Moodle release 3.10.8

weekly release 3.10.7+
Merge branch 'install_310_STABLE' of https://git.in.moodle.com/amosbot/moodle-install into MOODLE_310_STABLE
2021-11-06 10:34:22 +01:00 · 2021-11-05 19:18:36 +02:00 · 2021-11-05 19:18:35 +02:00 · 2021-11-05 13:16:04 +08:00 · 2021-11-05 12:45:04 +08:00 · 2021-11-05 12:42:23 +08:00
878 changed files with 15031 additions and 7680 deletions
@@ -2,6 +2,7 @@
  'plugins': [
    'babel',
    'promise',
+    'jsdoc',
  ],
  'env': {
    'browser': true,
@@ -191,7 +192,6 @@
        'property': 'str',
        'message': 'Use AMD module "core/str" or M.util.get_string()'
    }],
-
  },
  overrides: [
    {
@@ -200,7 +200,23 @@
      rules: {
        'no-undef': 'off',
        'no-unused-vars': 'off',
-        'no-unused-expressions': 'off'
+        'no-unused-expressions': 'off',
+
+        // === JSDocs ===
+        "jsdoc/check-access": 'off',
+        "jsdoc/check-alignment": 'off',
+        "jsdoc/check-param-names": 'off',
+        "jsdoc/check-property-names": 'off',
+        "jsdoc/empty-tags": 'off',
+        "jsdoc/implements-on-classes": 'off',
+        "jsdoc/multiline-blocks": 'off',
+        "jsdoc/require-jsdoc": 'off',
+        "jsdoc/require-param": 'off',
+        "jsdoc/require-param-name": 'off',
+        "jsdoc/require-param-type": 'off',
+        "jsdoc/require-property": 'off',
+        "jsdoc/require-property-name": 'off',
+        "jsdoc/require-property-type": 'off',
      }
    },
    {
@@ -238,7 +254,49 @@
        // === Promises ===
        // We have Promise now that we're using ES6.
        'promise/no-native': 'off',
-        'promise/avoid-new': 'off'
+        'promise/avoid-new': 'off',
+
+        // === JSDocs ===
+        "jsdoc/check-access": [
+          'error',
+        ],
+        "jsdoc/check-alignment": 1, // Recommended.
+        "jsdoc/check-param-names": [
+          'error',
+        ],
+        "jsdoc/check-property-names": [
+          'error',
+        ],
+        "jsdoc/empty-tags": [
+          'error',
+        ],
+        "jsdoc/implements-on-classes": [
+          'error',
+        ],
+        "jsdoc/multiline-blocks": [
+          'error',
+        ],
+        "jsdoc/require-jsdoc": [
+          'error',
+        ],
+        "jsdoc/require-param": [
+          'error',
+        ],
+        "jsdoc/require-param-name": [
+          'error',
+        ],
+        "jsdoc/require-param-type": [
+          'error',
+        ],
+        "jsdoc/require-property": [
+          'error',
+        ],
+        "jsdoc/require-property-name": [
+          'error',
+        ],
+        "jsdoc/require-property-type": [
+          'error',
+        ],
      },
      parserOptions: {
        'ecmaVersion': 9,
@@ -1 +1 @@
-v14.15.0
+v14.18.0
@@ -126,6 +126,7 @@ class filesize extends \admin_setting {
        if (is_null($bytes)) {
            return null;
        }
+        $bytes = intval($bytes);

        return self::parse_bytes($bytes);
    }
@@ -145,9 +146,10 @@ class filesize extends \admin_setting {
            return get_string('errorsetting', 'admin');
        }

+        // Calculate size in bytes, ensuring we don't overflow PHP_INT_MAX.
        $bytes = $data['v'] * $data['u'];
+        $result = (is_int($bytes) && $this->config_write($this->name, $bytes));

-        $result = $this->config_write($this->name, $bytes);
        return ($result ? '' : get_string('errorsetting', 'admin'));
    }

@@ -120,7 +120,14 @@ if ($options['unset'] || $options['set'] !== null) {
    }

    // Check that the variable is not hard-set in the main config.php already.
-    if (array_key_exists($options['name'], $CFG->config_php_settings)) {
+    $component = $options['component'];
+    if (!empty($component)) {
+        $componentsettings = $CFG->forced_plugin_settings[$component] ?? [];
+        $settinginconfig = array_key_exists($options['name'], $componentsettings);
+    } else {
+        $settinginconfig = array_key_exists($options['name'], $CFG->config_php_settings);
+    }
+    if ($settinginconfig) {
        cli_error('The configuration variable is hard-set in the config.php, unable to change.', 4);
    }

@@ -3163,6 +3163,11 @@
          <ON_CHECK message="sixtyfourbitswarning" />
        </FEEDBACK>
      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_igbinary322_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="igbinary322buggyversion" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
  <MOODLE version="3.10" requires="3.5">
@@ -3345,6 +3350,11 @@
          <ON_CHECK message="sixtyfourbitswarning" />
        </FEEDBACK>
      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_igbinary322_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="igbinary322buggyversion" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
  <MOODLE version="3.11" requires="3.6">
@@ -3714,6 +3724,11 @@
      </CUSTOM_CHECK>
      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_max_input_vars" level="optional">
      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_admin_dir_usage" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iscustomadminwarnings" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
 </COMPATIBILITY_MATRIX>
@@ -220,7 +220,7 @@ class core_admin_renderer extends plugin_renderer_base {
            $output .= $this->container_end();
        }

-        $button = new single_button($continueurl, get_string('upgradestart', 'admin'), 'get');
+        $button = new single_button($continueurl, get_string('upgradestart', 'admin'), 'get', true);
        $button->class = 'continuebutton';
        $output .= $this->render($button);
        $output .= $this->footer();
@@ -1616,12 +1616,18 @@ class core_admin_renderer extends plugin_renderer_base {

        $plugininfo = $pluginman->get_plugins();

-        $numtotal = $numextension = $numupdatable = 0;
+        $numtotal = $numextension = $numupdatable = $numinstallable = 0;

        foreach ($plugininfo as $type => $plugins) {
            foreach ($plugins as $name => $plugin) {
-                if ($plugin->available_updates()) {
+                if ($res = $plugin->available_updates()) {
                    $numupdatable++;
+                    foreach ($res as $updateinfo) {
+                        if ($pluginman->is_remote_plugin_installable($updateinfo->component, $updateinfo->version, $reason, false)) {
+                            $numinstallable++;
+                            break;
+                        }
+                    }
                }
                if ($plugin->get_status() === core_plugin_manager::PLUGIN_STATUS_MISSING) {
                    continue;
@@ -1664,16 +1670,13 @@ class core_admin_renderer extends plugin_renderer_base {
            $out .= $this->output->heading(get_string('overviewext', 'core_plugin'), 3);
        }

-        if ($numupdatable) {
-            $installableupdates = $pluginman->filter_installable($pluginman->available_updates());
-            if ($installableupdates) {
-                $out .= $this->output->single_button(
-                    new moodle_url($this->page->url, array('installupdatex' => 1)),
-                    get_string('updateavailableinstallall', 'core_admin', count($installableupdates)),
-                    'post',
-                    array('class' => 'singlebutton updateavailableinstallall')
-                );
-            }
+        if ($numinstallable) {
+            $out .= $this->output->single_button(
+                new moodle_url($this->page->url, array('installupdatex' => 1)),
+                get_string('updateavailableinstallall', 'core_admin', $numinstallable),
+                'post',
+                array('class' => 'singlebutton updateavailableinstallall')
+            );
        }

        $out .= html_writer::div($infoall, 'info info-all').
@@ -1907,7 +1910,7 @@ class core_admin_renderer extends plugin_renderer_base {
            'infos'
        );

-        if ($pluginman->is_remote_plugin_installable($updateinfo->component, $updateinfo->version, $reason)) {
+        if ($pluginman->is_remote_plugin_installable($updateinfo->component, $updateinfo->version, $reason, false)) {
            $box .= $this->output->single_button(
                new moodle_url($this->page->url, array('installupdate' => $updateinfo->component,
                    'installupdateversion' => $updateinfo->version)),
@@ -2127,8 +2130,16 @@ class core_admin_renderer extends plugin_renderer_base {
        $output .= $this->container_start('upgradekeyreq');
        $output .= $this->heading(get_string('upgradekeyreq', 'core_admin'));
        $output .= html_writer::start_tag('form', array('method' => 'POST', 'action' => $url));
-        $output .= html_writer::empty_tag('input', array('name' => 'upgradekey', 'type' => 'password'));
-        $output .= html_writer::empty_tag('input', array('value' => get_string('submit'), 'type' => 'submit'));
+        $output .= html_writer::empty_tag('input', [
+            'name' => 'upgradekey',
+            'type' => 'password',
+            'class' => 'form-control w-auto',
+        ]);
+        $output .= html_writer::empty_tag('input', [
+            'type' => 'submit',
+            'value' => get_string('submit'),
+            'class' => 'btn btn-primary mt-3',
+        ]);
        $output .= html_writer::end_tag('form');
        $output .= $this->container_end();
        $output .= $this->footer();
@@ -53,11 +53,8 @@ class behat_admin extends behat_base {
        }

        foreach ($data as $label => $value) {
-            $this->execute('behat_navigation::i_select_from_flat_navigation_drawer', [get_string('administrationsite')]);
-
-            // Search by label.
-            $this->execute('behat_forms::i_set_the_field_to', [get_string('search'), $label]);
-            $this->execute("behat_forms::press_button", get_string('search', 'admin'));
+            // Navigate straight to the search results fo rthis label.
+            $this->execute('behat_general::i_visit', ["/admin/search.php?query=" . urlencode($label)]);

            // Admin settings does not use the same DOM structure than other moodle forms
            // but we also need to use lib/behat/form_field/* to deal with the different moodle form elements.
@@ -137,7 +137,7 @@ if (!empty($validdatasets) && !$model->is_enabled() && $options['non-interactive
    }

    // Refresh the instance to prevent unexpected issues.
-    $model = new \core_analytics\model($modelobj);
+    $model = new \core_analytics\model($options['modelid']);

    // Set the time splitting method file and enable it.
    $model->enable($input);
@@ -48,7 +48,7 @@ Feature: Verify that all form fields values can be get and set
    And the "Unenrol users" select box should not contain "Baker"
    And the "Unenrol users" select box should not contain "President, Baker"
    And I am on "Course 1" course homepage with editing mode on
-    And I follow "Test this one"
+    And I am on the "Test this one" "wiki activity" page
    And I press "Create page"
    # Text (textarea & editor) & Select (multi-select) - Checking "I set the following fields to these values".
    When I set the following fields to these values:
@@ -61,8 +61,7 @@ Feature: Verify that all form fields values can be get and set
    # Checkbox - Checking "I set the field" and "The field matches value" ticked.
    And I set the field "Force format" to "1"
    And I press "Save and return to course"
-    And I should see "Test this one"
-    And I follow "Test this one"
+    And I am on the "Test this one" "wiki activity" page
    And I navigate to "Edit settings" in current page administration
    And I expand all fieldsets
    And the field "Force format" matches value "1"
@@ -70,8 +69,7 @@ Feature: Verify that all form fields values can be get and set
    # Checkbox - Checking "I set the field" and "The field matches value" unticked.
    And I set the field "Force format" to ""
    And I press "Save and return to course"
-    And I should see "Test this one"
-    And I follow "Test this one"
+    And I am on the "Test this one" "wiki activity" page
    And I navigate to "Edit settings" in current page administration
    And I expand all fieldsets
    And the field "Force format" matches value ""
@@ -80,8 +78,7 @@ Feature: Verify that all form fields values can be get and set
    And I set the following fields to these values:
      | Force format | 1 |
    And I press "Save and return to course"
-    And I should see "Test this one"
-    And I follow "Test this one"
+    And I am on the "Test this one" "wiki activity" page
    And I navigate to "Edit settings" in current page administration
    And I expand all fieldsets
    And the following fields match these values:
@@ -92,8 +89,7 @@ Feature: Verify that all form fields values can be get and set
    And I set the following fields to these values:
      | Force format | |
    And I press "Save and return to course"
-    And I should see "Test this one"
-    And I follow "Test this one"
+    And I am on the "Test this one" "wiki activity" page
    And I navigate to "Edit settings" in current page administration
    And I expand all fieldsets
    And the following fields match these values:
@@ -115,20 +111,21 @@ Feature: Verify that all form fields values can be get and set
      | Wiki name | Test this one baby |
      | Default format | HTML |
    And I press "Cancel"
-    And I am on "Course 1" course homepage
    # Radio - Checking "I set the field" and "the field matches value".
-    And I add a "Choice" to section "1" and I fill the form with:
-      | Choice name | Test choice name |
-      | Description | Test choice description |
-      | Allow choice to be updated | Yes |
-      | Option 1 | one |
-      | Option 2 | two |
-      | Option 3 | three |
-    And I follow "Test choice name"
-    And I set the field "one" to "1"
+    And the following "activity" exists:
+      | activity         | choice                       |
+      | course           | C1                           |
+      | idnumber         | choice1                      |
+      | intro            | Test choice description      |
+      | name             | Test choice name             |
+      | option           | Option 1, Option 2, Option 3 |
+      | section          | 1                            |
+      | allowupdate      | 1                            |
+    And I am on the "Test choice name" "choice activity" page
+    And I set the field "Option 1" to "1"
    And I press "Save my choice"
-    And the field "one" matches value "1"
-    And the field "two" matches value ""
+    And the field "Option 1" matches value "1"
+    And the field "Option 2" matches value ""
    # Check if field xpath set/match works.
    And I am on "Course 1" course homepage
    And I navigate to "Edit settings" in current page administration
@@ -174,31 +171,23 @@ Feature: Verify that all form fields values can be get and set
    And I press "Cancel"
    # Advanced checkbox requires real browser to allow uncheck to work. MDL-58681. MDL-55386.
    # Advanced checkbox - Checking "I set the field" and "The field matches value" ticked.
-    And I am on "Course 1" course homepage
-    And I follow "Test this one"
-    And I navigate to "Edit settings" in current page administration
+    And I am on the "Test choice name" "choice activity editing" page
    And I set the field "Display description on course page" to "1"
    And I press "Save and return to course"
-    And I should see "Test this one"
-    And I follow "Test this one"
-    And I navigate to "Edit settings" in current page administration
+    And I am on the "Test choice name" "choice activity editing" page
    And the field "Display description on course page" matches value "1"
    And the field "Display description on course page" does not match value ""
    # Advanced checkbox - Checking "I set the field" and "The field matches value" unticked.
    And I set the field "Display description on course page" to ""
    And I press "Save and return to course"
-    And I should see "Test this one"
-    And I follow "Test this one"
-    And I navigate to "Edit settings" in current page administration
+    And I am on the "Test choice name" "choice activity editing" page
    And the field "Display description on course page" matches value ""
    And the field "Display description on course page" does not match value "1"
    # Advanced checkbox - Checking "I set the following fields to these values:" and "The following fields match these values" ticked.
    And I set the following fields to these values:
      | Display description on course page | 1 |
    And I press "Save and return to course"
-    And I should see "Test this one"
-    And I follow "Test this one"
-    And I navigate to "Edit settings" in current page administration
+    And I am on the "Test choice name" "choice activity editing" page
    And the following fields match these values:
      | Display description on course page | 1 |
    And the following fields do not match these values:
@@ -207,9 +196,7 @@ Feature: Verify that all form fields values can be get and set
    And I set the following fields to these values:
      | Display description on course page | |
    And I press "Save and return to course"
-    And I should see "Test this one"
-    And I follow "Test this one"
-    And I navigate to "Edit settings" in current page administration
+    And I am on the "Test choice name" "choice activity editing" page
    And the following fields match these values:
      | Display description on course page | |
    And the following fields do not match these values:
@@ -0,0 +1,85 @@
+@tool @tool_behat
+Feature: Use core page resolvers for the I am on the page steps
+  In order to write tests correctly
+  As a developer
+  I need to have steps which take me straight to a page
+
+  Scenario Outline: When I am on an instance
+    Given the following "categories" exist:
+      | name  | category | idnumber |
+      | Cat 1 | 0        | CAT1     |
+    And the following "course" exists:
+      | fullname  | Economics 101 |
+      | shortname | ECON101       |
+      | idnumber  | 2021-econ101  |
+    And the following "activity" exists:
+      | course   | ECON101                   |
+      | activity | forum                     |
+      | name     | Fundamentals of Economics |
+      | idnumber | fundamentalsofeconomics   |
+    And I log in as "admin"
+    When I am on the <identifier> <type> page
+    Then I should see "<shouldsee>"
+
+    Examples:
+      | description              | identifier                  | type                         | shouldsee                  |
+      | Course Category idnumber | CAT1                        | category                     | Add a new course           |
+      | Course Category name     | "Cat 1"                     | Category                     | Add a new course           |
+      | Course Full name         | "Economics 101"             | course                       | Fundamentals of Economics  |
+      | Course Short name        | ECON101                     | COURSE                       | Fundamentals of Economics  |
+      | Course idnumber          | "2021-econ101"              | Course                       | Fundamentals of Economics  |
+      | Forum idnumber           | fundamentalsofeconomics     | Activity                     | Add a new discussion       |
+      | Generic activity editing | fundamentalsofeconomics     | "Activity editing"           | Updating: Forum            |
+      | Forum name               | "Fundamentals of Economics" | "Forum activity"             | Add a new discussion       |
+      | Forum name editing       | "Fundamentals of Economics" | "Forum activity editing"     | Updating: Forum            |
+      | Forum name permissions   | "Fundamentals of Economics" | "Forum activity permissions" | Permissions in Forum: Fun  |
+      | Forum name roles         | "Fundamentals of Economics" | "Forum activity roles"       | Assign roles in Forum: Fun |
+
+  Scenario Outline: When I am on an instance logged in as
+    Given the following "categories" exist:
+      | name  | category | idnumber |
+      | Cat 1 | 0        | CAT1     |
+    And the following "course" exists:
+      | fullname  | Economics 101 |
+      | shortname | ECON101       |
+      | idnumber  | 2021-econ101  |
+    And the following "activity" exists:
+      | course   | ECON101                   |
+      | activity | forum                     |
+      | name     | Fundamentals of Economics |
+      | idnumber | fundamentalsofeconomics   |
+    When I am on the <identifier> <type> page logged in as admin
+    Then I should see "<shouldsee>"
+
+    Examples:
+      | description              | identifier                  | type                         | shouldsee                  |
+      | Course Category idnumber | CAT1                        | category                     | Add a new course           |
+      | Course Category name     | "Cat 1"                     | Category                     | Add a new course           |
+      | Course Full name         | "Economics 101"             | course                       | Fundamentals of Economics  |
+      | Course Short name        | ECON101                     | COURSE                       | Fundamentals of Economics  |
+      | Course idnumber          | "2021-econ101"              | Course                       | Fundamentals of Economics  |
+      | Forum idnumber           | fundamentalsofeconomics     | Activity                     | Add a new discussion       |
+      | Generic activity editing | fundamentalsofeconomics     | "Activity editing"           | Updating: Forum            |
+      | Forum name               | "Fundamentals of Economics" | "Forum activity"             | Add a new discussion       |
+      | Forum name editing       | "Fundamentals of Economics" | "Forum activity editing"     | Updating: Forum            |
+      | Forum name permissions   | "Fundamentals of Economics" | "Forum activity permissions" | Permissions in Forum: Fun  |
+      | Forum name roles         | "Fundamentals of Economics" | "Forum activity roles"       | Assign roles in Forum: Fun |
+
+  Scenario Outline: When I am on a named page
+    Given I log in as "admin"
+    When I am on the <identifier> page
+    Then I should see "<shouldsee>"
+
+    Examples:
+      | description | identifier | shouldsee                   |
+      | Admin page  | "Admin notifications"      | Check for available updates |
+      | Home page   | Homepage   | Recently accessed courses   |
+
+  Scenario Outline: When I am on a named page logged in as
+    When I am on the <identifier> page logged in as admin
+    Then I should see "<shouldsee>"
+
+    Examples:
+      | description | identifier            | shouldsee                   |
+      | Admin page  | "Admin notifications" | Check for available updates |
+      | Home page   | Homepage              | Recently accessed courses   |
@@ -0,0 +1,110 @@
+@tool_behat
+Feature: Verify that the behat login and logout steps work as expected
+  In order to use behat login and log out steps
+  As a test writer
+  I need to verify that login and logout happen when the steps are used
+
+  Scenario: Log in as a user using the step
+    Given the following "users" exist:
+      | username  | firstname | lastname |
+      | traverst1 | Thomas    | Travers  |
+    When I log in as "traverst1"
+    Then I should see "Thomas Travers"
+
+  @javascript
+  Scenario: Log in as a user using the step (javascript)
+    Given the following "users" exist:
+      | username  | firstname | lastname |
+      | traverst1 | Thomas    | Travers  |
+    When I log in as "traverst1"
+    Then I should see "Thomas Travers"
+
+  Scenario: Log out using the log out step
+    Given the following "users" exist:
+      | username  | firstname | lastname |
+      | traverst1 | Thomas    | Travers  |
+    And I am logged in as traverst1
+    When I log out
+    Then I should not see "Thomas Travers"
+    And I should see "You are not logged in"
+
+  @javascript
+  Scenario: Log out using the log out step (javascript)
+    Given the following "users" exist:
+      | username  | firstname | lastname |
+      | traverst1 | Thomas    | Travers  |
+    And I am logged in as traverst1
+    When I log out
+    Then I should not see "Thomas Travers"
+    And I should see "You are not logged in"
+
+  Scenario: Log in step should automatically log user out if already logged in
+    Given the following "users" exist:
+      | username  | firstname | lastname |
+      | traverst1 | Thomas    | Travers  |
+      | emeryj    | Jane      | Emery    |
+    And I am logged in as traverst1
+    When I log in as "emeryj"
+    Then I should not see "Thomas Travers"
+    And I should see "Jane Emery"
+
+  @javascript
+  Scenario: Log in step should automatically log user out if already logged in (javascript)
+    Given the following "users" exist:
+      | username  | firstname | lastname |
+      | traverst1 | Thomas    | Travers  |
+      | emeryj    | Jane      | Emery    |
+    And I am logged in as traverst1
+    When I log in as "emeryj"
+    Then I should not see "Thomas Travers"
+    And I should see "Jane Emery"
+
+  Scenario: I am on page logged in as should redirect to correct page
+    Given the following "users" exist:
+      | username  | firstname | lastname |
+      | traverst1 | Thomas    | Travers  |
+    And the following "course" exists:
+      | fullname  | Life, the Universe, and Everything |
+      | shortname | hhgttg                             |
+    When I am on the hhgttg Course page logged in as traverst1
+    Then I should see "Thomas Travers"
+    And I should see "Life, the Universe, and Everything"
+
+  @javascript
+  Scenario: I am on page logged in as should redirect to correct page (javascript)
+    Given the following "users" exist:
+      | username  | firstname | lastname |
+      | traverst1 | Thomas    | Travers  |
+    And the following "course" exists:
+      | fullname  | Life, the Universe, and Everything |
+      | shortname | hhgttg                             |
+    When I am on the hhgttg Course page logged in as traverst1
+    Then I should see "Thomas Travers"
+    And I should see "Life, the Universe, and Everything"
+
+  Scenario: I am on page logged in as should redirect to correct page when automatically logging a user out
+    Given the following "users" exist:
+      | username  | firstname | lastname |
+      | traverst1 | Thomas    | Travers  |
+      | emeryj    | Jane      | Emery    |
+    And the following "course" exists:
+      | fullname  | Life, the Universe, and Everything |
+      | shortname | hhgttg                             |
+    And I am logged in as emeryj
+    When I am on the hhgttg Course page logged in as traverst1
+    Then I should see "Thomas Travers"
+    And I should see "Life, the Universe, and Everything"
+
+  @javascript
+  Scenario: I am on page logged in as should redirect to correct page when automatically logging a user out (javacript)
+    Given the following "users" exist:
+      | username  | firstname | lastname |
+      | traverst1 | Thomas    | Travers  |
+      | emeryj    | Jane      | Emery    |
+    And the following "course" exists:
+      | fullname  | Life, the Universe, and Everything |
+      | shortname | hhgttg                             |
+    And I am logged in as emeryj
+    When I am on the hhgttg Course page logged in as traverst1
+    Then I should see "Thomas Travers"
+    And I should see "Life, the Universe, and Everything"
@@ -97,7 +97,7 @@
                {{#modified}}list-group-item-info{{/modified}}"
            >
            <div class="row">
-                <div class="col-sm-4 col-md-2">
+                <div class="col-sm-4 col-md-2 text-break">
                    <div class="d-md-none">
                        <strong>{{#str}}headingcomponent, tool_customlang{{/str}}</strong>
                    </div>
@@ -9,10 +9,8 @@ Feature: Manage data requests
      | username | firstname | lastname | email          |
      | student1 | John      | Doe      | s1@example.com |
      | student2 | Jane      | Doe      | s2@example.com |
-    And I log in as "admin"
-    And I set the following administration settings values:
-      | contactdataprotectionofficer | 1 |
-    And I log out
+    And the following config values are set as admin:
+      | contactdataprotectionofficer | 1 | tool_dataprivacy |

  @javascript
  Scenario: Marking general enquiries as complete
@@ -27,7 +27,7 @@ require_once($CFG->libdir . '/adminlib.php');

 admin_externalpage_setup('tool_filetypes');

-$extension = required_param('extension', PARAM_RAW);
+$extension = required_param('extension', PARAM_ALPHANUMEXT);
 $redirecturl = new \moodle_url('/admin/tool/filetypes/index.php');

 if (optional_param('revert', 0, PARAM_INT)) {
@@ -100,10 +100,12 @@ class tool_generator_testplan_backend extends tool_generator_backend {
     *
     * @param int $courseid The target course id
     * @param bool $updateuserspassword Updates the course users password to $CFG->tool_generator_users_password
+     * @param int|null $size of the test plan. Used to limit the number of users exported
+     *                 to match the threads in the plan. For BC, defaults to null that means all enrolled users.
     * @return stored_file
     */
-    public static function create_users_file($courseid, $updateuserspassword) {
-        $csvcontents = self::generate_users_file($courseid, $updateuserspassword);
+    public static function create_users_file($courseid, $updateuserspassword, ?int $size = null) {
+        $csvcontents = self::generate_users_file($courseid, $updateuserspassword, $size);

        $fs = get_file_storage();
        $filerecord = self::get_file_record('users', 'csv');
@@ -171,14 +173,18 @@ class tool_generator_testplan_backend extends tool_generator_backend {
     *
     * @param int $targetcourseid
     * @param bool $updateuserspassword Updates the course users password to $CFG->tool_generator_users_password
+     * @param int|null $size of the test plan. Used to limit the number of users exported
+     *                 to match the threads in the plan. For BC, defaults to null that means all enrolled users.
     * @return string The users csv file contents.
     */
-    protected static function generate_users_file($targetcourseid, $updateuserspassword) {
+    protected static function generate_users_file($targetcourseid, $updateuserspassword, ?int $size = null) {
        global $CFG;

        $coursecontext = context_course::instance($targetcourseid);

-        $users = get_enrolled_users($coursecontext, '', 0, 'u.id, u.username, u.auth', 'u.username ASC');
+        // If requested, get the number of users (threads) to use in the plan. We only need those in the exported file.
+        $planusers = self::$users[$size] ?? 0;
+        $users = get_enrolled_users($coursecontext, '', 0, 'u.id, u.username, u.auth', 'u.username ASC', 0, $planusers);
        if (!$users) {
            print_error('coursewithoutusers', 'tool_generator');
        }
@@ -98,7 +98,7 @@ if (empty($CFG->tool_generator_users_password) || is_bool($CFG->tool_generator_u

 // Create files.
 $courseid = $DB->get_field('course', 'id', array('shortname' => $shortname));
-$usersfile = tool_generator_testplan_backend::create_users_file($courseid, !empty($options['updateuserspassword']));
+$usersfile = tool_generator_testplan_backend::create_users_file($courseid, !empty($options['updateuserspassword']), $size);
 $testplanfile = tool_generator_testplan_backend::create_testplan_file($courseid, $size);

 // One file path per line so other CLI scripts can easily parse the output.
@@ -51,7 +51,7 @@ if ($data = $mform->get_data()) {

    // Creating both test plan and users files.
    $testplanfile = tool_generator_testplan_backend::create_testplan_file($data->courseid, $data->size);
-    $usersfile = tool_generator_testplan_backend::create_users_file($data->courseid, $data->updateuserspassword);
+    $usersfile = tool_generator_testplan_backend::create_users_file($data->courseid, $data->updateuserspassword, $data->size);

    // Test plan link.
    $testplanurl = moodle_url::make_pluginfile_url(
@@ -1,6 +1,13 @@
 This files describes API changes in core libraries and APIs,
 information provided here is intended especially for developers.

+=== 3.10.8 ===
+
+* Function tool_generator_testplan_backend::create_users_file() now supports to pass the size of the testing plan,
+  that needs to be equal or smaller than the size of the generated site. That's used to effectively restrict the
+  exported number of users to the number of threads the jmeter plan will have (previously all the enrolled users
+  were being exported, with that leading to "false" loops (users not really looping X times).
+
 === 3.7 ===

 * Function tool_generator_testplan_backend::get_course_options() is removed, the 'course' form element is used instead.
@@ -50,6 +50,7 @@ switch ($action) {
    case 'disable':
        unset($enabled[$enrol]);
        set_config('enabled_stores', implode(',', array_keys($enabled)), 'tool_log');
+        add_to_config_log('tool_logstore_visibility', '1', '0', $enrol);
        break;

    case 'enable':
@@ -59,6 +60,7 @@ switch ($action) {
        $enabled = array_keys($enabled);
        $enabled[] = $enrol;
        set_config('enabled_stores', implode(',', $enabled), 'tool_log');
+        add_to_config_log('tool_logstore_visibility', '0', '1', $enrol);
        break;

    case 'up':
@@ -0,0 +1,19 @@
+@tool_log @report @report_configlog
+Feature: In a report, admin can see logstore visibility changes
+
+  # Change log stores visibility so the report contains known data.
+  Background:
+    Given I log in as "admin"
+    And the following config values are set as admin:
+      | enabled_stores | logstore_standard  | tool_log |
+
+  @javascript
+  Scenario: Display configuration changes report
+    When I navigate to "Plugins > Logging > Manage log stores" in site administration
+    And I click on "Disable" "icon" in the "Standard log" "table_row"
+    And I click on "Enable" "icon" in the "External database log" "table_row"
+    And I navigate to "Reports > Config changes" in site administration
+    Then the following should exist in the "report-configlog-report-table" table:
+      | User       | Plugin               | Setting                  | New value | Original value |
+      | Admin User | logstore_standard    | tool_logstore_visibility | 0         | 1              |
+      | Admin User | logstore_database    | tool_logstore_visibility | 1         | 0              |
@@ -98,8 +98,7 @@ define(['jquery'], function($) {
    /**
     * Callback to inject the template.
     *
-     * @param  {Node} container Node to inject in.
-     * @return {Promise} Resolved when done.
+     * @returns {Promise} Resolved when done.
     * @method injectTemplate
     */
    Rule.prototype.injectTemplate = function() {
@@ -37,9 +37,6 @@ define(['jquery',

    /**
     * Constructor for CompetencyDialogue.
-     *
-     * @param {Object} options
-     *
     */
    var Competencydialogue = function() {
      // Intentionally left empty.
@@ -156,9 +156,8 @@ define(['jquery',
    /**
     * Opens the picker.
     *
-     * @param {Number} competencyId The competency ID of the competency to work on.
     * @method display
-     * @return {Promise}
+     * @returns {Promise}
     */
    RuleConfig.prototype.display = function() {
        var self = this;
@@ -137,7 +137,6 @@ define(['jquery',
    /**
     * Refresh the course competencies page.
     *
-     * @param {Event} e
     * @method saveSettings
     */
    settingsMod.prototype.refreshCourseCompetenciesPage = function() {
@@ -26,7 +26,7 @@ define(['core/str', 'core/yui'], function(str, Y) {
    /**
     * Store the current instance of the core drag drop.
     *
-     * @property dragDropInstance M.tool_lp.dragdrop_reorder
+     * @property {object} dragDropInstance M.tool_lp.dragdrop_reorder
     */
    var dragDropInstance = null;

@@ -99,7 +99,6 @@ define(['jquery',
    /**
     * Opens the picker.
     *
-     * @param {Number} competencyId The competency ID of the competency to work on.
     * @method display
     * @return {Promise}
     */
@@ -43,8 +43,8 @@ define(['jquery'], function($) {
    /**
     * Constructor
     *
-     * @param {$} menuRoot Jquery collection matching the root of the menu.
-     * @param {Function[]} handlers, called when a menu item is chosen.
+     * @param {jQuery} menuRoot Jquery collection matching the root of the menu.
+     * @param {Function[]} handlers called when a menu item is chosen.
     */
    var Menubar = function(menuRoot, handlers) {
        // Setup private class variables.
@@ -574,8 +574,6 @@ define(['jquery', 'core/url', 'core/log'], function($, url, log) {
     * Handle a blur event
     *
     * @method handleBlur
-     * @param {Object} item item is the jquery id of the parent item of the group
-     * @param {Event} e The event.
     * @return {Boolean}
     */
    Tree.prototype.handleBlur = function() {
@@ -587,7 +585,6 @@ define(['jquery', 'core/url', 'core/log'], function($, url, log) {
     *
     * @method handleFocus
     * @param {Object} item item is the jquery id of the parent item of the group
-     * @param {Event} e The event.
     * @return {Boolean}
     */
    Tree.prototype.handleFocus = function(item) {
@@ -31,8 +31,6 @@ define(['jquery',

    /**
     * UserCompetencyWorkflow class.
-     *
-     * @param {String} selector The node containing the buttons to switch mode.
     */
    var UserCompetencyWorkflow = function() {
        EventBase.prototype.constructor.apply(this, []);
@@ -195,7 +195,6 @@ define(['jquery',
     *
     * @param {Object} evidenceData Evidence data from evidence node.
     * @param {Number} competencyIds The competency IDs.
-     * @param {Boolean} requestReview Send competencies to review.
     */
    UserEvidenceActions.prototype._doCreateUserEvidenceCompetency = function(evidenceData, competencyIds) {
        var self = this,
@@ -24,9 +24,7 @@ Feature: See the competencies for an activity on the course competencies page.
      | activity | name       | intro      | course | idnumber | completion | completionview |
      | page     | PageName1  | PageDesc1  | C1     | PAGE1    | 1          | 1              |
      | page     | PageName2  | PageDesc2  | C1     | PAGE2    | 1          | 1              |
-    And I log in as "admin"
-    And I am on site homepage
-    And I follow "Course 1"
+    And I am on the "Course 1" course page logged in as admin
    And I follow "Competencies"
    And I press "Add competencies to course"
    And "Competency picker" "dialogue" should be visible
@@ -36,9 +34,7 @@ Feature: See the competencies for an activity on the course competencies page.
    And "Competency picker" "dialogue" should be visible
    And I select "Test-Comp2" of the competency tree
    And I click on "Add" "button" in the "Competency picker" "dialogue"
-    And I am on "Course 1" course homepage
-    And I follow "PageName1"
-    And I navigate to "Edit settings" in current page administration
+    And I am on the PageName1 "page activity editing" page
    And I follow "Expand all"
    And I set the field "Course competencies" to "Test-Comp1"
    And I press "Save and return to course"
@@ -46,10 +42,8 @@ Feature: See the competencies for an activity on the course competencies page.

  @javascript
  Scenario: Go to the competency course competencies page.
-    When I log in as "student1"
-    And I am on site homepage
-    And I follow "Course 1"
-    And I follow "Competencies"
+    Given I am on the "Course 1" course page logged in as student1
+    When I follow "Competencies"
    Then I should see "Test-Comp1"
    And I should see "Test-Comp2"
    And I set the field "Filter competencies by resource or activity" to "PageName1"
@@ -64,12 +58,5 @@ Feature: See the competencies for an activity on the course competencies page.

  @javascript
  Scenario: None course competencies page.
-    When I log in as "student1"
-    And I am on site homepage
-    And I follow "Course 1"
-    And I follow "PageName1"
-    Then I should see "Test page content"
-    And I am on site homepage
-    And I follow "Course 1"
-    And I follow "PageName1"
+    When I am on the PageName1 "page activity" page logged in as student1
    Then I should see "Test page content"
@@ -329,6 +329,11 @@ class api {
            $settings->supportpage = $CFG->supportpage;
        }

+        if (empty($section) || $section === 'graceperiodsettings') {
+            $settings->coursegraceperiodafter = $CFG->coursegraceperiodafter;
+            $settings->coursegraceperiodbefore = $CFG->coursegraceperiodbefore;
+        }
+
        return $settings;
    }

@@ -234,6 +234,9 @@ class tool_mobile_external_testcase extends externallib_advanced_testcase {
        $expected[] = ['name' => 'supportemail', 'value' => $CFG->supportemail];
        $expected[] = ['name' => 'supportpage', 'value' => $CFG->supportpage];

+        $expected[] = ['name' => 'coursegraceperiodafter', 'value' => $CFG->coursegraceperiodafter];
+        $expected[] = ['name' => 'coursegraceperiodbefore', 'value' => $CFG->coursegraceperiodbefore];
+
        $this->assertCount(0, $result['warnings']);
        $this->assertEquals($expected, $result['settings']);

@@ -30,6 +30,8 @@ function($, Ajax, Notification, ModalFactory, ModalEvents) {

    /**
     * PolicyActions class.
+     *
+     * @param {jQuery} root
     */
    var PolicyActions = function(root) {
        this.registerEvents(root);
@@ -37,6 +39,8 @@ function($, Ajax, Notification, ModalFactory, ModalEvents) {

    /**
     * Register event listeners.
+     *
+     * @param {jQuery} root
     */
    PolicyActions.prototype.registerEvents = function(root) {
        root.on("click", function(e) {
@@ -115,6 +119,7 @@ function($, Ajax, Notification, ModalFactory, ModalEvents) {
         * Initialise the actions helper.
         *
         * @method init
+         * @param {object} root
         * @return {PolicyActions}
         */
        'init': function(root) {
@@ -42,9 +42,7 @@ Feature: Backup user data
      | Feedback for the response 'True'.  | So you think it is true                 |
      | Feedback for the response 'False'. | So you think it is false                |
    And I log out
-    And I log in as "student1"
-    And I am on "Course 1" course homepage
-    And I follow "Quiz 1"
+    When I am on the "Quiz 1" "quiz activity" page logged in as student1
    And I press "Attempt quiz now"
    And I click on "True" "radio" in the "First question" "question"
    And I click on "False" "radio" in the "Second question" "question"
@@ -59,10 +59,14 @@ if (!$task) {
 }

 // Start output.
-$PAGE->set_url(new moodle_url('/admin/tool/task/schedule_task.php'));
+$PAGE->set_url(new moodle_url('/admin/tool/task/schedule_task.php', ['task' => $taskname]));
 $PAGE->set_context($context);
-$PAGE->navbar->add(get_string('scheduledtasks', 'tool_task'), new moodle_url('/admin/tool/task/scheduledtasks.php'));
+$PAGE->set_heading($SITE->fullname);
+$PAGE->set_title($task->get_name());
+
+navigation_node::override_active_url(new moodle_url('/admin/tool/task/scheduledtasks.php'));
 $PAGE->navbar->add(s($task->get_name()));
+
 echo $OUTPUT->header();
 echo $OUTPUT->heading($task->get_name());

@@ -84,6 +84,7 @@ class tool_uploadcourse_step2_form extends tool_uploadcourse_base_form {

        $displaylist = core_course_category::make_categories_list('moodle/course:create');
        $mform->addElement('autocomplete', 'defaults[category]', get_string('coursecategory'), $displaylist);
+        $mform->addRule('defaults[category]', null, 'required', null, 'client');
        $mform->addHelpButton('defaults[category]', 'coursecategory');

        $choices = array();
@@ -1199,6 +1199,7 @@ export default class Tour {
            return this;
        }

+        stepConfig.placement = this.recalculatePlacement(stepConfig);
        let flipBehavior;
        switch (stepConfig.placement) {
            case 'left':
@@ -1293,6 +1294,33 @@ export default class Tour {
        return this;
    }

+    /**
+     * For left/right placement, checks that there is room for the step at current window size.
+     *
+     * If there is not enough room, changes placement to 'top'.
+     *
+     * @method  recalculatePlacement
+     * @param   {Object}    stepConfig      The step configuration of the step
+     * @return  {String}                    The placement after recalculate
+     */
+    recalculatePlacement(stepConfig) {
+        const buffer = 10;
+        const arrowWidth = 16;
+        let target = this.getStepTarget(stepConfig);
+        let widthContent = this.currentStepNode.width() + arrowWidth;
+        let targetOffsetLeft = target.offset().left - buffer;
+        let targetOffsetRight = target.offset().left + target.width() + buffer;
+        let placement = stepConfig.placement;
+
+        if (['left', 'right'].indexOf(placement) !== -1) {
+            if ((targetOffsetLeft < (widthContent + buffer)) &&
+                ((targetOffsetRight + widthContent + buffer) > document.documentElement.clientWidth)) {
+                placement = 'top';
+            }
+        }
+        return placement;
+    }
+
    /**
     * Add the backdrop.
     *
@@ -622,7 +622,26 @@ class manager {
     * @return  array
     */
    public static function get_matching_tours(\moodle_url $pageurl): array {
-        global $PAGE;
+        global $PAGE, $USER;
+
+        // The following three checks make sure that the user is fully ready to use the site. If not, we do not show any tours.
+        // We need the user to get properly set up so that all require_login() and other bits work as expected.
+
+        if (user_not_fully_set_up($USER)) {
+            return [];
+        }
+
+        if (get_user_preferences('auth_forcepasswordchange', false)) {
+            return [];
+        }
+
+        if (empty($USER->policyagreed) && !is_siteadmin()) {
+            $manager = new \core_privacy\local\sitepolicy\manager();
+
+            if ($manager->is_defined(isguestuser())) {
+                return [];
+            }
+        }

        $tours = cache::get_matching_tourdata($pageurl);

@@ -325,6 +325,8 @@ class tool_usertours_manager_testcase extends advanced_testcase {
    public function test_get_matching_tours(array $alltours, string $url, array $expected) {
        $this->resetAfterTest();

+        $this->setGuestUser();
+
        foreach ($alltours as $tourconfig) {
            $tour = $this->helper_create_tour((object) $tourconfig);
            $this->helper_create_step((object) ['tourid' => $tour->get_id()]);
@@ -336,4 +338,34 @@ class tool_usertours_manager_testcase extends advanced_testcase {
            $this->assertEquals($expected[$i], $matches[$i]->get_name());
        }
    }
+
+    /**
+     * Test that no matching tours are returned if there is pending site policy agreement.
+     */
+    public function test_get_matching_tours_for_user_without_site_policy_agreed() {
+        global $CFG;
+
+        $this->resetAfterTest();
+        $this->setGuestUser();
+
+        $tour = $this->helper_create_tour((object) [
+            'pathmatch' => '/%',
+            'enabled' => true,
+            'name' => 'Test tour',
+            'description' => '',
+            'configdata' => '',
+        ]);
+
+        $this->helper_create_step((object) [
+            'tourid' => $tour->get_id(),
+        ]);
+
+        $matches = \tool_usertours\manager::get_matching_tours(new moodle_url('/'));
+        $this->assertEquals(1, count($matches));
+
+        $CFG->sitepolicyguest = 'https://example.com';
+
+        $matches = \tool_usertours\manager::get_matching_tours(new moodle_url('/'));
+        $this->assertEmpty($matches);
+    }
 }
@@ -279,7 +279,7 @@ abstract class base extends \core_analytics\calculable {
        } else if ($context->contextlevel >= CONTEXT_COURSE) {
            // At course level or below only enrolled users although this is not ideal for
            // teachers assigned at category level.
-            $users = get_enrolled_users($context, 'moodle/analytics:listinsights');
+            $users = get_enrolled_users($context, 'moodle/analytics:listinsights', 0, 'u.*', null, 0, 0, true);
        } else {
            $users = get_users_by_capability($context, 'moodle/analytics:listinsights');
        }
@@ -131,11 +131,11 @@ class auth_plugin_db extends auth_plugin_base {
            $authdb->Close();

            if ($this->config->passtype === 'plaintext') {
-                return ($fromdb == $extpassword);
+                return ($fromdb === $extpassword);
            } else if ($this->config->passtype === 'md5') {
-                return (strtolower($fromdb) == md5($extpassword));
+                return (strtolower($fromdb) === md5($extpassword));
            } else if ($this->config->passtype === 'sha1') {
-                return (strtolower($fromdb) == sha1($extpassword));
+                return (strtolower($fromdb) === sha1($extpassword));
            } else if ($this->config->passtype === 'saltedcrypt') {
                return password_verify($extpassword, $fromdb);
            } else {
@@ -335,12 +335,28 @@ class auth_db_testcase extends advanced_testcase {
        $DB->update_record('auth_db_users', $user3);
        $this->assertTrue($auth->user_login('u3', 'heslo'));

+        // Test user created to see if the checking happens strictly.
+        $usermd5 = (object)['name' => 'usermd5', 'pass' => '0e462097431906509019562988736854'];
+        $usermd5->id = $DB->insert_record('auth_db_users', $usermd5);
+
+        // md5('240610708') === '0e462097431906509019562988736854'.
+        $this->assertTrue($auth->user_login('usermd5', '240610708'));
+        $this->assertFalse($auth->user_login('usermd5', 'QNKCDZO'));
+
        set_config('passtype', 'sh1', 'auth_db');
        $auth->config->passtype = 'sha1';
        $user3->pass = sha1('heslo');
        $DB->update_record('auth_db_users', $user3);
        $this->assertTrue($auth->user_login('u3', 'heslo'));

+        // Test user created to see if the checking happens strictly.
+        $usersha1 = (object)['name' => 'usersha1', 'pass' => '0e66507019969427134894567494305185566735'];
+        $usersha1->id = $DB->insert_record('auth_db_users', $usersha1);
+
+        // sha1('aaroZmOk') === '0e66507019969427134894567494305185566735'.
+        $this->assertTrue($auth->user_login('usersha1', 'aaroZmOk'));
+        $this->assertFalse($auth->user_login('usersha1', 'aaK1STfY'));
+
        set_config('passtype', 'saltedcrypt', 'auth_db');
        $auth->config->passtype = 'saltedcrypt';
        $user3->pass = password_hash('heslo', PASSWORD_BCRYPT);
@@ -1228,18 +1228,18 @@ class auth_plugin_ldap extends auth_plugin_base {
                    empty($nuvalue) ? $nuvalue = array() : $nuvalue;
                    $ouvalue = core_text::convert($oldvalue, 'utf-8', $this->config->ldapencoding);
                    foreach ($ldapkeys as $ldapkey) {
-                        // Skip update if $ldapkey does not exist in LDAP.
-                        if (!isset($user_entry[$ldapkey][0])) {
-                            $success = false;
-                            error_log($this->errorlogtag.get_string('updateremfailfield', 'auth_ldap',
-                                                                     array('ldapkey' => $ldapkey,
-                                                                            'key' => $key,
-                                                                            'ouvalue' => $ouvalue,
-                                                                            'nuvalue' => $nuvalue)));
-                            continue;
+                        // If the field is empty in LDAP there are two options:
+                        // 1. We get the LDAP field using ldap_first_attribute.
+                        // 2. LDAP don't send the field using  ldap_first_attribute.
+                        // So, for option 1 we check the if the field is retrieve it.
+                        // And get the original value of field in LDAP if the field.
+                        // Otherwise, let value in blank and delegate the check in ldap_modify.
+                        if (isset($user_entry[$ldapkey][0])) {
+                            $ldapvalue = $user_entry[$ldapkey][0];
+                        } else {
+                            $ldapvalue = '';
                        }

-                        $ldapvalue = $user_entry[$ldapkey][0];
                        if (!$ambiguous) {
                            // Skip update if the values already match
                            if ($nuvalue !== $ldapvalue) {
@@ -93,13 +93,12 @@ class helper {

        foreach ($sessions as $session) {
            // Get user session from DB.
-            if (session_decode(base64_decode($session->sessdata))) {
-                if (isset($_SESSION['SESSION']) && isset($_SESSION['SESSION']->shibboleth_session_id)) {
-                    // If there is a match, kill the session.
-                    if ($_SESSION['SESSION']->shibboleth_session_id == trim($spsessionid)) {
-                        // Delete this user's sessions.
-                        \core\session\manager::kill_user_sessions($session->userid);
-                    }
+            $usersession = self::unserializesession(base64_decode($session->sessdata));
+            if (isset($usersession['SESSION']) && isset($usersession['SESSION']->shibboleth_session_id)) {
+                // If there is a match, kill the session.
+                if ($usersession['SESSION']->shibboleth_session_id == trim($spsessionid)) {
+                    // Delete this user's sessions.
+                    \core\session\manager::kill_user_sessions($session->userid);
                }
            }
        }
@@ -42,6 +42,7 @@ class behat_auth extends behat_base {
     * Logs in the user. There should exist a user with the same value as username and password.
     *
     * @Given /^I log in as "(?P<username_string>(?:[^"]|\\")*)"$/
+     * @Given I am logged in as :username
     * @param string $username the user to log in as.
     * @param moodle_url|null $wantsurl optional, URL to go to after logging in.
     */
@@ -52,33 +53,24 @@ class behat_auth extends behat_base {
            return;
        }

-        $loginurl = new moodle_url('/login/index.php');
+        $loginurl = new moodle_url('/auth/tests/behat/login.php', [
+            'username' => $username,
+        ]);
        if ($wantsurl !== null) {
            $loginurl->param('wantsurl', $wantsurl->out_as_local_url());
        }

        // Visit login page.
        $this->execute('behat_general::i_visit', [$loginurl]);
-
-        // Enter username and password.
-        $this->execute('behat_forms::i_set_the_field_to', array('Username', $this->escape($username)));
-        $this->execute('behat_forms::i_set_the_field_to', array('Password', $this->escape($username)));
-
-        // Press log in button, no need to check for exceptions as it will checked after this step execution.
-        $this->execute('behat_forms::press_button', get_string('login'));
    }

    /**
     * Logs out of the system.
     *
     * @Given /^I log out$/
+     * @Given I am not logged in
     */
    public function i_log_out() {
-
-        // Wait for page to be loaded.
-        $this->wait_for_pending_js();
-
-        // Click on logout link in footer, as it's much faster.
-        $this->execute('behat_general::i_click_on_in_the', array(get_string('logout'), 'link', '#page-footer', "css_element"));
+        $this->execute('behat_general::i_visit', [new moodle_url('/auth/tests/behat/logout.php')]);
    }
 }
@@ -35,16 +35,14 @@ Feature: Authentication
    And I press "Log in"
    Then I should see "Invalid login, please try again"

-  Scenario: Log out
+  Scenario: Log out using the Log out link
    Given I log in as "admin"
-    When I log out
+    When I click on "Log out" "link" in the "#page-footer" "css_element"
    Then I should see "You are not logged in" in the "page-footer" "region"

  Scenario Outline: Checking the display of the Remember username checkbox
-    Given I log in as "admin"
-    And I set the following administration settings values:
+    Given the following config values are set as admin:
      | rememberusername | <settingvalue> |
-    And I log out
    And I am on homepage
    When I click on "Log in" "link" in the ".logininfo" "css_element"
    Then I should <expect> "Remember username"
@@ -0,0 +1,89 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+// phpcs:disable moodle.Files.RequireLogin.Missing
+// phpcs:disable moodle.PHP.ForbiddenFunctions.Found
+
+/**
+ * Login end point for Behat tests only.
+ *
+ * @package    core_auth
+ * @category   test
+ * @author     Guy Thomas
+ * @copyright  2021 Class Technologies Inc. {@link https://www.class.com/}
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+require(__DIR__.'/../../../config.php');
+require_once("{$CFG->dirroot}/login/lib.php");
+
+$behatrunning = defined('BEHAT_SITE_RUNNING') && BEHAT_SITE_RUNNING;
+if (!$behatrunning) {
+    redirect(new moodle_url('/'));
+}
+
+$username = required_param('username', PARAM_ALPHANUMEXT);
+$wantsurl = optional_param('wantsurl', null, PARAM_URL);
+
+if (isloggedin()) {
+    // If the user is already logged in, log them out and redirect them back to login again.
+    require_logout();
+    redirect(new moodle_url('/auth/tests/behat/login.php', [
+        'username' => $username,
+        'wantsurl' => (new moodle_url($wantsurl))->out(false),
+    ]));
+}
+
+// Note - with behat, the password is always the same as the username.
+$password = $username;
+
+$failurereason = null;
+$user = authenticate_user_login($username, $password, true, $failurereason, false);
+if ($failurereason) {
+    switch($failurereason) {
+        case AUTH_LOGIN_NOUSER:
+            $reason = get_string('invalidlogin');
+            break;
+        case AUTH_LOGIN_SUSPENDED:
+            $reason = 'User suspended';
+            break;
+        case AUTH_LOGIN_FAILED:
+            $reason = 'Login failed';
+            break;
+        case AUTH_LOGIN_LOCKOUT:
+            $reason = 'Account locked';
+            break;
+        case AUTH_LOGIN_UNAUTHORISED:
+            $reason = get_string('unauthorisedlogin', 'core', $username);
+            break;
+        default:
+            $reason = "Unknown login failure: '{$failurereason}'";
+            break;
+
+    }
+
+    // Note: Do not throw an exception here as we sometimes test that login does not work.
+    // Exceptions are automatic failures in Behat.
+    \core\notification::add($reason, \core\notification::ERROR);
+    redirect(new moodle_url('/'));
+}
+
+if (!complete_user_login($user)) {
+    throw new Exception("Failed to login as behat step for $username");
+}
+
+if (empty($wantsurl)) {
+    $wantsurl = core_login_get_return_url();
+}
+redirect(new moodle_url($wantsurl));
@@ -0,0 +1,41 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+// phpcs:disable moodle.Files.RequireLogin.Missing
+// phpcs:disable moodle.PHP.ForbiddenFunctions.Found
+
+/**
+ * Login end point for Behat tests only.
+ *
+ * @package    core_auth
+ * @category   test
+ * @copyright  Andrew Lyons <andrew@nicols.co.uk>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+require(__DIR__.'/../../../config.php');
+
+$behatrunning = defined('BEHAT_SITE_RUNNING') && BEHAT_SITE_RUNNING;
+if (!$behatrunning) {
+    redirect(new moodle_url('/login/logout.php'));
+}
+
+require_logout();
+
+$login = optional_param('loginpage', 0, PARAM_BOOL);
+if ($login) {
+    redirect(get_login_url());
+} else {
+    redirect(new moodle_url('/'));
+}
@@ -108,6 +108,64 @@ abstract class condition extends tree_node {
        return preg_replace('~^availability_(.*?)\\\\condition$~', '$1', get_class($this));
    }

+    /**
+     * Returns a marker indicating that an activity name should be placed in a description.
+     *
+     * Gets placeholder text which will be decoded by info::format_info later when we can safely
+     * display names.
+     *
+     * @param int $cmid Course-module id
+     * @return string Placeholder text
+     * @since Moodle 3.10.7
+     */
+    public static function description_cm_name(int $cmid): string {
+        return '<AVAILABILITY_CMNAME_' . $cmid . '/>';
+    }
+
+    /**
+     * Returns a marker indicating that formatted text should be placed in a description.
+     *
+     * Gets placeholder text which will be decoded by info::format_info later when we can safely
+     * call format_string.
+     *
+     * @param string $str Text to be processed with format_string
+     * @return string Placeholder text
+     * @since Moodle 3.10.7
+     */
+    public static function description_format_string(string $str): string {
+        return '<AVAILABILITY_FORMAT_STRING>' . htmlspecialchars($str, ENT_NOQUOTES) .
+                '</AVAILABILITY_FORMAT_STRING>';
+    }
+
+    /**
+     * Returns a marker indicating that some of the description text should be computed at display
+     * time.
+     *
+     * This will result in a call to the get_description_callback_value static function within
+     * the condition class.
+     *
+     * Gets placeholder text which will be decoded by info::format_info later when we can safely
+     * call most Moodle functions.
+     *
+     * @param string[] $params Array of arbitrary parameters
+     * @return string Placeholder text
+     * @since Moodle 3.10.7
+     */
+    public function description_callback(array $params): string {
+        $out = '<AVAILABILITY_CALLBACK type="' . $this->get_type() . '">';
+        $first = true;
+        foreach ($params as $param) {
+            if ($first) {
+                $first = false;
+            } else {
+                $out .= '<P/>';
+            }
+            $out .= htmlspecialchars($param, ENT_NOQUOTES);
+        }
+        $out .= '</AVAILABILITY_CALLBACK>';
+        return $out;
+    }
+
    /**
     * Obtains a string describing this restriction (whether or not
     * it actually applies). Used to obtain information that is displayed to
@@ -119,11 +177,17 @@ abstract class condition extends tree_node {
     * (when displaying only conditions they don't meet).
     *
     * If implementations require a course or modinfo, they should use
-     * the get methods in $info.
+     * the get methods in $info. They should not use any other functions that
+     * might rely on modinfo, such as format_string.
     *
-     * The special string <AVAILABILITY_CMNAME_123/> can be returned, where
-     * 123 is any number. It will be replaced with the correctly-formatted
-     * name for that activity.
+     * To work around this limitation, use the functions:
+     *
+     * description_cm_name()
+     * description_format_string()
+     * description_callback()
+     *
+     * These return special markers which will be added to the string and processed
+     * later after modinfo is complete.
     *
     * @param bool $full Set true if this is the 'full information' view
     * @param bool $not Set true if we are inverting the condition
@@ -142,11 +206,17 @@ abstract class condition extends tree_node {
     * the list, in front of the standard get_description call.
     *
     * If implementations require a course or modinfo, they should use
-     * the get methods in $info.
+     * the get methods in $info. They should not use any other functions that
+     * might rely on modinfo, such as format_string.
     *
-     * The special string <AVAILABILITY_CMNAME_123/> can be returned, where
-     * 123 is any number. It will be replaced with the correctly-formatted
-     * name for that activity.
+     * To work around this limitation, use the functions:
+     *
+     * description_cm_name()
+     * description_format_string()
+     * description_callback()
+     *
+     * These return special markers which will be added to the string and processed
+     * later after modinfo is complete.
     *
     * @param bool $full Set true if this is the 'full information' view
     * @param bool $not Set true if we are inverting the condition
@@ -746,6 +746,26 @@ abstract class info {
                        return format_string($cm->get_name(), true, ['context' => $context]);
                    }
                }, $info);
+        $info = preg_replace_callback('~<AVAILABILITY_FORMAT_STRING>(.*?)</AVAILABILITY_FORMAT_STRING>~s',
+                function($matches) use ($context) {
+                    $decoded = htmlspecialchars_decode($matches[1], ENT_NOQUOTES);
+                    return format_string($decoded, true, ['context' => $context]);
+                }, $info);
+        $info = preg_replace_callback('~<AVAILABILITY_CALLBACK type="([a-z0-9_]+)">(.*?)</AVAILABILITY_CALLBACK>~s',
+                function($matches) use ($modinfo, $context) {
+                    // Find the class, it must have already been loaded by now.
+                    $fullclassname = 'availability_' . $matches[1] . '\condition';
+                    if (!class_exists($fullclassname, false)) {
+                        return '<!-- Error finding class ' . $fullclassname .' -->';
+                    }
+                    // Load the parameters.
+                    $params = [];
+                    $encodedparams = preg_split('~<P/>~', $matches[2], 0);
+                    foreach ($encodedparams as $encodedparam) {
+                        $params[] = htmlspecialchars_decode($encodedparam, ENT_NOQUOTES);
+                    }
+                    return $fullclassname::get_description_callback_value($modinfo, $context, $params);
+                }, $info);

        return $info;
    }
@@ -51,7 +51,7 @@ class info_module extends info {
        // We cannot access $cm->name as a property at this point, because this
        // code may itself run in response to the $cm->name property access, and
        // PHP magic function properties do not allow recursion (because PHP).
-        return '<AVAILABILITY_CMNAME_' . $this->cm->id . '/>';
+        return condition::description_cm_name($this->cm->id);
    }

    protected function set_in_database($availability) {
@@ -354,7 +354,7 @@ class condition extends \core_availability\condition {
            if (!array_key_exists($cmid, $modinfo->cms) || $modinfo->cms[$cmid]->deletioninprogress) {
                $modname = get_string('missing', 'availability_completion');
            } else {
-                $modname = '<AVAILABILITY_CMNAME_' . $modinfo->cms[$cmid]->id . '/>';
+                $modname = self::description_cm_name($modinfo->cms[$cmid]->id);
            }
        }

@@ -48,10 +48,10 @@ Feature: Confirm that conditions on completion no longer cause a bug
    And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
    And I set the field with xpath "//div[contains(concat(' ', normalize-space(@class), ' '), ' availability-item ')][preceding-sibling::div]//select[@name='cm']" to "Page2"
    And I press "Save and return to course"
-    And I should see "Not available unless:" in the ".activity.glossary" "css_element"
+    Then I should see "Not available unless:" in the ".activity.glossary" "css_element"
    And I should see "The activity Page1 is marked complete" in the ".activity.glossary" "css_element"
    And I should see "The activity Page2 is marked complete" in the ".activity.glossary" "css_element"
-    And I follow "TestGlossary"

    # Behat will automatically check there is no error on this page.
-    Then I should see "TestGlossary"
+    And I am on the TestGlossary "glossary activity" page
+    And I should see "TestGlossary"
@@ -142,10 +142,29 @@ class condition extends \core_availability\condition {
                $string = 'notgeneral';
            }
        }
-        $name = self::get_cached_grade_name($course->id, $this->gradeitemid);
+        // We cannot get the name at this point because it requires format_string which is not
+        // allowed here. Instead, get it later with the callback function below.
+        $name = $this->description_callback([$this->gradeitemid]);
        return get_string('requires_' . $string, 'availability_grade', $name);
    }

+    /**
+     * Gets the grade name at display time.
+     *
+     * @param \course_modinfo $modinfo Modinfo
+     * @param \context $context Context
+     * @param string[] $params Parameters (just grade item id)
+     * @return string Text value
+     */
+    public static function get_description_callback_value(
+            \course_modinfo $modinfo, \context $context, array $params): string {
+        if (count($params) !== 1 || !is_number($params[0])) {
+            return '<!-- Invalid grade description callback -->';
+        }
+        $gradeitemid = (int)$params[0];
+        return self::get_cached_grade_name($modinfo->get_course_id(), $gradeitemid);
+    }
+
    protected function get_debug_string() {
        $out = '#' . $this->gradeitemid;
        if (!is_null($this->min)) {
@@ -86,13 +86,12 @@ Feature: availability_grade
    And I set the field "Minimum grade percentage (inclusive)" to "10"
    And I press "Save and return to course"

+    And I log out
+
    # Log in as student without a grade yet.
-    When I log out
-    And I log in as "student1"
-    And I am on "Course 1" course homepage
+    When I am on the "A1" "assign activity" page logged in as student1

    # Do the assignment.
-    And I follow "A1"
    And I click on "Add submission" "button"
    And I set the field "Online text" to "Q"
    And I click on "Save changes" "button"
@@ -103,27 +102,60 @@ Feature: availability_grade
    And I should not see "P3" in the "region-main" "region"
    And I should not see "P4" in the "region-main" "region"
    And I should see "A1" in the "region-main" "region"
+    And I log out

    # Log back in as teacher.
-    When I log out
-    And I log in as "teacher1"
-    And I am on "Course 1" course homepage
+    When I am on the "A1" "assign activity" page logged in as teacher1

    # Give the assignment 40%.
-    And I follow "A1"
    And I navigate to "View all submissions" in current page administration
    # Pick the grade link in the row that has s@example.com in it.
    And I click on "Grade" "link" in the "s@example.com" "table_row"
    And I set the field "Grade out of 100" to "40"
    And I click on "Save changes" "button"
    And I click on "Edit settings" "link"
+    And I log out

    # Log back in as student.
-    And I log out
-    And I log in as "student1"
-    And I am on "Course 1" course homepage
+    And I am on the "Course 1" course page logged in as student1

    # Check pages are visible.
    Then I should see "P2" in the "region-main" "region"
    And I should see "P4" in the "region-main" "region"
    And I should not see "P3" in the "region-main" "region"
+
+  @javascript
+  Scenario: Condition display with filters
+    # Teacher sets up a restriction on group G1, using multilang filter.
+    Given the following "activity" exists:
+      | activity    | assign                                                                                      |
+      | name        | <span lang="en" class="multilang">A-One</span><span lang="fr" class="multilang">A-Un</span> |
+      | intro       | Test                                                                                        |
+      | course      | C1                                                                                          |
+      | idnumber    | 0001                                                                                        |
+      | section     | 1                                                                                           |
+    And the "multilang" filter is "on"
+    And the "multilang" filter applies to "content and headings"
+    # The activity names filter is enabled because it triggered a bug in older versions.
+    And the "activitynames" filter is "on"
+    And the "activitynames" filter applies to "content and headings"
+    And I am on the "C1" "Course" page logged in as "teacher1"
+    And I turn editing mode on
+    And I add a "Page" to section "1"
+    And I expand all fieldsets
+    And I set the following fields to these values:
+      | Name         | P1 |
+      | Description  | x  |
+      | Page content | x  |
+    And I click on "Add restriction..." "button"
+    And I click on "Grade" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Grade" to "A-One"
+    And I click on "min" "checkbox" in the ".availability-item" "css_element"
+    And I set the field "Minimum grade percentage (inclusive)" to "10"
+    And I press "Save and return to course"
+    And I log out
+
+    # Student sees information about no access to group, with group name in correct language.
+    When I am on the "C1" "Course" page logged in as "student1"
+    Then I should see "Not available unless: You achieve a required score in A-One"
+    And I should not see "A-Un"
@@ -68,6 +68,7 @@ class availability_grade_condition_testcase extends advanced_testcase {
        // Check if available (not available).
        $this->assertFalse($cond->is_available(false, $info, true, $user->id));
        $information = $cond->get_description(false, false, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~have a grade.*Test!~', $information);
        $this->assertTrue($cond->is_available(true, $info, true, $user->id));

@@ -76,6 +77,7 @@ class availability_grade_condition_testcase extends advanced_testcase {
        $this->assertTrue($cond->is_available(false, $info, true, $user->id));
        $this->assertFalse($cond->is_available(true, $info, true, $user->id));
        $information = $cond->get_description(false, true, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~do not have a grade.*Test!~', $information);

        // Construct directly and test remaining conditions; first, min grade (fail).
@@ -84,6 +86,7 @@ class availability_grade_condition_testcase extends advanced_testcase {
        $cond = new condition($structure);
        $this->assertFalse($cond->is_available(false, $info, true, $user->id));
        $information = $cond->get_description(false, false, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~achieve a required score.*Test!~', $information);
        $this->assertTrue($cond->is_available(true, $info, true, $user->id));

@@ -92,6 +95,7 @@ class availability_grade_condition_testcase extends advanced_testcase {
        $this->assertTrue($cond->is_available(false, $info, true, $user->id));
        $this->assertFalse($cond->is_available(true, $info, true, $user->id));
        $information = $cond->get_description(false, true, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~do not get certain scores.*Test!~', $information);

        // Max grade (fail).
@@ -100,6 +104,7 @@ class availability_grade_condition_testcase extends advanced_testcase {
        $cond = new condition($structure);
        $this->assertFalse($cond->is_available(false, $info, true, $user->id));
        $information = $cond->get_description(false, false, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~get an appropriate score.*Test!~', $information);
        $this->assertTrue($cond->is_available(true, $info, true, $user->id));

@@ -108,6 +113,7 @@ class availability_grade_condition_testcase extends advanced_testcase {
        $this->assertTrue($cond->is_available(false, $info, true, $user->id));
        $this->assertFalse($cond->is_available(true, $info, true, $user->id));
        $information = $cond->get_description(false, true, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~do not get certain scores.*Test!~', $information);

        // Max and min (fail).
@@ -116,6 +122,7 @@ class availability_grade_condition_testcase extends advanced_testcase {
        $cond = new condition($structure);
        $this->assertFalse($cond->is_available(false, $info, true, $user->id));
        $information = $cond->get_description(false, false, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~get a particular score.*Test!~', $information);
        $this->assertTrue($cond->is_available(true, $info, true, $user->id));

@@ -128,6 +135,7 @@ class availability_grade_condition_testcase extends advanced_testcase {
        $this->assertTrue($cond->is_available(false, $info, true, $user->id));
        $this->assertFalse($cond->is_available(true, $info, true, $user->id));
        $information = $cond->get_description(false, true, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~do not get certain scores.*Test!~', $information);

        // Success (bottom end).
@@ -135,6 +143,7 @@ class availability_grade_condition_testcase extends advanced_testcase {
        $this->assertTrue($cond->is_available(false, $info, true, $user->id));
        $this->assertFalse($cond->is_available(true, $info, true, $user->id));
        $information = $cond->get_description(false, true, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~do not get certain scores.*Test!~', $information);
    }

@@ -110,9 +110,8 @@ class condition extends \core_availability\condition {
            if (!array_key_exists($this->groupid, self::$groupnames)) {
                $name = get_string('missing', 'availability_group');
            } else {
-                $context = \context_course::instance($course->id);
-                $name = format_string(self::$groupnames[$this->groupid], true,
-                        array('context' => $context));
+                // Not safe to call format_string here; use the special function to call it later.
+                $name = self::description_format_string(self::$groupnames[$this->groupid]);
            }
        } else {
            return get_string($not ? 'requires_notanygroup' : 'requires_anygroup',
@@ -6,8 +6,8 @@ Feature: availability_group

  Background:
    Given the following "courses" exist:
-      | fullname | shortname | format | enablecompletion |
-      | Course 1 | C1        | topics | 1                |
+      | fullname | shortname | format | enablecompletion | numsections |
+      | Course 1 | C1        | topics | 1                | 3           |
    And the following "users" exist:
      | username |
      | teacher1 |
@@ -101,3 +101,33 @@ Feature: availability_group
    Then I should see "P1" in the "region-main" "region"
    And I should see "P2" in the "region-main" "region"
    And I should not see "P3" in the "region-main" "region"
+
+  @javascript
+  Scenario: Condition display with filters
+    # Teacher sets up a restriction on group G1, using multilang filter.
+    Given the following "groups" exist:
+      | name                                                                                        | course | idnumber |
+      | <span lang="en" class="multilang">G-One</span><span lang="fr" class="multilang">G-Un</span> | C1     | GI1      |
+    And the "multilang" filter is "on"
+    And the "multilang" filter applies to "content and headings"
+    # The activity names filter is enabled because it triggered a bug in older versions.
+    And the "activitynames" filter is "on"
+    And the "activitynames" filter applies to "content and headings"
+    And I am on the "C1" "Course" page logged in as "teacher1"
+    And I turn editing mode on
+    And I add a "Page" to section "1"
+    And I expand all fieldsets
+    And I set the following fields to these values:
+      | Name         | P1 |
+      | Description  | x  |
+      | Page content | x  |
+    And I click on "Add restriction..." "button"
+    And I click on "Group" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Group" to "G-One"
+    And I click on "Save and return to course" "button"
+    And I log out
+
+    # Student sees information about no access to group, with group name in correct language.
+    When I am on the "C1" "Course" page logged in as "student1"
+    Then I should see "Not available unless: You belong to G-One"
+    And I should not see "G-Un"
@@ -73,6 +73,7 @@ class availability_group_condition_testcase extends advanced_testcase {
        // Check if available (when not available).
        $this->assertFalse($cond->is_available(false, $info, true, $user->id));
        $information = $cond->get_description(false, false, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~You belong to.*G1!~', $information);
        $this->assertTrue($cond->is_available(true, $info, true, $user->id));

@@ -85,6 +86,7 @@ class availability_group_condition_testcase extends advanced_testcase {
        $this->assertTrue($cond->is_available(false, $info, true, $user->id));
        $this->assertFalse($cond->is_available(true, $info, true, $user->id));
        $information = $cond->get_description(false, true, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~do not belong to.*G1!~', $information);

        // Check group 2 works also.
@@ -96,6 +98,7 @@ class availability_group_condition_testcase extends advanced_testcase {
        $this->assertTrue($cond->is_available(false, $info, true, $user->id));
        $this->assertFalse($cond->is_available(true, $info, true, $user->id));
        $information = $cond->get_description(false, true, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~do not belong to any~', $information);

        // Admin user doesn't belong to a group, but they can access it
@@ -108,6 +111,7 @@ class availability_group_condition_testcase extends advanced_testcase {
        $cond = new condition((object)array('id' => $group2->id + 1000));
        $this->assertFalse($cond->is_available(false, $info, true, $user->id));
        $information = $cond->get_description(false, false, $info);
+        $information = \core_availability\info::format_info($information, $course);
        $this->assertRegExp('~You belong to.*\(Missing group\)~', $information);
    }

@@ -141,9 +141,8 @@ class condition extends \core_availability\condition {
        if (!array_key_exists($groupingid, self::$groupingnames)) {
            $name = get_string('missing', 'availability_grouping');
        } else {
-            $context = \context_course::instance($course->id);
-            $name = format_string(self::$groupingnames[$groupingid], true,
-                    array('context' => $context));
+            // Not safe to call format_string here; use the special function to call it later.
+            $name = self::description_format_string(self::$groupingnames[$groupingid]);
        }

        return get_string($not ? 'requires_notgrouping' : 'requires_grouping',
@@ -114,3 +114,31 @@ Feature: availability_grouping
    And I press "Add group/grouping access restriction"
    When I press "Save and return to course"
    Then I should see "Not available unless: You belong to a group in Grouping A"
+
+  @javascript
+  Scenario: Condition display with filters
+    # Teacher sets up a restriction on group G1, using multilang filter.
+    Given the following "groupings" exist:
+      | name                                                                                          | course | idnumber |
+      | <span lang="en" class="multilang">Gr-One</span><span lang="fr" class="multilang">Gr-Un</span> | C1     | GA       |
+    And the following "activities" exist:
+      | activity  | name        | intro              | course | idnumber | groupmode | grouping |
+      | assign    | Test assign | Assign description | C1     | assign1  | 1         | GA       |
+    And the "multilang" filter is "on"
+    And the "multilang" filter applies to "content and headings"
+    # The activity names filter is enabled because it triggered a bug in older versions.
+    And the "activitynames" filter is "on"
+    And the "activitynames" filter applies to "content and headings"
+    And I am on the "C1" "Course" page logged in as "teacher1"
+    And I turn editing mode on
+    And I open "Test assign" actions menu
+    And I choose "Edit settings" in the open action menu
+    And I expand all fieldsets
+    And I press "Add group/grouping access restriction"
+    And I press "Save and return to course"
+    And I log out
+
+    # Student sees information about no access to group, with group name in correct language.
+    When I am on the "C1" "Course" page logged in as "student1"
+    Then I should see "Not available unless: You belong to a group in Gr-One"
+    And I should not see "Gr-Un"
@@ -199,9 +199,9 @@ class condition extends \core_availability\condition {
        } else {
            $translatedfieldname = get_user_field_name($this->standardfield);
        }
-        $context = \context_course::instance($course->id);
        $a = new \stdClass();
-        $a->field = format_string($translatedfieldname, true, array('context' => $context));
+        // Not safe to call format_string here; use the special function to call it later.
+        $a->field = self::description_format_string($translatedfieldname);
        $a->value = s($this->value);
        if ($not) {
            // When doing NOT strings, we replace the operator with its inverse.
@@ -95,8 +95,7 @@ Feature: availability_profile
    And I click on "Save and return to course" "button"

    # Edit it again and check the setting still works.
-    When I follow "P1"
-    And I navigate to "Edit settings" in current page administration
+    When I am on the P1 "page activity editing" page
    And I expand all fieldsets
    Then the field "User profile field" matches value "Super field"
    And the field "Value to compare against" matches value "Bananaman"
@@ -106,3 +105,35 @@ Feature: availability_profile
    And I log in as "student1"
    And I am on "Course 1" course homepage
    Then I should see "P1" in the "region-main" "region"
+
+  @javascript
+  Scenario: Condition display with filters
+    # Teacher sets up a restriction on group G1, using multilang filter.
+    Given the following "custom profile fields" exist:
+      | datatype | shortname | name                                                                                        | param2 |
+      | text     | frog      | <span lang="en" class="multilang">F-One</span><span lang="fr" class="multilang">F-Un</span> | 100    |
+    And the "multilang" filter is "on"
+    And the "multilang" filter applies to "content and headings"
+    # The activity names filter is enabled because it triggered a bug in older versions.
+    And the "activitynames" filter is "on"
+    And the "activitynames" filter applies to "content and headings"
+    And I am on the "C1" "Course" page logged in as "teacher1"
+    And I turn editing mode on
+    And I add a "Page" to section "1"
+    And I expand all fieldsets
+    And I set the following fields to these values:
+      | Name         | P1 |
+      | Description  | x  |
+      | Page content | x  |
+    And I click on "Add restriction..." "button"
+    And I click on "User profile" "button" in the "Add restriction..." "dialogue"
+    And I set the following fields to these values:
+      | User profile field       | F-One |
+      | Value to compare against | 111   |
+    And I click on "Save and return to course" "button"
+    And I log out
+
+    # Student sees information about no access to group, with group name in correct language.
+    When I am on the "C1" "Course" page logged in as "student1"
+    Then I should see "Not available unless: Your F-One is 111"
+    And I should not see "F-Un"
@@ -313,6 +313,7 @@ class availability_profile_condition_testcase extends advanced_testcase {
        // Check the message (should be using lang string with capital, which
        // is evidence that it called the right function to get the name).
        $information = $cond->get_description(false, false, $info);
+        $information = \core_availability\info::format_info($information, $info->get_course());
        $this->assertRegExp('~Department~', $information);

        // Set the field to true for both users and retry.
@@ -394,6 +395,7 @@ class availability_profile_condition_testcase extends advanced_testcase {
                'Failed checking normal (positive) result');
        if (!$yes) {
            $information = $cond->get_description(false, false, $info);
+            $information = \core_availability\info::format_info($information, $info->get_course());
            $this->assertRegExp($failpattern, $information);
        }

@@ -402,6 +404,7 @@ class availability_profile_condition_testcase extends advanced_testcase {
                'Failed checking NOT (negative) result');
        if ($yes) {
            $information = $cond->get_description(false, true, $info);
+            $information = \core_availability\info::format_info($information, $info->get_course());
            $this->assertRegExp($failpattern, $information);
        }
    }
@@ -2,6 +2,13 @@ This files describes API changes in /availability/*.

 The information here is intended only for developers.

+=== 3.10.8 ===
+
+* There were existing restrictions on what condition plugins can do in the get_description
+  method (for example they mustn't call format_string), which were not well documented.
+  New functions description_cm_name(), description_format_string(), description_callback()
+  can be used so that condition plugins to behave correctly in all situations.
+
 === 3.2 ===

 * Condition plugins must replace the CSS selector "#fitem_id_availabilityconditionsjson" with ".availability-field".
@@ -358,6 +358,15 @@ class backup_controller extends base_controller {
        return $this->plan;
    }

+    /**
+     * For debug only. Get a simple test display of all the settings.
+     *
+     * @return string
+     */
+    public function debug_display_all_settings_values(): string {
+        return $this->get_plan()->debug_display_all_settings_values();
+    }
+
    /**
     * Sets the user roles that should be kept in the destination course
     * for a course copy operation.
@@ -350,6 +350,15 @@ class restore_controller extends base_controller {
        }
    }

+    /**
+     * For debug only. Get a simple test display of all the settings.
+     *
+     * @return string
+     */
+    public function debug_display_all_settings_values(): string {
+        return $this->get_plan()->debug_display_all_settings_values();
+    }
+
    public function get_info() {
        return $this->info;
    }
@@ -162,6 +162,16 @@ abstract class restore_block_task extends restore_task {
     */
    abstract public function get_configdata_encoded_attributes();

+    /**
+     * Helper method to safely unserialize block configuration during restore
+     *
+     * @param string $configdata The original base64 encoded block config, as retrieved from the block_instances table
+     * @return stdClass
+     */
+    protected function decode_configdata(string $configdata): stdClass {
+        return unserialize_object(base64_decode($configdata));
+    }
+
    /**
     * Define the contents in the activity that must be
     * processed by the link decoder
@@ -2119,7 +2119,6 @@ class restore_ras_and_caps_structure_step extends restore_structure_step {

    public function process_override($data) {
        $data = (object)$data;
-
        // Check roleid is one of the mapped ones
        $newrole = $this->get_mapping('role', $data->roleid);
        $newroleid = $newrole->newitemid ?? false;
@@ -2137,8 +2136,8 @@ class restore_ras_and_caps_structure_step extends restore_structure_step {
                // Check if the new role is an overrideable role AND if the user performing the restore has the
                // capability to assign the capability.
                if (in_array($newrole->info['shortname'], $overrideableroles) &&
-                    ($safecapability && has_capability('moodle/role:safeoverride', $context, $userid) ||
-                        !$safecapability && has_capability('moodle/role:override', $context, $userid))
+                    (has_capability('moodle/role:override', $context, $userid) ||
+                            ($safecapability && has_capability('moodle/role:safeoverride', $context, $userid)))
                ) {
                    assign_capability($data->capability, $data->permission, $newroleid, $this->task->get_contextid());
                } else {
@@ -4206,7 +4205,7 @@ class restore_block_instance_structure_step extends restore_structure_step {
        // Let's look for anything within configdata neededing processing
        // (nulls and uses of legacy file.php)
        if ($attrstotransform = $this->task->get_configdata_encoded_attributes()) {
-            $configdata = (array)unserialize(base64_decode($data->configdata));
+            $configdata = (array) unserialize_object(base64_decode($data->configdata));
            foreach ($configdata as $attribute => $value) {
                if (in_array($attribute, $attrstotransform)) {
                    $configdata[$attribute] = $this->contentprocessor->process_cdata($value);
@@ -0,0 +1,179 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+defined('MOODLE_INTERNAL') || die();
+
+// Include all the needed stuff.
+global $CFG;
+require_once($CFG->dirroot . '/backup/util/includes/backup_includes.php');
+require_once($CFG->dirroot . '/backup/util/includes/restore_includes.php');
+
+
+/**
+ * Unit tests for how backup and restore handles role-related things.
+ *
+ * @package   core_backup
+ * @copyright 2021 The Open University
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class roles_backup_restore_test extends advanced_testcase {
+
+    /**
+     * Create a course where the (non-editing) Teacher role is overridden
+     * to have 'moodle/user:loginas' and 'moodle/site:accessallgroups'.
+     *
+     * @return stdClass the new course.
+     */
+    protected function create_course_with_role_overrides(): stdClass {
+        $generator = $this->getDataGenerator();
+        $course = $generator->create_course();
+        $teacher = $generator->create_user();
+
+        $context = context_course::instance($course->id);
+        $generator->enrol_user($teacher->id, $course->id, 'teacher');
+
+        $editingteacherrole = $this->get_role('teacher');
+        role_change_permission($editingteacherrole->id, $context, 'moodle/user:loginas', CAP_ALLOW);
+        role_change_permission($editingteacherrole->id, $context, 'moodle/site:accessallgroups', CAP_ALLOW);
+
+        return $course;
+    }
+
+    /**
+     * Get the role id from a shortname.
+     *
+     * @param string $shortname the role shortname.
+     * @return stdClass the role from the DB.
+     */
+    protected function get_role(string $shortname): stdClass {
+        global $DB;
+        return $DB->get_record('role', ['shortname' => $shortname]);
+    }
+
+    /**
+     * Get an array capability => CAP_... constant for all the orverrides set for a given role on a given context.
+     *
+     * @param string $shortname role shortname.
+     * @param context $context context.
+     * @return array the overrides set here.
+     */
+    protected function get_overrides_for_role_on_context(string $shortname, context $context): array {
+        $overridedata = get_capabilities_from_role_on_context($this->get_role($shortname), $context);
+        $overrides = [];
+        foreach ($overridedata as $override) {
+            $overrides[$override->capability] = $override->permission;
+        }
+        return $overrides;
+    }
+
+    /**
+     * Makes a backup of the course.
+     *
+     * @param stdClass $course The course object.
+     * @return string Unique identifier for this backup.
+     */
+    protected function backup_course(\stdClass $course): string {
+        global $CFG, $USER;
+
+        // Turn off file logging, otherwise it can't delete the file (Windows).
+        $CFG->backup_file_logger_level = backup::LOG_NONE;
+
+        // Do backup with default settings. MODE_IMPORT means it will just
+        // create the directory and not zip it.
+        $bc = new \backup_controller(backup::TYPE_1COURSE, $course->id,
+                backup::FORMAT_MOODLE, backup::INTERACTIVE_NO, backup::MODE_IMPORT,
+                $USER->id);
+        $backupid = $bc->get_backupid();
+        $bc->execute_plan();
+        $bc->destroy();
+
+        return $backupid;
+    }
+
+    /**
+     * Restores a backup that has been made earlier.
+     *
+     * @param string $backupid The unique identifier of the backup.
+     * @param string $asroleshortname Which role in the new cousre the restorer should have.
+     * @return int The new course id.
+     */
+    protected function restore_adding_to_course(string $backupid, string $asroleshortname): int {
+        global $CFG, $USER;
+
+        // Create course to restore into, and a user to do the restore.
+        $generator = $this->getDataGenerator();
+        $course = $generator->create_course();
+        $restorer = $generator->create_user();
+
+        $generator->enrol_user($restorer->id, $course->id, $asroleshortname);
+        $this->setUser($restorer);
+
+        // Turn off file logging, otherwise it can't delete the file (Windows).
+        $CFG->backup_file_logger_level = backup::LOG_NONE;
+
+        // Do restore to new course with default settings.
+        $rc = new \restore_controller($backupid, $course->id,
+                backup::INTERACTIVE_NO, backup::MODE_GENERAL, $USER->id,
+                backup::TARGET_CURRENT_ADDING);
+
+        $precheck = $rc->execute_precheck();
+        $this->assertTrue($precheck);
+        $rc->get_plan()->get_setting('role_assignments')->set_value(true);
+        $rc->execute_plan();
+        $rc->destroy();
+
+        return $course->id;
+    }
+
+    public function test_restore_role_overrides_as_manager(): void {
+        $this->resetAfterTest();
+        $this->setAdminUser();
+
+        // Create a course and back it up.
+        $course = $this->create_course_with_role_overrides();
+        $backupid = $this->backup_course($course);
+
+        // When manager restores, both role overrides should be restored.
+        $newcourseid = $this->restore_adding_to_course($backupid, 'manager');
+
+        // Verify.
+        $overrides = $this->get_overrides_for_role_on_context('teacher',
+                context_course::instance($newcourseid));
+        $this->assertArrayHasKey('moodle/user:loginas', $overrides);
+        $this->assertEquals(CAP_ALLOW, $overrides['moodle/user:loginas']);
+        $this->assertArrayHasKey('moodle/site:accessallgroups', $overrides);
+        $this->assertEquals(CAP_ALLOW, $overrides['moodle/site:accessallgroups']);
+    }
+
+    public function test_restore_role_overrides_as_teacher(): void {
+        $this->resetAfterTest();
+        $this->setAdminUser();
+
+        // Create a course and back it up.
+        $course = $this->create_course_with_role_overrides();
+        $backupid = $this->backup_course($course);
+
+        // When teacher restores, only the safe override should be restored.
+        $newcourseid = $this->restore_adding_to_course($backupid, 'editingteacher');
+
+        // Verify.
+        $overrides = $this->get_overrides_for_role_on_context('teacher',
+                context_course::instance($newcourseid));
+        $this->assertArrayNotHasKey('moodle/user:loginas', $overrides);
+        $this->assertArrayHasKey('moodle/site:accessallgroups', $overrides);
+        $this->assertEquals(CAP_ALLOW, $overrides['moodle/site:accessallgroups']);
+    }
+}
@@ -548,6 +548,7 @@ abstract class backup_controller_dbops extends backup_dbops {

        switch ($mode) {
            case backup::MODE_GENERAL:
+            case backup::MODE_ASYNC:
                // Load the general defaults
                $settings = array(
                        'backup_general_users'              => 'users',
@@ -126,6 +126,19 @@ abstract class base_plan implements checksumable, executable {
        return $result;
    }

+    /**
+     * For debug only. Get a simple test display of all the settings.
+     *
+     * @return string
+     */
+    public function debug_display_all_settings_values(): string {
+        $result = '';
+        foreach ($this->settings as $name => $setting) {
+            $result .= $name . ': ' . $setting->get_value() . "\n";
+        }
+        return $result;
+    }
+
    /**
     * Wrapper over @get_setting() that returns if the requested setting exists or no
     */
@@ -146,11 +146,13 @@ class base_setting_ui {
     * @throws base_setting_ui_exception when the label is not valid.
     * @param string $label
     */
-    public function set_label($label) {
-        $label = (string)$label;
-        if ($label === '' || $label !== clean_param($label, PARAM_TEXT)) {
+    public function set_label(string $label) :void {
+        $label = clean_param($label, PARAM_CLEANHTML);
+
+        if ($label === '') {
            throw new base_setting_ui_exception('setting_invalid_ui_label');
        }
+
        $this->label = $label;
    }

@@ -107,6 +107,7 @@ class copy_form extends \moodleform {
            $displaylist[$course->category] = \core_course_category::get($course->category, MUST_EXIST, true)->get_formatted_name();
        }
        $mform->addElement('autocomplete', 'category', get_string('coursecategory'), $displaylist);
+        $mform->addRule('category', null, 'required', null, 'client');
        $mform->addHelpButton('category', 'coursecategory');

        // Course visibility.
@@ -0,0 +1,70 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Tests for base_setting_ui class.
+ *
+ * @package   core_backup
+ * @copyright 2021 Université Rennes 2 {@link https://www.univ-rennes2.fr}
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+global $CFG;
+
+require_once($CFG->dirroot.'/backup/util/settings/tests/settings_test.php');
+
+/**
+ * Tests for base_setting_ui class.
+ *
+ * @copyright 2021 Université Rennes 2 {@link https://www.univ-rennes2.fr}
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class base_setting_ui_test extends advanced_testcase {
+    /**
+     * Tests set_label().
+     *
+     * @return void
+     */
+    public function test_set_label() {
+        $this->resetAfterTest();
+
+        $bs = new mock_base_setting('test', base_setting::IS_BOOLEAN);
+        $bsui = new base_setting_ui($bs);
+
+        // Should keep original text string.
+        $bsui->set_label('Section name');
+        $this->assertEquals('Section name', $bsui->get_label());
+
+        // Should keep original HTML string.
+        $bsui->set_label('<b>Section name</b>');
+        $this->assertEquals('<b>Section name</b>', $bsui->get_label());
+
+        // Should be converted to text string.
+        $bsui->set_label(123);
+        $this->assertSame('123', $bsui->get_label());
+
+        // Should raise an exception when label is empty.
+        try {
+            $bsui->set_label('');
+            $this->assertTrue(false, 'base_setting_ui_exception');
+        } catch (Exception $exception) {
+            $this->assertTrue($exception instanceof base_setting_ui_exception);
+            $this->assertEquals($exception->errorcode, 'setting_invalid_ui_label');
+        }
+    }
+}
@@ -14,10 +14,8 @@ Feature: Duplicate activities
    And the following "course enrolments" exist:
      | user | course | role |
      | teacher1 | C1 | editingteacher |
-    And I log in as "admin"
-    And I set the following administration settings values:
-      | backup_import_activities    | 0 |
-    And I log out
+    And the following config values are set as admin:
+      | backup_import_activities | 0 | backup |
    And I log in as "teacher1"
    And I am on "Course 1" course homepage with editing mode on
    And I add a "Database" to section "1" and I fill the form with:
@@ -36,6 +36,7 @@ $context = $badge->get_context();
 require_capability('moodle/badges:configuredetails', $context);

 if ($action == 'remove') {
+    require_sesskey();
    $badge->delete_related_badge($relatedid);
 }

@@ -59,7 +59,7 @@ class core_badges_renderer extends plugin_renderer_base {

            $name = html_writer::tag('span', $bname, array('class' => 'badge-name'));

-            $image = html_writer::empty_tag('img', array('src' => $imageurl, 'class' => 'badge-image'));
+            $image = html_writer::empty_tag('img', ['src' => $imageurl, 'class' => 'badge-image', 'alt' => $badge->imagecaption]);
            if (!empty($badge->dateexpire) && $badge->dateexpire < time()) {
                $image .= $this->output->pix_icon('i/expired',
                        get_string('expireddate', 'badges', userdate($badge->dateexpire)),
@@ -337,7 +337,7 @@ class core_badges_renderer extends plugin_renderer_base {
        $output = '';
        $output .= html_writer::start_tag('div', array('id' => 'badge'));
        $output .= html_writer::start_tag('div', array('id' => 'badge-image'));
-        $output .= html_writer::empty_tag('img', array('src' => $badgeimage, 'alt' => $badge->name, 'width' => '100'));
+        $output .= html_writer::empty_tag('img', array('src' => $badgeimage, 'alt' => $badge->imagecaption, 'width' => '100'));
        if ($expiration < $now) {
            $output .= $this->output->pix_icon('i/expired',
            get_string('expireddate', 'badges', userdate($issued['expires'])),
@@ -395,7 +395,9 @@ class core_badges_renderer extends plugin_renderer_base {

        $output .= $this->output->heading(get_string('issuerdetails', 'badges'), 3);
        $dl = array();
-        $dl[get_string('issuername', 'badges')] = $badge->issuername;
+        $dl[get_string('issuername', 'badges')] = format_string($badge->issuername, true,
+            ['context' => context_system::instance()]);
+
        if (isset($badge->issuercontact) && !empty($badge->issuercontact)) {
            $dl[get_string('contact', 'badges')] = obfuscate_mailto($badge->issuercontact);
        }
@@ -428,7 +430,7 @@ class core_badges_renderer extends plugin_renderer_base {

        if ($badge->type == BADGE_TYPE_COURSE && isset($badge->courseid)) {
            $coursename = $DB->get_field('course', 'fullname', array('id' => $badge->courseid));
-            $dl[get_string('course')] = $coursename;
+            $dl[get_string('course')] = format_string($coursename, true, ['context' => context_course::instance($badge->courseid)]);
        }
        $dl[get_string('bcriteria', 'badges')] = self::print_badge_criteria($badge);
        $output .= $this->definition_list($dl);
@@ -1291,13 +1293,13 @@ class core_badges_renderer extends plugin_renderer_base {
            );
            if (!$currentbadge->is_active() && !$currentbadge->is_locked()) {
                $action = $this->output->action_icon(
-                    new moodle_url('related_action.php',
-                        array(
-                            'badgeid' => $related->currentbadgeid,
-                            'relatedid' => $badge->id,
-                            'action' => 'remove'
-                        )
-                    ), new pix_icon('t/delete', get_string('delete')));
+                    new moodle_url('/badges/related_action.php', [
+                        'badgeid' => $related->currentbadgeid,
+                        'relatedid' => $badge->id,
+                        'sesskey' => sesskey(),
+                        'action' => 'remove'
+                    ]),
+                    new pix_icon('t/delete', get_string('delete')));
                $actions = html_writer::tag('div', $action, array('class' => 'badge-actions'));
                array_push($row, $actions);
            }
@@ -163,16 +163,17 @@ Feature: Award badges
      | teacher1 | Teacher | 1 | teacher1@example.com |
      | student1 | Student | 1 | student1@example.com |
      | student2 | Student | 2 | student2@example.com |
+    And the "multilang" filter is "on"
+    And the "multilang" filter applies to "content and headings"
    And the following "courses" exist:
      | fullname | shortname | category | groupmode |
-      | Course 1 | C1 | 0 | 1 |
+      | <span class="multilang" lang="en">Course 1</span><span class="multilang" lang="de">Kurs 1</span> | C1 | 0 | 1 |
    And the following "course enrolments" exist:
      | user | course | role |
      | teacher1 | C1 | editingteacher |
      | student1 | C1 | student |
      | student2 | C1 | student |
-    And I log in as "teacher1"
-    And I am on "Course 1" course homepage
+    And I am on the "C1" "Course" page logged in as "teacher1"
    And I navigate to "Badges > Add a new badge" in current page administration
    And I follow "Add a new badge"
    And I set the following fields to these values:
@@ -197,7 +198,9 @@ Feature: Award badges
    And I log in as "student1"
    And I follow "Profile" in the user menu
    And I click on "Course 1" "link" in the "region-main" "region"
-    And I should see "Course Badge"
+    And I click on "Course Badge" "link"
+    And "Course 1" "text" should appear after "Badge details" "text"
+    And "Kurs 1" "text" should not exist

  @javascript
  Scenario: Award badge on activity completion
@@ -51,18 +51,18 @@ Feature: Award badges based on activity completion
    And I log out

  Scenario: Student earns a badge using activity completion, but does not get passing grade
-    When I log in as "student1"
+    Given I log in as "student1"
    And I am on "Course 1" course homepage
    And the "Test quiz name" "quiz" activity with "auto" completion should be marked as not complete
-    And I follow "Test quiz name"
+    When I am on the "Test quiz name" "quiz activity" page
    And I press "Re-attempt quiz"
    And I set the field "False" to "1"
    And I press "Finish attempt ..."
    And I press "Submit all and finish"
    And I click on "Submit all and finish" "button" in the "Confirmation" "dialogue"
    And I log out
-    Then I log in as "teacher1"
-    And I am on "Course 1" course homepage
+
+    And I am on the "Course 1" course page logged in as teacher1
    And I navigate to "Badges > Manage badges" in current page administration
    And I follow "Course Badge"
-    And I should see "Recipients (1)"
+    Then I should see "Recipients (1)"
@@ -73,7 +73,7 @@ class restore_activity_results_block_task extends restore_block_task {
        $blockid = $this->get_blockid();

        if ($configdata = $DB->get_field('block_instances', 'configdata', array('id' => $blockid))) {
-            $config = unserialize(base64_decode($configdata));
+            $config = $this->decode_configdata($configdata);
            if (!empty($config->activityparentid)) {
                // Get the mapping and replace it in config.
                if ($mapping = restore_dbops::get_backup_ids_record($this->get_restoreid(),
@@ -58,7 +58,7 @@ class restore_glossary_random_block_task extends restore_block_task {

        // Extract block configdata and update it to point to the new glossary
        if ($configdata = $DB->get_field('block_instances', 'configdata', array('id' => $blockid))) {
-            $config = unserialize(base64_decode($configdata));
+            $config = $this->decode_configdata($configdata);
            if (!empty($config->glossary)) {
                if ($glossarymap = restore_dbops::get_backup_ids_record($this->get_restoreid(), 'glossary', $config->glossary)) {
                    // Get glossary mapping and replace it in config
@@ -82,7 +82,7 @@ class restore_html_block_decode_content extends restore_decode_content {
    }

    protected function preprocess_field($field) {
-        $this->configdata = unserialize(base64_decode($field));
+        $this->configdata = unserialize_object(base64_decode($field));
        return isset($this->configdata->text) ? $this->configdata->text : '';
    }

@@ -43,7 +43,7 @@ class content extends \core_search\base_block {
                $this->componentname, $this->areaname);

        // Get stdclass object with data from DB.
-        $data = unserialize(base64_decode($record->configdata));
+        $data = unserialize_object(base64_decode($record->configdata));

        // Get content.
        $content = content_to_text($data->text, $data->format);
@@ -51,7 +51,7 @@ class block_html_edit_form extends block_edit_form {
    }

    function set_data($defaults) {
-        if (!empty($this->block->config) && is_object($this->block->config)) {
+        if (!empty($this->block->config) && !empty($this->block->config->text)) {
            $text = $this->block->config->text;
            $draftid_editor = file_get_submitted_draft_itemid('config_text');
            if (empty($text)) {
@@ -61,7 +61,7 @@ class block_html_edit_form extends block_edit_form {
            }
            $defaults->config_text['text'] = file_prepare_draft_area($draftid_editor, $this->block->context->id, 'block_html', 'content', 0, array('subdirs'=>true), $currenttext);
            $defaults->config_text['itemid'] = $draftid_editor;
-            $defaults->config_text['format'] = $this->block->config->format;
+            $defaults->config_text['format'] = $this->block->config->format ?? FORMAT_MOODLE;
        } else {
            $text = '';
        }
@@ -100,7 +100,7 @@ function block_html_global_db_replace($search, $replace) {
    $instances = $DB->get_recordset('block_instances', array('blockname' => 'html'));
    foreach ($instances as $instance) {
        // TODO: intentionally hardcoded until MDL-26800 is fixed
-        $config = unserialize(base64_decode($instance->configdata));
+        $config = unserialize_object(base64_decode($instance->configdata));
        if (isset($config->text) and is_string($config->text)) {
            $config->text = str_replace($search, $replace, $config->text);
            $DB->update_record('block_instances', ['id' => $instance->id,
--- a/Show More
+++ b/Show More