Moodle release 2.8.12

In short, when a user is creating a new course they can set
the ID number, shortname, fullname and summary. However, when
they merge a backup into a course they need the permissions to do so.

admin/environment.xml

@@ -1647,6 +1647,8 @@
       </PHP_EXTENSION>
       <PHP_EXTENSION name="xml" level="required">
       </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
       <PHP_EXTENSION name="intl" level="optional">
         <FEEDBACK>
           <ON_CHECK message="intlrecommended" />

auth/db/tests/db_test.php

@@ -431,7 +431,7 @@ class auth_db_testcase extends advanced_testcase {
         $user3->username = 'john%#&~%*_doe';
         $user3->email = ' john@testing.com ';
         $user3->deleted = 'no';
-        $user3->description = '<b>A description <script>alert(123)</script>about myself.</b>';
+        $user3->description = '<b>A description about myself.</b>';
         $user3cleaned = $auth->clean_data($user3);
 
         // Expected results.

backup/moodle2/restore_stepslib.php

@@ -1686,27 +1686,54 @@ class restore_course_structure_step extends restore_structure_step {
      */
     public function process_course($data) {
         global $CFG, $DB;
+        $context = context::instance_by_id($this->task->get_contextid());
+        $userid = $this->task->get_userid();
+        $target = $this->get_task()->get_target();
+        $isnewcourse = $target != backup::TARGET_CURRENT_ADDING && $target != backup::TARGET_EXISTING_ADDING;
+
+        // When restoring to a new course we can set all the things except for the ID number.
+        $canchangeidnumber = $isnewcourse || has_capability('moodle/course:changeidnumber', $context, $userid);
+        $canchangeshortname = $isnewcourse || has_capability('moodle/course:changeshortname', $context, $userid);
+        $canchangefullname = $isnewcourse || has_capability('moodle/course:changefullname', $context, $userid);
+        $canchangesummary = $isnewcourse || has_capability('moodle/course:changesummary', $context, $userid);
 
         $data = (object)$data;
+        $data->id = $this->get_courseid();
 
         $fullname  = $this->get_setting_value('course_fullname');
         $shortname = $this->get_setting_value('course_shortname');
         $startdate = $this->get_setting_value('course_startdate');
 
-        // Calculate final course names, to avoid dupes
+        // Calculate final course names, to avoid dupes.
         list($fullname, $shortname) = restore_dbops::calculate_course_names($this->get_courseid(), $fullname, $shortname);
 
-        // Need to change some fields before updating the course record
-        $data->id = $this->get_courseid();
-        $data->fullname = $fullname;
-        $data->shortname= $shortname;
+        if ($canchangefullname) {
+            $data->fullname = $fullname;
+        } else {
+            unset($data->fullname);
+        }
+
+        if ($canchangeshortname) {
+            $data->shortname = $shortname;
+        } else {
+            unset($data->shortname);
+        }
+
+        if (!$canchangesummary) {
+            unset($data->summary);
+            unset($data->summaryformat);
+        }
 
         // Only allow the idnumber to be set if the user has permission and the idnumber is not already in use by
         // another course on this site.
-        $context = context::instance_by_id($this->task->get_contextid());
-        if (!empty($data->idnumber) && has_capability('moodle/course:changeidnumber', $context, $this->task->get_userid()) &&
-                $this->task->is_samesite() && !$DB->record_exists('course', array('idnumber' => $data->idnumber))) {
+        if (!empty($data->idnumber) && $canchangeidnumber && $this->task->is_samesite()
+                && !$DB->record_exists('course', array('idnumber' => $data->idnumber))) {
             // Do not reset idnumber.
+
+        } else if (!$isnewcourse) {
+            // Prevent override when restoring as merge.
+            unset($data->idnumber);
+
         } else {
             $data->idnumber = '';
         }

course/tests/restore_test.php

@@ -0,0 +1,324 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Course restore tests.
+ *
+ * @package    core_course
+ * @copyright  2016 Frédéric Massart - FMCorz.net
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+global $CFG;
+
+require_once($CFG->dirroot . '/backup/util/includes/backup_includes.php');
+require_once($CFG->dirroot . '/backup/util/includes/restore_includes.php');
+
+/**
+ * Course restore testcase.
+ *
+ * @package    core_course
+ * @copyright  2016 Frédéric Massart - FMCorz.net
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class core_restore_backup_testcase extends advanced_testcase {
+
+    /**
+     * Backup a course and return its backup ID.
+     *
+     * @param int $courseid The course ID.
+     * @param int $userid The user doing the backup.
+     * @return string
+     */
+    protected function backup_course($courseid, $userid = 2) {
+        globaL $CFG;
+        $packer = get_file_packer('application/vnd.moodle.backup');
+
+        $bc = new backup_controller(backup::TYPE_1COURSE, $courseid, backup::FORMAT_MOODLE, backup::INTERACTIVE_NO,
+            backup::MODE_GENERAL, $userid);
+        $bc->execute_plan();
+
+        $results = $bc->get_results();
+        $results['backup_destination']->extract_to_pathname($packer, "$CFG->tempdir/backup/core_course_testcase");
+
+        $bc->destroy();
+        unset($bc);
+        return 'core_course_testcase';
+    }
+
+    /**
+     * Create a role with capabilities and permissions.
+     *
+     * @param string|array $caps Capability names.
+     * @param int $perm Constant CAP_* to apply to the capabilities.
+     * @return int The new role ID.
+     */
+    protected function create_role_with_caps($caps, $perm) {
+        $caps = (array) $caps;
+        $dg = $this->getDataGenerator();
+        $roleid = $dg->create_role();
+        foreach ($caps as $cap) {
+            assign_capability($cap, $perm, $roleid, context_system::instance()->id, true);
+        }
+        accesslib_clear_all_caches_for_unit_testing();
+        return $roleid;
+    }
+
+    /**
+     * Restore a course.
+     *
+     * @param int $backupid The backup ID.
+     * @param int $courseid The course ID to restore in, or 0.
+     * @param int $userid The ID of the user performing the restore.
+     * @return stdClass The updated course object.
+     */
+    protected function restore_course($backupid, $courseid, $userid) {
+        global $DB;
+
+        $target = backup::TARGET_CURRENT_ADDING;
+        if (!$courseid) {
+            $target = backup::TARGET_NEW_COURSE;
+            $categoryid = $DB->get_field_sql("SELECT MIN(id) FROM {course_categories}");
+            $courseid = restore_dbops::create_new_course('Tmp', 'tmp', $categoryid);
+        }
+
+        $rc = new restore_controller($backupid, $courseid, backup::INTERACTIVE_NO, backup::MODE_GENERAL, $userid, $target);
+        $target == backup::TARGET_NEW_COURSE ?: $rc->get_plan()->get_setting('overwrite_conf')->set_value(true);
+        $rc->execute_precheck();
+        $rc->execute_plan();
+
+        $course = $DB->get_record('course', array('id' => $rc->get_courseid()));
+
+        $rc->destroy();
+        unset($rc);
+        return $course;
+    }
+
+    /**
+     * Restore a course to an existing course.
+     *
+     * @param int $backupid The backup ID.
+     * @param int $courseid The course ID to restore in.
+     * @param int $userid The ID of the user performing the restore.
+     * @return stdClass The updated course object.
+     */
+    protected function restore_to_existing_course($backupid, $courseid, $userid = 2) {
+        return $this->restore_course($backupid, $courseid, $userid);
+    }
+
+    /**
+     * Restore a course to a new course.
+     *
+     * @param int $backupid The backup ID.
+     * @param int $userid The ID of the user performing the restore.
+     * @return stdClass The new course object.
+     */
+    protected function restore_to_new_course($backupid, $userid = 2) {
+        return $this->restore_course($backupid, 0, $userid);
+    }
+
+    public function test_restore_existing_idnumber_in_new_course() {
+        $this->resetAfterTest();
+
+        $dg = $this->getDataGenerator();
+        $c1 = $dg->create_course(['idnumber' => 'ABC']);
+        $backupid = $this->backup_course($c1->id);
+        $c2 = $this->restore_to_new_course($backupid);
+
+        // The ID number is set empty.
+        $this->assertEquals('', $c2->idnumber);
+    }
+
+    public function test_restore_non_existing_idnumber_in_new_course() {
+        global $DB;
+        $this->resetAfterTest();
+
+        $dg = $this->getDataGenerator();
+        $c1 = $dg->create_course(['idnumber' => 'ABC']);
+        $backupid = $this->backup_course($c1->id);
+
+        $c1->idnumber = 'BCD';
+        $DB->update_record('course', $c1);
+
+        // The ID number changed.
+        $c2 = $this->restore_to_new_course($backupid);
+        $this->assertEquals('ABC', $c2->idnumber);
+    }
+
+    public function test_restore_existing_idnumber_in_existing_course() {
+        global $DB;
+        $this->resetAfterTest();
+
+        $dg = $this->getDataGenerator();
+        $c1 = $dg->create_course(['idnumber' => 'ABC']);
+        $c2 = $dg->create_course(['idnumber' => 'DEF']);
+        $backupid = $this->backup_course($c1->id);
+
+        // The ID number does not change.
+        $c2 = $this->restore_to_existing_course($backupid, $c2->id);
+        $this->assertEquals('DEF', $c2->idnumber);
+
+        $c1 = $DB->get_record('course', array('id' => $c1->id));
+        $this->assertEquals('ABC', $c1->idnumber);
+    }
+
+    public function test_restore_non_existing_idnumber_in_existing_course() {
+        global $DB;
+        $this->resetAfterTest();
+
+        $dg = $this->getDataGenerator();
+        $c1 = $dg->create_course(['idnumber' => 'ABC']);
+        $c2 = $dg->create_course(['idnumber' => 'DEF']);
+        $backupid = $this->backup_course($c1->id);
+
+        $c1->idnumber = 'XXX';
+        $DB->update_record('course', $c1);
+
+        // The ID number has changed.
+        $c2 = $this->restore_to_existing_course($backupid, $c2->id);
+        $this->assertEquals('ABC', $c2->idnumber);
+    }
+
+    public function test_restore_idnumber_in_existing_course_without_permissions() {
+        global $DB;
+        $this->resetAfterTest();
+        $dg = $this->getDataGenerator();
+        $u1 = $dg->create_user();
+
+        $managers = get_archetype_roles('manager');
+        $manager = array_shift($managers);
+        $roleid = $this->create_role_with_caps('moodle/course:changeidnumber', CAP_PROHIBIT);
+        $dg->role_assign($manager->id, $u1->id);
+        $dg->role_assign($roleid, $u1->id);
+
+        $c1 = $dg->create_course(['idnumber' => 'ABC']);
+        $c2 = $dg->create_course(['idnumber' => 'DEF']);
+        $backupid = $this->backup_course($c1->id);
+
+        $c1->idnumber = 'XXX';
+        $DB->update_record('course', $c1);
+
+        // The ID number does not change.
+        $c2 = $this->restore_to_existing_course($backupid, $c2->id, $u1->id);
+        $this->assertEquals('DEF', $c2->idnumber);
+    }
+
+    public function test_restore_course_info_in_new_course() {
+        global $DB;
+        $this->resetAfterTest();
+        $dg = $this->getDataGenerator();
+
+        $c1 = $dg->create_course(['shortname' => 'SN', 'fullname' => 'FN', 'summary' => 'DESC', 'summaryformat' => FORMAT_MOODLE]);
+        $backupid = $this->backup_course($c1->id);
+
+        // The information is restored but adapted because names are already taken.
+        $c2 = $this->restore_to_new_course($backupid);
+        $this->assertEquals('SN_1', $c2->shortname);
+        $this->assertEquals('FN copy 1', $c2->fullname);
+        $this->assertEquals('DESC', $c2->summary);
+        $this->assertEquals(FORMAT_MOODLE, $c2->summaryformat);
+    }
+
+    public function test_restore_course_info_in_existing_course() {
+        global $DB;
+        $this->resetAfterTest();
+        $dg = $this->getDataGenerator();
+
+        $c1 = $dg->create_course(['shortname' => 'SN', 'fullname' => 'FN', 'summary' => 'DESC', 'summaryformat' => FORMAT_MOODLE]);
+        $c2 = $dg->create_course(['shortname' => 'A', 'fullname' => 'B', 'summary' => 'C', 'summaryformat' => FORMAT_PLAIN]);
+        $backupid = $this->backup_course($c1->id);
+
+        // The information is restored but adapted because names are already taken.
+        $c2 = $this->restore_to_existing_course($backupid, $c2->id);
+        $this->assertEquals('SN_1', $c2->shortname);
+        $this->assertEquals('FN copy 1', $c2->fullname);
+        $this->assertEquals('DESC', $c2->summary);
+        $this->assertEquals(FORMAT_MOODLE, $c2->summaryformat);
+    }
+
+    public function test_restore_course_shortname_in_existing_course_without_permissions() {
+        global $DB;
+        $this->resetAfterTest();
+        $dg = $this->getDataGenerator();
+        $u1 = $dg->create_user();
+
+        $managers = get_archetype_roles('manager');
+        $manager = array_shift($managers);
+        $roleid = $this->create_role_with_caps('moodle/course:changeshortname', CAP_PROHIBIT);
+        $dg->role_assign($manager->id, $u1->id);
+        $dg->role_assign($roleid, $u1->id);
+
+        $c1 = $dg->create_course(['shortname' => 'SN', 'fullname' => 'FN', 'summary' => 'DESC', 'summaryformat' => FORMAT_MOODLE]);
+        $c2 = $dg->create_course(['shortname' => 'A1', 'fullname' => 'B1', 'summary' => 'C1', 'summaryformat' => FORMAT_PLAIN]);
+
+        // The shortname does not change.
+        $backupid = $this->backup_course($c1->id);
+        $restored = $this->restore_to_existing_course($backupid, $c2->id, $u1->id);
+        $this->assertEquals($c2->shortname, $restored->shortname);
+        $this->assertEquals('FN copy 1', $restored->fullname);
+        $this->assertEquals('DESC', $restored->summary);
+        $this->assertEquals(FORMAT_MOODLE, $restored->summaryformat);
+    }
+
+    public function test_restore_course_fullname_in_existing_course_without_permissions() {
+        global $DB;
+        $this->resetAfterTest();
+        $dg = $this->getDataGenerator();
+        $u1 = $dg->create_user();
+
+        $managers = get_archetype_roles('manager');
+        $manager = array_shift($managers);
+        $roleid = $this->create_role_with_caps('moodle/course:changefullname', CAP_PROHIBIT);
+        $dg->role_assign($manager->id, $u1->id);
+        $dg->role_assign($roleid, $u1->id);
+
+        $c1 = $dg->create_course(['shortname' => 'SN', 'fullname' => 'FN', 'summary' => 'DESC', 'summaryformat' => FORMAT_MOODLE]);
+        $c2 = $dg->create_course(['shortname' => 'A1', 'fullname' => 'B1', 'summary' => 'C1', 'summaryformat' => FORMAT_PLAIN]);
+
+        // The fullname does not change.
+        $backupid = $this->backup_course($c1->id);
+        $restored = $this->restore_to_existing_course($backupid, $c2->id, $u1->id);
+        $this->assertEquals('SN_1', $restored->shortname);
+        $this->assertEquals($c2->fullname, $restored->fullname);
+        $this->assertEquals('DESC', $restored->summary);
+        $this->assertEquals(FORMAT_MOODLE, $restored->summaryformat);
+    }
+
+    public function test_restore_course_summary_in_existing_course_without_permissions() {
+        global $DB;
+        $this->resetAfterTest();
+        $dg = $this->getDataGenerator();
+        $u1 = $dg->create_user();
+
+        $managers = get_archetype_roles('manager');
+        $manager = array_shift($managers);
+        $roleid = $this->create_role_with_caps('moodle/course:changesummary', CAP_PROHIBIT);
+        $dg->role_assign($manager->id, $u1->id);
+        $dg->role_assign($roleid, $u1->id);
+
+        $c1 = $dg->create_course(['shortname' => 'SN', 'fullname' => 'FN', 'summary' => 'DESC', 'summaryformat' => FORMAT_MOODLE]);
+        $c2 = $dg->create_course(['shortname' => 'A1', 'fullname' => 'B1', 'summary' => 'C1', 'summaryformat' => FORMAT_PLAIN]);
+
+        // The summary and format do not change.
+        $backupid = $this->backup_course($c1->id);
+        $restored = $this->restore_to_existing_course($backupid, $c2->id, $u1->id);
+        $this->assertEquals('SN_1', $restored->shortname);
+        $this->assertEquals('FN copy 1', $restored->fullname);
+        $this->assertEquals($c2->summary, $restored->summary);
+        $this->assertEquals($c2->summaryformat, $restored->summaryformat);
+    }
+}

install/lang/br/langconfig.php

@@ -0,0 +1,34 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['thisdirection'] = 'ltr';
+$string['thislanguage'] = 'Breizh';

install/lang/ca/install.php

@@ -35,7 +35,7 @@ $string['availablelangs'] = 'Llista d\'idiomes disponibles';
 $string['chooselanguagehead'] = 'Trieu un idioma';
 $string['chooselanguagesub'] = 'Trieu un idioma per a la instal·lació. S\'utilitzarà també com a idioma per defecte del lloc, tot i que després podeu canviar-lo.';
 $string['clialreadyconfigured'] = 'El fitxer config.php ja existeix, feu servir dmin/cli/install_database.php si voleu instal·lar aquest lloc web.';
-$string['clialreadyinstalled'] = 'El fitxer config.php ja existeix, feu servir admin/cli/upgrade.php si voleu actualitzar aquest lloc web.';
+$string['clialreadyinstalled'] = 'El fitxer de configuració config.php ja existeix. Feu servir admin/cli/upgrade.php si voleu actualitzar Moodle per a aquest lloc web.';
 $string['cliinstallheader'] = 'Programa d\'instal·lació de línia d\'ordres de Moodle {$a}';
 $string['databasehost'] = 'Servidor de base de dades:';
 $string['databasename'] = 'Nom de la base de dades:';

install/lang/da/install.php

@@ -34,6 +34,7 @@ $string['admindirname'] = 'Admin-mappe';
 $string['availablelangs'] = 'Tilgængelige sprogpakker';
 $string['chooselanguagehead'] = 'Vælg et sprog';
 $string['chooselanguagesub'] = 'Vælg et sprog til brug under installationen. Dette sprog vil også blive brugt som standardsprog på webstedet, men det kan altid ændres til et andet sprog.';
+$string['clialreadyconfigured'] = 'Konfigurationsfilen config.php eksisterer allerede. Benyt venigst admin/cli/install_database.php til at installere Moodle for dette site.';
 $string['clialreadyinstalled'] = 'Filen config.php eksisterer allerede, brug venligst admin/cli/upgrade.php hvis du ønsker at opgradere dette websted.';
 $string['cliinstallheader'] = 'Moodle {$a} kommandolinje-installationsprogram';
 $string['databasehost'] = 'Databasevært';

install/lang/es_mx/install.php

@@ -90,7 +90,7 @@ $string['phpversionhelp'] = '<p>Moodle requiere al menos una versión de PHP 4.3
 <p>¡Debe actualizar PHP o trasladarse a otro servidor con una versión más reciente de PHP!<br />
 (En caso de 5.0.x podría también revertir a la versión 4.4.x)</p>';
 $string['welcomep10'] = '{$a->installername} ({$a->installerversion})';
-$string['welcomep20'] = 'Si está viendo esta página es porque ha podido ejecutar el paquete <strong>{$a->packname} {$a->packversion}</strong> en su computadora. !Enhorabuena!';
+$string['welcomep20'] = 'Si está viendo esta página es porque ha podido instalar y ejecutar exitosamente el paquete <strong>{$a->packname} {$a->packversion}</strong> en su computadora. !Enhorabuena!';
 $string['welcomep30'] = 'Esta versión de <strong>{$a->installername}</strong> incluye las aplicaciones necesarias para que <strong>Moodle</strong> funcione en su computadora,  principalmente:';
 $string['welcomep40'] = 'El paquete también incluye <strong>Moodle {$a->moodlerelease} ({$a->moodleversion})</strong>.';
 $string['welcomep50'] = 'El uso de todas las aplicaciones del paquete está gobernado por sus respectivas

install/lang/fr/admin.php

@@ -40,5 +40,5 @@ $string['cliunknowoption'] = 'Options non reconnues :
  {$a}.
 Utilisez l\'option --help.';
 $string['cliyesnoprompt'] = 'Tapez y (pour oui) ou n (pour non)';
-$string['environmentrequireinstall'] = 'doit être installé et activé';
-$string['environmentrequireversion'] = 'la version {$a->needed} est requise ; vous utilisez actuellement la version {$a->current}';
+$string['environmentrequireinstall'] = 'L\'extension doit être installée et activée';
+$string['environmentrequireversion'] = 'La version {$a->needed} est requise ; vous utilisez actuellement la version {$a->current}';

install/lang/mk/moodle.php

@@ -33,3 +33,4 @@ defined('MOODLE_INTERNAL') || die();
 $string['language'] = 'Јазик';
 $string['next'] = 'Следно';
 $string['previous'] = 'Претходно';
+$string['reload'] = 'Вчитај повторно';

install/lang/pt/error.php

@@ -44,7 +44,7 @@ $string['dmlexceptiononinstall'] = '<p>Ocorreu um erro de base de dados [{$a->er
 $string['downloadedfilecheckfailed'] = 'A verificação do ficheiro descarregado falhou.';
 $string['invalidmd5'] = 'A variável de verificação está errada - tente novamente.';
 $string['missingrequiredfield'] = 'Um dos campos obrigatórios está em falta';
-$string['remotedownloaderror'] = 'O download do componente para o servidor falhou. Verifique as configurações do proxy. A instalação da extensão cURL do PHP é muito recomendada.<br /><br />Terá de fazer manualmente o download do ficheiro <a href="{$a->url}">{$a->url}</a>, copiá-lo para a pasta "{$a->dest}" no seu servidor e descompactá-lo';
+$string['remotedownloaderror'] = 'Não foi possível descarregar o componente para o servidor. Verifique as configurações do proxy. A instalação da extensão cURL do PHP é muito recomendada.<br /><br />Terá de descarregar manualmente o ficheiro <a href="{$a->url}">{$a->url}</a>, copiá-lo para a pasta "{$a->dest}" no seu servidor e descompactá-lo';
 $string['wrongdestpath'] = 'Caminho de destino errado';
 $string['wrongsourcebase'] = 'Base do URL de origem errada';
 $string['wrongzipfilename'] = 'Nome de ficheiro ZIP errado';

install/lang/pt/install.php

@@ -48,7 +48,7 @@ $string['environmenthead'] = 'A verificar sistema...';
 $string['environmentsub2'] = 'Cada nova versão do Moodle tem pré-requisitos mínimos relativamente à versão do PHP e extensões necessárias para o seu correto funcionamento. Estes pré-requisitos são verificados sempre que o Moodle é instalado ou atualizado. Contacte o administrador do servidor caso seja necessário atualizar a versão do PHP ou instalar novas extensões.';
 $string['errorsinenvironment'] = 'A verificação do sistema falhou!';
 $string['installation'] = 'Instalação';
-$string['langdownloaderror'] = 'Não foi possível instalar o idioma <b>{$a}</b> por falha no download. O processo de instalação continuará em Inglês.';
+$string['langdownloaderror'] = 'Não foi possível descarregar o idioma <b>{$a}</b> . O processo de instalação continuará em Inglês.';
 $string['memorylimithelp'] = '<p>O limite de memória para o PHP definido atualmente no servidor é <b>{$a}</b>.</p><p>Um número elevado de módulos em utilização ou de utilizadores registados pode fazer com que o Moodle apresente problemas de falta de memória.</p><p>É recomendado que o PHP seja configurado com um limite de memória de pelo menos 40MB. Esta configuração pode ser definida de diversas formas:</p><ol><li>Compilação do PHP com o parâmetro <b>--enable-memory-limit</b>. Esta definição permitirá ao próprio Moodle definir o valor a utilizar.</li><li>Alteração do parâmetro <b>memory_limit</b> no ficheiro de configuração do PHP para um valor igual ou superior a 40MB.</li><li>Criação de um ficheiro <b>.htaccess</b> na raiz da pasta do Moodle com a linha <b>php_value memory_limit 40M</b><p>ATENÇÃO: Em alguns servidores esta configuração impedirá o funcionamento de <b>todas</b> as páginas PHP. Nestes casos, não poderá ser utilizado o ficheiro <b>.htaccess</b>.</p></li></ol>';
 $string['paths'] = 'Caminhos';
 $string['pathserrcreatedataroot'] = 'O programa de instalação não conseguiu criar a pasta de dados <b>{$a->dataroot}</b>.';

install/lang/ro/error.php

@@ -42,6 +42,7 @@ $string['cannotsavemd5file'] = 'Fişierul md5 nu poate fi salvat';
 $string['cannotsavezipfile'] = 'Arhiva ZIP nu poate fi salvată';
 $string['cannotunzipfile'] = 'Arhiva nu poate fi deschisă';
 $string['componentisuptodate'] = 'Componenta este actualizată';
+$string['dmlexceptiononinstall'] = '<p>A apărut o problemă la baza de date [{$a->errorcode}].<br />{$a->debuginfo}</p>';
 $string['downloadedfilecheckfailed'] = 'Verificarea fişierului descărcat a eşuat';
 $string['invalidmd5'] = 'md5 incorect';
 $string['missingrequiredfield'] = 'Lipseşte un câmp obligatoriu';

install/lang/ro/install.php

@@ -36,6 +36,7 @@ $string['chooselanguagehead'] = 'Selectare limbă';
 $string['chooselanguagesub'] = 'Vă rugăm selectaţi limba pentru interfaţa de instalare, limba selectată va fi folosită EXCLUSIV în cadrul procedurii de instalare. Ulterior veţi putea selecta limba în care doriţi să fie afişată interfaţa.';
 $string['clialreadyconfigured'] = 'Fișierul de configurare';
 $string['clialreadyinstalled'] = 'Fișierul de configurare config.php există deja. Vă rugăm să folosiți dmin/cli/install_database.php to pentru a upgrada Moodle pentru acest site.';
+$string['cliinstallheader'] = 'Program  command line installation Moodle {$a}';
 $string['databasehost'] = 'Gazdă baza de date';
 $string['databasename'] = 'Nume baza de date';
 $string['databasetypehead'] = 'Alegere driver baza de date';
@@ -44,9 +45,13 @@ $string['datarootpermission'] = 'Permisiuni directoare date';
 $string['dbprefix'] = 'Prefix tabele';
 $string['dirroot'] = 'Director Moodle';
 $string['environmenthead'] = 'Se verifică mediul...';
+$string['environmentsub2'] = 'Fiecare versiune Moodle are o anumită cerință minimă PHP și un număr de extensii PHP obligatorii.
+Verificarea completă a mediului se face înainte de fiecare instalare și upgrade. Vă rugăm să contactați administratorul serverului, dacă nu știți cum se instalează noua versiune sau dacă activați extensiile PHP.';
+$string['errorsinenvironment'] = 'Verificarea mediului eșuată!';
 $string['installation'] = 'Instalare';
 $string['langdownloaderror'] = 'Din păcate, limba "{$a}" nu a putut fi descărcată. Procesul de instalare va continua în limba engleză.';
 $string['paths'] = 'Căi';
+$string['pathserrcreatedataroot'] = 'Data directory ({$a->dataroot}) nu poate fi creat de către installer.';
 $string['pathshead'] = 'Confirmare căi';
 $string['pathsrodataroot'] = 'Directorul dataroot nu poate fi scris.';
 $string['pathssubdirroot'] = '<p>Calea completă către directorul care conține codul Moodle .</p>';
@@ -54,5 +59,10 @@ $string['pathsunsecuredataroot'] = 'Locația dataroot nu este sigură';
 $string['pathswrongadmindir'] = 'Directorul admin nu există';
 $string['phpextension'] = 'extensie PHP {$a}';
 $string['phpversion'] = 'Versiune PHP';
+$string['phpversionhelp'] = '<p>Moodle necesită o versiune PHP de cel puțin  4.3.0 or 5.1.0 (5.0.x are un număr de probleme cunscute).</p>
+<p>Momentan rulați versiunea {$a}</p>
+<p>Trebuie să upgradați PHP sau să îl mutați pe o gazdă cu o nouă versiune de PHP!<br />
+(În cazul 5.0.x puteți, de asemenea, să downgradați la versiunea 4.4.x)</p>';
 $string['welcomep10'] = '{$a->installername} ({$a->installerversion})';
+$string['welcomep40'] = 'Pachetul include și <strong>Moodle {$a->moodlerelease} ({$a->moodleversion})</strong>.';
 $string['wwwroot'] = 'Adresă Web';

install/lang/sl/install.php

@@ -40,6 +40,7 @@ $string['databasehost'] = 'Gostitelj podatkovne baze';
 $string['databasename'] = 'Ime podatkovne baze';
 $string['databasetypehead'] = 'Izberite gonilnik podatkovne baze';
 $string['dataroot'] = 'Imenik za podatke';
+$string['datarootpermission'] = 'Pravice za podatkovno mapo';
 $string['dbprefix'] = 'Predpona tabel';
 $string['dirroot'] = 'Imenik Moodle';
 $string['environmenthead'] = 'Preverjanje vašega okolja ...';

lib/badgeslib.php

@@ -1141,12 +1141,7 @@ function profile_display_badges($userid, $courseid = 0) {
     global $CFG, $PAGE, $USER, $SITE;
     require_once($CFG->dirroot . '/badges/renderer.php');
 
-    // Determine context.
-    if (isloggedin()) {
-        $context = context_user::instance($USER->id);
-    } else {
-        $context = context_system::instance();
-    }
+    $context = context_user::instance($userid);
 
     if ($USER->id == $userid || has_capability('moodle/badges:viewotherbadges', $context)) {
         $records = badges_get_user_badges($userid, $courseid, null, null, null, true);

lib/classes/user.php

@@ -257,15 +257,15 @@ class core_user {
         // Every new field on the user table should be added here otherwise it won't be validated.
         $fields = array();
         $fields['id'] = array('type' => PARAM_INT);
-        $fields['auth'] = array('type' => PARAM_NOTAGS);
+        $fields['auth'] = array('type' => PARAM_AUTH);
         $fields['confirmed'] = array('type' => PARAM_BOOL);
         $fields['policyagreed'] = array('type' => PARAM_BOOL);
         $fields['deleted'] = array('type' => PARAM_BOOL);
         $fields['suspended'] = array('type' => PARAM_BOOL);
-        $fields['mnethostid'] = array('type' => PARAM_BOOL);
+        $fields['mnethostid'] = array('type' => PARAM_INT);
         $fields['username'] = array('type' => PARAM_USERNAME);
-        $fields['password'] = array('type' => PARAM_NOTAGS);
-        $fields['idnumber'] = array('type' => PARAM_NOTAGS);
+        $fields['password'] = array('type' => PARAM_RAW);
+        $fields['idnumber'] = array('type' => PARAM_RAW);
         $fields['firstname'] = array('type' => PARAM_NOTAGS);
         $fields['lastname'] = array('type' => PARAM_NOTAGS);
         $fields['surname'] = array('type' => PARAM_NOTAGS);
@@ -282,20 +282,20 @@ class core_user {
         $fields['department'] = array('type' => PARAM_TEXT);
         $fields['address'] = array('type' => PARAM_TEXT);
         $fields['city'] = array('type' => PARAM_TEXT);
-        $fields['country'] = array('type' => PARAM_TEXT);
-        $fields['lang'] = array('type' => PARAM_TEXT);
+        $fields['country'] = array('type' => PARAM_ALPHA);
+        $fields['lang'] = array('type' => PARAM_LANG);
         $fields['calendartype'] = array('type' => PARAM_NOTAGS);
-        $fields['theme'] = array('type' => PARAM_NOTAGS);
-        $fields['timezones'] = array('type' => PARAM_TEXT);
+        $fields['theme'] = array('type' => PARAM_THEME);
+        $fields['timezone'] = array('type' => PARAM_TIMEZONE);
         $fields['firstaccess'] = array('type' => PARAM_INT);
         $fields['lastaccess'] = array('type' => PARAM_INT);
         $fields['lastlogin'] = array('type' => PARAM_INT);
         $fields['currentlogin'] = array('type' => PARAM_INT);
         $fields['lastip'] = array('type' => PARAM_NOTAGS);
-        $fields['secret'] = array('type' => PARAM_TEXT);
+        $fields['secret'] = array('type' => PARAM_RAW);
         $fields['picture'] = array('type' => PARAM_INT);
         $fields['url'] = array('type' => PARAM_URL);
-        $fields['description'] = array('type' => PARAM_CLEANHTML);
+        $fields['description'] = array('type' => PARAM_RAW);
         $fields['descriptionformat'] = array('type' => PARAM_INT);
         $fields['mailformat'] = array('type' => PARAM_INT);
         $fields['maildigest'] = array('type' => PARAM_INT);

lib/tests/scheduled_task_test.php

@@ -132,8 +132,9 @@ class core_scheduled_task_testcase extends advanced_testcase {
         // We are testing a difference between $CFG->timezone and the php.ini timezone.
         // GMT+8.
         date_default_timezone_set('Australia/Perth');
-        // GMT-04:30.
-        $CFG->timezone = 'America/Caracas';
+
+        // GMT+04:30.
+        $CFG->timezone = 'Asia/Kabul';
 
         $testclass = new \core\task\scheduled_test_task();
 
@@ -149,9 +150,9 @@ class core_scheduled_task_testcase extends advanced_testcase {
         $userdate = userdate($nexttime);
 
         // Should be displayed in user timezone.
-        // I used http://www.timeanddate.com/worldclock/fixedtime.html?msg=Moodle+Test&iso=20140314T01&p1=58
-        // to verify this time.
-        $this->assertContains('11:15 AM', core_text::strtoupper($userdate));
+        // I used http://www.timeanddate.com/worldclock/fixedtime.html?msg=Moodle+Test&iso=20160502T01&p1=113
+        // setting my location to Kathmandu to verify this time.
+        $this->assertContains('2:15 AM', core_text::strtoupper($userdate));
 
         $CFG->timezone = $currenttimezonecfg;
         date_default_timezone_set($currenttimezonephp);

mod/forum/index.php

@@ -230,7 +230,7 @@ if ($generalforums) {
                 } else if ($unread = forum_tp_count_forum_unread_posts($cm, $course)) {
                         $unreadlink = '<span class="unread"><a href="view.php?f='.$forum->id.'">'.$unread.'</a>';
                     $unreadlink .= '<a title="'.$strmarkallread.'" href="markposts.php?f='.
-                                   $forum->id.'&amp;mark=read"><img src="'.$OUTPUT->pix_url('t/markasread') . '" alt="'.$strmarkallread.'" class="iconsmall" /></a></span>';
+                                   $forum->id.'&amp;mark=read&amp;sesskey=' . sesskey() . '"><img src="'.$OUTPUT->pix_url('t/markasread') . '" alt="'.$strmarkallread.'" class="iconsmall" /></a></span>';
                 } else {
                     $unreadlink = '<span class="read">0</span>';
                 }
@@ -368,7 +368,7 @@ if ($course->id != SITEID) {    // Only real courses have learning forums
                     } else if ($unread = forum_tp_count_forum_unread_posts($cm, $course)) {
                         $unreadlink = '<span class="unread"><a href="view.php?f='.$forum->id.'">'.$unread.'</a>';
                         $unreadlink .= '<a title="'.$strmarkallread.'" href="markposts.php?f='.
-                                       $forum->id.'&amp;mark=read"><img src="'.$OUTPUT->pix_url('t/markasread') . '" alt="'.$strmarkallread.'" class="iconsmall" /></a></span>';
+                                       $forum->id.'&amp;mark=read&sesskey=' . sesskey() . '"><img src="'.$OUTPUT->pix_url('t/markasread') . '" alt="'.$strmarkallread.'" class="iconsmall" /></a></span>';
                     } else {
                         $unreadlink = '<span class="read">0</span>';
                     }

mod/forum/lib.php

@@ -3805,7 +3805,7 @@ function forum_print_discussion_header(&$post, $forum, $group=-1, $datestring=""
                     echo $post->unread;
                     echo '</a>';
                     echo '<a title="'.$strmarkalldread.'" href="'.$CFG->wwwroot.'/mod/forum/markposts.php?f='.
-                         $forum->id.'&amp;d='.$post->discussion.'&amp;mark=read&amp;returnpage=view.php">' .
+                         $forum->id.'&amp;d='.$post->discussion.'&amp;mark=read&amp;returnpage=view.php&amp;sesskey=' . sesskey() . '">' .
                          '<img src="'.$OUTPUT->pix_url('t/markasread') . '" class="iconsmall" alt="'.$strmarkalldread.'" /></a>';
                     echo '</span>';
                 } else {
@@ -5486,7 +5486,7 @@ function forum_print_latest_discussions($course, $forum, $maxdiscussions = -1, $
                 if ($forumtracked) {
                     echo '<a title="'.get_string('markallread', 'forum').
                          '" href="'.$CFG->wwwroot.'/mod/forum/markposts.php?f='.
-                         $forum->id.'&amp;mark=read&amp;returnpage=view.php">'.
+                         $forum->id.'&amp;mark=read&amp;returnpage=view.php&amp;sesskey=' . sesskey() . '">'.
                          '<img src="'.$OUTPUT->pix_url('t/markasread') . '" class="iconsmall" alt="'.get_string('markallread', 'forum').'" /></a>';
                 }
                 echo '</th>';

mod/forum/markposts.php

@@ -55,6 +55,7 @@ if (!$cm = get_coursemodule_from_instance("forum", $forum->id, $course->id)) {
 $user = $USER;
 
 require_login($course, false, $cm);
+require_sesskey();
 
 if ($returnpage == 'index.php') {
     $returnto = forum_go_back_to(new moodle_url("/mod/forum/$returnpage", array('id' => $course->id)));

mod/forum/subscribe.php

@@ -53,7 +53,9 @@ if (!is_null($sesskey)) {
 }
 if (!is_null($discussionid)) {
     $url->param('d', $discussionid);
-    $discussion = $DB->get_record('forum_discussions', array('id' => $discussionid), '*', MUST_EXIST);
+    if (!$discussion = $DB->get_record('forum_discussions', array('id' => $discussionid, 'forum' => $id))) {
+        print_error('invaliddiscussionid', 'forum');
+    }
 }
 $PAGE->set_url($url);
 

mod/forum/subscribe_ajax.php

@@ -32,7 +32,7 @@ $includetext    = optional_param('includetext', false, PARAM_BOOL);
 
 $forum          = $DB->get_record('forum', array('id' => $forumid), '*', MUST_EXIST);
 $course         = $DB->get_record('course', array('id' => $forum->course), '*', MUST_EXIST);
-$discussion     = $DB->get_record('forum_discussions', array('id' => $discussionid), '*', MUST_EXIST);
+$discussion     = $DB->get_record('forum_discussions', array('id' => $discussionid, 'forum' => $forumid), '*', MUST_EXIST);
 $cm             = get_coursemodule_from_instance('forum', $forum->id, $course->id, false, MUST_EXIST);
 $context        = context_module::instance($cm->id);
 

mod/scorm/player.js

@@ -23,6 +23,7 @@ function scorm_openpopup(url,name,options,width,height) {
     options += ",width=" + width + ",height=" + height;
 
     windowobj = window.open(url,name,options);
+    windowobj.opener = null;
     if (!windowobj) {
         return;
     }

mod/scorm/view.js

@@ -83,6 +83,7 @@ M.mod_scormform.init = function(Y) {
         winobj = window.open(launch_url,'Popup', poptions);
         this.target = 'Popup';
         scormredirect(winobj);
+        winobj.opener = null;
     }
     // Listen for view form submit and generate popup on user interaction.
     if (scormform) {
@@ -91,6 +92,7 @@ M.mod_scormform.init = function(Y) {
             winobj = window.open(launch_url, 'Popup', poptions);
             this.target = 'Popup';
             scormredirect(winobj);
+            winobj.opener = null;
             e.preventDefault();
         }, scormform);
     }

user/edit_form.php

@@ -133,6 +133,7 @@ class user_edit_form extends moodleform {
             $fields = get_user_fieldnames();
             $authplugin = get_auth_plugin($user->auth);
             $customfields = $authplugin->get_custom_user_profile_fields();
+            $customfieldsdata = profile_user_record($userid, false);
             $fields = array_merge($fields, $customfields);
             foreach ($fields as $field) {
                 if ($field === 'description') {
@@ -144,7 +145,15 @@ class user_edit_form extends moodleform {
                 if (!$mform->elementExists($formfield)) {
                     continue;
                 }
-                $value = $mform->getElement($formfield)->exportValue($mform->getElementValue($formfield)) ?: '';
+
+                // Get the original value for the field.
+                if (in_array($field, $customfields)) {
+                    $key = str_replace('profile_field_', '', $field);
+                    $value = isset($customfieldsdata->{$key}) ? $customfieldsdata->{$key} : '';
+                } else {
+                    $value = $user->{$field};
+                }
+
                 $configvariable = 'field_lock_' . $field;
                 if (isset($authplugin->config->{$configvariable})) {
                     if ($authplugin->config->{$configvariable} === 'locked') {

user/profile/lib.php

@@ -551,9 +551,10 @@ function profile_signup_fields($mform) {
 /**
  * Returns an object with the custom profile fields set for the given user
  * @param integer $userid
+ * @param bool $onlyinuserobject True if you only want the ones in $USER.
  * @return stdClass
  */
-function profile_user_record($userid) {
+function profile_user_record($userid, $onlyinuserobject = true) {
     global $CFG, $DB;
 
     $usercustomfields = new stdClass();
@@ -563,7 +564,7 @@ function profile_user_record($userid) {
             require_once($CFG->dirroot.'/user/profile/field/'.$field->datatype.'/field.class.php');
             $newfield = 'profile_field_'.$field->datatype;
             $formfield = new $newfield($field->id, $userid);
-            if ($formfield->is_user_object_data()) {
+            if (!$onlyinuserobject || $formfield->is_user_object_data()) {
                 $usercustomfields->{$field->shortname} = $formfield->data;
             }
         }

user/tests/profilelib_test.php

@@ -62,6 +62,9 @@ class core_user_profilelib_testcase extends advanced_testcase {
         // Check that profile_user_record returns same (no) fields.
         $this->assertObjectNotHasAttribute('frogdesc', profile_user_record($user->id));
 
+        // Check that profile_user_record returns all the fields when requested.
+        $this->assertObjectHasAttribute('frogdesc', profile_user_record($user->id, false));
+
         // Add another custom field, this time of normal text type.
         $id2 = $DB->insert_record('user_info_field', array(
                 'shortname' => 'frogname', 'name' => 'Name of frog', 'categoryid' => 1,
@@ -77,6 +80,9 @@ class core_user_profilelib_testcase extends advanced_testcase {
 
         // Check profile_user_record returns same field.
         $this->assertObjectHasAttribute('frogname', profile_user_record($user->id));
+
+        // Check that profile_user_record returns all the fields when requested.
+        $this->assertObjectHasAttribute('frogname', profile_user_record($user->id, false));
     }
 
     /**

version.php

@@ -29,11 +29,11 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$version  = 2014111011.00;              // 20141110      = branching date YYYYMMDD - do not modify!
+$version  = 2014111012.00;              // 20141110      = branching date YYYYMMDD - do not modify!
                                         //         RR    = release increments - 00 in DEV branches.
                                         //           .XX = incremental changes.
 
-$release  = '2.8.11 (Build: 20160314)'; // Human-friendly version name
+$release  = '2.8.12 (Build: 20160509)'; // Human-friendly version name
 
 $branch   = '28';                       // This version's branch.
 $maturity = MATURITY_STABLE;             // This version's maturity level.