choices);
-    $choices[NOGROUPS] = get_string("groupsnone");
-    $choices[SEPARATEGROUPS] = get_string("groupsseparate");
-    $choices[VISIBLEGROUPS] = get_string("groupsvisible");
-    $mform->addElement('select', 'groupmode', get_string("groupmode"), $choices);
-    $mform->setDefault('groupmodeforce', $toform->groupmodeforce);
-    unset($choices);
-    $choices["0"] = get_string("no");
-    $choices["1"] = get_string("yes");
-    $mform->addElement('select', 'groupmodeforce', get_string("force"), $choices);
+//--------------------------------------------------------------------------------
+        $mform->addElement('header','enrolhdr', get_string('enrolments'));
 
-    $mform->addElement('header','', get_string("availability"));
+        $choices = array();
+        $modules = explode(',', $CFG->enrol_plugins_enabled);
+        foreach ($modules as $module) {
+            $name = get_string('enrolname', "enrol_$module");
+            $plugin = enrolment_factory::factory($module);
+            if (method_exists($plugin, 'print_entry')) {
+                $choices[$name] = $module;
+            }
+        }
+        asort($choices);
+        $choices = array_flip($choices);
+        $choices = array_merge(array('' => get_string('sitedefault').' ('.get_string('enrolname', "enrol_$CFG->enrol").')'), $choices);
+        $mform->addElement('select', 'enrol', get_string('enrolmentplugins'), $choices);
+        $mform->setHelpButton('enrol', array('courseenrolmentplugins', get_string('enrolmentplugins')), true);
 
-    $mform->setDefault('visible', $toform->visible);
-    unset($choices);
-    $choices["0"] = get_string("courseavailablenot");
-    $choices["1"] = get_string("courseavailable");
-    $mform->addElement('select', 'visible', get_string("availability"), $choices);
-    $mform->setDefault('password', $toform->password);
-    $mform->addElement('text', 'password', get_string("enrolmentkey"), 'size="25"');
-    $mform->setDefault('guest', $toform->guest);
-    unset($choices);
-    $choices["0"] = get_string("guestsno");
-    $choices["1"] = get_string("guestsyes");
-    $choices["2"] = get_string("guestskey");
-    $mform->addElement('select', 'guest', get_string("opentoguests"), $choices);
-    if (isset($course) && method_exists(enrolment_factory::factory($course->enrol), 'print_entry') && $course->enrol != 'manual') {
-        $mform->setDefault('cost', $toform->cost);
-        $mform->setDefault('currency', $toform->currency);
-        $costgroup=array();
-        $currencies = get_list_of_currencies();
-        $costgroup[]= &moodleform::createElement('text','cost', '', 'maxlength="6" size="6"');
-        $costgroup[]= &moodleform::createElement('select', 'currency', '', $currencies);
-        $mform->addGroup($costgroup, 'costgrp', get_string("cost"), '&nbsp;', false);
+        $radio = array();
+        $radio[] = &MoodleQuickForm::createElement('radio', 'enrollable', null, get_string('no'), 0);
+        $radio[] = &MoodleQuickForm::createElement('radio', 'enrollable', null, get_string('yes'), 1);
+        $radio[] = &MoodleQuickForm::createElement('radio', 'enrollable', null, get_string('enroldate'), 2);
+        $mform->addGroup($radio, 'enrollable', get_string('enrollable'), ' ', false);
+        $mform->setHelpButton('enrollable', array('courseenrollable', get_string('enrollable')), true);
+        $mform->setDefault('enrollable', 1);
+
+        $enroldatestartgrp = array();
+        $enroldatestartgrp[] = &MoodleQuickForm::createElement('date_selector', 'enrolstartdate');
+        $enroldatestartgrp[] = &MoodleQuickForm::createElement('checkbox', 'enrolstartdisabled', null, get_string('disable'));
+        $mform->addGroup($enroldatestartgrp, 'enrolstartdategrp', get_string('enrolstartdate'), ' ', false);
+        $mform->setDefault('enrolstartdate', 0);
+        $mform->setDefault('enrolstartdisabled', 1);
+        $mform->disabledIf('enrolstartdategrp', 'enrolstartdisabled', 'checked');
+
+        $enroldateendgrp = array();
+        $enroldateendgrp[] = &MoodleQuickForm::createElement('date_selector', 'enrolenddate');
+        $enroldateendgrp[] = &MoodleQuickForm::createElement('checkbox', 'enrolenddisabled', null, get_string('disable'));
+        $mform->addGroup($enroldateendgrp, 'enroldateendgrp', get_string('enrolenddate'), ' ', false);
+        $mform->setDefault('enrolenddate', 0);
+        $mform->setDefault('enrolenddisabled', 1);
+        $mform->disabledIf('enroldateendgrp', 'enrolenddisabled', 'checked');
+
+        $periodmenu=array();
+        $periodmenu[0] = get_string('unlimited');
+        for ($i=1; $i<=365; $i++) {
+            $seconds = $i * 86400;
+            $periodmenu[$seconds] = get_string('numdays', '', $i);
+        }
+        $mform->addElement('select', 'enrolperiod', get_string('enrolperiod'), $periodmenu);
+        $mform->setDefault('enrolperiod', 0);
+
+//--------------------------------------------------------------------------------
+        $mform->addElement('header','expirynotifyhdr', get_string('expirynotify'));
+
+        $choices = array();
+        $choices['0'] = get_string('no');
+        $choices['1'] = get_string('yes');
+        $mform->addElement('select', 'expirynotify', get_string('notify'), $choices);
+        $mform->setHelpButton('expirynotify', array('expirynotify', get_string('expirynotify')), true);
+        $mform->setDefault('expirynotify', 0);
+
+        $mform->addElement('select', 'notifystudents', get_string('expirynotifystudents'), $choices);
+        $mform->setHelpButton('notifystudents', array('expirynotifystudents', get_string('expirynotifystudents')), true);
+        $mform->setDefault('notifystudents', 0);
+
+        $thresholdmenu=array();
+        for ($i=1; $i<=30; $i++) {
+            $seconds = $i * 86400;
+            $thresholdmenu[$seconds] = get_string('numdays', '', $i);
+        }
+        $mform->addElement('select', 'expirythreshold', get_string('expirythreshold'), $thresholdmenu);
+        $mform->setHelpButton('expirythreshold', array('expirythreshold', get_string('expirythreshold')), true);
+        $mform->setDefault('expirythreshold', 10 * 86400);
+
+//--------------------------------------------------------------------------------
+        $mform->addElement('header','', get_string('groups', 'group'));
+
+        $choices = array();
+        $choices[NOGROUPS] = get_string('no');
+        $choices[SEPARATEGROUPS] = get_string('separate');
+        $choices[VISIBLEGROUPS] = get_string('visible');
+        $mform->addElement('select', 'groupmode', get_string('groupmode'), $choices);
+        $mform->setHelpButton('groupmode', array('groupmode', get_string('groupmode')), true);
+        $mform->setDefault('groupmode', 0);
+
+        $choices = array();
+        $choices['0'] = get_string('no');
+        $choices['1'] = get_string('yes');
+        $mform->addElement('select', 'groupmodeforce', get_string('force'), $choices);
+        $mform->setHelpButton('groupmodeforce', array('groupmodeforce', get_string('groupmodeforce')), true);
+        $mform->setDefault('groupmodeforce', 0);
+
+//--------------------------------------------------------------------------------
+        $mform->addElement('header','', get_string('availability'));
+
+        $choices = array();
+        $choices['0'] = get_string('courseavailablenot');
+        $choices['1'] = get_string('courseavailable');
+        $mform->addElement('select', 'visible', get_string('availability'), $choices);
+        $mform->setHelpButton('visible', array('courseavailability', get_string('availability')), true);
+        $mform->setDefault('visible', 1);
+
+        $mform->addElement('text', 'password', get_string('enrolmentkey'), 'size="25"');
+        $mform->setHelpButton('password', array('enrolmentkey', get_string('enrolmentkey')), true);
+        $mform->setDefault('password', '');
+        $mform->setType('password', PARAM_RAW);
+
+        $choices = array();
+        $choices['0'] = get_string('guestsno');
+        $choices['1'] = get_string('guestsyes');
+        $choices['2'] = get_string('guestskey');
+        $mform->addElement('select', 'guest', get_string('opentoguests'), $choices);
+        $mform->setHelpButton('guest', array('guestaccess', get_string('opentoguests')), true);
+        $mform->setDefault('guest', 0);
+
+        if (!empty($course) && method_exists(enrolment_factory::factory($course->enrol), 'print_entry') && $course->enrol != 'manual') {
+            $costgroup=array();
+            $currencies = get_list_of_currencies();
+            $costgroup[]= &MoodleQuickForm::createElement('text','cost', '', 'maxlength="6" size="6"');
+            $costgroup[]= &MoodleQuickForm::createElement('select', 'currency', '', $currencies);
+            $mform->addGroup($costgroup, 'costgrp', get_string('cost'), '&nbsp;', false);
+            //defining a rule for a form element within a group :
+            $costgrprules=array();
+            //set the message to null to tell Moodle to use a default message
+            //available for most rules, fetched from language pack (err_{rulename}).
+            $costgrprules['cost'][]=array(null, 'numeric', null, 'client');
+            $mform->addGroupRule('costgrp',$costgrprules);
+            $mform->setHelpButton('costgrp', array('cost', get_string('cost')), true);
+            $mform->setDefault('cost', '');
+            $mform->setDefault('currency', empty($CFG->enrol_currency) ? 'USD' : $CFG->enrol_currency);
+
+        }
+
+//--------------------------------------------------------------------------------
+        $mform->addElement('header','', get_string('language'));
+
+        $languages=array();
+        $languages[''] = get_string('forceno');
+        $languages += get_list_of_languages();
+        $mform->addElement('select', 'lang', get_string('forcelanguage'), $languages);
+
+//--------------------------------------------------------------------------------
+        if (has_capability('moodle/site:config', $systemcontext) && ((!empty($course->requested) && $CFG->restrictmodulesfor == 'requested') || $CFG->restrictmodulesfor == 'all')) {
+            $mform->addElement('header', '', get_string('restrictmodules'));
+
+            $options = array();
+            $options['0'] = get_string('no');
+            $options['1'] = get_string('yes');
+            $mform->addElement('select', 'restrictmodules', get_string('restrictmodules'), $options);
+            $mods = array(0=>get_string('allownone'));
+            $mods += get_records_menu('modules', '','','','id, name');
+
+
+            $mform->addElement('select', 'allowedmods', get_string('to'), $mods,
+                            array('multiple'=>'multiple', 'size'=>'10'));
+            $mform->disabledIf('allowedmods', 'restrictmodules', 'eq', 0);
+        } else {
+            $mform->addElement('hidden', 'restrictmodules', null);
+        }
+        if ($CFG->restrictmodulesfor == 'all') {
+            $mform->setDefault('allowedmods', explode(',',$CFG->defaultallowedmodules));
+            if (!empty($CFG->restrictbydefault)) {
+                $mform->setDefault('restrictmodules', 1);
+            }
+        }
+        $mform->setType('restrictmodules', PARAM_INT);
+
+//--------------------------------------------------------------------------------
+        $this->add_action_buttons();
+//--------------------------------------------------------------------------------
+        $mform->addElement('hidden', 'id', null);
+        $mform->setType('id', PARAM_INT);
+
+        // fill in default teacher and student names to keep backwards compatibility for a while
+        $mform->addElement('hidden', 'teacher', get_string('defaultcourseteacher'));
+        $mform->addElement('hidden', 'teachers', get_string('defaultcourseteachers'));
+        $mform->addElement('hidden', 'student', get_string('defaultcoursestudent'));
+        $mform->addElement('hidden', 'students', get_string('defaultcoursestudents'));
     }
 
-    $mform->addElement('header','', get_string("language"));
-    $mform->setDefault('lang',(isset($toform->lang))?$toform->lang:'');
-    $languages=array();
-    $languages[''] = get_string("forceno");
-    $languages += get_list_of_languages();
-    $mform->addElement('select', 'lang', get_string("forcelanguage"), $languages);
 
-    if(!has_capability('moodle/course:create', get_context_instance(CONTEXT_COURSECAT, $toform->category))) { 
-        $mform->addElement('hidden', 'category', null);
-    }
-    $mform->addElement('hidden', 'id', null);
-   
-    $mform->setDefault('restrictmodules',(isset($toform->restrictmodules))?$toform->restrictmodules:0);
-    if (has_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM, SITEID)) && ((!empty($course->requested) && $CFG->restrictmodulesfor == 'requested') || $CFG->restrictmodulesfor == 'all')) {         
-        unset($options);
-        $options[0] = get_string("no");
-        $options[1] = get_string("yes");
-        $mform->addElement('header', '', get_string("restrictmodules"));
-        $mform->addElement('select', 'restrictmodules', get_string("restrictmodules"), $options,
-                array('onChange'=>"document.getElementById('id_allowedmods').disabled=".
-                            "((this.selectedIndex==0)?true:false);"));
-        $mods = array(0=>get_string('allownone'));
-        $mods += get_records_menu("modules", '','','','id, name');
-        $disabled=($mform->exportValue('restrictmodules')==1) ? array() :array('disabled' => 'disabled') ;
-        
-        
-        $mform->setDefault('allowedmods', $toform->allowedmods);
-        $mform->addElement('select', 'allowedmods', get_string("to"),$mods,
-                        array('multiple'=>"multiple", 'size'=>"10", 'id'=>"allowedmods")
-                                +$disabled);
-    }else {
-        $mform->addElement('hidden', 'restrictmodules', $toform->restrictmodules);
-    }
-    $mform->setHelpButtons(array('category'=>array("coursecategory", get_string("category")),
-                             'fullname'=>array("coursefullname", get_string("fullname")),
-                             'shortname'=>array("courseshortname", get_string("shortname")),
-                             'idnumber'=>array("courseidnumber", get_string("idnumbercourse")),
-                             'summary'=>array("text", get_string("helptext")),
-                             'format'=>array("courseformats", get_string("courseformats")),
-                             'summary'=>array("coursestartdate", get_string("startdate")),
-                             'enrol'=>array("courseenrolmentplugins", get_string("enrolmentplugins")),
-                             'enrollable'=>array("courseenrollable", get_string("enrollable")),
-                             'expirynotify'=>array("expirynotify", get_string("expirynotify")),
-                             'notifystudents'=>array("expirynotifystudents", get_string("expirynotifystudents")),
-                             'expirythreshold'=>array("expirythreshold", get_string("expirythreshold")),
-                             'groupmode'=>array("groupmode", get_string("groupmode")),
-                             'groupmodeforce'=>array("groupmodeforce", get_string("groupmodeforce")),
-                             'visible'=>array("courseavailability", get_string("availability")),
-                             'password'=>array("enrolmentkey", get_string("enrolmentkey")),
-                             'guest'=>array("guestaccess", get_string("opentoguests")),
-                             'costgrp'=>array("cost", get_string("cost")),
-                             'hiddensections'=>array("coursehiddensections", get_string("hiddensections")),
-                             'newsitems'=>array("coursenewsitems", get_string("newsitemsnumber")),
-                             'showgrades'=>array("coursegrades", get_string("grades")),
-                             'showreports'=>array("coursereports", get_string("activityreport")),
-                             'maxbytes'=>array("courseuploadsize", get_string("maximumupload")),
-                             'metacourse'=>array("metacourse", get_string("metacourse")),
-                             'defaultrole'=>array("coursedefaultrole", get_string("defaultrole", 'role'))),
-                                    true);
-    $mform->addElement('submit', 'submit', get_string("savechanges"));
-    
-    $mform->addRule('fullname', get_string("missingfullname"), 'required', null, 'client');
-    $mform->addRule('shortname', get_string("missingshortname"), 'required', null, 'client');
-    $mform->addRule('summary', get_string("missingsummary"), 'required', null, 'client');
-    $mform->addRule('category', get_string("missingcategory"), 'required', null, 'client');
-    
-    /**
-     * a Form rule check - if we need to create rules which involve the contents of more than one 
-     * field this is the way to do it. We can do it all at once in one function or create several
-     * form rules.
-     *
-     * @param array $fields values from form without slashes
-     * @return mixed array of errors or true if passed check
-     */
-    function form_check($fields){
-        global $course;
+/// perform some extra moodle validation
+    function validation($data){
         $errors= array();
-        if ($foundcourses = get_records("course", "shortname", addslashes($fields['shortname']))) {
-            if (!empty($course->id)) {
-                unset($foundcourses[$course->id]);
+        if ($foundcourses = get_records('course', 'shortname', $data['shortname'])) {
+            if (!empty($data['id'])) {
+                unset($foundcourses[$data['id']]);
             }
             if (!empty($foundcourses)) {
                 foreach ($foundcourses as $foundcourse) {
                     $foundcoursenames[] = $foundcourse->fullname;
                 }
-                $foundcoursenamestring = addslashes(implode(',', $foundcoursenames));
-        
-                $errors['shortname']= get_string("shortnametaken", "", $foundcoursenamestring);
-                
-            }
-            
-            
-        }
-        if (empty($fields['enrolenddisabled'])){
-            $enrolenddate=make_timestamp($fields['enrolenddate']['year'],
-                                        $fields['enrolenddate']['month'],
-                                        $fields['enrolenddate']['day']);
-            $enrolstartdate=make_timestamp($fields['enrolstartdate']['year'],
-                                        $fields['enrolstartdate']['month'],
-                                        $fields['enrolstartdate']['day']);
-            if ($enrolenddate <= $enrolstartdate){
-                $errors['enroldateendgrp']=get_string("enrolenddaterror");
+                $foundcoursenamestring = implode(',', $foundcoursenames);
+                $errors['shortname']= get_string('shortnametaken', '', $foundcoursenamestring);
             }
         }
-        if (0==count($errors)){    
+
+        if (empty($data['enrolenddisabled'])){
+            if ($data['enrolenddate'] <= $data['enrolstartdate']){
+                $errors['enroldateendgrp'] = get_string('enrolenddaterror');
+            }
+        }
+
+        if (0 == count($errors)){
             return true;
-        }else {
+        } else {
             return $errors;
         }
     }
-    $mform->addFormRule('form_check');
-
-    $renderer =& $mform->defaultRenderer();
-    $renderer->addStopFieldsetElements('submit');
-?>
+}
+?>

course/enrol.php

@@ -8,12 +8,15 @@
     require_once("$CFG->dirroot/enrol/enrol.class.php");
 
     $id           = required_param('id', PARAM_INT);
-    $loginasguest = optional_param('loginasguest', 0, PARAM_BOOL);
+    $loginasguest = optional_param('loginasguest', 0, PARAM_BOOL); // hmm, is this still needed?
 
-    require_login();
-
-    if ($USER->username == 'guest') {                      // Guests can't enrol in anything!
-        redirect($CFG->wwwroot.'/login/index.php');
+    if (!isloggedin()) {
+        $wwwroot = $CFG->wwwroot;
+        if (!empty($CFG->loginhttps)) {
+            $wwwroot = str_replace('http:','https:', $wwwroot);
+        }
+        // do not use require_login here because we are usually comming from it 
+        redirect($wwwroot.'/login/index.php');
     }
 
     if (! $course = get_record('course', 'id', $id) ) {
@@ -24,9 +27,7 @@
         error("That's an invalid course id");
     }
 
-    if (! $enrol = enrolment_factory::factory($course->enrol)) {
-        error("Could not determine course enrolment method!");
-    }
+    $enrol = enrolment_factory::factory($course->enrol); // do not use if (!$enrol... here, it can not work in PHP4 - see MDL-7529 
 
 /// Refreshing all current role assignments for the current user
 
@@ -36,7 +37,7 @@
 /// thus got to this script by mistake.  This might occur if enrolments 
 /// changed during this session or something
 
-    if (has_capability('moodle/course:view', $context) and !has_capability('moodle/legacy:guest', $context)) {
+    if (has_capability('moodle/course:view', $context) and !has_capability('moodle/legacy:guest', $context, NULL, false)) {
         if ($SESSION->wantsurl) {
             $destination = $SESSION->wantsurl;
             unset($SESSION->wantsurl);

course/format/lams/format.php

@@ -238,17 +238,19 @@ while ($section <= $course->numsections) {
 
         $currenttopic = ($course->marker == $section);
 
+        $currenttext = '';
         if (!$thissection->visible) {
             $sectionstyle = ' hidden';
         } else if ($currenttopic) {
             $sectionstyle = ' current';
+            $currenttext = get_accesshide(get_string('currenttopic','access'));
         } else {
             $sectionstyle = '';
         }
 
         echo '<tr id="section-'.$section.'" class="section main'.$sectionstyle.'">';
 
-        echo '<td class="left side">&nbsp;</td>';
+        echo '<td class="left side">&nbsp;'.$currenttext.'</td>';
 
         echo '<td class="content">';
         if (!has_capability('moodle/course:viewhiddensections', $context) and !$thissection->visible) {   // Hidden for students

course/format/topics/format.php

@@ -171,16 +171,18 @@
 
             $currenttopic = ($course->marker == $section);
 
+            $currenttext = '';
             if (!$thissection->visible) {
                 $sectionstyle = ' hidden';
             } else if ($currenttopic) {
                 $sectionstyle = ' current';
+                $currenttext = get_accesshide(get_string('currenttopic','access'));
             } else {
                 $sectionstyle = '';
             }
 
             echo '<tr id="section-'.$section.'" class="section main'.$sectionstyle.'">';
-            echo '<td class="left side">'.$section.'</td>';
+            echo '<td class="left side">'.$currenttext.$section.'</td>';
 
             echo '<td class="content">';
             if (!has_capability('moodle/course:viewhiddensections', $context) and !$thissection->visible) {   // Hidden for students

course/format/weeks/format.php

@@ -13,9 +13,9 @@
     define('BLOCK_R_MIN_WIDTH', 100);
     define('BLOCK_R_MAX_WIDTH', 210);
 
-    $preferred_width_left  = bounded_number(BLOCK_L_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]),  
+    $preferred_width_left  = bounded_number(BLOCK_L_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]),
                                             BLOCK_L_MAX_WIDTH);
-    $preferred_width_right = bounded_number(BLOCK_R_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]), 
+    $preferred_width_right = bounded_number(BLOCK_R_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]),
                                             BLOCK_R_MAX_WIDTH);
 
     if ($week != -1) {
@@ -88,7 +88,7 @@
         echo '<tr id="section-0" class="section main">';
         echo '<td class="left side">&nbsp;</td>';
         echo '<td class="content">';
-        
+
         echo '<div class="summary">';
         $summaryformatoptions->noclean = true;
         echo format_text($thissection->summary, FORMAT_HTML, $summaryformatoptions);
@@ -99,7 +99,7 @@
                  'class="icon edit" alt="'.$streditsummary.'" /></a><br /><br />';
         }
         echo '</div>';
-        
+
         print_section($course, $thissection, $mods, $modnamesused);
 
         if (isediting($course->id)) {
@@ -162,26 +162,20 @@
 
             $currentweek = (($weekdate <= $timenow) && ($timenow < $nextweekdate));
 
+            $currenttext = '';
             if (!$thissection->visible) {
                 $sectionstyle = ' hidden';
             } else if ($currentweek) {
                 $sectionstyle = ' current';
+                $currenttext = get_accesshide(get_string('currentweek','access'));
             } else {
                 $sectionstyle = '';
             }
 
             echo '<tr id="section-'.$section.'" class="section main'.$sectionstyle.'">';
-            echo '<td class="left side">&nbsp;</td>';
+            echo '<td class="left side">&nbsp;'.$currenttext.'</td>';
 
-            if (!empty($USER->ajax) && $editing) {
-                // Temporarily hide the dates for the weeks. We do it this way
-                // for now. Eventually, we'll have to modify the javascript code
-                // to handle re-calculation of dates when sections are moved
-                // around. For now, just hide all the dates to avoid confusion.
-                $weekperiod = '';
-            } else {
-                $weekperiod = $weekday.' '.$endweekday;
-            }
+            $weekperiod = $weekday.' - '.$endweekday;
 
             echo '<td class="content">';
             if (!has_capability('moodle/course:viewhiddensections', $context) and !$thissection->visible) {   // Hidden for students
@@ -265,4 +259,4 @@
 
     echo '</tr></table>';
 
-?>
+?>

course/format/weekscss/format.php

@@ -190,10 +190,12 @@
 
             $currentweek = (($weekdate <= $timenow) && ($timenow < $nextweekdate));
 
+            $currenttext = '';
             if (!$thissection->visible) {
                 $sectionstyle = ' hidden';
             } else if ($currentweek) {
                 $sectionstyle = ' current';
+                $currenttext = get_accesshide(get_string('currentweek','access'));
             } else {
                 $sectionstyle = '';
             }
@@ -201,7 +203,7 @@
             echo '<li id="section-'.$section.'" class="section main'.$sectionstyle.'" >'; //'<div class="left side">&nbsp;</div>';
 
             // Note, 'right side' is BEFORE content.
-            echo '<div class="right side">';
+            echo '<div class="right side">'.$currenttext;
             
             if ($displaysection == $section) {
                 echo '<a href="view.php?id='.$course->id.'&amp;week=0#section-'.$section.'" title="'.$strshowallweeks.'">'.

course/import/groups/index.php

@@ -164,7 +164,7 @@
                     $newgrpcoursecontext = get_context_instance(CONTEXT_COURSE, $newgroup->courseid);
                     
                     ///Users cannot upload groups in courses they cannot update.
-                    if (has_capability('moodle/course:update', $newgrpcoursecontext)){
+                    if (!has_capability('moodle/course:managegroups', $newgrpcoursecontext)){
                         notify("$newgroup->name ".get_string('notaddedto').$newgroup->coursename.get_string('notinyourcapacity'));
                     }
                     
@@ -212,4 +212,3 @@ function my_file_get_contents($filename, $use_include_path = 0) {
 }
 
 ?>
-

course/importstudents.php

@@ -110,13 +110,12 @@
 
 /// If no search results then get potential students for this course excluding users already in course
     if (empty($searchcourses)) {
+        $numcourses = count_courses_notin_metacourse($course->id);
 
-        $numcourses = get_courses_notin_metacourse($course->id,true);
-
-        $courses = array();
-
-        if ($numcourses <= MAX_COURSES_PER_PAGE) {
+        if ($numcourses > 0 and $numcourses <= MAX_COURSES_PER_PAGE) {
             $courses = get_courses_notin_metacourse($course->id);
+        } else {
+            $courses = array();
         }
     }
 

course/index.php

@@ -60,11 +60,13 @@
         echo "<center>";
         
         /// I am not sure this context in the next has_capability call is correct. 
-        if (isloggedin() and !isguest() and !has_capability('moodle/course:create', get_context_instance(CONTEXT_SYSTEM, SITEID))) {  // Print link to request a new course
+        if (isloggedin() and !isguest() and !has_capability('moodle/course:create', get_context_instance(CONTEXT_SYSTEM, SITEID))  and $CFG->enablecourserequests) {  // Print link to request a new course
             print_single_button("request.php", NULL, get_string("courserequest"), "get");
         }
         if (has_capability('moodle/course:create', get_context_instance(CONTEXT_SYSTEM, SITEID))) {       // Print link to create a new course
-            print_single_button("edit.php", NULL, get_string("addnewcourse"), "get");
+        /// Get the 1st available category
+            $options = array('category' => get_field('course_categories', 'id', 'parent', '0'));
+            print_single_button('edit.php', $options, get_string('addnewcourse'), 'get');
         }
         if (has_capability('moodle/site:approvecourse', get_context_instance(CONTEXT_SYSTEM, SITEID))  and !empty($CFG->enablecourserequests)) {
             print_single_button('pending.php',NULL, get_string('coursespending'),"get");

course/info.php

@@ -43,28 +43,37 @@
     }
 
 
-    if ($teachers = get_course_teachers($course->id)) {
-        echo "<table align=\"center\"><tr><td nowrap=\"nowrap\">";
-        echo "<p><font size=\"1\">\n";
-        foreach ($teachers as $teacher) {
-            if ($teacher->authority > 0) {
-                if (!$teacher->role) {
-                    $teacher->role = $course->teacher;
+    /// first find all roles that are supposed to be displayed
+    if (!empty($CFG->coursemanager)) {
+        $coursemanagerroles = split(',', $CFG->coursemanager);
+        $context = get_context_instance(CONTEXT_COURSE, $course->id);
+        foreach ($coursemanagerroles as $roleid) {
+            $role = get_record('role','id',$roleid);
+            if ($users = get_role_users($roleid, $context, true, '', 'u.lastname ASC', true)) {
+                foreach ($users as $teacher) {
+                    $fullname = fullname($teacher, has_capability('moodle/site:viewfullnames', $context)); 
+                    $namesarray[] = format_string($role->name).': <a href="'.$CFG->wwwroot.'/user/view.php?id='.
+                                    $teacher->id.'&amp;course='.SITEID.'">'.$fullname.'</a>';
                 }
-                echo "$teacher->role: ";
-                link_to_popup_window ("/user/view.php?id=$teacher->id&amp;course=$site->id", "opener", 
-                                      fullname($teacher), 400, 500, "$teacher->role", 
-                                      "");
-                echo "<br />";
-            }
+            }          
+        }
+        
+        if (!empty($namesarray)) {
+            echo "<div align=\"center\">";
+            echo implode('<br />', $namesarray);
+            echo "</div>";
         }
-        echo "</font></p>";
-        echo "</td</tr></table>";
     }
+
     echo "<br />";
 
     print_simple_box_start("center", "100%");
     echo filter_text(text_to_html($course->summary),$course->id);
+
+    require_once("$CFG->dirroot/enrol/enrol.class.php");
+    $enrol = enrolment_factory::factory($course->enrol);
+    echo $enrol->get_access_icons($course);
+
     print_simple_box_end();
 
     echo "<br />";
@@ -72,4 +81,3 @@
     close_window_button();
 
 ?>
-

course/lib.php

@@ -417,7 +417,7 @@ function print_log($course, $user=0, $date=0, $order="l.time ASC", $page=0, $per
 
         $log->url  = strip_tags(urldecode($log->url));   // Some XSS protection
         $log->info = strip_tags(urldecode($log->info));  // Some XSS protection
-        $log->url  = str_replace('&', '&', $log->url); /// XHTML compatibility
+        $log->url  = s($log->url); /// XSS protection and XHTML compatibility - should be in link_to_popup_window() instead!!
 
         echo '<tr class="r'.$row.'">';
         if ($course->id == SITEID) {
@@ -509,7 +509,7 @@ function print_log_csv($course, $user, $date, $order='l.time DESC', $modname,
 
         $log->url  = strip_tags(urldecode($log->url));     // Some XSS protection
         $log->info = strip_tags(urldecode($log->info));    // Some XSS protection
-        $log->url  = str_replace('&', '&amp;', $log->url); // XHTML compatibility
+        $log->url  = str_replace('&', '&amp;', $log->url); /// XHTML compatibility
 
         $firstField = $courses[$log->course];
         $fullname = fullname($log, has_capability('moodle/site:viewfullnames', get_context_instance(CONTEXT_COURSE, $course->id)));
@@ -532,7 +532,8 @@ function print_log_xls($course, $user, $date, $order='l.time DESC', $modname,
                        $modname, $modid, $modaction, $groupid)) {
         return false;
     }
-    
+
+    $courses = array();
     if ($course->id == SITEID) {
         $courses[0] = '';
         if ($ccc = get_courses('all', 'c.id ASC', 'c.id,c.shortname')) {
@@ -540,6 +541,8 @@ function print_log_xls($course, $user, $date, $order='l.time DESC', $modname,
                 $courses[$cc->id] = $cc->shortname;
             }
         }
+    } else {
+        $courses[$course->id] = $course->shortname;
     }
     
     $count=0;
@@ -1027,15 +1030,13 @@ function get_all_sections($courseid) {
 function course_set_display($courseid, $display=0) {
     global $USER;
 
-    if (empty($USER->id)) {
-        return false;
-    }
-
     if ($display == "all" or empty($display)) {
         $display = 0;
     }
 
-    if (record_exists("course_display", "userid", $USER->id, "course", $courseid)) {
+    if (empty($USER->id) or $USER->username == 'guest') {
+        //do not store settings in db for guests
+    } else if (record_exists("course_display", "userid", $USER->id, "course", $courseid)) {
         set_field("course_display", "display", $display, "userid", $USER->id, "course", $courseid);
     } else {
         $record->userid = $USER->id;
@@ -1549,21 +1550,21 @@ function print_course($course, $width="100%") {
          $linkcss.' href="'.$CFG->wwwroot.'/course/view.php?id='.$course->id.'">'.
          $course->fullname.'</a></b><br />';
 
-    if ($teachers = get_users_by_capability($context, 'moodle/course:update', 
-                                            'u.*, ul.timeaccess as lastaccess, ra.hidden', 
-                                            'r.sortorder ASC', '','','','', false)) {
-        $canseehidden = has_capability('moodle/role:viewhiddenassigns', $context);
-        $namesarray = array();
-        foreach ($teachers as $teacher) {
-            if (!$teacher->hidden || $canseehidden) {
-                $roles = get_user_roles($context, $teacher->id);
-                $role = array_shift($roles);  // First one
-                $fullname = fullname($teacher, has_capability('moodle/site:viewfullnames', $context));
-                $namesarray[] = format_string($role->name).': <a href="'.$CFG->wwwroot.'/user/view.php?id='.
-                                  $teacher->id.'&amp;course='.SITEID.'">'.$fullname.'</a>';
-            }
+    /// first find all roles that are supposed to be displayed
+    if (!empty($CFG->coursemanager)) {
+        $coursemanagerroles = split(',', $CFG->coursemanager);
+        foreach ($coursemanagerroles as $roleid) {
+            $role = get_record('role','id',$roleid);
+            if ($users = get_role_users($roleid, $context, true, '', 'u.lastname ASC', true)) {
+                foreach ($users as $teacher) {
+                    $fullname = fullname($teacher, has_capability('moodle/site:viewfullnames', $context)); 
+                    $namesarray[] = format_string($role->name).': <a href="'.$CFG->wwwroot.'/user/view.php?id='.
+                                    $teacher->id.'&amp;course='.SITEID.'">'.$fullname.'</a>';
+                }
+            }          
         }
-        if ($namesarray) {
+        
+        if (!empty($namesarray)) {
             echo "<ul class=\"teachers\">\n<li>";
             echo implode('</li><li>', $namesarray);
             echo "</li></ul>";
@@ -1763,7 +1764,7 @@ function delete_course_module($id) {
     $modulename = get_field('modules', 'name', 'id', $cm->module);
     if ($events = get_records_select('event', "instance = '$cm->instance' AND modulename = '$modulename'")) {
         foreach($events as $event) {
-            delete_event($event);
+            delete_event($event->id);
         }
     }
     return delete_records('course_modules', 'id', $cm->id);
@@ -1882,16 +1883,16 @@ function make_editing_buttons($mod, $absolute=false, $moveselect=true, $indent=-
     static $sesskey;
 
     if (!isset($str)) {
-        $str->delete    = get_string("delete");
-        $str->move      = get_string("move");
-        $str->moveup    = get_string("moveup");
-        $str->movedown  = get_string("movedown");
-        $str->moveright = get_string("moveright");
-        $str->moveleft  = get_string("moveleft");
-        $str->update    = get_string("update");
-        $str->duplicate    = get_string("duplicate");
-        $str->hide      = get_string("hide");
-        $str->show      = get_string("show");
+        $str->delete         = get_string("delete");
+        $str->move           = get_string("move");
+        $str->moveup         = get_string("moveup");
+        $str->movedown       = get_string("movedown");
+        $str->moveright      = get_string("moveright");
+        $str->moveleft       = get_string("moveleft");
+        $str->update         = get_string("update");
+        $str->duplicate      = get_string("duplicate");
+        $str->hide           = get_string("hide");
+        $str->show           = get_string("show");
         $str->clicktochange  = get_string("clicktochange");
         $str->forcedmode     = get_string("forcedmode");
         $str->groupsnone     = get_string("groupsnone");
@@ -1913,32 +1914,35 @@ function make_editing_buttons($mod, $absolute=false, $moveselect=true, $indent=-
     }
 
     if ($mod->visible) {
-        $hideshow = '<a title="'.$str->hide.'" href="'.$path.'/mod.php?hide='.$mod->id.
+        $hideshow = '<a class="editing_hide" title="'.$str->hide.'" href="'.$path.'/mod.php?hide='.$mod->id.
                     '&amp;sesskey='.$sesskey.$section.'"><img'.
                     ' src="'.$CFG->pixpath.'/t/hide.gif" hspace="2" height="11" width="11" '.
-                    ' border="0" alt="'.$str->hide.'" /></a> ';
+                    ' border="0" alt="'.$str->hide.'" /></a>'."\n";
     } else {
-        $hideshow = '<a title="'.$str->show.'" href="'.$path.'/mod.php?show='.$mod->id.
+        $hideshow = '<a class="editing_show" title="'.$str->show.'" href="'.$path.'/mod.php?show='.$mod->id.
                     '&amp;sesskey='.$sesskey.$section.'"><img'.
                     ' src="'.$CFG->pixpath.'/t/show.gif" hspace="2" height="11" width="11" '.
-                    ' border="0" alt="'.$str->show.'" /></a> ';
+                    ' border="0" alt="'.$str->show.'" /></a>'."\n";
     }
     if ($mod->groupmode !== false) {
         if ($mod->groupmode == SEPARATEGROUPS) {
             $grouptitle = $str->groupsseparate;
+            $groupclass = 'editing_groupseparate';
             $groupimage = $CFG->pixpath.'/t/groups.gif';
             $grouplink  = $path.'/mod.php?id='.$mod->id.'&amp;groupmode=0&amp;sesskey='.$sesskey;
         } else if ($mod->groupmode == VISIBLEGROUPS) {
             $grouptitle = $str->groupsvisible;
+            $groupclass = 'editing_groupvisible';
             $groupimage = $CFG->pixpath.'/t/groupv.gif';
             $grouplink  = $path.'/mod.php?id='.$mod->id.'&amp;groupmode=1&amp;sesskey='.$sesskey;
         } else {
             $grouptitle = $str->groupsnone;
+            $groupclass = 'editing_groupsnone';
             $groupimage = $CFG->pixpath.'/t/groupn.gif';
             $grouplink  = $path.'/mod.php?id='.$mod->id.'&amp;groupmode=2&amp;sesskey='.$sesskey;
         }
         if ($mod->groupmodelink) {
-            $groupmode = '<a title="'.$grouptitle.' ('.$str->clicktochange.')" href="'.$grouplink.'">'.
+            $groupmode = '<a class="'.$groupclass.'" title="'.$grouptitle.' ('.$str->clicktochange.')" href="'.$grouplink.'">'.
                          '<img src="'.$groupimage.'" hspace="2" height="11" width="11" '.
                          'border="0" alt="'.$grouptitle.'" /></a>';
         } else {
@@ -1951,44 +1955,44 @@ function make_editing_buttons($mod, $absolute=false, $moveselect=true, $indent=-
     }
 
     if ($moveselect) {
-        $move =     '<a title="'.$str->move.'" href="'.$path.'/mod.php?copy='.$mod->id.
+        $move =     '<a class="editing_move" title="'.$str->move.'" href="'.$path.'/mod.php?copy='.$mod->id.
                     '&amp;sesskey='.$sesskey.$section.'"><img'.
                     ' src="'.$CFG->pixpath.'/t/move.gif" hspace="2" height="11" width="11" '.
-                    ' border="0" alt="'.$str->move.'" /></a>';
+                    ' border="0" alt="'.$str->move.'" /></a>'."\n";
     } else {
-        $move =     '<a title="'.$str->moveup.'" href="'.$path.'/mod.php?id='.$mod->id.
+        $move =     '<a class="editing_moveup" title="'.$str->moveup.'" href="'.$path.'/mod.php?id='.$mod->id.
                     '&amp;move=-1&amp;sesskey='.$sesskey.$section.'"><img'.
                     ' src="'.$CFG->pixpath.'/t/up.gif" hspace="2" height="11" width="11" '.
-                    ' border="0" alt="'.$str->moveup.'" /></a>'.
-                    '<a title="'.$str->movedown.'" href="'.$path.'/mod.php?id='.$mod->id.
+                    ' border="0" alt="'.$str->moveup.'" /></a>'."\n".
+                    '<a class="editing_movedown" title="'.$str->movedown.'" href="'.$path.'/mod.php?id='.$mod->id.
                     '&amp;move=1&amp;sesskey='.$sesskey.$section.'"><img'.
                     ' src="'.$CFG->pixpath.'/t/down.gif" hspace="2" height="11" width="11" '.
-                    ' border="0" alt="'.$str->movedown.'" /></a>';
+                    ' border="0" alt="'.$str->movedown.'" /></a>'."\n";
     }
 
     $leftright = "";
     if ($indent > 0) {
-        $leftright .= '<a title="'.$str->moveleft.'" href="'.$path.'/mod.php?id='.$mod->id.
+        $leftright .= '<a class="editing_moveleft" title="'.$str->moveleft.'" href="'.$path.'/mod.php?id='.$mod->id.
                       '&amp;indent=-1&amp;sesskey='.$sesskey.$section.'"><img'.
                       ' src="'.$CFG->pixpath.'/t/left.gif" hspace="2" height="11" width="11" '.
-                      ' border="0" alt="'.$str->moveleft.'" /></a>';
+                      ' border="0" alt="'.$str->moveleft.'" /></a>'."\n";
     }
     if ($indent >= 0) {
-        $leftright .= '<a title="'.$str->moveright.'" href="'.$path.'/mod.php?id='.$mod->id.
+        $leftright .= '<a class="editing_moveright" title="'.$str->moveright.'" href="'.$path.'/mod.php?id='.$mod->id.
                       '&amp;indent=1&amp;sesskey='.$sesskey.$section.'"><img'.
                       ' src="'.$CFG->pixpath.'/t/right.gif" hspace="2" height="11" width="11" '.
-                      ' border="0" alt="'.$str->moveright.'" /></a>';
+                      ' border="0" alt="'.$str->moveright.'" /></a>'."\n";
     }
 
-    return '<span class="commands">'.$leftright.$move.
-           '<a title="'.$str->update.'" href="'.$path.'/mod.php?update='.$mod->id.
+    return '<span class="commands">'."\n".$leftright.$move.
+           '<a class="editing_update" title="'.$str->update.'" href="'.$path.'/mod.php?update='.$mod->id.
            '&amp;sesskey='.$sesskey.$section.'"><img'.
            ' src="'.$CFG->pixpath.'/t/edit.gif" hspace="2" height="11" width="11" border="0" '.
-           ' alt="'.$str->update.'" /></a>'.
-           '<a title="'.$str->delete.'" href="'.$path.'/mod.php?delete='.$mod->id.
+           ' alt="'.$str->update.'" /></a>'."\n".
+           '<a class="editing_delete" title="'.$str->delete.'" href="'.$path.'/mod.php?delete='.$mod->id.
            '&amp;sesskey='.$sesskey.$section.'"><img'.
            ' src="'.$CFG->pixpath.'/t/delete.gif" hspace="2" height="11" width="11" border="0" '.
-           ' alt="'.$str->delete.'" /></a>'.$hideshow.$groupmode.'</span>';
+           ' alt="'.$str->delete.'" /></a>'."\n".$hideshow.$groupmode."\n".'</span>';
 }
 
 /**
@@ -2189,4 +2193,36 @@ function move_courses ($courseids, $categoryid) {
     return true;
 }
 
+
+/**
+ * Can the current user delete this course?
+ * @param int $courseid
+ * @return boolean
+ *
+ * Exception here to fix MDL-7796.
+ *
+ * FIXME
+ *   Course creators who can manage activities in the course
+ *   shoule be allowed to delete the course. We do it this
+ *   way because we need a quick fix to bring the functionality
+ *   in line with what we had pre-roles. We can't give the
+ *   default course creator role moodle/course:delete at
+ *   CONTEXT_SYSTEM level because this will allow them to
+ *   delete any course in the site. So we hard code this here
+ *   for now.
+ *
+ * @author vyshane AT gmail.com
+ */
+function can_delete_course($courseid) {
+
+    $context = get_context_instance(CONTEXT_COURSE, $courseid);
+
+    return ( has_capability('moodle/course:delete', $context)
+             || (has_capability('moodle/legacy:coursecreator', $context)
+             && has_capability('moodle/course:manageactivities', $context)) );
+}
+
+
+
+
 ?>

course/loginas.php

@@ -53,6 +53,9 @@
         if (!has_capability('moodle/course:view', $context, $userid, false)) {
             error('This user is not in this course!');
         }
+        if (has_capability('moodle/site:doanything', $context, $userid, false)) {
+            print_error('nologinas');
+        }
     }
 
 /// User must have permissions

course/mod.php

@@ -3,7 +3,7 @@
 //  Moves, adds, updates, duplicates or deletes modules in a course
 
     require("../config.php");
-    require("lib.php");
+    require_once("lib.php");
 
     require_login();
 

course/report/outline/index.php

@@ -126,4 +126,3 @@ function print_outline_row($mod, $instance, $result) {
 }
 
 ?>
-

course/report/stats/graph.php

@@ -73,17 +73,17 @@
                 $graph->y_data['line3'][] = $stat->line3;
             }
         }
-        $graph->y_order = array('line1','line2');
-        if (!empty($param->line3)) {
-            $graph->y_order[] = 'line3';
-        }
+        $graph->y_order = array('line1');
         $graph->y_format['line1'] = array('colour' => $c[1],'line' => 'line','legend' => $param->line1);
         if (!empty($param->line2)) {
+            $graph->y_order[] = 'line2';
             $graph->y_format['line2'] = array('colour' => $c[2],'line' => 'line','legend' => $param->line2); 
         }
         if (!empty($param->line3)) {
+            $graph->y_order[] = 'line3';
             $graph->y_format['line3'] = array('colour' => $c[3],'line' => 'line','legend' => $param->line3); 
         }
+        $graph->y_tick_labels = false;
     } else {
         $data = array();
         $times = array();
@@ -103,6 +103,16 @@
                 $times[$stat->timeend] = userdate($stat->timeend,get_string('strftimedate'),$CFG->timezone);
             }
         }
+        foreach (array_keys($times) as $t) {
+            foreach ($data as $roleid => $stuff) {
+                if (!array_key_exists($t, $stuff)) {
+                    $data[$roleid][$t] = 0;
+                }
+            }
+        }
+        foreach ($data as $role => $stuff) {
+            ksort($data[$role]);
+        }
         $nonzeroroleid = 0;
         foreach (array_keys($data) as $roleid) {
             if ($roleid == 0) {

course/report/stats/report.php

@@ -167,6 +167,13 @@
                             $rolesdata[$roleid] = 0;
                         }
                     }
+                    else {
+                        foreach (array_keys($roles) as $r) {
+                            if (!array_key_exists($r, $rolesdata)) {
+                                $rolesdata[$r] = 0;
+                            }
+                        }
+                    }
                     krsort($rolesdata); 
                     $row = array_merge(array($times[$time]),$rolesdata);
                     if (empty($CFG->loglifetime) || ($stat->timeend-(60*60*24)) >= (time()-60*60*24*$CFG->loglifetime)) {

course/rest.php

@@ -6,11 +6,10 @@ require_once($CFG->dirroot.'/course/lib.php');
 require_once($CFG->libdir .'/pagelib.php');
 require_once($CFG->libdir .'/blocklib.php');
 
+
 // Initialise ALL the incoming parameters here, up front.
-
-$courseid = required_param('courseId', PARAM_INT);
-$class    = required_param('class', PARAM_ALPHA);
-
+$courseid   = required_param('courseId', PARAM_INT);
+$class      = required_param('class', PARAM_ALPHA);
 $field      = optional_param('field', '', PARAM_ALPHA);
 $instanceid = optional_param('instanceId', 0, PARAM_INT);
 $sectionid  = optional_param('sectionId', 0, PARAM_INT);
@@ -22,46 +21,51 @@ $summary    = optional_param('summary', '', PARAM_RAW);
 $sequence   = optional_param('sequence', '', PARAM_SEQUENCE);
 $visible    = optional_param('visible', 0, PARAM_INT);
 
-// Authorise the user and verify some incoming data
 
+// Authorise the user and verify some incoming data
 if (!$course = get_record('course', 'id', $courseid)) {
     error_log('AJAX commands.php: Course does not exist');
     die;
 }
 
 $PAGE = page_create_object(PAGE_COURSE_VIEW, $course->id);
-$pageblocks = blocks_setup($PAGE,BLOCKS_PINNED_BOTH);
+$pageblocks = blocks_setup($PAGE, BLOCKS_PINNED_BOTH);
+
 if (!empty($instanceid)) {
     $blockinstance = blocks_find_instance($instanceid, $pageblocks);
-    if (!$blockinstance || $blockinstance->pageid != $course->id || $blockinstance->pagetype != 'course-view') {
+    if (!$blockinstance || $blockinstance->pageid != $course->id
+                        || $blockinstance->pagetype != 'course-view') {
         error_log('AJAX commands.php: Bad block ID '.$instanceid);
         die;
     }
 }
 
 $context = get_context_instance(CONTEXT_COURSE, $course->id);
-
 require_login($course->id);
 require_capability('moodle/course:update', $context);
 
-// OK, now let's process the parameters and do stuff
 
+
+// OK, now let's process the parameters and do stuff
 switch($_SERVER['REQUEST_METHOD']) {
     case 'POST':
+
         switch ($class) {
-            case 'block':                  
-            switch ($field) {
-                case 'visible':   
-                    blocks_execute_action($PAGE, $pageblocks, 'toggle', $blockinstance);
-                    break;
-     
-                case 'position':  
-                    //while not entirely restful this will handle all the details of moving a block                    
-                    blocks_execute_repositioning_atomic($blockinstance, $column, $value);                    
-                    break;
-            }
-            break;
- 
+            case 'block':
+
+                switch ($field) {
+                    case 'visible':   
+                        blocks_execute_action($PAGE, $pageblocks, 'toggle', $blockinstance);
+                        break;
+
+                    case 'position':  // Misleading case. Should probably call it 'move'.
+                        // We want to move the block around. This means changing
+                        // the column (position field) and/or block sort order
+                        // (weight field).
+                        blocks_move_block($PAGE, $blockinstance, $column, $value);
+                        break;
+                }
+                break;
 
             case 'section':
  
@@ -95,6 +99,18 @@ switch($_SERVER['REQUEST_METHOD']) {
                         set_coursemodule_groupmode($mod->id, $value);
                         break;
 
+                    case 'indentleft':
+                        if ($mod->indent > 0) {
+                            $mod->indent--;
+                            update_record('course_modules', $mod);
+                        }
+                        break;
+
+                    case 'indentright':
+                        $mod->indent++;
+                        update_record('course_modules', $mod);
+                        break;
+
                     case 'move':
                         if (!$section = get_record('course_sections','course',$course->id,'section',$sectionid)) {
                             error_log('AJAX commands.php: Bad section ID '.$sectionid);

course/search.php

@@ -163,14 +163,25 @@
             echo "<th>$strcategory</th>";
             echo "<th>$strselect</th>";
             echo "<th>$stredit</th>";
-            foreach ($courses as $course) {
+            foreach ($courses as $course) {    		    
+                
+                $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
+                
                 $course->fullname = highlight("$search", $course->fullname);
                 $linkcss = $course->visible ? "" : " class=\"dimmed\" ";
                 echo "<tr>";
                 echo "<td><a $linkcss href=\"view.php?id=$course->id\">$course->fullname</a></td>";
                 echo "<td>".$displaylist[$course->category]."</td>";
                 echo "<td align=\"center\">";
-                echo "<input type=\"checkbox\" name=\"c$course->id\">";
+                
+                // this is ok since this will get inherited from course category context
+                // if it is set
+                if (has_capability('moodle/category:update', $coursecontext)) {
+                    echo "<input type=\"checkbox\" name=\"c$course->id\">";
+                } else {
+                    echo "<input type=\"checkbox\" name=\"c$course->id\" disabled=\"disabled\">";
+                }
+                
                 echo "</td>";
                 echo "<td>";
                 if (empty($THEME->custompix)) {
@@ -178,25 +189,48 @@
                 } else {
                     $pixpath = "$CFG->themedir/$CFG->theme/pix";
                 }
-                echo "<a title=\"".get_string("settings")."\" href=\"$CFG->wwwroot/course/edit.php?id=$course->id\"><img".
-                    " src=\"$pixpath/t/edit.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
-                echo "<a title=\"".get_string("assignteachers")."\" href=\"$CFG->wwwroot/course/teacher.php?id=$course->id\"><img".
-                    " src=\"$pixpath/t/user.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
-                echo "<a title=\"".get_string("delete")."\" href=\"delete.php?id=$course->id\"><img".
-                    " src=\"$pixpath/t/delete.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
-                if (!empty($course->visible)) {
-                    echo "<a title=\"".get_string("hide")."\" href=\"search.php?search=$encodedsearch&amp;perpage=$perpage&amp;page=$page&amp;hide=$course->id&amp;sesskey=$USER->sesskey\"><img".
-                        " src=\"$pixpath/t/hide.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
-                } else {
-                    echo "<a title=\"".get_string("show")."\" href=\"search.php?search=$encodedsearch&amp;perpage=$perpage&amp;page=$page&amp;show=$course->id&amp;sesskey=$USER->sesskey\"><img".
-                        " src=\"$pixpath/t/show.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
+                
+                // checks whether user can update course settings
+                if (has_capability('moodle/course:update', $coursecontext)) {
+                    echo "<a title=\"".get_string("settings")."\" href=\"$CFG->wwwroot/course/edit.php?id=$course->id\"><img".
+                        " src=\"$pixpath/t/edit.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
+                }
+
+                // checks whether user can do role assignment
+    		    if (has_capability('moodle/role:assign', $coursecontext)) {
+                    echo'<a title="'.get_string('assignroles', 'role').'" href="'.$CFG->wwwroot.'/'.$CFG->admin.'/roles/assign.php?contextid='.$coursecontext->id.'">';
+    		        echo '<img src="'.$CFG->pixpath.'/i/roles.gif" height="11" width="11" alt="'.get_string('assignroles', 'role').'" /></a>';
+    		    }                
+
+                // checks whether user can delete course
+                if (has_capability('moodle/course:delete', $coursecontext)) {  
+                    echo "<a title=\"".get_string("delete")."\" href=\"delete.php?id=$course->id\"><img".
+                        " src=\"$pixpath/t/delete.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
+                }  
+
+                // checks whether user can change visibility
+                if (has_capability('moodle/course:visibility', $coursecontext)) {
+                    if (!empty($course->visible)) {
+                        echo "<a title=\"".get_string("hide")."\" href=\"search.php?search=$encodedsearch&amp;perpage=$perpage&amp;page=$page&amp;hide=$course->id&amp;sesskey=$USER->sesskey\"><img".
+                            " src=\"$pixpath/t/hide.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
+                    } else {
+                        echo "<a title=\"".get_string("show")."\" href=\"search.php?search=$encodedsearch&amp;perpage=$perpage&amp;page=$page&amp;show=$course->id&amp;sesskey=$USER->sesskey\"><img".
+                            " src=\"$pixpath/t/show.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
+                    }
+                }              
+
+                // checks whether user can do site backup
+                if (has_capability('moodle/site:backup', $coursecontext)) {
+                    echo "<a title=\"".get_string("backup")."\" href=\"../backup/backup.php?id=$course->id\"><img".
+                        " src=\"$pixpath/t/backup.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
                 }
                 
-                echo "<a title=\"".get_string("backup")."\" href=\"../backup/backup.php?id=$course->id\"><img".
-                    " src=\"$pixpath/t/backup.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
-                
-                echo "<a title=\"".get_string("restore")."\" href=\"../files/index.php?id=$course->id&wdir=/backupdata\"><img".
-                    " src=\"$pixpath/t/restore.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
+                // checks whether user can do restore
+                if (has_capability('moodle/site:restore', $coursecontext)) {
+                    echo "<a title=\"".get_string("restore")."\" href=\"../files/index.php?id=$course->id&wdir=/backupdata\"><img".
+                        " src=\"$pixpath/t/restore.gif\" height=\"11\" width=\"11\" border=\"0\"></a> ";
+                }
+
                 echo "</td></tr>";
             }
             echo "<tr><td colspan=\"4\" align=\"center\">";
@@ -213,7 +247,7 @@
 
         if ($perpage != 99999 && $totalcount > $perpage) {
             echo "<center><p>";
-            echo "<a href=\"search.php?search=$encoededsearch&perpage=99999\">".get_string("showall", "", $totalcount)."</a>";
+            echo "<a href=\"search.php?search=$encodedsearch&perpage=99999\">".get_string("showall", "", $totalcount)."</a>";
             echo "</p></center>";
         }
 
@@ -229,4 +263,3 @@
 
 
 ?>
-

course/user.php

@@ -285,4 +285,3 @@ function print_outline_row($mod, $instance, $result) {
 }
 
 ?>
-

enrol/authorize/authorizenetlib.php

@@ -97,21 +97,22 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE, $
     static $conststring;
 
     if (!isset($conststring)) {
+        $mconfig = get_config('enrol/authorize');
         $constdata = array(
              'x_version'         => '3.1',
              'x_delim_data'      => 'True',
              'x_delim_char'      => AN_DELIM,
              'x_encap_char'      => AN_ENCAP,
              'x_relay_response'  => 'FALSE',
-             'x_login'           => $CFG->an_login
+             'x_login'           => rc4decrypt($mconfig->an_login)
         );
         $str = '';
         foreach($constdata as $ky => $vl) {
             $str .= $ky . '=' . urlencode($vl) . '&';
         }
-        $str .= (!empty($CFG->an_tran_key)) ?
-                'x_tran_key=' . urlencode($CFG->an_tran_key):
-                'x_password=' . urlencode($CFG->an_password);
+        $str .= (!empty($mconfig->an_tran_key)) ?
+                'x_tran_key=' . urlencode(rc4decrypt($mconfig->an_tran_key)):
+                'x_password=' . urlencode(rc4decrypt($mconfig->an_password));
 
         $conststring = $str;
         $str = '';
@@ -133,17 +134,12 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE, $
 
     $action = intval($action);
     if ($method == AN_METHOD_ECHECK) {
-        if ($action != AN_ACTION_AUTH_CAPTURE /*&& $action != AN_ACTION_CREDIT*/) {
-            $message = "Please perform only AUTH_CAPTURE for echecks";
+        if ($action != AN_ACTION_AUTH_CAPTURE && $action != AN_ACTION_CREDIT) {
+            $message = "Please perform AUTH_CAPTURE or CREDIT for echecks";
             return AN_RETURNZERO;
         }
     }
 
-    if ($action <= AN_ACTION_NONE or $action > AN_ACTION_VOID) {
-        $message = "Invalid action!";
-        return AN_RETURNZERO;
-    }
-
     $poststring = $conststring;
     $poststring .= '&x_method=' . $method;
 
@@ -222,7 +218,11 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE, $
             $poststring .= '&x_invoice_num=' . urlencode($extra->orderid);
             $poststring .= '&x_amount=' . urlencode($extra->amount);
             if ($method == AN_METHOD_CC) {
-                $poststring .= '&x_card_num=' . sprintf("%04d", intval($order->cclastfour));
+                $poststring .= '&x_card_num=' . sprintf("%04d", intval($order->refundinfo));
+            }
+            elseif ($method == AN_METHOD_ECHECK && empty($order->refundinfo)) {
+                $message = "Business checkings can be refunded only.";
+                return AN_RETURNZERO;
             }
             break;
         }
@@ -248,6 +248,7 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE, $
         $referer = "Referer: $CFG->an_referer\r\n";
     }
 
+    $errno = 0; $errstr = '';
     $host = $test ? 'certification.authorize.net' : 'secure.authorize.net';
     $fp = fsockopen("ssl://$host", 443, $errno, $errstr, 60);
     if (!$fp) {
@@ -357,8 +358,6 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE, $
                 }
                 break;
             }
-            default:
-                return AN_RETURNZERO;
         }
     }
     else

enrol/authorize/config.html

@@ -83,37 +83,34 @@ if (!isset($frm->acceptechecktypes)) {
 <tr valign="top"><td colspan="2"><h4><?php print_string("adminauthorizesettings", "enrol_authorize") ?></h4></td></tr>
 
 <tr valign="top">
-    <td align="right">an_login:</td>
-    <td><input type="text" name="an_login" value="<?php p($frm->an_login) ?>" /><br />
-        <?php print_string("anlogin", "enrol_authorize") ?></td>
+    <td align="right">&nbsp;&nbsp;</td>
+    <td><?php print_string("logininfo", "enrol_authorize") ?></td>
 </tr>
 
 <tr valign="top">
-    <td align="right">#&nbsp;#&nbsp;</td>
-    <td><?php print_string("chooseone", "enrol_authorize") ?></td>
+    <td align="right">an_login:<br /><?php echo (isset($mconfig->an_login)) ? '<font color=green>'.get_string('ok').'</font>' : ''; ?></td>
+    <td><?php print_string("anlogin", "enrol_authorize") ?><br /><input type="text" name="an_login" size="26" value="" /><sup>*</sup></td>
 </tr>
 
 <tr valign="top">
-    <td align="right">an_tran_key:</td>
-    <td><input type="text" name="an_tran_key" value="<?php p($frm->an_tran_key) ?>" /><sup>#1</sup><br />
-        <?php print_string("antrankey", "enrol_authorize") ?></td>
+    <td align="right">an_tran_key:<br /><?php echo (isset($mconfig->an_tran_key)) ? '<font color=green>'.get_string('ok').'</font>' : ''; ?></td>
+    <td><?php print_string("antrankey", "enrol_authorize") ?><br /><input type="text" name="an_tran_key" size="26" value="" /><sup>#1</sup></td>
 </tr>
 
 <tr valign="top">
-    <td align="right">an_password:</td>
-    <td><input type="text" name="an_password" value="" /><sup>#2</sup><br />
-        <?php print_string("anpassword", "enrol_authorize") ?><br />(<?php print_string("leavetokeep") ?>)</td>
+    <td align="right">an_password:<br /><?php echo (isset($mconfig->an_password)) ? '<font color=green>'.get_string('ok').'</font>' : ''; ?></td>
+    <td><?php print_string("anpassword", "enrol_authorize") ?><br /><input type="text" name="an_password" size="26" value="" /><sup>#2</sup></td>
 </tr>
 
 <tr valign="top">
     <td align="right">delete_current:</td>
     <td><?php print_checkbox('delete_current', '1', !empty($frm->delete_current)) ?> <br />
-        <?php print_string("deletecheck", "moodle", get_string('oldpassword')) ?><br /><br /></td>
+        <?php print_string("deletecheck", "moodle", get_string('oldpassword')) ?><br /><hr size="1" width="100%" noshade /></td>
 </tr>
 
 <tr valign="top">
     <td align="right">an_referer:</td>
-    <td><input type="text" name="an_referer" value="<?php p($frm->an_referer) ?>" /><br />
+    <td><input type="text" name="an_referer" size="35" value="<?php p($frm->an_referer) ?>" /><br />
         <?php print_string("anreferer", "enrol_authorize") ?></td>
 </tr>
 

enrol/authorize/db/install.xml

@@ -1,12 +1,15 @@
 <?xml version="1.0" encoding="UTF-8" ?>
-<XMLDB PATH="enrol/authorize/db" VERSION="20060809" COMMENT="XMLDB file for Moodle enrol/authorize">
+<XMLDB PATH="enrol/authorize/db" VERSION="20061117" COMMENT="XMLDB file for Moodle enrol/authorize"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="../../../lib/xmldb/xmldb.xsd"
+>
   <TABLES>
     <TABLE NAME="enrol_authorize" COMMENT="Holds all known information about authorize.net transactions" NEXT="enrol_authorize_refunds">
       <FIELDS>
         <FIELD NAME="id" TYPE="int" LENGTH="10" NOTNULL="true" UNSIGNED="true" SEQUENCE="true" ENUM="false" NEXT="paymentmethod"/>
-        <FIELD NAME="paymentmethod" TYPE="char" LENGTH="6" NOTNULL="true" DEFAULT="cc" SEQUENCE="false" ENUM="true" ENUMVALUES="'cc', 'echeck'" PREVIOUS="id" NEXT="cclastfour"/>
-        <FIELD NAME="cclastfour" TYPE="int" LENGTH="4" NOTNULL="true" UNSIGNED="true" DEFAULT="0" SEQUENCE="false" ENUM="false" PREVIOUS="paymentmethod" NEXT="ccname"/>
-        <FIELD NAME="ccname" TYPE="char" LENGTH="255" NOTNULL="true" SEQUENCE="false" ENUM="false" PREVIOUS="cclastfour" NEXT="courseid"/>
+        <FIELD NAME="paymentmethod" TYPE="char" LENGTH="6" NOTNULL="true" DEFAULT="cc" SEQUENCE="false" ENUM="true" ENUMVALUES="'cc', 'echeck'" PREVIOUS="id" NEXT="refundinfo"/>
+        <FIELD NAME="refundinfo" TYPE="int" LENGTH="4" NOTNULL="true" UNSIGNED="true" DEFAULT="0" SEQUENCE="false" ENUM="false" PREVIOUS="paymentmethod" NEXT="ccname"/>
+        <FIELD NAME="ccname" TYPE="char" LENGTH="255" NOTNULL="true" SEQUENCE="false" ENUM="false" PREVIOUS="refundinfo" NEXT="courseid"/>
         <FIELD NAME="courseid" TYPE="int" LENGTH="10" NOTNULL="true" UNSIGNED="true" DEFAULT="0" SEQUENCE="false" ENUM="false" PREVIOUS="ccname" NEXT="userid"/>
         <FIELD NAME="userid" TYPE="int" LENGTH="10" NOTNULL="true" UNSIGNED="true" DEFAULT="0" SEQUENCE="false" ENUM="false" PREVIOUS="courseid" NEXT="transid"/>
         <FIELD NAME="transid" TYPE="int" LENGTH="10" NOTNULL="true" UNSIGNED="true" DEFAULT="0" SEQUENCE="false" ENUM="false" PREVIOUS="userid" NEXT="status"/>

enrol/authorize/db/upgrade.php

@@ -23,14 +23,41 @@ function xmldb_enrol_authorize_upgrade($oldversion=0) {
 
     $result = true;
 
-/// And upgrade begins here. For each one, you'll need one 
-/// block of code similar to the next one. Please, delete 
-/// this comment lines once this file start handling proper
-/// upgrade code.
+    if ($result && $oldversion < 2006101701) {
+        $table = new XMLDBTable('enrol_authorize');
+        if (!field_exists($table, new XMLDBField('refundinfo'))) {
+            $field = new XMLDBField('cclastfour');
+            $field->setAttributes(XMLDB_TYPE_INTEGER, '4', XMLDB_UNSIGNED, XMLDB_NOTNULL, null, null, null, '0', 'paymentmethod');
+            $result = $result && rename_field($table, $field, 'refundinfo');
+        }
+    }
 
-/// if ($result && $oldversion < YYYYMMDD00) { //New version in version.php
-///     $result = result of "/lib/ddllib.php" function calls
-/// }
+    if ($result && $oldversion < 2006101702) {
+        if (isset($CFG->an_login)) {
+            if (empty($CFG->an_login)) {
+            	unset_config('an_login');
+            }
+            else {
+            	$result = $result && set_config('an_login', rc4encrypt($CFG->an_login), 'enrol/authorize') && unset_config('an_login');
+            }
+        }
+        if (isset($CFG->an_tran_key)) {
+            if (empty($CFG->an_tran_key)) {
+            	unset_config('an_tran_key');
+            }
+            else {
+            	$result = $result && set_config('an_tran_key', rc4encrypt($CFG->an_tran_key), 'enrol/authorize') && unset_config('an_tran_key');
+            }
+        }
+        if (isset($CFG->an_password)) {
+            if (empty($CFG->an_password)) {
+            	unset_config('an_password');
+            }
+            else {
+                $result = $result && set_config('an_password', rc4encrypt($CFG->an_password), 'enrol/authorize') && unset_config('an_password');
+            }
+        }
+    }
 
     return $result;
 }

enrol/authorize/enrol.html

@@ -33,7 +33,7 @@ function print_cc_form($classreference)
 
     $formvars = array(
         'ccaddress', 'cccity', 'ccstate', 'cccountry', 'cczip',
-        'ccfirstname', 'cclastname', 'cc', 'ccexpiremm', 'ccexpireyyyy', 'cctype', 'cvv'
+        'firstname', 'lastname', 'cc', 'ccexpiremm', 'ccexpireyyyy', 'cctype', 'cvv'
     );
     foreach ($formvars as $var) {
         if (!isset($form->$var)) {
@@ -42,8 +42,8 @@ function print_cc_form($classreference)
     }
 
     $curcost = get_course_cost($course);
-    $userfirstname = empty($form->ccfirstname) ? $USER->firstname : $form->ccfirstname;
-    $userlastname = empty($form->cclastname) ? $USER->lastname : $form->cclastname;
+    $userfirstname = empty($form->firstname) ? $USER->firstname : $form->firstname;
+    $userlastname = empty($form->lastname) ? $USER->lastname : $form->lastname;
     $useraddress = empty($form->ccaddress) ? $USER->address : $form->ccaddress;
     $usercity = empty($form->cccity) ? $USER->city : $form->cccity;
     $usercountry = empty($form->cccountry) ? $USER->country : $form->cccountry;
@@ -68,8 +68,8 @@ function print_cc_form($classreference)
     </tr>
     <tr>
       <td align="right"><?php print_string("nameoncard", "enrol_authorize") ?>: </td>
-      <td align="left"><input type="text" name="ccfirstname" size="8" value="<?php p($userfirstname) ?>" />
-      <input type="text" name="cclastname" size="8" value="<?php p($userlastname) ?>" />
+      <td align="left"><input type="text" name="firstname" size="8" value="<?php p($userfirstname) ?>" />
+      <input type="text" name="lastname" size="8" value="<?php p($userlastname) ?>" />
       <?php if (!empty($classreference->authorizeerrors['ccfirstlast'])) { formerr($classreference->authorizeerrors['ccfirstlast']); } ?></td>
     </tr>
     <tr>

enrol/authorize/enrol.php

@@ -47,7 +47,7 @@ class enrolment_plugin_authorize
 
         httpsrequired();
 
-        if (empty($_SERVER['HTTPS']) || $_SERVER['HTTPS'] == 'off') {
+        if (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] != 443) { // MDL-9836
             if (empty($CFG->loginhttps)) {
                 error(get_string('httpsrequired', 'enrol_authorize'));
             } else {
@@ -70,7 +70,7 @@ class enrolment_plugin_authorize
         }
 
         print_simple_box_start('center');
-        if (has_capability('moodle/legacy:guest', get_context_instance(CONTEXT_SYSTEM), $USER->id, false)) {
+        if ($USER->username == 'guest') { // only real guest user, not for users with guest role
             $curcost = get_course_cost($course);
             echo '<div align="center">';
             echo '<p>'.get_string('paymentrequired').'</p>';
@@ -143,8 +143,8 @@ class enrolment_plugin_authorize
         $timenow = time();
         $order = new stdClass();
         $order->paymentmethod = AN_METHOD_CC;
-        $order->cclastfour = substr($form->cc, -4);
-        $order->ccname = $form->ccfirstname . " " . $form->cclastname;
+        $order->refundinfo = substr($form->cc, -4);
+        $order->ccname = $form->firstname . " " . $form->lastname;
         $order->courseid = $course->id;
         $order->userid = $USER->id;
         $order->status = AN_STATUS_NONE; // it will be changed...
@@ -166,8 +166,8 @@ class enrolment_plugin_authorize
         $extra->x_exp_date = $exp_date;
         $extra->x_currency_code = $curcost['currency'];
         $extra->x_amount = $curcost['cost'];
-        $extra->x_first_name = $form->ccfirstname;
-        $extra->x_last_name = $form->cclastname;
+        $extra->x_first_name = $form->firstname;
+        $extra->x_last_name = $form->lastname;
         $extra->x_country = $form->cccountry;
         $extra->x_address = $form->ccaddress;
         $extra->x_state = $form->ccstate;
@@ -290,12 +290,13 @@ class enrolment_plugin_authorize
 
         $useripno = getremoteaddr();
         $curcost = get_course_cost($course);
+        $isbusinesschecking = ($form->acctype == 'BUSINESSCHECKING');
 
         // NEW ECHECK ORDER
         $timenow = time();
         $order = new stdClass();
         $order->paymentmethod = AN_METHOD_ECHECK;
-        $order->cclastfour = 0;
+        $order->refundinfo = $isbusinesschecking ? 1 : 0;
         $order->ccname = $form->firstname . ' ' . $form->lastname;
         $order->courseid = $course->id;
         $order->userid = $USER->id;
@@ -316,7 +317,7 @@ class enrolment_plugin_authorize
         $extra->x_bank_aba_code = $form->abacode;
         $extra->x_bank_acct_num = $form->accnum;
         $extra->x_bank_acct_type = $form->acctype;
-        $extra->x_echeck_type = ($form->acctype == 'BUSINESSCHECKING') ? 'CCD' : 'WEB';
+        $extra->x_echeck_type = $isbusinesschecking ? 'CCD' : 'WEB';
         $extra->x_bank_name = $form->bankname;
         $extra->x_currency_code = $curcost['currency'];
         $extra->x_amount = $curcost['cost'];
@@ -393,6 +394,7 @@ class enrolment_plugin_authorize
     function config_form($frm)
     {
         global $CFG;
+        $mconfig = get_config('enrol/authorize');
 
         if (! check_openssl_loaded()) {
             notify('PHP must be compiled with SSL support (--with-openssl)');
@@ -403,7 +405,7 @@ class enrolment_plugin_authorize
             $a->url = "$CFG->wwwroot/$CFG->admin/settings.php?section=httpsecurity";
             notice(get_string('adminconfighttps', 'enrol_authorize', $a));
         }
-        elseif (empty($_SERVER['HTTPS']) || $_SERVER['HTTPS'] == 'off') {
+        elseif (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] != 443) { // MDL-9836
             $wwwsroot = qualified_me();
             $wwwsroot = str_replace('http:', 'https:', $wwwsroot);
             $a = new stdClass;
@@ -415,7 +417,6 @@ class enrolment_plugin_authorize
             $captureday = intval($frm->an_capture_day);
             $emailexpired = intval($frm->an_emailexpired);
             if ($captureday > 0 || $emailexpired > 0) {
-                $mconfig = get_config('enrol/authorize');
                 if ((time() - intval($mconfig->an_lastcron) > 3600 * 24)) {
                     notify(get_string('admincronsetup', 'enrol_authorize'));
                 }
@@ -430,10 +431,10 @@ class enrolment_plugin_authorize
         }
 
         if (data_submitted()) {
-            if (empty($frm->an_login)) {
+            if (empty($mconfig->an_login)) {
                 notify("an_login required");
             }
-            if (empty($frm->an_tran_key) && empty($frm->an_password)) {
+            if (empty($mconfig->an_tran_key) && empty($mconfig->an_password)) {
                 notify("an_tran_key or an_password required");
             }
         }
@@ -452,6 +453,7 @@ class enrolment_plugin_authorize
     function process_config($config)
     {
         global $CFG;
+        $mconfig = get_config('enrol/authorize');
 
         // site settings
         if (($cost = optional_param('enrol_cost', 5, PARAM_INT)) > 0) {
@@ -489,7 +491,6 @@ class enrolment_plugin_authorize
         $emailexpired = ($emailexpired > 5) ? 5 : (($emailexpired < 0) ? 0 : $emailexpired);
 
         if (!empty($reviewval) && ($captureday > 0 || $emailexpired > 0)) {
-            $mconfig = get_config('enrol/authorize');
             if (time() - intval($mconfig->an_lastcron) > 3600 * 24) {
                 return false;
             }
@@ -507,30 +508,35 @@ class enrolment_plugin_authorize
             return false;
         }
 
-        // required fields
+        // REQUIRED fields;
+        // an_login
         $loginval = optional_param('an_login', '');
-        if (empty($loginval)) {
+        if (empty($loginval) && empty($mconfig->an_login)) {
             return false;
         }
-        set_config('an_login', $loginval);
+        $loginval = !empty($loginval) ? rc4encrypt($loginval) : strval($mconfig->an_login);
+        set_config('an_login', $loginval, 'enrol/authorize');
 
+        // an_tran_key, an_password
         $tranval = optional_param('an_tran_key', '');
+        $tranval = !empty($tranval) ? rc4encrypt($tranval) : (isset($mconfig->an_tran_key)?$mconfig->an_tran_key:'');
         $passwordval = optional_param('an_password', '');
-        $deletecurrent = optional_param('delete_current', '');
-
-        if (!empty($passwordval)) { // password is changing
-            set_config('an_password', $passwordval);
+        $passwordval = !empty($passwordval) ? rc4encrypt($passwordval) :(isset($mconfig->an_password)?$mconfig->an_password:'');
+        $deletecurrent = optional_param('delete_current', '0', PARAM_BOOL);
+        if (!empty($deletecurrent) and !empty($tranval)) {
+            unset_config('an_password', 'enrol/authorize');
+            $passwordval = '';
         }
-        elseif (!empty($deletecurrent) and !empty($tranval)) {
-            set_config('an_password', '');
-            $CFG->an_password = '';
+        elseif (!empty($passwordval)) {
+            set_config('an_password', $passwordval, 'enrol/authorize');
         }
-
-        if (empty($tranval) and empty($CFG->an_password)) {
+        if (empty($tranval) and empty($passwordval)) {
             return false;
         }
+        if (!empty($tranval)) {
+            set_config('an_tran_key', $tranval, 'enrol/authorize');
+        }
 
-        set_config('an_tran_key', $tranval);
         return true;
     }
 
@@ -676,6 +682,7 @@ class enrolment_plugin_authorize
 
         $oneday = 86400;
         $timenow = time();
+        $onepass = $timenow - $oneday;
         $settlementtime = authorize_getsettletime($timenow);
         $timediff30 = $settlementtime - (30 * $oneday);
 
@@ -692,7 +699,24 @@ class enrolment_plugin_authorize
         $select = "(status='".AN_STATUS_EXPIRE."') AND (timecreated<'$timediff60')";
         delete_records_select('enrol_authorize', $select);
 
-        // XXX TODO SEND EMAIL to uploadcsv user
+        // XXX TODO SEND EMAIL to 'enrol/authorize:uploadcsv'
+        // get_users_by_capability() does not handling user level resolving
+        // After user resolving, get_admin() to get_users_by_capability()
+        $adminuser = get_admin();
+        $select = "status IN(".AN_STATUS_UNDERREVIEW.",".AN_STATUS_APPROVEDREVIEW.") " .
+                  "AND (timecreated<'$onepass') AND (timecreated>'$timediff60')";
+        $count = count_records_select('enrol_authorize', $select);
+        if ($count) {
+            $a = new stdClass;
+            $a->count = $count;
+            $a->course = $SITE->shortname;
+            $subject = get_string('pendingechecksubject', 'enrol_authorize', $a);
+            $a = new stdClass;
+            $a->count = $count;
+            $a->url = $CFG->wwwroot.'/enrol/authorize/uploadcsv.php';
+            $message = get_string('pendingecheckemail', 'enrol_authorize', $a);
+            @email_to_user($adminuser, $adminuser, $subject, $message);
+        }
 
         // Daily warning email for pending orders expiring.
         if (empty($CFG->an_emailexpired)) {
@@ -720,7 +744,6 @@ class enrolment_plugin_authorize
         $a->enrolurl = "$CFG->wwwroot/$CFG->admin/enrol_config.php?enrol=authorize";
         $a->url = $CFG->wwwroot.'/enrol/authorize/index.php?status='.AN_STATUS_AUTH;
         $message = get_string('pendingordersemail', 'enrol_authorize', $a);
-        $adminuser = get_admin();
         email_to_user($adminuser, $adminuser, $subject, $message);
 
         // Email to teachers

enrol/authorize/index.php

@@ -9,6 +9,11 @@
     $courseid = optional_param('course', SITEID, PARAM_INT);
     $userid   = optional_param('user', 0, PARAM_INT);
 
+/// Get course
+    if (! $course = get_record('course', 'id', $courseid)) {
+        error('Could not find that course');
+    }
+
 /// Only site users can access to this page
     require_login(); // Don't use $courseid! User may want to see old orders.
 
@@ -16,10 +21,6 @@
         error("Guests cannot use this page.");
     }
 
-    if (! $course = get_record('course', 'id', $courseid)) {
-        error('Could not find that course');
-    }
-
 /// Load strings. All strings should be defined here. locallib.php uses these strings.
     $strs = get_strings(array('search','status','action','time','course','confirm','no','all','none','error'));
     $authstrs = get_strings(array('orderid','nameoncard','echeckfirslasttname','void','capture','refund','delete',
@@ -30,9 +31,9 @@
 
 /// Print header
     $strpaymentmanagement = get_string('paymentmanagement', 'enrol_authorize');
-    print_header_simple("$strpaymentmanagement", "", "<a href=\"index.php\">$strpaymentmanagement</a>");
+    print_header_simple($strpaymentmanagement, "", "<a href=\"index.php\">$strpaymentmanagement</a>");
 
-/// If orderid is empty, print orders
+/// If orderid is empty, user wants to see all orders
     if (empty($orderid)) {
         authorize_print_orders($courseid, $userid);
     } else {

enrol/authorize/localfuncs.php

@@ -31,9 +31,7 @@ function prevent_double_paid($course)
 {
     global $CFG, $SESSION, $USER;
 
-    $sql = "SELECT id FROM {$CFG->prefix}enrol_authorize
-            WHERE userid = $USER->id
-              AND courseid = $course->id ";
+    $sql = "SELECT id FROM {$CFG->prefix}enrol_authorize WHERE userid = '$USER->id' AND courseid = '$course->id' ";
 
     if (empty($CFG->an_test)) { // Real mode
         $sql .= 'AND status IN('.AN_STATUS_AUTH.','.AN_STATUS_UNDERREVIEW.','.AN_STATUS_APPROVEDREVIEW.')';
@@ -42,16 +40,16 @@ function prevent_double_paid($course)
         $sql .= 'AND status='.AN_STATUS_NONE;
     }
 
-    if ($rec = get_record_sql($sql)) {
+    if ($recid = get_field_sql($sql)) {
         $a = new stdClass;
-        $a->orderid = $rec->id;
+        $a->orderid = $recid;
         $a->url = "$CFG->wwwroot/enrol/authorize/index.php?order=$a->orderid";
         redirect($a->url, get_string("paymentpending", "enrol_authorize", $a), '10');
         return;
     }
     if (isset($SESSION->ccpaid)) {
         unset($SESSION->ccpaid);
-        redirect($CFG->wwwroot . '/login/logout.php');
+        redirect($CFG->wwwroot . '/login/logout.php?sesskey='.sesskey());
         return;
     }
 }
@@ -232,7 +230,7 @@ function validate_cc_form($form, &$err)
         }
     }
 
-    if (empty($form->ccfirstname) || empty($form->cclastname)) {
+    if (empty($form->firstname) || empty($form->lastname)) {
         $err['ccfirstlast'] = get_string('missingfullname');
     }
 

enrol/authorize/locallib.php

@@ -26,8 +26,11 @@ function authorize_print_orders($courseid, $userid)
     $status = optional_param('status', AN_STATUS_NONE, PARAM_INT);
     $searchtype = optional_param('searchtype', 'id', PARAM_ALPHA);
     $idortransid = optional_param('idortransid', '0', PARAM_INT);
+    $showonlymy = optional_param('showonlymy', 0, PARAM_BOOL);
 
-    if (! has_capability('enrol/authorize:managepayments', get_context_instance(CONTEXT_COURSE, $courseid))) {
+    $canmanagepayments = has_capability('enrol/authorize:managepayments', get_context_instance(CONTEXT_COURSE, $courseid));
+
+    if ($showonlymy || !$canmanagepayments) {
         $userid = $USER->id;
     }
 
@@ -46,22 +49,29 @@ function authorize_print_orders($courseid, $userid)
     );
 
     $sql = "SELECT c.id, c.fullname FROM {$CFG->prefix}course c INNER JOIN {$CFG->prefix}enrol_authorize e ON c.id = e.courseid ";
-    if ($CFG->enrol == 'authorize') { // default enrolment plugin
-        $sql .= "WHERE (c.enrol IS NULL) OR (c.enrol='') OR (c.enrol = 'authorize') ";
-    }
-    else {
-        $sql .= "WHERE (c.enrol = 'authorize') ";
+    if ($userid > 0) {
+        $sql .= "WHERE (e.userid='$userid') ";
     }
     $sql .= "ORDER BY c.sortorder, c.fullname";
     if ($popupcrs = get_records_sql_menu($sql)) {
         $popupcrs = array($SITE->id => $SITE->fullname) + $popupcrs;
         echo "<table border='0' width='100%' cellspacing=0 cellpadding=3 class='generaltable generalbox'>";
         echo "<tr>";
-        echo "<td width='5%'>$strs->status: </td><td width='10%'>";popup_form($baseurl.'&amp;course='.$courseid.'&amp;status=',$statusmenu,'statusmenu',$status,'','','',false);echo"</td>\n";
-        echo "<td width='5%'>$strs->course: </td><td width='10%'>";popup_form($baseurl.'&amp;status='.$status.'&amp;course=',$popupcrs,'coursesmenu',$courseid,'','','',false);echo"</td>\n";
+        echo "<td width='5%' valign='top'>$strs->status: </td><td width='10%'>";
+        popup_form($baseurl.'&amp;course='.$courseid.'&amp;status=',$statusmenu,'statusmenu',$status,'','','',false);
+        if ($canmanagepayments) {
+            echo "<br />\n";
+            print_checkbox('showonlymy', '1', $userid == $USER->id, get_string('mypaymentsonly', 'enrol_authorize'), '',
+            "var locationtogo = '{$CFG->wwwroot}/enrol/authorize/index.php?status=$status&amp;course=$courseid';
+                                  locationtogo += '&amp;user=' + (this.checked ? '$USER->id' : '0');
+                                  top.location.href=locationtogo;");
+        }
+        echo "</td>\n";
+        echo "<td width='5%' valign='top'>$strs->course: </td><td width='10%' valign='top'>";
+        popup_form($baseurl.'&amp;status='.$status.'&amp;course=',$popupcrs,'coursesmenu',$courseid,'','','',false);echo"</td>\n";
         if (has_capability('enrol/authorize:uploadcsv', get_context_instance(CONTEXT_USER, $USER->id))) {
             echo "<form method='get' action='uploadcsv.php'>";
-            echo "<td rowspan=2 align='center' valign='middle' width='50%'><input type='submit' value='".get_string('uploadcsv', 'enrol_authorize')."'></td>";
+            echo "<td rowspan=2 align='right' valign='middle' width='50%'><input type='submit' value='".get_string('uploadcsv', 'enrol_authorize')."' /></td>";
             echo "</form>";
         }
         else {
@@ -88,7 +98,7 @@ function authorize_print_orders($courseid, $userid)
 
     $table->define_columns(array('id', 'timecreated', 'userid', 'status', ''));
     $table->define_headers(array($authstrs->orderid, $strs->time, $authstrs->nameoncard, $strs->status, $strs->action));
-    $table->define_baseurl($baseurl."&amp;status=$status");
+    $table->define_baseurl($baseurl."&amp;status=$status&amp;course=$courseid");
 
     $table->sortable(true, 'id', SORT_DESC);
     $table->pageable(true);
@@ -218,7 +228,7 @@ function authorize_print_order_details($orderno)
     }
 
     echo "<form action=\"index.php\" method=\"post\">\n";
-    echo "<input type=\"hidden\" name=\"order\" value=\"$orderno\">\n";
+    echo "<input type=\"hidden\" name=\"order\" value=\"$orderno\" />\n";
     echo "<input type=\"hidden\" name=\"sesskey\" value=\"" . sesskey() . "\" />";
 
     $settled = authorize_settled($order);
@@ -256,7 +266,7 @@ function authorize_print_order_details($orderno)
             $strcaptureyes = get_string('captureyes', 'enrol_authorize');
             $table->data[] = array("<b>$strs->confirm:</b>",
             "$strcaptureyes <br />
-            <input type='hidden' name='confirm' value='1'><input type='submit' name='". ORDER_CAPTURE ."' value='$authstrs->capture' />
+            <input type='hidden' name='confirm' value='1' /><input type='submit' name='". ORDER_CAPTURE ."' value='$authstrs->capture' />
             &nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
         }
         else {
@@ -318,14 +328,15 @@ function authorize_print_order_details($orderno)
                 $cbunenrol = print_checkbox('unenrol', '1', !empty($unenrol), '', '', '', true);
                 $table->data[] = array("<b>$authstrs->unenrolstudent</b>", $cbunenrol);
                 $table->data[] = array("<b>$strhowmuch</b>",
-                    "<input type='hidden' name='confirm' value='1'>
-                     <input type='text' size='5' name='amount' value='$amount'>
+                    "<input type='hidden' name='confirm' value='1' />
+                     <input type='text' size='5' name='amount' value='$amount' />
                      $strcanbecredit<br /><input type='submit' name='".ORDER_REFUND."' value='$authstrs->refund'>");
             }
             else {
                 $extra->amount = $amount;
                 $message = '';
-                if (AN_APPROVED == authorize_action($order, $message, $extra, AN_ACTION_CREDIT)) {
+                $success = authorize_action($order, $message, $extra, AN_ACTION_CREDIT);
+                if (AN_APPROVED == $success || AN_REVIEW == $success) {
                     if (empty($CFG->an_test)) {
                         if (empty($extra->id)) {
                             $table->data[] = array("<b><font color=red>$strs->error:</font></b>", 'insert record error');
@@ -360,8 +371,8 @@ function authorize_print_order_details($orderno)
             if (empty($confirm)) {
                 $strvoidyes = get_string('voidyes', 'enrol_authorize');
                 $table->data[] = array("<b>$strs->confirm:</b>",
-                    "$strvoidyes<br /><input type='hidden' name='".ORDER_VOID."' value='y'>
-                     <input type='hidden' name='confirm' value='1'>
+                    "$strvoidyes<br /><input type='hidden' name='".ORDER_VOID."' value='y' />
+                     <input type='hidden' name='confirm' value='1' />
                      <input type='submit' value='$authstrs->void'>
                      &nbsp;&nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
             }
@@ -407,9 +418,9 @@ function authorize_print_order_details($orderno)
                     $cbunenrol = print_checkbox('unenrol', '1', !empty($unenrol), '', '', '', true);
                     $table->data[] = array("<b>$authstrs->unenrolstudent</b>", $cbunenrol);
                     $table->data[] = array("<b>$strs->confirm:</b>",
-                        "$strsubvoidyes<br /><input type='hidden' name='".ORDER_VOID."' value='y'>
-                         <input type='hidden' name='confirm' value='1'>
-                         <input type='hidden' name='suborder' value='$suborderno'>
+                        "$strsubvoidyes<br /><input type='hidden' name='".ORDER_VOID."' value='y' />
+                         <input type='hidden' name='confirm' value='1' />
+                         <input type='hidden' name='suborder' value='$suborderno' />
                          <input type='submit' value='$authstrs->void'>
                          &nbsp;&nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
                 }
@@ -446,8 +457,8 @@ function authorize_print_order_details($orderno)
             $cbunenrol = print_checkbox('unenrol', '1', !empty($unenrol), '', '', '', true);
             $table->data[] = array("<b>$authstrs->unenrolstudent</b>", $cbunenrol);
             $table->data[] = array("<b>$strs->confirm:</b>",
-                "<input type='hidden' name='".ORDER_DELETE."' value='y'>
-                 <input type='hidden' name='confirm' value='1'>
+                "<input type='hidden' name='".ORDER_DELETE."' value='y' />
+                 <input type='hidden' name='confirm' value='1' />
                  <input type='submit' value='$authstrs->delete'>
                  &nbsp;&nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
         }
@@ -583,8 +594,10 @@ function authorize_get_status_action($order)
 
     case AN_STATUS_AUTHCAPTURE:
         if (authorize_settled($order)) {
-            if ($order->paymentmethod == AN_METHOD_CC && $canmanage) {
-                $ret->actions = array(ORDER_REFUND);
+            if ($canmanage) {
+                if (($order->paymentmethod == AN_METHOD_CC) || ($order->paymentmethod == AN_METHOD_ECHECK && !empty($order->refundinfo))) {
+                    $ret->actions = array(ORDER_REFUND);
+                }
             }
             $ret->status = 'settled';
         }

enrol/authorize/uploadcsv.php

@@ -33,10 +33,10 @@
 /// Print submit form
     $maxuploadsize = get_max_upload_file_size();
     echo '<center><form method="post" enctype="multipart/form-data" action="uploadcsv.php">
-          <input type="hidden" name="MAX_FILE_SIZE" value="'.$maxuploadsize.'">
+          <input type="hidden" name="MAX_FILE_SIZE" value="'.$maxuploadsize.'" />
           <input type="hidden" name="sesskey" value="'.$USER->sesskey.'">';
           upload_print_form_fragment(1, array('csvfile'), array(get_string('file')));
-    echo '<input type="submit" value="'.get_string('upload').'">';
+    echo '<input type="submit" value="'.get_string('upload').'" />';
     echo '</form></center><br />';
 
 /// Print footer
@@ -50,7 +50,7 @@ function authorize_process_csv($filename)
 
 /// We need these fields
     $myfields = array(
-        'Transaction ID',           // enrol_authorize.transid
+        'Transaction ID',           // enrol_authorize.transid or enrol_authorize_refunds.transid; See: Reference Transaction ID
         'Transaction Status',       // Under Review,Approved Review,Review Failed,Settled Successfully
         'Transaction Type',         // Authorization w/ Auto Capture, Authorization Only, Capture Only, Credit, Void, Prior Authorization Capture
         'Settlement Amount',        //
@@ -59,7 +59,7 @@ function authorize_process_csv($filename)
         'Authorization Amount',     //
         'Authorization Currency',   //
         'Submit Date/Time',         // timecreated
-        'Reference Transaction ID', // enrol_authorize_refunds.transid
+        'Reference Transaction ID', // enrol_authorize.transid if Transaction Type = Credit
         'Total Amount',             // enrol_authorize.cost
         'Currency',                 // enrol_authorize.currency
         'Invoice Number',           // enrol_authorize.id: Don't trust this! Backup/Restore changes this
@@ -111,6 +111,7 @@ function authorize_process_csv($filename)
         $transid = $data[$csvfields['Transaction ID']];
         $transtype = $data[$csvfields['Transaction Type']];
         $transstatus = $data[$csvfields['Transaction Status']];
+        $reftransid = $data[$csvfields['Reference Transaction ID']];
         $settlementdate = strtotime($data[$csvfields['Settlement Date/Time']]);
 
         if ($transstatus == 'Approved Review' || $transstatus == 'Review Failed') {
@@ -122,6 +123,29 @@ function authorize_process_csv($filename)
             continue;
         }
 
+        if (!empty($reftransid) && is_numeric($reftransid) && 'Settled Successfully' == $transstatus && 'Credit' == $transtype) {
+            if ($order = get_record('enrol_authorize', 'transid', $reftransid)) {
+                if (AN_METHOD_ECHECK == $order->paymentmethod) {
+                    $refund = get_record('enrol_authorize_refunds', 'transid', $transid);
+                    if ($refund) {
+                        $refund->status = AN_STATUS_CREDIT;
+                        $refund->settletime = $settlementdate;
+                        update_record('enrol_authorize_refunds', $refund);
+                        $updated++;
+                    }
+                    else {
+                        $ignored++;
+                        $ignoredlines .= $reftransid . ": Not our business(Reference Transaction ID)\n";
+                    }
+                }
+            }
+            else {
+                $ignored++;
+                $ignoredlines .= $reftransid . ": Not our business(Transaction ID)\n";
+            }
+            continue;
+        }
+
         if (! ($transstatus == 'Settled Successfully' && $transtype == 'Authorization w/ Auto Capture')) {
             $ignored++;
             $ignoredlines .= $transid . ": Not settled\n";

enrol/authorize/version.php

@@ -1,6 +1,6 @@
 <?php // $Id$
 
-$plugin->version  = 2006101700;
+$plugin->version  = 2006101702;
 $plugin->requires = 2006100401;
 
 ?>

enrol/database/config.html

@@ -79,7 +79,7 @@
     </td>
 </tr>
 <th colspan="2">
-    <?php print_string("field_mapping", "enrol_database") ?>
+    <?php print_string("remote_fields_mapping", "enrol_database") ?>
 </td>
 <tr valign="top">
     <td align="right">enrol_localcoursefield:</td>

enrol/database/enrol.php

@@ -18,7 +18,7 @@ function setup_enrolments(&$user) {
     // $this->enrol_disconnect() as it is doing some nasty vodoo with $CFG->prefix
     $enroldb = $this->enrol_connect();
     if (!$enroldb) {
-        error_log('[ENROL_DB] Could not make a connection: '.$enroldb->ErrorMsg());
+        error_log('[ENROL_DB] Could not make a connection');
         return;
     }
 
@@ -61,7 +61,7 @@ function setup_enrolments(&$user) {
             error_log('[ENROL_DB] Using config default for roles: '.$role->shortname);
         }*/
         
-        if ($rs = $enroldb->Execute("SELECT {$CFG->enrol_remotecoursefield}
+        if ($rs = $enroldb->Execute("SELECT {$CFG->enrol_remotecoursefield} as enrolremotecoursefield
                                        FROM {$CFG->enrol_dbtable}
                                       WHERE {$CFG->enrol_remoteuserfield} = " . $useridfield .
                                         (isset($remote_role_name, $remote_role_value) ? ' AND '.$remote_role_name.' = '.$remote_role_value : ''))) {
@@ -83,43 +83,61 @@ function setup_enrolments(&$user) {
             if ($rs->RecordCount() > 0) {   // We found some courses
 
                 $courselist = array();
-                while (!$rs->EOF) {         // Make a nice little array of courses to process
-                    $courselist[] = $rs->fields[0];
-                    $rs->MoveNext();
+                while ($fields_obj = rs_fetch_next_record($rs)) {         // Make a nice little array of courses to process
+                    $courselist[] = $fields_obj->enrolremotecoursefield;
                 }
-                $rs->Close();
+                rs_close($rs);
 
                 foreach ($courselist as $coursefield) {   /// Check the list of courses against existing
-                    if ($course = get_record('course', $CFG->enrol_localcoursefield, $coursefield)) {
-
-                        /// If there's no role specified, we get the default course role (usually student)
-                        if ($use_default_role) {
-                            $role = get_default_course_role($course);
+                    $course = get_record('course', $CFG->enrol_localcoursefield, $coursefield);
+                    if (!is_object($course)) {
+                        if (empty($CFG->enrol_db_autocreate)) { // autocreation not allowed
+                            print "Course $coursefield does not exist, skipping\n";
+                            continue; // next foreach course
                         }
-
-                        $context = get_context_instance(CONTEXT_COURSE, $course->id);
-
-                        // Couldn't get a role or context, skip.
-                        if (!$role || !$context) {
-                            continue;
+                        // ok, now then let's create it!
+                        print "Creating Course $coursefield...";
+                        // prepare any course properties we actually have
+                        $course = new StdClass;
+                        $course->{$CFG->enrol_localcoursefield} = $coursefield;
+                        $course->fullname  = $coursefield;
+                        $course->shortname = $coursefield;
+                        if ($newcourseid = $this->create_course($course, true)
+                            and $course = get_record( 'course', 'id', $newcourseid)) {
+                            // we are skipping fix_course_sortorder()
+                            print "created\n";
+                        } else {
+                            print "failed\n";
+                            continue; // nothing left to do...
                         }
-
-
-                        // Search the role assignments to see if this user
-                        // already has this role in this context.  If it is, we
-                        // skip to the next course.
-                        foreach($existing as $key => $role_assignment) {
-                            if ($role_assignment->roleid = $role->id
-                             && $role_assignment->contextid = $context->id) {
-                                unset($existing[$key]);
-                                //error_log('[ENROL_DB] User is already enroled in course '.$course->idnumber);
-                                continue 2;
-                            }
-                        }
-
-                        //error_log('[ENROL_DB] Enrolling user in course '.$course->idnumber);
-                        role_assign($role->id, $user->id, 0, $context->id, 0, 0, 0, 'database');
                     }
+
+                    /// If there's no role specified, we get the default course role (usually student)
+                    if ($use_default_role) {
+                        $role = get_default_course_role($course);
+                    }
+                    
+                    $context = get_context_instance(CONTEXT_COURSE, $course->id);
+                    
+                    // Couldn't get a role or context, skip.
+                    if (!$role || !$context) {
+                        continue;
+                    }
+                    
+                    // Search the role assignments to see if this user
+                    // already has this role in this context.  If it is, we
+                    // skip to the next course.
+                    foreach($existing as $key => $role_assignment) {
+                        if ($role_assignment->roleid == $role->id
+                            && $role_assignment->contextid == $context->id) {
+                            unset($existing[$key]);
+                            //error_log('[ENROL_DB] User is already enroled in course '.$course->idnumber);
+                            continue 2;
+                        }
+                    }
+                    
+                    //error_log('[ENROL_DB] Enrolling user in course '.$course->idnumber);
+                    role_assign($role->id, $user->id, 0, $context->id, 0, 0, 0, 'database');
                 }
             } // We've processed all external courses found
 
@@ -193,10 +211,9 @@ function sync_enrolments($role = null) {
 
     begin_sql();
     $extcourses = array();
-    while (!$rs->EOF) { // there are more course records
-        $extcourse = $rs->Fields($CFG->enrol_remotecoursefield);
+    while ($extcourse_obj = rs_fetch_next_record($rs)) { // there are more course records
+        $extcourse = $extcourse_obj->{$CFG->enrol_remotecoursefield};
         array_push($extcourses, $extcourse);
-        $rs->MoveNext(); // prep the next record
 
         print "course $extcourse\n";
 
@@ -255,11 +272,10 @@ function sync_enrolments($role = null) {
         }
 
         // slurp results into an array
-        while (!$crs->EOF) {
-            array_push($extenrolments,$crs->Fields($CFG->enrol_remoteuserfield));
-            $crs->MoveNext(); 
+        while ($crs_obj = rs_fetch_next_record($crs)) {
+            array_push($extenrolments, $crs_obj->{$CFG->enrol_remoteuserfield});
         }
-        $crs->Close(); // release the handle
+        rs_close($crs); // release the handle
 
         //
         // prune enrolments
@@ -318,9 +334,10 @@ function sync_enrolments($role = null) {
                 trigger_error('weird! no user record entry?');
                 continue;
             }
-            $userid      = $ers->Fields('userid');
-            $enrolmentid = $ers->Fields('enrolmentid');
-            unset($ers); // release the handle
+            $user_obj = rs_fetch_record($ers);
+            $userid      = $user_obj->userid;
+            $enrolmentid = $user_obj->enrolmentid;
+            rs_close($ers); // release the handle
 
             if ($enrolmentid) { // already enrolled - skip
                 continue;
@@ -334,6 +351,7 @@ function sync_enrolments($role = null) {
 
         } // end foreach member
     } // end while course records
+    rs_close($rs); //Close the main course recordset
 
     //
     // prune enrolments to courses that are no longer in ext auth
@@ -364,19 +382,18 @@ function sync_enrolments($role = null) {
         return false;
     }
     if ( $ers->RecordCount() > 0 ) {             
-        while (!$ers->EOF) {
-            $roleid     = $ers->Fields('roleid');
-            $user       = $ers->Fields('userid');
-            $contextid  = $ers->Fields('contextid');
-            $ers->MoveNext(); 
+        while ($user_obj = rs_fetch_next_record($ers)) {
+            $roleid     = $user_obj->roleid;
+            $user       = $user_obj->userid;
+            $contextid  = $user_obj->contextid;
             if (role_unassign($roleid, $user, 0, $contextid)){
                 print "Unassigned role {$roleid} from user $user in context $contextid\n";
             } else {
                 print "Failed unassign role {$roleid} from user $user in context $contextid\n";
             }
         }
+        rs_close($ers); // release the handle
     }
-    unset($ers); // release the handle
     commit_sql();
     
     // we are done now, a bit of housekeeping
@@ -561,7 +578,7 @@ function create_course ($course,$skip_fix_course_sortorder=0){
     $course->shortname = substr($course->shortname, 0, 15);
     
     // store it and log
-    if ($newcourseid = insert_record("course", $course)) {  // Set up new course
+    if ($newcourseid = insert_record("course", addslashes_object($course))) {  // Set up new course
         $section = NULL;
         $section->course = $newcourseid;   // Create a default section.
         $section->section = 0;
@@ -604,6 +621,7 @@ function enrol_connect() {
     // Try to connect to the external database
     $enroldb = &ADONewConnection($CFG->enrol_dbtype);
     if ($enroldb->PConnect($CFG->enrol_dbhost,$CFG->enrol_dbuser,$CFG->enrol_dbpass,$CFG->enrol_dbname)) {
+        $enroldb->SetFetchMode(ADODB_FETCH_ASSOC); ///Set Assoc mode always after DB connection
         return $enroldb;
     } else {
         // do a bit of cleanup, and lot the problem

enrol/database/enrol_database_sync.php

@@ -9,6 +9,7 @@
     require_once(dirname(dirname(dirname(__FILE__))).'/config.php'); // global moodle config file.
 
     require_once($CFG->dirroot . '/course/lib.php');
+    require_once($CFG->dirroot . '/lib/blocklib.php');
     require_once($CFG->dirroot . "/enrol/database/enrol.php");
 
     // ensure errors are well explained

enrol/imsenterprise/enrol.php

@@ -542,7 +542,7 @@ function process_group_tag($tagcontents){
                 }else{
                     $course->sortorder = 1000;
                 }
-                if($course->id = insert_record('course', $course)){
+                if($course->id = insert_record('course', addslashes_object($course))){
                 
                     // Setup the blocks
                     $page = page_create_object(PAGE_COURSE_VIEW, $course->id);

enrol/ldap/enrol.php

@@ -76,7 +76,7 @@ function setup_enrolments(&$user) {
                     error_log("[ENROL_LDAP] User $user->username enrolled to a nonexistant course $course_ext_id \n");
                 }
             } else { // the course object exists before we call...
-                if ($course_obj->visible==0 && $user->{$type}[$course_obj->id] == 'ldap') {
+                if ($course_obj->visible==0) {
                     // non-visible courses don't show up in the enrolled 
                     // array, so we should skip them -- 
                     continue;
@@ -576,8 +576,8 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
 
     // override with required ext data
     $course->idnumber  = $course_ext[$CFG->enrol_ldap_course_idnumber][0];
-    $course->fullname  = $course_ext[$CFG->enrol_ldap_course_fullname][0];
-    $course->shortname = $course_ext[$CFG->enrol_ldap_course_shortname][0];
+    $course->fullname  = addslashes($course_ext[$CFG->enrol_ldap_course_fullname][0]);
+    $course->shortname = addslashes($course_ext[$CFG->enrol_ldap_course_shortname][0]);
     if (   empty($course->idnumber)
         || empty($course->fullname)
         || empty($course->shortname) ) { 
@@ -589,7 +589,7 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
 
     $course->summary = empty($CFG->enrol_ldap_course_summary) || empty($course_ext[$CFG->enrol_ldap_course_summary][0])
         ? ''
-        : $course_ext[$CFG->enrol_ldap_course_summary][0];
+        : addslashes($course_ext[$CFG->enrol_ldap_course_summary][0]);
     
     if(!empty($CFG->enrol_ldap_category)){ // optional ... but ensure it is set!
         $course->category   = $CFG->enrol_ldap_category;

enrol/manual/enrol.php

@@ -137,11 +137,9 @@ function check_entry($form, $course) {
 
     $groupid = $this->check_group_entry($course->id, $form->password);
 
-    $context = get_context_instance(CONTEXT_COURSE, $course->id);
-
     if (($form->password == $course->password) or ($groupid !== false) ) {
 
-        if (has_capability('moodle/legacy:guest', $context, $USER->id, false)) {
+        if ($USER->username == 'guest') { // only real user guest, do not use this for users with guest role
             $USER->enrolkey[$course->id] = true;
             add_to_log($course->id, 'course', 'guest', 'view.php?id='.$course->id, getremoteaddr());
 

enrol/paypal/enrol.php

@@ -42,7 +42,7 @@ function print_entry($course) {
 
         print_simple_box_start("center");
 
-        if (has_capability('moodle/legacy:guest', get_context_instance(CONTEXT_SYSTEM, SITEID), NULL, false)) {
+        if ($USER->username == 'guest') { // force login only for guest user, not real users with guest role
             if (empty($CFG->loginhttps)) {
                 $wwwroot = $CFG->wwwroot;
             } else {

enrol/paypal/ipn.php

@@ -112,7 +112,7 @@
 
 
 
-            if ($existing = get_record("enrol_paypal", "txn_id", $data->txn_id)) {   // Make sure this transaction doesn't exist already
+            if ($existing = get_record("enrol_paypal", "txn_id", addslashes($data->txn_id))) {   // Make sure this transaction doesn't exist already
                 email_paypal_error_to_admin("Transaction $data->txn_id is being repeated!", $data);
                 die;
 
@@ -150,11 +150,11 @@
 
             // ALL CLEAR !
 
-            if (!insert_record("enrol_paypal", $data)) {       // Insert a transaction record
+            if (!insert_record("enrol_paypal", addslashes_object($data))) {       // Insert a transaction record
                 email_paypal_error_to_admin("Error while trying to insert valid transaction", $data);
             }
 
-            if (enrol_into_course($course, $user, 'paypal')) {
+            if (!enrol_into_course($course, $user, 'paypal')) {
                 email_paypal_error_to_admin("Error while trying to enrol ".fullname($user)." in '$course->fullname'", $data);
                 die;
             } else {
@@ -188,7 +188,7 @@
 
 
         } else if (strcmp ($result, "INVALID") == 0) { // ERROR
-            insert_record("enrol_paypal", $data, false);
+            insert_record("enrol_paypal", addslashes_object($data), false);
             email_paypal_error_to_admin("Received an invalid payment notification!! (Fake payment?)", $data);
         }
     }
@@ -203,7 +203,7 @@
 
 function email_paypal_error_to_admin($subject, $data) {
     $admin = get_admin();
-    $site = get_admin();
+    $site = get_site();
 
     $message = "$site->fullname:  Transaction failed.\n\n$subject\n\n";