In the recent issue MDL-56225, we started to record the current user as
the usermodified in the forum_discussions table when updating a forum
post. It made sense but it was a mistake.
Even if the current user really modifies the discussion by updating the
post, the field usermodified has actually been always interpreted and
displayed as the last post' author. Not as the last user who touched the
discussion.
This patch reverts that particular change to the previous behaviour and
adds explicit unit test for it.
The PARAM_TEXT has been misused in certain cases here. The 'action'
parameter seems to always be alphabetic, with values like
savesubmission, editsubmission and others as handled in assign::view().
Fixing the action handling fixes the reported XSS issue. While working
on it, I spotted two more places where PARAM_TEXT does not seem
appropriate. I include changes for them too, even if they are no
strictly related to the reported bug and there are no known ways to
abuse it.
* The 'plugin' looks like PARAM_PLUGIN and is even declared as such in
some other parts of the assignment code (such as feedback forms).
* The 'workflowstate' is one of the ASSIGN_MARKING_WORKFLOW_STATE
constants and is supposed to be alpha in external function input
parameters handling, too.
noreplyaddress should be a valid address, else
it will not be saved. For behat we don't send
email, so set it to noreply@example.com, to
avoid failing validation on localhost
The patch adds validation for the noreplyaddress setting variable, for
the explicit $replyto parameter and for the sender's email. In case of
misconfigured noreplyaddress setting, it falls back to the default
noreply address value. In case of invalid email in the user's record,
the email is not sent.
The patch also adds unit test for the value returned by the function
generate_email_processing_address() so that it can be considered as a
valid email, too.
This is supposed to significantly minimise the risk of exploiting the
vulnerability in PHPMailer's Sender field.
The 'attachments' is not a real DB field here. It comes from the form's
filepicker and holds the id of the attachments filearea. The function
forum_add_attachment() expects it as a property of the first argument.
There were two possible approaches here. Either to pass the raw $newpost
to forum_add_attachment(), or add the attachments into the list
modifiable fields. The second approach is safer.
Exceptions returned from ajax are not in the format expected by the JS, so
an error occurs and the exception popups are not appearing.
Conflicts:
lib/amd/build/notification.min.js
lib/amd/src/notification.js
In some languages "to" having the meaning of "until" and "to" having the meaning of "addressed to" are different.
This should be taken care of by having two different translation terms.
AMOS BEGIN
CPY [to,core],[addressedto,core]
AMOS END
Some DBs have troubles to execute such a huge query as generated in this
test. We do not actually need to execute it. All we need is to make sure
that the parameter placeholders are enumerated correctly. So it is what
this new test does.
Static variables do not behave the way you might expect when accessing
them through the classes inheritance. When accessing a method via self::
or static:: operators, even though the method is inherited, its variable
scope is not. So the method unique_sql_parameter() was using the scope
of the child class and each child class had its own sequence of usp1,
usp2, usp3, ... placeholders. This led to "Incorrect number of query
parameters" error when multiuple condition classes were contributing to
a single SQL query.
All credit should go to Adam Olley who debugged and described the
essence of the problem in the tracker.
Before this change if a language pack was updated by the
\tool_langimport\task\update_langpacks_task scheduled task, changes
would not be available to users until an admin manually cleared the
strings cache.
This change causes the cache to purged when a language pack it update,
this will cause it to rebuild so users will start seeing updates
automatically.
In some cases we may inspect an empty zip file. If we do open
an empty zip file, check that it changed before we attempt to write
it to disk. It may be the case that we were reading the file from
a location that we don't have write access to.
This patch changes the effective response code from a 407 to a 403 when
erroring on iOS 10 and when a HTTP_X_PLAYBACK_SESSION_ID HTTP header is
found.
This causes the iOS Media framework to send the cookie with the request
which subsequently succeeds.
Previously a purge_store was only purging caches but it was leaving a
reference to the store instance for the cache definition.
As a result, the cache was never cleared away correctly and, in cases
where the cache store makes a TCP connection to a backend system, the
number of open sockets was increasing for each store instance.
After a complete purge, as found in the unit test reset, the cache
definitions should be both purged and removed.
This change should also lead to a drop in memory consumption for unit
tests as there will no longer be references to unused definition stores.
Using moodle_url where possible is preferable to hardcoding uri's as
moodle_url is able to take care of alot of the formatting for us.
In this instance, it handles the $CFG->admin url path for us.
Several places in admin/mnet pull in required files using a hardcoded
admin dir string, as this is configurable it needs to use $CFG->admin
instead.
Places where the url is passed through moodle_url don't need to be
updated as that already automatically translates the urls for us.
The status screen in mod_feedback simply checks to see if there are any
attempts in progress to return the user status. This check should be
limited to only include instances of the current feedback activity not
any feedback activity on the site.
This is primarily because iOS has changed something under the hood which
means that only session cookies which have an expiry are passed around the
OS.
In order to make media playable outside of the browser (e.g. a video), we
must set a session cookie timeout.
Since the session timeout is configurable, this patch sets the cookie
timeout to the session timeout plus a period of one week.
This ensures that videos continue to work, and that the expired session
message is shown on the login page, but without requiring excessively long
session times.
Prior to the patch the strings wrapped as the following one
where not found and replaced when rendering the template via Javascript
{{#quote}}{{#str}}string,component{{/str}}{{/quote}}
If the quiz attempt use popup window with Javascript security it will
show to the user misleading message that he is going to lose entered
data.
To avoid this we should mark form as submitted to turn off browser`s
pop-up window when user confirms finishing attempt.
Also we need to check if core_formchangechecker is present on a page.
If two instances of moodleforms are validated in the same run, most
likely a phpunit test run, it would store the first validation result.
Now it stores the validation result per instance, not for all instances.
When registereing an external blog the choose a link button is
misleading, we don't have any repos which restrict to RSS feeds, so the
majority of results you get from the repo picker will be wrong.
Role sort order was not available in the UI (in JavaScript) due to
the use of PHP assoc arrays and JSON encoding/decoding. This patch
addresses this by sending the roles in a json array, rather than
json object.
When editing a quiz that is using the require passing grade completion method,
the grade to pass cannot be zero. Since the completion method is locked we
cannot recommend that the completion method is changed (as we do when the quiz
is being created). Instead we have to inform the user that the grade to pass
must not be zero.
When using a passing grade of zero, with the required passing grade
option, an error was displayed on the "grade to pass" element.
This was confusing as the error message is referring to the
"Require passing grade" element. This patch moves the message to
the "Require passing grade" element.
Additionaly this patch fixes a small typo in a comment.
When an image was added via Atto and it was set to resize automatically
if the alignment was set to Top, Middle or Bottom when it was made
smaller then a vertical scroll bar would be displayed.
This was caused by the interaction of the margin settings on the image
and the 100% width set via the img-responsive css class. The width of
an element only includes the content area and not any borders, padding
or margins.
This change stops atto hardcoding the styles for image alignment into
the images style tag, it instead adds a class that defines the alignment
the image should have.
This change has the benefit that themers will now be able to adjust
how atto image alignments work if they wish.
Images added before this patch will continue to have the issue
until they are edited by the plugin, at which time their legacy style
will be removed and the new alignment method will be added.
Thanks to Andrew Nicols who provided a refactor for the Alignment
and style detection code.
This is a backport of the patch from MDL-55048
Check npm install and grunt execution on the higest and lowest node
versions. Included some minor tweaks along the way:
* Move the grunt execution into scripts part of the configuration (that way
the grunt output is not collapsed and is easily visible in build output).
* Restructure the install section to be task based (thanks to Eloy for
the suggestion) and as such, don't run composer install on the grunt
task (speed up the build slightly).
* Switch around the grunt job to a matrix include so that every
variation of grunt job doesn't need to be excluded.
( https://docs.travis-ci.com/user/customizing-the-build/#Explicity-Including-Jobs )
Partial backport of MDL-52127 to allow people to use eslint linting
in earlier branches than master.
This is an earlier version of eslint than in master beacuse of
node requirements being higer.
This is a fix for a regressions introduced by MDL-54778. It
seems that escaped all our tests because there isn't any case
of such a dependency in core, but Daniele Cordella was facing
it within his surveypro module.
When there is more than one question on a page, say questions 2, 3 & 4.
Then when you click the navigation button for Q4, then it should load
the next page scrolled down so that Q4 is visible. That was not working.
If there is a required custom field that the user can fill by editing
their profile, and that field is missing, the user should be considered
as not fully set up. Instead, we want to redirect them to edit their
profile first.
There are some exceptions when we want to fall back to the previous
behaviour and check just the name and email fields. These exceptional
cases include checking remote user data in incoming MNet request (no
user id, no custom fields supported) and calls to require_login() with
redirecting disabled (typically ajax filepicker requests on profile
editing page itself).
Additional plugins that call the function user_not_fully_set_up()
themselves, should perform the strict check in most/typical cases. So
the strict mode is enabled by default even if it changes the behaviour
slightly. In improbable case of additional plugins relying on the
previous behaviour of the function, they can use the $strict parameter
and keep performing the lax check. However, I am sure the correct fix in
that case will likely be to stop abusing this function.
Note that custom fields are not currently transferred during the MNet
roaming. So having custom fields configured as required on MNet service
provider site (where users can't edit their profiles) is expected to
display an error (as the site is considered as misconfigured).
Here we optimise SQL queries for enrolled users list. Expensive subquery is
replaced with faster LEFT JOIN and the whole groups filtering component is
aded on demand.
As we experienced in a bigger moodle.org course (7500 users, 70 grade
items), the standard memory limit 256M may not be enough here. We were
not able to find any obvious memory leak in the processing. Requiring
extra memory helped in this particular case and it seems reasonable to
have it in the core.
There was a bug with serving the files from the areas instructauthors,
instructreviewers and conclusion. These three areas should not use the
itemid in the plugininfo URLs. But they did use 0 as the itemid which
broke the file previews when browsing via server files repository.
The first part of the patch fixes all relevant calls to
file_rewrite_pluginfile_urls() so that null is now properly used instead
of zero.
The second part of the fix is that we no longer delete the first $args
element in the workshop_pluginfile() function - the itemid is not
supposed to appear there now.
The last part of the patch is that instead of repeating the same code
block copy&pasted for each file area in workshop_pluginfile(), we now
have a single block covering them all.
As behat cli process is 1 run for features
Any modification in will be reflected
in later runs on cli. In this case
- disabling enablebadges in block_badges.feature
- reflected while running cron in award_badges.feature
Recent activity is showing activities which were
updated since user last logged in and first modification
done on the activity. So ensure update happens at different
time than activity created.
The old method for displaying the name of a field was being
used. This meant that it was not possible to show a plugin's
name in view.php
Thanks to David Herney Bernal for providing a solution.
Store the token value in the session and redirect to self, thus
removing the token from the URL and eliminating the problem where
the token is exposed via the http referer header.
The unserialize() function will not always return an object
especially when as can happen the controller field of a
record in the backup_controllers table is empty.
This change ensures that in this case the script will
not cause a fatal error, but instead throw an error.
Before this patch if the pre-check failed during
the final stage of an import a request for the
page header to be output was made for a second
time, this caused a coding_error to occur.
This change removes the second request to
output the page header, which will allow the user
to see the reasons the pre-check failed.
This only arises in specific situations: student submitted less than 2
mintues before time close, or when a teacher previews after the close
date. However, in those cases, the old behaviour was confusing. Now,
'After the quiz is closed' takes priority.
In a very rare cases where the columns are not declared explicitly, we
want to fetch single row only without a warning raised. This seems like
a valid use case for IGNORE_MULTIPLE flag.
The problem here was that user/index.php checks the system level
capability moodle/site:viewparticipants when the user is on the front
page, and the moodle/course:viewparticipants on non-front pages.
But the navigation displayed the link by mistake even in situations,
when the user has the capability moodle/course:viewparticipants on the
front page (typically when the default role for the front page is set to
student).
Added behat tests for reproducing the bug and also for checking the
basic functionality of the feature.
When a cachable object is store in the static cache from
the backing store, it was incorrect serialised rather than
using the wake function. This has been resolved and tests added.
During the investigation into cacheable_object, it was discovered
that set_identifiers never removes identifiers when you call it,
so set_identifiers(array('a')) and set_identifiers(array('b')) really
resulted in array('a','b') as the identifiers rather than 'b'.
The fix for this issue depends on the set_identifiers fix and
they have been coupled together as a result.
The completion cache is currently not marked as simpledata. On the
course page it is frequently retrieved hundreds of times which results
in many calls to the slow unserialize function. By making a slight
change to the data format (using arrays instead of objects) we can
mark it as simpledata, which will avoid using unserialize.
PHP has a recursion limit and random_bytes on PHP5.6 without openssl
will error if sent a large value. Using a loop has lower overhead than
recursion as well.
This commit add an upgrade step to remove wrong CAP_PROHIBIT on enrol/self:holdkey for manager role.
Also remove the restriction from the self enrolment access file.
PHP7 doesn't have any default XHProf support and all other
investigated forks don't have stable PHP7. Tideways is under
active development and is easy to install. The data format
is compatible with XHProf so it is a drop-in replacement in that way.
format_text cannot be called on the whole input text, but must be
called on user-supplied text that will be output into chats. This
means it cannot simply be called in one place, but must instead be
called on the relevant parts of text once commands have been matched.
This also has a couple of bugfixes:
- file_info_context_system::get_children() was looking for courses with parent=0, it is impossible, block removed;
- file_info_context_coursecat::get_area_coursecat_description() was checking the wrong capability to view files in description
These scenarios should cover common cases of defining the grades to pass
pass via the workshop settings form. Note that behaviour of the fields
in terms of locale-specific decimals input (MDL-51806) is not covered
with these tests as I want to avoid installation of additional language
pack. Instead, I assume that functionality of unformat_float() is tested
separately in the core.
When editing existing workshop with a grade to pass defined, when the
field is emptied, it should be interpreted as setting it to zero. This
was not happening because unformat_float replaces the field with null,
therefore effectively unsetting it.
By casting to float, we interpret all empty values (including null) as
zeros. This behaviour is consistent with how gradebook setup UI works.
As a regression of MDL-55360, it was not possible to create new
workshops if the field "Submission grade to pass" or "Assessment grade
to pass" was left empty. The validation failed with "You must enter a
number here".
The fields submissiongradepass and gradinggradepass are always present
as we explicitly define them in the mod form. So the isset() condition
in the validation was useless and it did not allow to submit the form
with these fields empty.
Additionally, the unformat_float() returns null only if it receives
empty value on the input. Which can't happen in our case so I am
removing this condition to improve the readability of the code.
Blocks can declare has_config() as true without actually using the
default node in the admin tree. Typical use case is when the block
injects its settings to other parts of the admin tree and it assigns
null to its $setting node in its settings.php file.
As Janek L.B. correctly spotted, this led to false debugging message
on admin/blocks.php as the code interpreted it as missing settings.php
file.
The patch adds explicit file existence test for this rare case.
In a Workshop activity, comment fields on Assessment forms do not properly link to the corresponding Aspect.
So screen reader users may find it difficult to complete the Assessment forms.
There should be a hidden label text for each comment field.
When using a different theme and removing an editor
plugin such as the equation plugin, atto will display
an error about a missing dependency.
A thank you to Anthony Forth for providing this patch.
Mustache JS helper can overwrite JS blocks when using nested templates.
Each call to render should have it's own scope.
Conflicts:
lib/amd/build/templates.min.js
lib/amd/src/templates.js
Backported from MDL-53667 to make cherry-picking easier across branches.
The native String.replace method in extremely slow when we are
dealing with a large string and large quantity of strings to replace.
This new solution walks through the string looking for placeholders
to replace.
This commit just:
- Moves the null => '' to better place, restricting it to PHP >= 7.0
(bug https://bugs.php.net/bug.php?id=72524)
- Adds a couple of notes here and there.
- Changes some small details to keep the file using the same coding.
While searching for existing files if directory
separator is not correct then original files
and directories will be deleted. So use DIRECTORY_SEPARATOR.
Specifically on paste - we don't need all the random style attributes
from content on the clipboard. When you copy from a webpage - the browser
inlines all the styles from the page so that the pasted content will look
like the place it was copied from. But this is never what you want - you
want the content on paste, but with no special styling.
Upstream: https://github.com/ADOdb/ADOdb/pull/259
Prevent segfault with ocipo driver on php7.
The OCIFetchinto function is causing segfaults on php7 - probably because the fields array
is not initialised or it is optimised out. This fixes just changes to use the safer function
oci_fetch_array instead.
While this ony seems to affect MySQL, better put the filter/conditions
on every query so the temporary view/table does not need to handle
thousands of potentially unrelated records.
The JS blocks in a template must _not_ use a shared variable as they can be
executed asynchronously and complete in any order.
Instead it is stored in the only local variable available - the current
context.
Since the context can be passed in from elsewhere, we namespace it to
reduce the chance of collission.
These are our bugs actually - the oci docs are very clear that bound
params should be in-scope when oci_execute is called - and due to pass by value etc,
this was not true for our driver.
There is another bug that needed fixing - OCI barfs if null values are bound - this
can be avoided by setting them to '' which oci treats as null.
And finally - all our lob/clob/blob hacks were also binding to local "out-of-scope" vars.
Existing language strings for the host component suggest that the host can
be provided in the format hostname:port, but we previously did not support
this.
This patch explodes the string based on the colon character and assumes
that if there are two parts, that they are in the format hostname:port.
Note: This does not attempt to deal with full host specifications (e.g.
protocol://hostname:port), as this is beyond the scope of this change.
define(["jquery","core/ajax","core/log","core/notification","core/templates","core/config","core/str"],function(a,b,c,d,e,f,g){varh=function(a,b){varc="@template "+b,d=0,e=[];if(e=a.match(/{{!([\s\S]*?)}}/g),null!==e)for(d=0;d<e.length;d++){varf=e[d],g=f.indexOf(c);if(-1!==g){varh=g+c.length+1;returnf=f.substr(h,f.length-2-h)}}return!1},i=function(b,f,i){g.get_string("templateselected","tool_templatelibrary",b).done(function(b){a('[data-region="displaytemplateheader"]').text(b)}).fail(d.exception);varj=h(f,b);j===!1&&(j=h(i,b)),j&&(f=j),a('[data-region="displaytemplatesource"]').text(f);vark=f.match(/Example context \(json\):([\s\S]*)/),l=!1;if(k){varm=k[1].trim();try{l=a.parseJSON(m)}catch(n){c.debug("Could not parse json example context for template."),c.debug(n)}}l?e.render(b,l).done(function(b,c){e.replaceNodeContents(a('[data-region="displaytemplateexample"]'),b,c)}).fail(d.exception):g.get_string("templatehasnoexample","tool_templatelibrary").done(function(b){a('[data-region="displaytemplateexample"]').text(b)}).fail(d.exception)},j=function(c){vare=c.split("/"),g=e.shift(),h=e.shift(),j=b.call([{methodname:"core_output_load_template",args:{component:g,template:h,themename:f.theme}},{methodname:"tool_templatelibrary_load_canonical_template",args:{component:g,template:h}}],!0,!1);a.when.apply(a,j).done(function(a,b){i(c,a,b)}).fail(d.exception)};returna('[data-region="list-templates"]').on("click","[data-templatename]",function(b){varc=a(this).data("templatename");b.preventDefault(),j(c)}),{}});
define(["jquery","core/ajax","core/log","core/notification","core/templates","core/config","core/str"],function(a,b,c,d,e,f,g){varh=function(a,b){if(!a)return!1;varc="@template "+b,d=0,e=[];if(e=a.match(/{{!([\s\S]*?)}}/g),null!==e)for(d=0;d<e.length;d++){varf=e[d],g=f.indexOf(c);if(-1!==g){varh=g+c.length+1;returnf=f.substr(h,f.length-2-h)}}return!1},i=function(b,f,i){g.get_string("templateselected","tool_templatelibrary",b).done(function(b){a('[data-region="displaytemplateheader"]').text(b)}).fail(d.exception);varj=h(f,b);j===!1&&(j=h(i,b)),j&&(f=j),a('[data-region="displaytemplatesource"]').text(f);vark=f.match(/Example context \(json\):([\s\S]*)/),l=!1;if(k){varm=k[1].trim();try{l=a.parseJSON(m)}catch(n){c.debug("Could not parse json example context for template."),c.debug(n)}}l?e.render(b,l).done(function(b,c){e.replaceNodeContents(a('[data-region="displaytemplateexample"]'),b,c)}).fail(d.exception):g.get_string("templatehasnoexample","tool_templatelibrary").done(function(b){a('[data-region="displaytemplateexample"]').text(b)}).fail(d.exception)},j=function(c){vare=c.split("/"),g=e.shift(),h=e.shift(),j=b.call([{methodname:"core_output_load_template",args:{component:g,template:h,themename:f.theme}},{methodname:"tool_templatelibrary_load_canonical_template",args:{component:g,template:h}}],!0,!1);a.when.apply(a,j).done(function(a,b){i(c,a,b)}).fail(d.exception)};returna('[data-region="list-templates"]').on("click","[data-templatename]",function(b){varc=a(this).data("templatename");b.preventDefault(),j(c)}),{}});
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Eloy Lafuente (stronk7)