Moodle release 3.3.5

The base class had abstract static methods which raises strict standards
warning on PHP 5.6.

.gitattributes

@@ -1,4 +1,5 @@
 **/yui/build/** -diff
 **/amd/build/** -diff
+lib/dml/oci_native_moodle_package.sql text eol=lf
 theme/bootstrapbase/style/editor.css -diff
 theme/bootstrapbase/style/moodle.css -diff

.travis.yml

@@ -17,7 +17,7 @@ php:
     - 5.6
 
 addons:
-  postgresql: "9.3"
+  postgresql: "9.6"
   packages:
     - mysql-server-5.6
     - mysql-client-core-5.6
@@ -53,12 +53,9 @@ matrix:
     fast_finish: true
 
     include:
-          # Run grunt/npm install on lowest supported npm version
-        - php: 7.1
-          env: DB=none     TASK=GRUNT   NVM_VERSION='4'
           # Run grunt/npm install on highest version ('node' is an alias for the latest node.js version.)
         - php: 7.1
-          env: DB=none     TASK=GRUNT   NVM_VERSION='node'
+          env: DB=none     TASK=GRUNT   NVM_VERSION='8.9'
 
     exclude:
         # MySQL - it's just too slow.
@@ -95,7 +92,7 @@ install:
             sudo service postgresql stop
             sudo mv /var/lib/postgresql /mnt/ramdisk
             sudo ln -s /mnt/ramdisk/postgresql /var/lib/postgresql
-            sudo service postgresql start 9.3
+            sudo service postgresql start 9.6
         fi
     - >
         if [ "$TASK" = 'PHPUNIT' ];

admin/auth_config.php

@@ -165,6 +165,12 @@ function print_auth_lock_options($auth, $user_fields, $helptext, $retrieveopts,
             // If custom field then pick name from database.
             $fieldshortname = str_replace('profile_field_', '', $fieldname);
             $fieldname = $customfieldname[$fieldshortname]->name;
+            if (core_text::strlen($fieldshortname) > 67) {
+                // If custom profile field name is longer than 67 characters we will not be able to store the setting
+                // such as 'field_updateremote_profile_field_NOTSOSHORTSHORTNAME' in the database because the character
+                // limit for the setting name is 100.
+                continue;
+            }
         } elseif ($fieldname == 'url') {
             $fieldname = get_string('webpage');
         } else {

admin/category.php

@@ -54,14 +54,16 @@ $statusmsg = '';
 $errormsg  = '';
 
 if ($data = data_submitted() and confirm_sesskey()) {
-    if (admin_write_settings($data)) {
-        $statusmsg = get_string('changessaved');
-    }
-
+    $count = admin_write_settings($data);
     if (empty($adminroot->errors)) {
-        switch ($return) {
-            case 'site': redirect("$CFG->wwwroot/");
-            case 'admin': redirect("$CFG->wwwroot/$CFG->admin/");
+        // No errors. Did we change any setting?  If so, then indicate success.
+        if ($count) {
+            $statusmsg = get_string('changessaved');
+        } else {
+            switch ($return) {
+                case 'site': redirect("$CFG->wwwroot/");
+                case 'admin': redirect("$CFG->wwwroot/$CFG->admin/");
+            }
         }
     } else {
         $errormsg = get_string('errorwithsettings', 'admin');
@@ -73,7 +75,7 @@ if ($data = data_submitted() and confirm_sesskey()) {
 if ($PAGE->user_allowed_editing() && $adminediting != -1) {
     $USER->editing = $adminediting;
 }
-
+$buttons = null;
 if ($PAGE->user_allowed_editing()) {
     $url = clone($PAGE->url);
     if ($PAGE->user_is_editing()) {
@@ -127,7 +129,9 @@ if ($savebutton) {
 $visiblepathtosection = array_reverse($settingspage->visiblepath);
 $PAGE->set_title("$SITE->shortname: " . implode(": ",$visiblepathtosection));
 $PAGE->set_heading($SITE->fullname);
-$PAGE->set_button($buttons);
+if ($buttons) {
+    $PAGE->set_button($buttons);
+}
 
 echo $OUTPUT->header();
 

admin/environment.xml

@@ -1754,6 +1754,7 @@
       <VENDOR name="oracle" version="10.2" />
     </DATABASE>
     <PHP version="5.6.5" level="required">
+      <RESTRICT function="restrict_php_version_72" message="unsupportedphpversion72" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -1919,6 +1920,7 @@
       <VENDOR name="oracle" version="10.2" />
     </DATABASE>
     <PHP version="5.6.5" level="required">
+      <RESTRICT function="restrict_php_version_72" message="unsupportedphpversion72" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -2257,4 +2259,180 @@
       </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
+  <MOODLE version="3.5" requires="3.1">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="5.5.31" />
+      <VENDOR name="mysql" version="5.5.31" />
+      <VENDOR name="postgres" version="9.3" />
+      <VENDOR name="mssql" version="10.0" />
+      <VENDOR name="oracle" version="10.2" />
+    </DATABASE>
+    <PHP version="7.0.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/purgecaches.php

@@ -29,9 +29,10 @@ require_once($CFG->libdir.'/adminlib.php');
 $confirm = optional_param('confirm', 0, PARAM_BOOL);
 $returnurl = optional_param('returnurl', null, PARAM_LOCALURL);
 
+admin_externalpage_setup('purgecaches');
+
 // If we have got here as a confirmed aciton, do it.
-if ($confirm && isloggedin() && confirm_sesskey()) {
-    require_capability('moodle/site:config', context_system::instance());
+if ($confirm && confirm_sesskey()) {
 
     // Valid request. Purge, and redirect the user back to where they came from.
     purge_all_caches();
@@ -45,8 +46,6 @@ if ($confirm && isloggedin() && confirm_sesskey()) {
 }
 
 // Otherwise, show a button to actually purge the caches.
-admin_externalpage_setup('purgecaches');
-
 $actionurl = new moodle_url('/admin/purgecaches.php', array('sesskey'=>sesskey(), 'confirm'=>1));
 if ($returnurl) {
     $actionurl->param('returnurl', $returnurl);

admin/roles/assign.php

@@ -245,7 +245,7 @@ if ($roleid) {
     $select = new single_select($PAGE->url, 'roleid', $nameswithcounts, $roleid, null);
     $select->label = get_string('assignanotherrole', 'core_role');
     echo $OUTPUT->render($select);
-    echo '<p><a href="' . $PAGE->url . '">' . get_string('backtoallroles', 'core_role') . '</a></p>';
+    echo '<p><a href="' . $url . '">' . get_string('backtoallroles', 'core_role') . '</a></p>';
     echo '</div>';
 
 } else if (empty($assignableroles)) {

admin/roles/classes/capability_table_with_risks.php

@@ -183,9 +183,14 @@ abstract class core_role_capability_table_with_risks extends core_role_capabilit
     public function get_risk_icon($type) {
         global $OUTPUT;
 
-        $text = $OUTPUT->pix_icon('i/' . str_replace('risk', 'risk_', $type), get_string($type . 'short', 'admin'));
+        $alt = get_string("{$type}short", "admin");
+        $title = get_string($type, "admin");
+
+        $text = $OUTPUT->pix_icon('i/' . str_replace('risk', 'risk_', $type), $alt, 'moodle', [
+                'title' => $title,
+            ]);
         $action = new popup_action('click', $this->risksurl, 'docspopup');
-        $riskicon = $OUTPUT->action_link($this->risksurl, $text, $action, array('title'=>get_string($type, 'admin')));
+        $riskicon = $OUTPUT->action_link($this->risksurl, $text, $action);
 
         return $riskicon;
     }

admin/roles/classes/define_role_table_advanced.php

@@ -100,6 +100,8 @@ class core_role_define_role_table_advanced extends core_role_capability_table_wi
             $this->role->shortname = core_text::strtolower(clean_param($this->role->shortname, PARAM_ALPHANUMEXT));
             if (empty($this->role->shortname)) {
                 $this->errors['shortname'] = get_string('errorbadroleshortname', 'core_role');
+            } else if (core_text::strlen($this->role->shortname) > 100) { // Check if it exceeds the max of 100 characters.
+                $this->errors['shortname'] = get_string('errorroleshortnametoolong', 'core_role');
             }
         }
         if ($DB->record_exists_select('role', 'shortname = ? and id <> ?', array($this->role->shortname, $this->roleid))) {
@@ -476,7 +478,7 @@ class core_role_define_role_table_advanced extends core_role_capability_table_wi
     }
 
     protected function get_shortname_field($id) {
-        return '<input type="text" id="' . $id . '" name="' . $id . '" maxlength="254" value="' . s($this->role->shortname) . '"' .
+        return '<input type="text" id="' . $id . '" name="' . $id . '" maxlength="100" value="' . s($this->role->shortname) . '"' .
                 ' class="form-control"/>';
     }
 

admin/search.php

@@ -5,11 +5,19 @@
 require_once('../config.php');
 require_once($CFG->libdir.'/adminlib.php');
 
+redirect_if_major_upgrade_required();
+
 $query = trim(optional_param('query', '', PARAM_NOTAGS));  // Search string
 
 $context = context_system::instance();
 $PAGE->set_context($context);
 
+$hassiteconfig = has_capability('moodle/site:config', $context);
+
+if ($hassiteconfig && moodle_needs_upgrading()) {
+    redirect(new moodle_url('/admin/index.php'));
+}
+
 admin_externalpage_setup('search', '', array('query' => $query)); // now hidden page
 
 $adminroot = admin_get_root(); // need all settings here
@@ -21,15 +29,16 @@ $focus = '';
 // now we'll deal with the case that the admin has submitted the form with changed settings
 if ($data = data_submitted() and confirm_sesskey() and isset($data->action) and $data->action == 'save-settings') {
     require_capability('moodle/site:config', $context);
-    if (admin_write_settings($data)) {
-        redirect($PAGE->url, get_string('changessaved'), null, \core\output\notification::NOTIFY_SUCCESS);
-    }
-
+    $count = admin_write_settings($data);
     if (!empty($adminroot->errors)) {
         $errormsg = get_string('errorwithsettings', 'admin');
         $firsterror = reset($adminroot->errors);
         $focus = $firsterror->id;
     } else {
+        // No errors. Did we change any setting? If so, then redirect with success.
+        if ($count) {
+            redirect($PAGE->url, get_string('changessaved'), null, \core\output\notification::NOTIFY_SUCCESS);
+        }
         redirect($PAGE->url);
     }
 }
@@ -55,7 +64,7 @@ if ($errormsg !== '') {
 
 $showsettingslinks = true;
 
-if (has_capability('moodle/site:config', $context)) {
+if ($hassiteconfig) {
     require_once("admin_settings_search_form.php");
     $form = new admin_settings_search_form();
     $form->display();

admin/settings.php

@@ -39,11 +39,15 @@ $statusmsg = '';
 $errormsg  = '';
 
 if ($data = data_submitted() and confirm_sesskey()) {
-    if (admin_write_settings($data)) {
-        redirect($PAGE->url, get_string('changessaved'), null, \core\output\notification::NOTIFY_SUCCESS);
-    }
 
+    $count = admin_write_settings($data);
+    // Regardless of whether any setting change was written (a positive count), check validation errors for those that didn't.
     if (empty($adminroot->errors)) {
+        // No errors. Did we change any setting? If so, then redirect with success.
+        if ($count) {
+            redirect($PAGE->url, get_string('changessaved'), null, \core\output\notification::NOTIFY_SUCCESS);
+        }
+        // We didn't change a setting.
         switch ($return) {
             case 'site': redirect("$CFG->wwwroot/");
             case 'admin': redirect("$CFG->wwwroot/$CFG->admin/");

admin/settings/privacy.php

@@ -0,0 +1,80 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Adds privacy and policies links to admin tree.
+ *
+ * @package   core_privacy
+ * @copyright 2018 Marina Glancy
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+if ($hassiteconfig) {
+    // Privacy settings.
+    $temp = new admin_settingpage('privacysettings', new lang_string('privacysettings', 'admin'));
+
+    $options = array(
+        0 => get_string('no'),
+        1 => get_string('yes')
+    );
+    $url = new moodle_url('/admin/settings.php?section=supportcontact');
+    $url = $url->out();
+    $setting = new admin_setting_configselect('agedigitalconsentverification',
+        new lang_string('agedigitalconsentverification', 'admin'),
+        new lang_string('agedigitalconsentverification_desc', 'admin', $url), 0, $options);
+    $setting->set_force_ltr(true);
+    $temp->add($setting);
+
+    $setting = new admin_setting_agedigitalconsentmap('agedigitalconsentmap',
+        new lang_string('ageofdigitalconsentmap', 'admin'),
+        new lang_string('ageofdigitalconsentmap_desc', 'admin'),
+        // See {@link https://gdpr-info.eu/art-8-gdpr/}.
+        implode(PHP_EOL, [
+            '*, 16',
+            'AT, 14',
+            'CZ, 13',
+            'DE, 14',
+            'DK, 13',
+            'ES, 13',
+            'FI, 15',
+            'GB, 13',
+            'HU, 14',
+            'IE, 13',
+            'LT, 16',
+            'LU, 16',
+            'NL, 16',
+            'PL, 13',
+            'SE, 13',
+        ]),
+        PARAM_RAW
+    );
+    $temp->add($setting);
+
+    $ADMIN->add('privacy', $temp);
+
+    // Policy settings.
+    $temp = new admin_settingpage('policysettings', new lang_string('policysettings', 'admin'));
+    $temp->add(new admin_settings_sitepolicy_handler_select('sitepolicyhandler', new lang_string('sitepolicyhandler', 'core_admin'),
+        new lang_string('sitepolicyhandler_desc', 'core_admin')));
+    $temp->add(new admin_setting_configtext('sitepolicy', new lang_string('sitepolicy', 'core_admin'),
+        new lang_string('sitepolicy_help', 'core_admin'), '', PARAM_RAW));
+    $temp->add(new admin_setting_configtext('sitepolicyguest', new lang_string('sitepolicyguest', 'core_admin'),
+        new lang_string('sitepolicyguest_help', 'core_admin'), (isset($CFG->sitepolicy) ? $CFG->sitepolicy : ''), PARAM_RAW));
+
+    $ADMIN->add('privacy', $temp);
+}

admin/settings/security.php

@@ -49,8 +49,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
                        3600 => new lang_string('numminutes', '', 60))));
 
     $temp->add(new admin_setting_configcheckbox('extendedusernamechars', new lang_string('extendedusernamechars', 'admin'), new lang_string('configextendedusernamechars', 'admin'), 0));
-    $temp->add(new admin_setting_configtext('sitepolicy', new lang_string('sitepolicy', 'admin'), new lang_string('sitepolicy_help', 'admin'), '', PARAM_RAW));
-    $temp->add(new admin_setting_configtext('sitepolicyguest', new lang_string('sitepolicyguest', 'admin'), new lang_string('sitepolicyguest_help', 'admin'), (isset($CFG->sitepolicy) ? $CFG->sitepolicy : ''), PARAM_RAW));
+
     $temp->add(new admin_setting_configcheckbox('extendedusernamechars', new lang_string('extendedusernamechars', 'admin'), new lang_string('configextendedusernamechars', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('keeptagnamecase', new lang_string('keeptagnamecase','admin'),new lang_string('configkeeptagnamecase', 'admin'),'1'));
 

admin/settings/top.php

@@ -35,6 +35,7 @@ $ADMIN->add('root', new admin_category('badges', new lang_string('badges'), empt
 $ADMIN->add('root', new admin_category('location', new lang_string('location','admin')));
 $ADMIN->add('root', new admin_category('language', new lang_string('language')));
 $ADMIN->add('root', new admin_category('modules', new lang_string('plugins', 'admin')));
+$ADMIN->add('root', new admin_category('privacy', new lang_string('privacyandpolicies', 'admin')));
 $ADMIN->add('root', new admin_category('security', new lang_string('security','admin')));
 $ADMIN->add('root', new admin_category('appearance', new lang_string('appearance','admin')));
 $ADMIN->add('root', new admin_category('frontpage', new lang_string('frontpage','admin')));

admin/tool/behat/cli/util.php

@@ -398,7 +398,7 @@ function print_combined_install_output($processes) {
     // Show process name in first row.
     foreach ($processes as $name => $process) {
         // If we don't have enough space to show full run name then show runX.
-        if ($lengthofprocessline < strlen($name + 2)) {
+        if ($lengthofprocessline < strlen($name) + 2) {
             $name = substr($name, -5);
         }
         // One extra padding as we are adding | separator for rest of the data.

admin/tool/cohortroles/classes/api.php

@@ -167,7 +167,7 @@ class api {
                 $params['roleid'] = $roleid;
                 $params['userid'] = $userid;
 
-                $sql = 'SELECT u.id AS userid, ra.id, ctx.id AS contextid
+                $sql = 'SELECT DISTINCT u.id AS userid, ra.id, ctx.id AS contextid
                           FROM {user} u
                           JOIN {cohort_members} cm ON u.id = cm.userid
                           JOIN {context} ctx ON u.id = ctx.instanceid AND ctx.contextlevel = :usercontext

admin/tool/cohortroles/classes/output/cohort_role_assignments_table.php

@@ -98,7 +98,7 @@ class cohort_role_assignments_table extends table_sql {
         );
         $context = context_helper::instance_by_id($data->cohortcontextid);
 
-        $exporter = new \tool_lp\external\cohort_summary_exporter($record, array('context' => $context));
+        $exporter = new \core_cohort\external\cohort_summary_exporter($record, array('context' => $context));
         $cohort = $exporter->export($OUTPUT);
 
         $html = $OUTPUT->render_from_template('tool_cohortroles/cohort-in-list', $cohort);

admin/tool/customlang/locallib.php

@@ -159,6 +159,11 @@ class tool_customlang_utils {
                         $needsupdate = true;
                         $current[$stringid]->local          = $stringlocal;
                         $current[$stringid]->timecustomized = $now;
+                    } else if (isset($currentlocal) && $stringlocal !== $currentlocal) {
+                        // If local string has been removed, we need to remove also the old local value from DB.
+                        $needsupdate = true;
+                        $current[$stringid]->local          = null;
+                        $current[$stringid]->timecustomized = $now;
                     }
 
                     if ($needsupdate) {

admin/tool/lp/templates/manage_competencies_page.mustache

@@ -64,6 +64,7 @@
                                 <li>
                                     <a href="#">{{#str}}edit{{/str}}</a><b class="caret"></b>
                                     <ul class="dropdown dropdown-menu">
+                                    {{#canmanage}}
                                     <li class="dropdown-item">
                                         <a href="#" data-action="edit">
                                             {{#pix}}t/edit{{/pix}} {{#str}}edit{{/str}}
@@ -89,11 +90,13 @@
                                             {{#pix}}t/down{{/pix}} {{#str}}movedown{{/str}}
                                         </a>
                                     </li>
+                                    {{/canmanage}}
                                     <li class="dropdown-item">
                                         <a href="#" data-action="linkedcourses">
                                             {{#pix}}t/viewdetails{{/pix}} {{#str}}linkedcourses, tool_lp{{/str}}
                                         </a>
                                     </li>
+                                    {{#canmanage}}
                                     <li class="dropdown-item">
                                         <a href="#" data-action="relatedcompetencies">
                                             {{#pix}}t/add{{/pix}} {{#str}}addcrossreferencedcompetency, tool_lp{{/str}}
@@ -104,6 +107,7 @@
                                             {{#pix}}t/edit{{/pix}} {{#str}}competencyrule, tool_lp{{/str}}
                                         </a>
                                     </li>
+                                    {{/canmanage}}
                                 </ul>
                             </li>
                         </ul>
@@ -112,11 +116,11 @@
                 <p data-region="competencyinfo">
                     {{#str}}nocompetencyselected, tool_lp{{/str}}
                 </p>
-                {{#canmanage}}
                 <div data-region="competencyactions">
+                    {{#canmanage}}
                     <button class="btn btn-secondary" data-action="add">{{#pix}}t/add{{/pix}} <span data-region="term"></span></button>
+                    {{/canmanage}}
                 </div>
-                {{/canmanage}}
             </div>
         </div>
     </div>

admin/tool/mobile/classes/api.php

@@ -128,7 +128,7 @@ class api {
             'rememberusername' => $CFG->rememberusername,
             'authloginviaemail' => $CFG->authloginviaemail,
             'registerauth' => $CFG->registerauth,
-            'forgottenpasswordurl' => $CFG->forgottenpasswordurl,
+            'forgottenpasswordurl' => clean_param($CFG->forgottenpasswordurl, PARAM_URL), // We may expect a mailto: here.
             'authinstructions' => $authinstructions,
             'authnoneenabled' => (int) is_enabled_auth('none'),
             'enablewebservices' => $CFG->enablewebservices,
@@ -152,10 +152,11 @@ class api {
         $url = new moodle_url("/$CFG->admin/tool/mobile/launch.php");
         $settings['launchurl'] = $url->out(false);
 
-        if ($logourl = $OUTPUT->get_logo_url()) {
+        // Check that we are receiving a moodle_url object, themes can override get_logo_url and may return incorrect values.
+        if (($logourl = $OUTPUT->get_logo_url()) && $logourl instanceof moodle_url) {
             $settings['logourl'] = $logourl->out(false);
         }
-        if ($compactlogourl = $OUTPUT->get_compact_logo_url()) {
+        if (($compactlogourl = $OUTPUT->get_compact_logo_url()) && $compactlogourl instanceof moodle_url) {
             $settings['compactlogourl'] = $compactlogourl->out(false);
         }
 
@@ -210,12 +211,19 @@ class api {
         }
 
         if (empty($section) or $section == 'sitepolicies') {
+            $manager = new \core_privacy\local\sitepolicy\manager();
+            $settings->sitepolicy = ($sitepolicy = $manager->get_embed_url()) ? $sitepolicy->out(false) : '';
+            $settings->sitepolicyhandler = $CFG->sitepolicyhandler;
             $settings->disableuserimages = $CFG->disableuserimages;
         }
 
         if (empty($section) or $section == 'gradessettings') {
             require_once($CFG->dirroot . '/user/lib.php');
-            $settings->mygradesurl = user_mygrades_url()->out(false);
+            $settings->mygradesurl = user_mygrades_url();
+            // The previous function may return moodle_url instances or plain string URLs.
+            if ($settings->mygradesurl instanceof moodle_url) {
+                $settings->mygradesurl = $settings->mygradesurl->out(false);
+            }
         }
 
         if (empty($section) or $section == 'mobileapp') {

admin/tool/mobile/classes/external.php

@@ -23,6 +23,7 @@
  */
 
 namespace tool_mobile;
+defined('MOODLE_INTERNAL') || die();
 
 require_once("$CFG->libdir/externallib.php");
 

admin/tool/mobile/lang/en/tool_mobile.php

@@ -24,7 +24,7 @@
 
 $string['androidappid'] = 'Android app\'s unique identifier';
 $string['androidappid_desc'] = 'This setting may be left as default unless you have a custom Android app.';
-$string['autologinkeygenerationlockout'] = 'Auto-login key generation is blocked because of too many requests within an hour.';
+$string['autologinkeygenerationlockout'] = 'Auto-login key generation is blocked. You need to wait 6 minutes between requests.';
 $string['autologinnotallowedtoadmins'] = 'Auto-login is not allowed for site admins.';
 $string['cachedef_plugininfo'] = 'This stores the list of plugins with mobile addons';
 $string['clickheretolaunchtheapp'] = 'Click here if the app does not open automatically.';
@@ -74,4 +74,4 @@ $string['smartappbanners'] = 'App Banners';
 $string['pluginnotenabledorconfigured'] = 'Plugin not enabled or configured.';
 $string['remoteaddons'] = 'Remote add-ons';
 $string['typeoflogin'] = 'Type of login';
-$string['typeoflogin_desc'] = 'If the site uses a SSO authentication method, then select via a browser window or via an embedded browser. An embedded browser provides a better user experience, though it doesn\'t work with all SSO plugins. If using SSO, autologinguests should be disabled.';
+$string['typeoflogin_desc'] = 'If the site uses a SSO authentication method, then select via a browser window or via an embedded browser. An embedded browser provides a better user experience, though it doesn\'t work with all SSO plugins.';

admin/tool/mobile/tests/externallib_test.php

@@ -97,11 +97,13 @@ class tool_mobile_external_testcase extends externallib_advanced_testcase {
         set_config('typeoflogin', api::LOGIN_VIA_BROWSER, 'tool_mobile');
         set_config('logo', 'mock.png', 'core_admin');
         set_config('logocompact', 'mock.png', 'core_admin');
+        set_config('forgottenpasswordurl', 'mailto:fake@email.zy'); // Test old hack.
 
         list($authinstructions, $notusedformat) = external_format_text($authinstructions, FORMAT_MOODLE, $context->id);
         $expected['registerauth'] = 'email';
         $expected['authinstructions'] = $authinstructions;
         $expected['typeoflogin'] = api::LOGIN_VIA_BROWSER;
+        $expected['forgottenpasswordurl'] = ''; // Expect empty when it's not an URL.
 
         if ($logourl = $OUTPUT->get_logo_url()) {
             $expected['logourl'] = $logourl->out(false);
@@ -123,6 +125,10 @@ class tool_mobile_external_testcase extends externallib_advanced_testcase {
         require_once($CFG->dirroot . '/course/format/lib.php');
 
         $this->resetAfterTest(true);
+
+        $mysitepolicy = 'http://mysite.is/policy/';
+        set_config('sitepolicy', $mysitepolicy);
+
         $result = external::get_config();
         $result = external_api::clean_returnvalue(external::get_config_returns(), $result);
 
@@ -143,6 +149,8 @@ class tool_mobile_external_testcase extends externallib_advanced_testcase {
             array('name' => 'numsections', 'value' => course_get_format($SITE)->get_last_section_number()),
             array('name' => 'newsitems', 'value' => $SITE->newsitems),
             array('name' => 'commentsperpage', 'value' => $CFG->commentsperpage),
+            array('name' => 'sitepolicy', 'value' => $mysitepolicy),
+            array('name' => 'sitepolicyhandler', 'value' => ''),
             array('name' => 'disableuserimages', 'value' => $CFG->disableuserimages),
             array('name' => 'mygradesurl', 'value' => user_mygrades_url()->out(false)),
             array('name' => 'tool_mobile_forcelogout', 'value' => 0),

admin/tool/monitor/db/install.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8" ?>
-<XMLDB PATH="tool/monitor/db" VERSION="20141103" COMMENT="XMLDB file for Moodle tool/monitor"
+<XMLDB PATH="admin/tool/monitor/db" VERSION="20141103" COMMENT="XMLDB file for Moodle tool/monitor"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:noNamespaceSchemaLocation="../../../lib/xmldb/xmldb.xsd"
+    xsi:noNamespaceSchemaLocation="../../../../lib/xmldb/xmldb.xsd"
 >
   <TABLES>
     <TABLE NAME="tool_monitor_rules" COMMENT="Table to store rules">
@@ -79,4 +79,4 @@
       </KEYS>
     </TABLE>
   </TABLES>
-</XMLDB>
+</XMLDB>

admin/tool/oauth2/classes/form/issuer.php

@@ -78,6 +78,10 @@ class issuer extends persistent {
         $mform->addRule('clientsecret', get_string('maximumchars', '', 255), 'maxlength', 255, 'client');
         $mform->addHelpButton('clientsecret', 'issuerclientsecret', 'tool_oauth2');
 
+        // Use basic authentication.
+        $mform->addElement('checkbox', 'basicauth', get_string('usebasicauth', 'tool_oauth2'));
+        $mform->addHelpButton('basicauth', 'usebasicauth', 'tool_oauth2');
+
         // Login scopes.
         $mform->addElement('text', 'loginscopes', get_string('issuerloginscopes', 'tool_oauth2'));
         $mform->addRule('loginscopes', null, 'required', null, 'client');

admin/tool/oauth2/lang/en/tool_oauth2.php

@@ -93,6 +93,8 @@ $string['systemaccountconnected_help'] = 'System accounts are used to provide ad
 $string['systemaccountconnected'] = 'System account connected';
 $string['systemaccountnotconnected'] = 'System account not connected';
 $string['systemauthstatus'] = 'System account connected';
+$string['usebasicauth'] = 'Authenticate token requests via HTTP headers';
+$string['usebasicauth_help'] = 'Utilise the HTTP Basic authentication scheme when sending client ID and password with a refresh token request. Recommended by the OAuth 2 standard, but may not be available with some issuers.';
 $string['userfieldexternalfield'] = 'External field name';
 $string['userfieldexternalfield_help'] = 'Name of the field provided by the external OAuth system.';
 $string['userfieldinternalfield_help'] = 'Name of the Moodle user field that should be mapped from the external field.';

admin/tool/recyclebin/db/install.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8" ?>
-<XMLDB PATH="tool/recyclebin/db" VERSION="20160315" COMMENT="XMLDB file for Moodle tool/recyclebin"
+<XMLDB PATH="admin/tool/recyclebin/db" VERSION="20160315" COMMENT="XMLDB file for Moodle tool/recyclebin"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:noNamespaceSchemaLocation="../../../lib/xmldb/xmldb.xsd"
+    xsi:noNamespaceSchemaLocation="../../../../lib/xmldb/xmldb.xsd"
 >
   <TABLES>
     <TABLE NAME="tool_recyclebin_course" COMMENT="A list of items in the course recycle bin">
@@ -38,4 +38,4 @@
       </INDEXES>
     </TABLE>
   </TABLES>
-</XMLDB>
+</XMLDB>

admin/tool/recyclebin/tests/behat/basic_functionality.feature

@@ -9,6 +9,7 @@ Feature: Basic recycle bin functionality
       | username | firstname | lastname | email |
       | teacher1 | Teacher | 1 | teacher@asd.com |
       | student1 | Student | 1 | student@asd.com |
+      | student2 | Student | 2 | student2@asd.com |
     And the following "courses" exist:
       | fullname | shortname |
       | Course 1 | C1 |
@@ -16,6 +17,23 @@ Feature: Basic recycle bin functionality
     And the following "course enrolments" exist:
       | user | course | role |
       | teacher1 | C1 | editingteacher |
+      | student1 | C1 | student |
+      | student2 | C1 | student |
+      | teacher1 | C2 | editingteacher |
+      | student1 | C2 | student |
+      | student2 | C2 | student |
+    And the following "groups" exist:
+      | name | course | idnumber |
+      | Group A | C2 | G1 |
+      | Group B | C2 | G2 |
+      | Group C | C2 | G3 |
+    And the following "group members" exist:
+      | user | group |
+      | teacher1 | G1 |
+      | teacher1 | G2 |
+      | student1 | G1 |
+      | student2 | G1 |
+      | student2 | G2 |
     And the following config values are set as admin:
       | coursebinenable | 1 | tool_recyclebin |
       | categorybinenable | 1 | tool_recyclebin |
@@ -58,6 +76,12 @@ Feature: Basic recycle bin functionality
     And I wait to be redirected
     And I go to the courses management page
     And I should see "Course 2" in the "#course-listing" "css_element"
+    And I am on "Course 2" course homepage
+    And I navigate to "Groups" node in "Course administration > Users"
+    And I follow "Overview"
+    And "Student 1" "text" should exist in the "Group A" "table_row"
+    And "Student 2" "text" should exist in the "Group A" "table_row"
+    And "Student 2" "text" should exist in the "Group B" "table_row"
 
   @javascript
   Scenario: Deleting a single item from the recycle bin

admin/tool/templatelibrary/classes/external.php

@@ -22,6 +22,7 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 namespace tool_templatelibrary;
+defined('MOODLE_INTERNAL') || die();
 
 require_once("$CFG->libdir/externallib.php");
 

admin/tool/uploaduser/index.php

@@ -358,7 +358,7 @@ if ($formdata = $mform2->is_cancelled()) {
 
         // add default values for remaining fields
         $formdefaults = array();
-        if ($updatetype != UU_UPDATE_FILEOVERRIDE && $updatetype != UU_UPDATE_NOCHANGES) {
+        if (!$existinguser || ($updatetype != UU_UPDATE_FILEOVERRIDE && $updatetype != UU_UPDATE_NOCHANGES)) {
             foreach ($STD_FIELDS as $field) {
                 if (isset($user->$field)) {
                     continue;

admin/tool/uploaduser/picture_form.php

@@ -37,7 +37,7 @@ class admin_uploadpicture_form extends moodleform {
 
 
         $options = array();
-        $options['accepted_types'] = array('archive');
+        $options['accepted_types'] = array('.zip');
         $mform->addElement('filepicker', 'userpicturesfile', get_string('file'), 'size="40"', $options);
         $mform->addRule('userpicturesfile', null, 'required');
 

admin/tool/uploaduser/tests/behat/upload_users.feature

@@ -38,6 +38,31 @@ Feature: Upload users
     And I set the field "groups" to "Section 1 (1)"
     And the "members" select box should contain "Tom Jones"
 
+  @javascript
+  Scenario: Upload users enrolling them on courses and groups applying defaults
+    Given the following "courses" exist:
+      | fullname | shortname | category |
+      | Maths | math102 | 0 |
+    And the following "groups" exist:
+      | name | course | idnumber |
+      | Section 1 | math102 | S1 |
+      | Section 3 | math102 | S3 |
+    And I log in as "admin"
+    And I navigate to "Upload users" node in "Site administration > Users > Accounts"
+    When I upload "lib/tests/fixtures/upload_users.csv" file to "File" filemanager
+    And I press "Upload users"
+    And I set the following fields to these values:
+      | City/town  | Brighton   |
+      | Department | Purchasing |
+    And I press "Upload users"
+    And I press "Continue"
+    And I navigate to "Users > Accounts > Browse list of users" in site administration
+    And I should see "Tom Jones"
+    And I follow "Tom Jones"
+    And I follow "Edit profile"
+    And the field "City/town" matches value "Brighton"
+    And the field "Department" matches value "Purchasing"
+
   @javascript
   Scenario: Upload users with custom profile fields
     # Create user profile field.

admin/tool/usertours/amd/build/usertours.min.js

@@ -1 +1 @@
-define(["core/ajax","tool_usertours/tour","jquery","core/templates","core/str","core/log","core/notification"],function(a,b,c,d,e,f,g){var h={tourId:null,currentTour:null,context:null,init:function(a,b,d){h.tourId=a,h.context=d,"undefined"==typeof b&&(b=!0),b&&h.fetchTour(a),h.addResetLink(),c("body").on("click",'[data-action="tool_usertours/resetpagetour"]',function(a){a.preventDefault(),h.resetTourState(h.tourId)})},fetchTour:function(b){c.when(a.call([{methodname:"tool_usertours_fetch_and_start_tour",args:{tourid:b,context:h.context,pageurl:window.location.href}}])[0],d.render("tool_usertours/tourstep",{})).then(function(a,c){h.startBootstrapTour(b,c[0],a.tourconfig)}).fail(g.exception)},addResetLink:function(){e.get_string("resettouronpage","tool_usertours").done(function(a){c("footer, .logininfo").last().append('<div class="usertour"><a href="#" data-action="tool_usertours/resetpagetour">'+a+"</a></div>")})},startBootstrapTour:function(a,c,d){h.currentTour&&(d.onEnd=null,h.currentTour.endTour(),delete h.currentTour),d.eventHandlers={afterEnd:[h.markTourComplete],afterRender:[h.markStepShown]},d.tourName=d.name,delete d.name,d.template=c,d.steps=d.steps.map(function(a){return"undefined"!=typeof a.element&&(a.target=a.element,delete a.element),"undefined"!=typeof a.reflex&&(a.moveOnClick=!!a.reflex,delete a.reflex),"undefined"!=typeof a.content&&(a.body=a.content,delete a.content),a}),h.currentTour=new b(d),h.currentTour.startTour()},markStepShown:function(){var b=this.getStepConfig(this.getCurrentStepNumber());c.when(a.call([{methodname:"tool_usertours_step_shown",args:{tourid:h.tourId,context:h.context,pageurl:window.location.href,stepid:b.stepid,stepindex:this.getCurrentStepNumber()}}])[0]).fail(f.error)},markTourComplete:function(){var b=this.getStepConfig(this.getCurrentStepNumber());c.when(a.call([{methodname:"tool_usertours_complete_tour",args:{tourid:h.tourId,context:h.context,pageurl:window.location.href,stepid:b.stepid,stepindex:this.getCurrentStepNumber()}}])[0]).fail(f.error)},resetTourState:function(b){c.when(a.call([{methodname:"tool_usertours_reset_tour",args:{tourid:b,context:h.context,pageurl:window.location.href}}])[0]).then(function(a){a.startTour&&h.fetchTour(a.startTour)}).fail(g.exception)}};return{init:h.init,resetTourState:h.resetTourState}});
+define(["core/ajax","tool_usertours/tour","jquery","core/templates","core/str","core/log","core/notification"],function(a,b,c,d,e,f,g){var h={tourId:null,currentTour:null,context:null,init:function(a,b,d){h.tourId=a,h.context=d,"undefined"==typeof b&&(b=!0),b&&h.fetchTour(a),h.addResetLink(),c("body").on("click",'[data-action="tool_usertours/resetpagetour"]',function(a){a.preventDefault(),h.resetTourState(h.tourId)})},fetchTour:function(b){M.util.js_pending("admin_usertour_fetchTour"+b),c.when(a.call([{methodname:"tool_usertours_fetch_and_start_tour",args:{tourid:b,context:h.context,pageurl:window.location.href}}])[0],d.render("tool_usertours/tourstep",{})).then(function(a,c){return h.startBootstrapTour(b,c[0],a.tourconfig)}).always(function(){M.util.js_complete("admin_usertour_fetchTour"+b)}).fail(g.exception)},addResetLink:function(){M.util.js_pending("admin_usertour_addResetLink"),e.get_string("resettouronpage","tool_usertours").done(function(a){c("footer, .logininfo").last().append('<div class="usertour"><a href="#" data-action="tool_usertours/resetpagetour">'+a+"</a></div>")}).always(function(){M.util.js_complete("admin_usertour_addResetLink")}).fail()},startBootstrapTour:function(a,c,d){return h.currentTour&&(d.onEnd=null,h.currentTour.endTour(),delete h.currentTour),d.eventHandlers={afterEnd:[h.markTourComplete],afterRender:[h.markStepShown]},d.tourName=d.name,delete d.name,d.template=c,d.steps=d.steps.map(function(a){return"undefined"!=typeof a.element&&(a.target=a.element,delete a.element),"undefined"!=typeof a.reflex&&(a.moveOnClick=!!a.reflex,delete a.reflex),"undefined"!=typeof a.content&&(a.body=a.content,delete a.content),a}),h.currentTour=new b(d),h.currentTour.startTour()},markStepShown:function(){var b=this.getStepConfig(this.getCurrentStepNumber());c.when(a.call([{methodname:"tool_usertours_step_shown",args:{tourid:h.tourId,context:h.context,pageurl:window.location.href,stepid:b.stepid,stepindex:this.getCurrentStepNumber()}}])[0]).fail(f.error)},markTourComplete:function(){var b=this.getStepConfig(this.getCurrentStepNumber());c.when(a.call([{methodname:"tool_usertours_complete_tour",args:{tourid:h.tourId,context:h.context,pageurl:window.location.href,stepid:b.stepid,stepindex:this.getCurrentStepNumber()}}])[0]).fail(f.error)},resetTourState:function(b){c.when(a.call([{methodname:"tool_usertours_reset_tour",args:{tourid:b,context:h.context,pageurl:window.location.href}}])[0]).then(function(a){a.startTour&&h.fetchTour(a.startTour)}).fail(g.exception)}};return{init:h.init,resetTourState:h.resetTourState}});

admin/tool/usertours/amd/src/tour.js

@@ -634,6 +634,24 @@ Tour.prototype.processStepListeners = function (stepConfig) {
         args: ['click', '[data-role="end"]', $.proxy(this.endTour, this)]
     },
 
+    // Click backdrop and hide tour.
+    {
+        node: $('[data-flexitour="backdrop"]'),
+        args: ['click', $.proxy(this.hide, this)]
+    },
+
+    // Click out and hide tour without backdrop.
+    {
+        node: $('body'),
+        args: ['click', $.proxy(function (e) {
+            // Handle click in or click out tour content,
+            // if click out, hide tour.
+            if (!this.currentStepNode.is(e.target) && $(e.target).closest('[data-role="flexitour-step"]').length === 0) {
+                this.hide();
+            }
+        }, this)]
+    },
+
     // Keypresses.
     {
         node: $('body'),
@@ -904,7 +922,7 @@ Tour.prototype.announceStep = function (stepConfig) {
  * @param   {EventFacade} e
  */
 Tour.prototype.handleKeyDown = function (e) {
-    var tabbableSelector = 'a[href], link[href], [draggable=true], [contenteditable=true], :input:enabled, [tabindex], button';
+    var tabbableSelector = 'a[href], link[href], [draggable=true], [contenteditable=true], :input:enabled, [tabindex], button:enabled';
     switch (e.keyCode) {
         case 27:
             this.endTour();
@@ -923,8 +941,17 @@ Tour.prototype.handleKeyDown = function (e) {
                 var activeElement = $(document.activeElement);
                 var stepTarget = this.getStepTarget(this.currentStepConfig);
                 var tabbableNodes = $(tabbableSelector);
+                var dialogContainer = $('span[data-flexitour="container"]');
                 var currentIndex = void 0;
-                tabbableNodes.filter(function (index, element) {
+                // Filter out element which is not belong to target section or dialogue.
+                if (stepTarget) {
+                    tabbableNodes = tabbableNodes.filter(function (index, element) {
+                        return stepTarget != null && (stepTarget.has(element).length || dialogContainer.has(element).length || stepTarget.is(element) || dialogContainer.is(element));
+                    });
+                }
+
+                // Find index of focusing element.
+                tabbableNodes.each(function (index, element) {
                     if (activeElement.is(element)) {
                         currentIndex = index;
                         return false;
@@ -934,7 +961,7 @@ Tour.prototype.handleKeyDown = function (e) {
                 var nextIndex = void 0;
                 var nextNode = void 0;
                 var focusRelevant = void 0;
-                if (currentIndex) {
+                if (currentIndex != void 0) {
                     var direction = 1;
                     if (e.shiftKey) {
                         direction = -1;
@@ -1090,6 +1117,16 @@ Tour.prototype.hide = function (transition) {
         $(this).remove();
     });
 
+    // Remove aria-describedby and tabindex attributes.
+    if (this.currentStepNode && this.currentStepNode.length) {
+        var stepId = this.currentStepNode.attr('id');
+        if (stepId) {
+            var currentStepElement = '[aria-describedby="' + stepId + '-body"]';
+            $(currentStepElement).removeAttr('tabindex');
+            $(currentStepElement).removeAttr('aria-describedby');
+        }
+    }
+
     // Reset the listeners.
     this.resetStepListeners();
 
@@ -1224,6 +1261,58 @@ Tour.prototype.positionStep = function (stepConfig) {
             arrow: {
                 element: '[data-role="arrow"]'
             }
+        },
+        onCreate: function onCreate(data) {
+            recalculateArrowPosition(data);
+        },
+        onUpdate: function onUpdate(data) {
+            recalculateArrowPosition(data);
+        }
+    };
+
+    var recalculateArrowPosition = function recalculateArrowPosition(data) {
+        var placement = data.placement.split('-')[0];
+        var isVertical = ['left', 'right'].indexOf(placement) !== -1;
+        var arrowElement = data.instance.popper.querySelector('[data-role="arrow"]');
+        var stepElement = $(data.instance.popper.querySelector('[data-role="flexitour-step"]'));
+        if (isVertical) {
+            var arrowHeight = parseFloat(window.getComputedStyle(arrowElement).height);
+            var arrowOffset = parseFloat(window.getComputedStyle(arrowElement).top);
+            var popperHeight = parseFloat(window.getComputedStyle(data.instance.popper).height);
+            var popperOffset = parseFloat(window.getComputedStyle(data.instance.popper).top);
+            var popperBorderWidth = parseFloat(stepElement.css('borderTopWidth'));
+            var popperBorderRadiusWidth = parseFloat(stepElement.css('borderTopLeftRadius')) * 2;
+            var arrowPos = arrowOffset + arrowHeight / 2;
+            var maxPos = popperHeight + popperOffset - popperBorderWidth - popperBorderRadiusWidth;
+            var minPos = popperOffset + popperBorderWidth + popperBorderRadiusWidth;
+            if (arrowPos >= maxPos || arrowPos <= minPos) {
+                var newArrowPos = 0;
+                if (arrowPos > popperHeight / 2) {
+                    newArrowPos = maxPos - arrowHeight;
+                } else {
+                    newArrowPos = minPos + arrowHeight;
+                }
+                $(arrowElement).css('top', newArrowPos);
+            }
+        } else {
+            var arrowWidth = parseFloat(window.getComputedStyle(arrowElement).width);
+            var _arrowOffset = parseFloat(window.getComputedStyle(arrowElement).left);
+            var popperWidth = parseFloat(window.getComputedStyle(data.instance.popper).width);
+            var _popperOffset = parseFloat(window.getComputedStyle(data.instance.popper).left);
+            var _popperBorderWidth = parseFloat(stepElement.css('borderTopWidth'));
+            var _popperBorderRadiusWidth = parseFloat(stepElement.css('borderTopLeftRadius')) * 2;
+            var _arrowPos = _arrowOffset + arrowWidth / 2;
+            var _maxPos = popperWidth + _popperOffset - _popperBorderWidth - _popperBorderRadiusWidth;
+            var _minPos = _popperOffset + _popperBorderWidth + _popperBorderRadiusWidth;
+            if (_arrowPos >= _maxPos || _arrowPos <= _minPos) {
+                var _newArrowPos = 0;
+                if (_arrowPos > popperWidth / 2) {
+                    _newArrowPos = _maxPos - arrowWidth;
+                } else {
+                    _newArrowPos = _minPos + arrowWidth;
+                }
+                $(arrowElement).css('left', _newArrowPos);
+            }
         }
     };
 

admin/tool/usertours/amd/src/usertours.js

@@ -54,6 +54,7 @@ function(ajax, BootstrapTour, $, templates, str, log, notification) {
          * @param   {Number}    tourId      The ID of the tour to start.
          */
         fetchTour: function(tourId) {
+            M.util.js_pending('admin_usertour_fetchTour' + tourId);
             $.when(
                 ajax.call([
                     {
@@ -67,7 +68,11 @@ function(ajax, BootstrapTour, $, templates, str, log, notification) {
                 ])[0],
                 templates.render('tool_usertours/tourstep', {})
             ).then(function(response, template) {
-                usertours.startBootstrapTour(tourId, template[0], response.tourconfig);
+                return usertours.startBootstrapTour(tourId, template[0], response.tourconfig);
+            }).always(function() {
+                M.util.js_complete('admin_usertour_fetchTour' + tourId);
+
+                return;
             }).fail(notification.exception);
         },
 
@@ -77,6 +82,7 @@ function(ajax, BootstrapTour, $, templates, str, log, notification) {
          * @method  addResetLink
          */
         addResetLink: function() {
+            M.util.js_pending('admin_usertour_addResetLink');
             str.get_string('resettouronpage', 'tool_usertours')
                 .done(function(s) {
                     // Grab the last item in the page of these.
@@ -89,7 +95,13 @@ function(ajax, BootstrapTour, $, templates, str, log, notification) {
                             '</a>' +
                         '</div>'
                     );
-                });
+                })
+                .always(function() {
+                    M.util.js_complete('admin_usertour_addResetLink');
+
+                    return;
+                })
+                .fail();
         },
 
         /**
@@ -99,6 +111,7 @@ function(ajax, BootstrapTour, $, templates, str, log, notification) {
          * @param   {Number}    tourId      The ID of the tour to start.
          * @param   {String}    template    The template to use.
          * @param   {Object}    tourConfig  The tour configuration.
+         * @return  {Object}
          */
         startBootstrapTour: function(tourId, template, tourConfig) {
             if (usertours.currentTour) {
@@ -142,7 +155,7 @@ function(ajax, BootstrapTour, $, templates, str, log, notification) {
             });
 
             usertours.currentTour = new BootstrapTour(tourConfig);
-            usertours.currentTour.startTour();
+            return usertours.currentTour.startTour();
         },
 
         /**

admin/tool/usertours/classes/privacy/provider.php

@@ -0,0 +1,95 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Privacy Subsystem implementation for tool_usertours.
+ *
+ * @package    tool_usertours
+ * @copyright  2018 Andrew Nicols <andrew@nicols.co.uk>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace tool_usertours\privacy;
+
+use \core_privacy\local\request\writer;
+use \core_privacy\local\metadata\collection;
+use \core_privacy\local\request\transform;
+
+defined('MOODLE_INTERNAL') || die();
+
+/**
+ * Implementation of the privacy subsystem plugin provider for the user tours feature.
+ *
+ * @copyright  2018 Andrew Nicols <andrew@nicols.co.uk>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class provider implements
+    // This plugin has data.
+    \core_privacy\local\metadata\provider,
+
+    // This plugin has some sitewide user preferences to export.
+    \core_privacy\local\request\user_preference_provider
+{
+
+    /**
+     * Returns meta data about this system.
+     *
+     * @param   collection     $itemcollection The initialised item collection to add items to.
+     * @return  collection     A listing of user data stored through this system.
+     */
+    public static function get_metadata(collection $items) {
+        // There are several user preferences.
+        $items->add_user_preference(\tool_usertours\tour::TOUR_REQUESTED_BY_USER, 'privacy:metadata:preference:requested');
+        $items->add_user_preference(\tool_usertours\tour::TOUR_LAST_COMPLETED_BY_USER, 'privacy:metadata:preference:completed');
+
+        return $items;
+    }
+
+    /**
+     * Store all user preferences for the plugin.
+     *
+     * @param   int         $userid The userid of the user whose data is to be exported.
+     */
+    public static function export_user_preferences($userid) {
+        $preferences = get_user_preferences();
+        foreach ($preferences as $name => $value) {
+            $descriptionidentifier = null;
+            $tourid = null;
+            if (strpos($name, \tool_usertours\tour::TOUR_REQUESTED_BY_USER) === 0) {
+                $descriptionidentifier = 'privacy:request:preference:requested';
+                $tourid = substr($name, strlen(\tool_usertours\tour::TOUR_REQUESTED_BY_USER));
+            } else if (strpos($name, \tool_usertours\tour::TOUR_LAST_COMPLETED_BY_USER) === 0) {
+                $descriptionidentifier = 'privacy:request:preference:completed';
+                $tourid = substr($name, strlen(\tool_usertours\tour::TOUR_LAST_COMPLETED_BY_USER));
+            }
+
+            if ($descriptionidentifier !== null) {
+                $time = transform::datetime($value);
+                $tour = \tool_usertours\tour::instance($tourid);
+
+                writer::export_user_preference(
+                    'tool_usertours',
+                    $name,
+                    $time,
+                    get_string($descriptionidentifier, 'tool_usertours', (object) [
+                        'name' => $tour->get_name(),
+                        'time' => $time,
+                    ])
+                );
+            }
+        }
+    }
+}

admin/tool/usertours/db/install.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8" ?>
-<XMLDB PATH="tool/usertours/db" VERSION="20160830" COMMENT="XMLDB file for Moodle tool/usertours"
+<XMLDB PATH="admin/tool/usertours/db" VERSION="20160830" COMMENT="XMLDB file for Moodle tool/usertours"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:noNamespaceSchemaLocation="../../../lib/xmldb/xmldb.xsd"
+    xsi:noNamespaceSchemaLocation="../../../../lib/xmldb/xmldb.xsd"
 >
   <TABLES>
     <TABLE NAME="tool_usertours_tours" COMMENT="List of tours">

admin/tool/usertours/lang/en/tool_usertours.php

@@ -169,3 +169,7 @@ $string['tour2_title_addingblocks'] = 'Adding blocks';
 $string['tour2_content_addingblocks'] = 'You can add blocks to this page using this button. However, think carefully about including any blocks on your pages. Blocks are not shown on the Moodle Mobile app, so for the best user experience it is better to make sure your course works well without any blocks.';
 $string['tour2_title_end'] = 'End of tour';
 $string['tour2_content_end'] = 'This is the end of your user tour. It won\'t show again unless you reset it using the link in the footer. The site admin can also create further tours for this site if required.';
+$string['privacy:metadata:preference:requested'] = 'The time that a user last manually requested a user tour.';
+$string['privacy:metadata:preference:completed'] = 'The time that a user last completed a user tour.';
+$string['privacy:request:preference:requested'] = 'You last requested the "{$a->name}" user tour on {$a->time}';
+$string['privacy:request:preference:completed'] = 'You last marked the "{$a->name}" user tour as completed on {$a->time}';

admin/tool/usertours/tests/behat/behat_tool_usertours.php

@@ -62,7 +62,16 @@ class behat_tool_usertours extends behat_base {
     public function i_add_steps_to_the_named_tour($tourname, TableNode $table) {
         $this->execute('behat_tool_usertours::i_open_the_user_tour_settings_page');
         $this->execute('behat_general::click_link', $this->escape($tourname));
+        $this->execute('behat_tool_usertours::i_add_steps_to_the_tour', $table);
+    }
 
+    /**
+     * Add new steps to the current user tour.
+     *
+     * @Given /^I add steps to the tour:$/
+     * @param   TableNode   $table
+     */
+    public function i_add_steps_to_the_tour(TableNode $table) {
         foreach ($table->getHash() as $step) {
             $this->execute('behat_general::click_link', get_string('newstep', 'tool_usertours'));
 

admin/tool/usertours/tests/behat/tour_accessibility.feature

@@ -0,0 +1,85 @@
+@tool @tool_usertours
+Feature: Apply accessibility to a tour
+  Background:
+    Given I log in as "admin"
+    And I add a new user tour with:
+      | Name                | First tour |
+      | Description         | My first tour |
+      | Apply to URL match  | FRONTPAGE |
+      | Tour is enabled     | 1 |
+      | Show with backdrop  | 1 |
+    And I add steps to the "First tour" tour:
+      | targettype                  | Title             | Content |
+      | Display in middle of page   | Welcome           | Welcome tour. |
+    And I add steps to the tour:
+      | targettype | targetvalue_selector | Title       | Content   |
+      | Selector   | .usermenu            | User menu   | Next page |
+      | Selector   | input,button         | Page 2      | Next page |
+    And I add steps to the tour:
+      | targettype                  | Title   | Content     |
+      | Display in middle of page   | Page 3  | Final page. |
+
+  @javascript
+  Scenario: Check tabbing working correctly.
+    Given I am on site homepage
+    And I wait "1" seconds
+    And I should see "Welcome"
+    # First dialogue of the tour, "Welcome". It has Close, Next and End buttons.
+    # Nothing highlighted on the page. Initially whole dialogue focused.
+    When I press tab
+    Then the focused element is ".close" "css_element" in the "Welcome" "dialogue"
+    When I press tab
+    Then the focused element is "Next" "button" in the "Welcome" "dialogue"
+    When I press tab
+    Then the focused element is "End tour" "button" in the "Welcome" "dialogue"
+    When I press tab
+    # Here the focus loops round to the whole dialogue again.
+    And I press tab
+    Then the focused element is ".close" "css_element" in the "Welcome" "dialogue"
+    # Check looping works properly going backwards too.
+    When I press shift tab
+    And I press shift tab
+    Then the focused element is "End tour" "button" in the "Welcome" "dialogue"
+
+    When I press "Next"
+    # Now we are on the "User menu" step, so Previous is also enabled.
+    # Also, the user menu section in the page is highlighted, and this
+    # section contain a hyperlink so the focus have to go though and back to the dialogue.
+    And I wait "1" seconds
+    And I press tab
+    Then the focused element is ".close" "css_element" in the "User menu" "dialogue"
+    When I press tab
+    Then the focused element is "Previous" "button" in the "User menu" "dialogue"
+    When I press tab
+    Then the focused element is "Next" "button" in the "User menu" "dialogue"
+    When I press tab
+    Then the focused element is "End tour" "button" in the "User menu" "dialogue"
+    # We tab 3 times from "End Tour" button to header container, drop down then go to "Dashboard" link.
+    When I press tab
+    Then the focused element is ".usermenu" "css_element"
+    When I press tab
+    Then the focused element is "Admin User" "link" in the ".usermenu" "css_element"
+    When I press tab
+    And I press tab
+    Then the focused element is ".close" "css_element" in the "User menu" "dialogue"
+    # Press shift-tab twice should lead us back to "Admin user" link.
+    When I press shift tab
+    And I press shift tab
+    Then the focused element is "Admin User" "link" in the ".usermenu" "css_element"
+
+  @javascript
+  Scenario: Aria tags should not exist
+    And I am on site homepage
+    When I click on "Next" "button"
+    And I click on "Next" "button"
+    Then "input[aria-describedby^='tour-step-tool_usertours'],button[aria-describedby^='tour-step-tool_usertours']" "css_element" should exist
+    And "input[tabindex],button[tabindex]" "css_element" should exist
+    When I click on "Next" "button"
+    Then "input[aria-describedby^='tour-step-tool_usertours'],button[aria-describedby^='tour-step-tool_usertours']" "css_element" should not exist
+    And "input[tabindex],button[tabindex]" "css_element" should not exist
+    When I click on "Previous" "button"
+    Then "input[aria-describedby^='tour-step-tool_usertours'],button[aria-describedby^='tour-step-tool_usertours']" "css_element" should exist
+    And "input[tabindex],button[tabindex]" "css_element" should exist
+    When I click on "End tour" "button"
+    Then "input[aria-describedby^='tour-step-tool_usertours'],button[aria-describedby^='tour-step-tool_usertours']" "css_element" should not exist
+    And "input[tabindex],button[tabindex]" "css_element" should not exist

admin/tool/usertours/tests/privcacy_provider_test.php

@@ -0,0 +1,115 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Unit tests for the block_html implementation of the privacy API.
+ *
+ * @package    block_html
+ * @category   test
+ * @copyright  2018 Andrew Nicols <andrew@nicols.co.uk>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+use \core_privacy\local\metadata\collection;
+use \core_privacy\local\request\writer;
+use \core_privacy\local\request\approved_contextlist;
+use \core_privacy\local\request\deletion_criteria;
+use \tool_usertours\tour;
+use \tool_usertours\privacy\provider;
+
+/**
+ * Unit tests for the block_html implementation of the privacy API.
+ *
+ * @copyright  2018 Andrew Nicols <andrew@nicols.co.uk>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class tool_usertours_privacy_testcase extends \core_privacy\tests\provider_testcase {
+
+    /**
+     * Ensure that get_metadata exports valid content.
+     */
+    public function test_get_metadata() {
+        $items = new collection('tool_usertours');
+        $result = provider::get_metadata($items);
+        $this->assertSame($items, $result);
+        $this->assertInstanceOf(collection::class, $result);
+    }
+
+    /**
+     * Ensure that export_user_preferences returns no data if the user has completed no tours.
+     */
+    public function test_export_user_preferences_no_pref() {
+        $user = \core_user::get_user_by_username('admin');
+        provider::export_user_preferences($user->id);
+
+        $writer = writer::with_context(\context_system::instance());
+
+        $this->assertFalse($writer->has_any_data());
+    }
+
+    /**
+     * Ensure that export_user_preferences returns request completion data.
+     */
+    public function test_export_user_preferences_completed() {
+        global $DB;
+
+        $this->resetAfterTest();
+        $this->setAdminUser();
+
+        $alltours = $DB->get_records('tool_usertours_tours');
+        $tourdata = reset($alltours);
+
+        $user = \core_user::get_user_by_username('admin');
+        $tour = tour::instance($tourdata->id);
+        $tour->mark_user_completed();
+        provider::export_user_preferences($user->id);
+
+        $writer = writer::with_context(\context_system::instance());
+
+        $this->assertTrue($writer->has_any_data());
+        $prefs = $writer->get_user_preferences('tool_usertours');
+
+        $this->assertCount(1, (array) $prefs);
+    }
+
+    /**
+     * Ensure that export_user_preferences returns request completion data.
+     */
+    public function test_export_user_preferences_requested() {
+        global $DB;
+
+        $this->resetAfterTest();
+        $this->setAdminUser();
+
+        $alltours = $DB->get_records('tool_usertours_tours');
+        $tourdata = reset($alltours);
+
+        $user = \core_user::get_user_by_username('admin');
+        $tour = tour::instance($tourdata->id);
+        $tour->mark_user_completed();
+        $tour->request_user_reset();
+        provider::export_user_preferences($user->id);
+
+        $writer = writer::with_context(\context_system::instance());
+
+        $this->assertTrue($writer->has_any_data());
+        $prefs = $writer->get_user_preferences('tool_usertours');
+
+        $this->assertCount(2, (array) $prefs);
+    }
+}

admin/tool/usertours/thirdpartylibs.xml

@@ -4,7 +4,7 @@
     <location>amd/src/tour.js</location>
     <name>Flexitour</name>
     <license>GPLv3</license>
-    <version>0.10.0</version>
+    <version>0.12.2</version>
     <licenseversion>3</licenseversion>
   </library>
   <library>

admin/user.php

@@ -262,11 +262,17 @@
                 $users[$key]->country = $countries[$user->country];
             }
         }
-        if ($sort == "country") {  // Need to resort by full country name, not code
+        if ($sort == "country") {
+            // Need to resort by full country name, not code.
             foreach ($users as $user) {
                 $susers[$user->id] = $user->country;
             }
-            asort($susers);
+            // Sort by country name, according to $dir.
+            if ($dir === 'DESC') {
+                arsort($susers);
+            } else {
+                asort($susers);
+            }
             foreach ($susers as $key => $value) {
                 $nusers[] = $users[$key];
             }

auth/classes/digital_consent.php

@@ -0,0 +1,106 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Contains helper class for digital consent.
+ *
+ * @package     core_auth
+ * @copyright   2018 Mihail Geshoski <mihail@moodle.com>
+ * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace core_auth;
+
+defined('MOODLE_INTERNAL') || die();
+
+/**
+ * Helper class for digital consent.
+ *
+ * @copyright 2018 Mihail Geshoski <mihail@moodle.com>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class digital_consent {
+
+    /**
+     * Returns true if age and location verification is enabled in the site.
+     *
+     * @return bool
+     */
+    public static function is_age_digital_consent_verification_enabled() {
+        global $CFG;
+
+        return !empty($CFG->agedigitalconsentverification);
+    }
+
+    /**
+     * Checks if a user is a digital minor.
+     *
+     * @param int $age
+     * @param string $country The country code (ISO 3166-2)
+     * @return bool
+     */
+    public static function is_minor($age, $country) {
+        global $CFG;
+
+        $ageconsentmap = $CFG->agedigitalconsentmap;
+        $agedigitalconsentmap = self::parse_age_digital_consent_map($ageconsentmap);
+
+        return array_key_exists($country, $agedigitalconsentmap) ?
+            $age < $agedigitalconsentmap[$country] : $age < $agedigitalconsentmap['*'];
+    }
+
+    /**
+     * Parse the agedigitalconsentmap setting into an array.
+     *
+     * @param  string $ageconsentmap The value of the agedigitalconsentmap setting
+     * @return array $ageconsentmapparsed
+     */
+    public static function parse_age_digital_consent_map($ageconsentmap) {
+
+        $ageconsentmapparsed = array();
+        $countries = get_string_manager()->get_list_of_countries();
+        $isdefaultvaluepresent = false;
+        $lines = preg_split('/\r|\n/', $ageconsentmap, -1, PREG_SPLIT_NO_EMPTY);
+        foreach ($lines as $line) {
+            $arr = explode(",", $line);
+            // Handle if there is more or less than one comma separator.
+            if (count($arr) != 2) {
+                throw new \moodle_exception('agedigitalconsentmapinvalidcomma', 'error', '', $line);
+            }
+            $country = trim($arr[0]);
+            $age = trim($arr[1]);
+            // Check if default.
+            if ($country == "*") {
+                $isdefaultvaluepresent = true;
+            }
+            // Handle if the presented value for country is not valid.
+            if ($country !== "*" && !array_key_exists($country, $countries)) {
+                throw new \moodle_exception('agedigitalconsentmapinvalidcountry', 'error', '', $country);
+            }
+            // Handle if the presented value for age is not valid.
+            if (!is_numeric($age)) {
+                throw new \moodle_exception('agedigitalconsentmapinvalidage', 'error', '', $age);
+            }
+            $ageconsentmapparsed[$country] = $age;
+        }
+        // Handle if a default value does not exist.
+        if (!$isdefaultvaluepresent) {
+            throw new \moodle_exception('agedigitalconsentmapinvaliddefault');
+        }
+
+        return $ageconsentmapparsed;
+    }
+}

auth/classes/external.php

@@ -121,4 +121,125 @@ class core_auth_external extends external_api {
             )
         );
     }
+
+    /**
+     * Describes the parameters for the digital minor check.
+     *
+     * @return external_function_parameters
+     * @since Moodle 3.4
+     */
+    public static function is_minor_parameters() {
+        return new external_function_parameters(
+            array(
+                'age' => new external_value(PARAM_INT, 'Age'),
+                'country' => new external_value(PARAM_ALPHA, 'Country of residence'),
+            )
+        );
+    }
+
+    /**
+     * Requests a check if a user is digital minor.
+     *
+     * @param  int $age User age
+     * @param  string $country Country of residence
+     * @return array status (true if the user is a minor, false otherwise)
+     * @since Moodle 3.4
+     * @throws moodle_exception
+     */
+    public static function is_minor($age, $country) {
+        global $CFG, $PAGE;
+        require_once($CFG->dirroot . '/login/lib.php');
+
+        $params = self::validate_parameters(
+            self::is_minor_parameters(),
+            array(
+                'age' => $age,
+                'country' => $country,
+            )
+        );
+
+        if (!array_key_exists($params['country'], get_string_manager()->get_list_of_countries())) {
+            throw new invalid_parameter_exception('Invalid value for country parameter (value: '.
+                $params['country'] .')');
+        }
+
+        $context = context_system::instance();
+        $PAGE->set_context($context);
+
+        // Check if verification of age and location (minor check) is enabled.
+        if (!\core_auth\digital_consent::is_age_digital_consent_verification_enabled()) {
+            throw new moodle_exception('nopermissions', 'error', '',
+                get_string('agelocationverificationdisabled', 'error'));
+        }
+
+        $status = \core_auth\digital_consent::is_minor($params['age'], $params['country']);
+
+        return array(
+            'status' => $status
+        );
+    }
+
+    /**
+     * Describes the is_minor return value.
+     *
+     * @return external_single_structure
+     * @since Moodle 3.4
+     */
+    public static function is_minor_returns() {
+        return new external_single_structure(
+            array(
+                'status' => new external_value(PARAM_BOOL, 'True if the user is considered to be a digital minor,
+                    false if not')
+            )
+        );
+    }
+
+    /**
+     * Describes the parameters for is_age_digital_consent_verification_enabled.
+     *
+     * @return external_function_parameters
+     * @since Moodle 3.3
+     */
+    public static function is_age_digital_consent_verification_enabled_parameters() {
+        return new external_function_parameters(array());
+    }
+
+    /**
+     * Checks if age digital consent verification is enabled.
+     *
+     * @return array status (true if digital consent verification is enabled, false otherwise.)
+     * @since Moodle 3.3
+     * @throws moodle_exception
+     */
+    public static function is_age_digital_consent_verification_enabled() {
+        global $PAGE;
+
+        $context = context_system::instance();
+        $PAGE->set_context($context);
+
+        $status = false;
+        // Check if verification is enabled.
+        if (\core_auth\digital_consent::is_age_digital_consent_verification_enabled()) {
+            $status = true;
+        }
+
+        return array(
+            'status' => $status
+        );
+    }
+
+    /**
+     * Describes the is_age_digital_consent_verification_enabled return value.
+     *
+     * @return external_single_structure
+     * @since Moodle 3.3
+     */
+    public static function is_age_digital_consent_verification_enabled_returns() {
+        return new external_single_structure(
+            array(
+                'status' => new external_value(PARAM_BOOL, 'True if digital consent verification is enabled,
+                    false otherwise.')
+            )
+        );
+    }
 }

auth/classes/form/verify_age_location_form.php

@@ -0,0 +1,62 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Age and location verification mform.
+ *
+ * @package     core_auth
+ * @copyright   2018 Mihail Geshoski <mihail@moodle.com>
+ * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace core_auth\form;
+
+defined('MOODLE_INTERNAL') || die();
+
+require_once($CFG->libdir.'/formslib.php');
+
+use moodleform;
+
+/**
+ * Age and location verification mform class.
+ *
+ * @copyright 2018 Mihail Geshoski <mihail@moodle.com>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class verify_age_location_form extends moodleform {
+    /**
+     * Defines the form fields.
+     */
+    public function definition() {
+        global $CFG;
+
+        $mform = $this->_form;
+
+        $mform->addElement('text', 'age', get_string('whatisyourage'), array('optional'  => false));
+        $mform->setType('age', PARAM_RAW);
+        $mform->addRule('age', null, 'required', null, 'client');
+        $mform->addRule('age', null, 'numeric', null, 'client');
+
+        $countries = get_string_manager()->get_list_of_countries();
+        $defaultcountry[''] = get_string('selectacountry');
+        $countries = array_merge($defaultcountry, $countries);
+        $mform->addElement('select', 'country', get_string('wheredoyoulive'), $countries);
+        $mform->addRule('country', null, 'required', null, 'client');
+        $mform->setDefault('country', $CFG->country);
+
+        $this->add_action_buttons(true, get_string('proceed'));
+    }
+}

auth/classes/output/digital_minor_page.php

@@ -0,0 +1,63 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Digital minor renderable.
+ *
+ * @package     core_auth
+ * @copyright   2018 Mihail Geshoski <mihail@moodle.com>
+ * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace core_auth\output;
+
+defined('MOODLE_INTERNAL') || die();
+
+use renderable;
+use renderer_base;
+use templatable;
+
+/**
+ * Digital minor renderable class.
+ *
+ * @copyright 2018 Mihail Geshoski <mihail@moodle.com>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class digital_minor_page implements renderable, templatable {
+
+    /**
+     * Export the page data for the mustache template.
+     *
+     * @param renderer_base $output renderer to be used to render the page elements.
+     * @return stdClass
+     */
+    public function export_for_template(renderer_base $output) {
+        global $SITE, $CFG;
+
+        $sitename = format_string($SITE->fullname);
+        $supportname = $CFG->supportname;
+        $supportemail = $CFG->supportemail;
+
+        $context = [
+            'sitename' => $sitename,
+            'supportname' => $supportname,
+            'supportemail' => $supportemail,
+            'homelink' => new \moodle_url('/')
+        ];
+
+        return $context;
+    }
+}

auth/classes/output/verify_age_location_page.php

@@ -0,0 +1,81 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Age and location verification renderable.
+ *
+ * @package     core_auth
+ * @copyright   2018 Mihail Geshoski <mihail@moodle.com>
+ * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace core_auth\output;
+
+defined('MOODLE_INTERNAL') || die();
+
+use renderable;
+use renderer_base;
+use templatable;
+
+require_once($CFG->libdir.'/formslib.php');
+
+/**
+ * Age and location verification renderable class.
+ *
+ * @copyright 2018 Mihail Geshoski <mihail@moodle.com>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class verify_age_location_page implements renderable, templatable {
+
+    /** @var mform The form object */
+    protected $form;
+
+    /** @var string Error message */
+    protected $errormessage;
+
+    /**
+     * Constructor
+     *
+     * @param mform $form The form object
+     * @param string $errormessage The error message.
+     */
+    public function __construct($form, $errormessage = null) {
+        $this->form = $form;
+        $this->errormessage = $errormessage;
+    }
+
+    /**
+     * Export the page data for the mustache template.
+     *
+     * @param renderer_base $output renderer to be used to render the page elements.
+     * @return stdClass
+     */
+    public function export_for_template(renderer_base $output) {
+        global $SITE;
+
+        $sitename = format_string($SITE->fullname);
+        $formhtml = $this->form->render();
+        $error = $this->errormessage;
+
+        $context = [
+            'sitename' => $sitename,
+            'formhtml' => $formhtml,
+            'error'    => $error
+        ];
+
+        return $context;
+    }
+}

auth/db/lang/en/auth_db.php

@@ -45,7 +45,7 @@ $string['auth_dbname'] = 'Name of the database itself. Leave empty if using an O
 $string['auth_dbname_key'] = 'DB name';
 $string['auth_dbpass'] = 'Password matching the above username';
 $string['auth_dbpass_key'] = 'Password';
-$string['auth_dbpasstype'] = '<p>Specify the format that the password field is using. MD5 hashing is useful for connecting to other common web applications like PostNuke.</p> <p>Use \'internal\' if you want the external database to manage usernames and email addresses, but Moodle to manage passwords. If you use \'internal\', you <i>must</i> provide a populated email address field in the external database, and you must execute both admin/cron.php and auth/db/cli/sync_users.php regularly. Moodle will send an email to new users with a temporary password.</p>';
+$string['auth_dbpasstype'] = '<p>Specify the format that the password field is using.</p> <p>Use \'internal\' if you want the external database to manage usernames and email addresses, but Moodle to manage passwords. If you use \'internal\', you <i>must</i> provide a populated email address field in the external database, and you must execute both admin/cron.php and auth/db/cli/sync_users.php regularly. Moodle will send an email to new users with a temporary password.</p>';
 $string['auth_dbpasstype_key'] = 'Password format';
 $string['auth_dbreviveduser'] = 'Revived user {$a->name} id {$a->id}';
 $string['auth_dbrevivedusererror'] = 'Error reviving user {$a}';

auth/email/classes/external.php

@@ -88,8 +88,9 @@ class auth_email_external extends external_api {
         if (!empty($CFG->passwordpolicy)) {
             $result['passwordpolicy'] = print_password_policy();
         }
-        if (!empty($CFG->sitepolicy)) {
-            $result['sitepolicy'] = $CFG->sitepolicy;
+        $manager = new \core_privacy\local\sitepolicy\manager();
+        if ($sitepolicy = $manager->get_embed_url()) {
+            $result['sitepolicy'] = $sitepolicy->out(false);
         }
         if (!empty($CFG->defaultcity)) {
             $result['defaultcity'] = $CFG->defaultcity;
@@ -112,11 +113,11 @@ class auth_email_external extends external_api {
         }
 
         if (signup_captcha_enabled()) {
-            require_once($CFG->libdir . '/recaptchalib.php');
-            // We return the public key, maybe we want to use the javascript api to get the image.
+            // With reCAPTCHA v2 the captcha will be rendered by the mobile client using just the publickey.
+            // For now include placeholders for the v1 paramaters to support older mobile app versions.
             $result['recaptchapublickey'] = $CFG->recaptchapublickey;
             list($result['recaptchachallengehash'], $result['recaptchachallengeimage'], $result['recaptchachallengejs']) =
-                recaptcha_get_challenge_hash_and_urls(RECAPTCHA_API_SECURE_SERVER, $CFG->recaptchapublickey);
+                array('', '', '');
         }
 
         $result['warnings'] = array();
@@ -137,7 +138,7 @@ class auth_email_external extends external_api {
                      new external_value(PARAM_NOTAGS, 'The order of the name fields')
                 ),
                 'passwordpolicy' => new external_value(PARAM_RAW, 'Password policy', VALUE_OPTIONAL),
-                'sitepolicy' => new external_value(PARAM_URL, 'Site policy url', VALUE_OPTIONAL),
+                'sitepolicy' => new external_value(PARAM_RAW, 'Site policy', VALUE_OPTIONAL),
                 'defaultcity' => new external_value(PARAM_NOTAGS, 'Default city', VALUE_OPTIONAL),
                 'country' => new external_value(PARAM_ALPHA, 'Default country', VALUE_OPTIONAL),
                 'profilefields' => new external_multiple_structure(
@@ -287,7 +288,8 @@ class auth_email_external extends external_api {
         $data = $params;
         $data['email2'] = $data['email'];
         // Force policy agreed if a site policy is set. The client is responsible of implementing the interface check.
-        if (!empty($CFG->sitepolicy)) {
+        $manager = new \core_privacy\local\sitepolicy\manager();
+        if (!$manager->is_defined()) {
             $data['policyagreed'] = 1;
         }
         unset($data['recaptcharesponse']);
@@ -307,11 +309,11 @@ class auth_email_external extends external_api {
 
         // Validate recaptcha.
         if (signup_captcha_enabled()) {
-            require_once($CFG->libdir . '/recaptchalib.php');
-            $response = recaptcha_check_answer($CFG->recaptchaprivatekey, getremoteaddr(), $params['recaptchachallengehash'],
-                                               $params['recaptcharesponse'], true);
-            if (!$response->is_valid) {
-                $errors['recaptcharesponse'] = $response->error;
+            require_once($CFG->libdir . '/recaptchalib_v2.php');
+            $response = recaptcha_check_response(RECAPTCHA_VERIFY_URL, $CFG->recaptchaprivatekey,
+                                                 getremoteaddr(), $params['recaptcharesponse']);
+            if (!$response['isvalid']) {
+                $errors['recaptcharesponse'] = $response['error'];
             }
         }
 

auth/email/tests/behat/behat_auth_email.php

@@ -0,0 +1,54 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Step definition for auth_email
+ *
+ * @package    auth_email
+ * @category   test
+ * @copyright  2018 Marina Glancy
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+require_once(__DIR__ . '/../../../../lib/behat/behat_base.php');
+
+/**
+ * Step definition for auth_email.
+ *
+ * @package    auth_email
+ * @category   test
+ * @copyright  2018 Marina Glancy
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class behat_auth_email extends behat_base {
+
+    /**
+     * Emulate clicking on confirmation link from the email
+     *
+     * @When /^I confirm email for "(?P<username>(?:[^"]|\\")*)"$/
+     *
+     * @param string $username
+     */
+    public function i_confirm_email_for($username) {
+        global $DB;
+        $secret = $DB->get_field('user', 'secret', ['username' => $username], MUST_EXIST);
+        $confirmationurl = new moodle_url('/login/confirm.php');
+        $confirmationpath = $confirmationurl->out_as_local_url(false);
+        $url = $confirmationpath .  '?' . 'data='. $secret .'/'. $username;
+
+        $this->getSession()->visit($this->locate_path($url));
+    }
+}

auth/email/tests/behat/signup.feature

@@ -0,0 +1,65 @@
+@auth @auth_email
+Feature: User must accept policy when logging in and signing up
+  In order to record user agreement to use the site
+  As a user
+  I need to be able to accept site policy during sign up
+
+  Scenario: Accept policy on sign up, no site policy
+    Given the following config values are set as admin:
+      | registerauth    | email |
+      | passwordpolicy  | 0     |
+    And I am on site homepage
+    And I follow "Log in"
+    When I press "Create new account"
+    Then I should not see "I understand and agree"
+    And I set the following fields to these values:
+      | Username      | user1                 |
+      | Password      | user1                 |
+      | Email address | user1@address.invalid |
+      | Email (again) | user1@address.invalid |
+      | First name    | User1                 |
+      | Surname       | L1                    |
+    And I press "Create my new account"
+    And I should see "Confirm your account"
+    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I confirm email for "user1"
+    And I should see "Thanks, User1 L1"
+    And I should see "Your registration has been confirmed"
+    And I open my profile in edit mode
+    And the field "First name" matches value "User1"
+    And I log out
+    # Confirm that user can login and browse the site (edit their profile).
+    And I log in as "user1"
+    And I open my profile in edit mode
+    And the field "First name" matches value "User1"
+
+  Scenario: Accept policy on sign up, with site policy
+    Given the following config values are set as admin:
+      | registerauth    | email              |
+      | passwordpolicy  | 0                  |
+      | sitepolicy      | https://moodle.org |
+    And I am on site homepage
+    And I follow "Log in"
+    When I press "Create new account"
+    Then the field "I understand and agree" matches value "0"
+    And I set the following fields to these values:
+      | Username      | user1                 |
+      | Password      | user1                 |
+      | Email address | user1@address.invalid |
+      | Email (again) | user1@address.invalid |
+      | First name    | User1                 |
+      | Surname       | L1                    |
+      | I understand and agree | 1            |
+    And I press "Create my new account"
+    And I should see "Confirm your account"
+    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I confirm email for "user1"
+    And I should see "Thanks, User1 L1"
+    And I should see "Your registration has been confirmed"
+    And I open my profile in edit mode
+    And the field "First name" matches value "User1"
+    And I log out
+    # Confirm that user is not asked to agree to site policy again after the next login.
+    And I log in as "user1"
+    And I open my profile in edit mode
+    And the field "First name" matches value "User1"

auth/ldap/auth.php

@@ -836,23 +836,7 @@ class auth_plugin_ldap extends auth_plugin_base {
 /// User Updates - time-consuming (optional)
         if ($do_updates) {
             // Narrow down what fields we need to update
-            $all_keys = array_keys(get_object_vars($this->config));
-            $updatekeys = array();
-            foreach ($all_keys as $key) {
-                if (preg_match('/^field_updatelocal_(.+)$/', $key, $match)) {
-                    // If we have a field to update it from
-                    // and it must be updated 'onlogin' we
-                    // update it on cron
-                    if (!empty($this->config->{'field_map_'.$match[1]})
-                         and $this->config->{$match[0]} === 'onlogin') {
-                        array_push($updatekeys, $match[1]); // the actual key name
-                    }
-                }
-            }
-            if ($this->config->suspended_attribute && $this->config->sync_suspended) {
-                $updatekeys[] = 'suspended';
-            }
-            unset($all_keys); unset($key);
+            $updatekeys = $this->get_profile_keys();
 
         } else {
             print_string('noupdatestobedone', 'auth_ldap');
@@ -960,6 +944,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                     role_assign($creatorrole->id, $id, $sitecontext->id, $this->roleauth);
                 }
 
+                // Save custom profile fields.
+                $updatekeys = $this->get_profile_keys(true);
+                $this->update_user_record($user->username, $updatekeys, false);
             }
             $transaction->allow_commit();
             unset($add_users); // free mem
@@ -990,6 +977,8 @@ class auth_plugin_ldap extends auth_plugin_base {
     function update_user_record($username, $updatekeys = false, $triggerevent = false) {
         global $CFG, $DB;
 
+        require_once($CFG->dirroot.'/user/profile/lib.php');
+
         // Just in case check text case
         $username = trim(core_text::strtolower($username));
 
@@ -1004,6 +993,8 @@ class auth_plugin_ldap extends auth_plugin_base {
         // Protect the userid from being overwritten
         $userid = $user->id;
 
+        $needsupdate = false;
+
         if ($newinfo = $this->get_userinfo($username)) {
             $newinfo = truncate_userinfo($newinfo);
 
@@ -1016,6 +1007,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                 $newuser->id = $userid;
                 // The cast to int is a workaround for MDL-53959.
                 $newuser->suspended = (int)$this->is_user_suspended((object) $newinfo);
+                // Get all custom fields.
+                $profilefields = (array) profile_user_record($user->id, false);
+                $newprofilefields = [];
 
                 foreach ($updatekeys as $key) {
                     if (isset($newinfo[$key])) {
@@ -1025,18 +1019,50 @@ class auth_plugin_ldap extends auth_plugin_base {
                     }
 
                     if (!empty($this->config->{'field_updatelocal_' . $key})) {
-                        // Only update if it's changed.
-                        if ($user->{$key} != $value) {
+                        if (preg_match('/^profile_field_(.*)$/', $key, $match)) {
+                            // Custom field.
+                            $field = $match[1];
+                            $currentvalue = isset($profilefields[$field]) ? $profilefields[$field] : null;
+                            $newprofilefields[$field] = $value;
+                        } else {
+                            // Standard field.
+                            $currentvalue = isset($user->$key) ? $user->$key : null;
                             $newuser->$key = $value;
                         }
                     }
+
+                    // Only update if it's changed.
+                    if ($currentvalue !== $value) {
+                        $needsupdate = true;
+                    }
                 }
-                user_update_user($newuser, false, $triggerevent);
             }
-        } else {
-            return false;
+
+            if ($needsupdate) {
+                user_update_user($newuser, false, $triggerevent);
+
+                // Now, save the profile fields if the user has any.
+                if ($fields = $DB->get_records('user_info_field')) {
+                    foreach ($fields as $field) {
+                        if (isset($newprofilefields[$field->shortname])) {
+                            $conditions = array('fieldid' => $field->id, 'userid' => $newuser->id);
+                            $id = $DB->get_field('user_info_data', 'id', $conditions);
+                            $data = $newprofilefields[$field->shortname];
+                            if ($id) {
+                                $DB->set_field('user_info_data', 'data', $data, array('id' => $id));
+                            } else {
+                                $record = array('fieldid' => $field->id, 'userid' => $newuser->id, 'data' => $data);
+                                $DB->insert_record('user_info_data', $record);
+                            }
+                        }
+                    }
+                }
+
+                return $DB->get_record('user', array('id' => $userid, 'deleted' => 0));
+            }
         }
-        return $DB->get_record('user', array('id'=>$userid, 'deleted'=>0));
+
+        return false;
     }
 
     /**
@@ -1141,7 +1167,9 @@ class auth_plugin_ldap extends auth_plugin_base {
      *
      */
     function user_update($olduser, $newuser) {
-        global $USER;
+        global $CFG;
+
+        require_once($CFG->dirroot . '/user/profile/lib.php');
 
         if (isset($olduser->username) and isset($newuser->username) and $olduser->username != $newuser->username) {
             error_log($this->errorlogtag.get_string('renamingnotallowed', 'auth_ldap'));
@@ -1186,6 +1214,14 @@ class auth_plugin_ldap extends auth_plugin_base {
             return false;
         }
 
+        // Load old custom fields.
+        $olduserprofilefields = (array) profile_user_record($olduser->id, false);
+
+        $fields = array();
+        foreach (profile_get_custom_fields(false) as $field) {
+            $fields[$field->shortname] = $field;
+        }
+
         $success = true;
         $user_info_result = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);
         if ($user_info_result) {
@@ -1204,19 +1240,24 @@ class auth_plugin_ldap extends auth_plugin_base {
             $user_entry = $user_entry[0];
 
             foreach ($attrmap as $key => $ldapkeys) {
-                $profilefield = '';
-                // Only process if the moodle field ($key) has changed and we
-                // are set to update LDAP with it
-                $customprofilefield = 'profile_field_' . $key;
-                if (isset($olduser->$key) and isset($newuser->$key)
-                    and ($olduser->$key !== $newuser->$key)) {
-                    $profilefield = $key;
-                } else if (isset($olduser->$customprofilefield) && isset($newuser->$customprofilefield)
-                    && $olduser->$customprofilefield !== $newuser->$customprofilefield) {
-                    $profilefield = $customprofilefield;
+                if (preg_match('/^profile_field_(.*)$/', $key, $match)) {
+                    // Custom field.
+                    $fieldname = $match[1];
+                    if (isset($fields[$fieldname])) {
+                        $class = 'profile_field_' . $fields[$fieldname]->datatype;
+                        $formfield = new $class($fields[$fieldname]->id, $olduser->id);
+                        $oldvalue = isset($olduserprofilefields[$fieldname]) ? $olduserprofilefields[$fieldname] : null;
+                    } else {
+                        $oldvalue = null;
+                    }
+                    $newvalue = $formfield->edit_save_data_preprocess($newuser->{$formfield->inputname}, new stdClass);
+                } else {
+                    // Standard field.
+                    $oldvalue = isset($olduser->$key) ? $olduser->$key : null;
+                    $newvalue = isset($newuser->$key) ? $newuser->$key : null;
                 }
 
-                if (!empty($profilefield) && !empty($this->config->{'field_updateremote_' . $key})) {
+                if ($newvalue !== null and $newvalue !== $oldvalue and !empty($this->config->{'field_updateremote_' . $key})) {
                     // For ldap values that could be in more than one
                     // ldap key, we will do our best to match
                     // where they came from
@@ -1229,9 +1270,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                         $ambiguous = false;
                     }
 
-                    $nuvalue = core_text::convert($newuser->$profilefield, 'utf-8', $this->config->ldapencoding);
+                    $nuvalue = core_text::convert($newvalue, 'utf-8', $this->config->ldapencoding);
                     empty($nuvalue) ? $nuvalue = array() : $nuvalue;
-                    $ouvalue = core_text::convert($olduser->$profilefield, 'utf-8', $this->config->ldapencoding);
+                    $ouvalue = core_text::convert($oldvalue, 'utf-8', $this->config->ldapencoding);
 
                     foreach ($ldapkeys as $ldapkey) {
                         $ldapkey   = $ldapkey;
@@ -2151,4 +2192,30 @@ class auth_plugin_ldap extends auth_plugin_base {
             echo $OUTPUT->notification(get_string('ldapnotconfigured', 'auth_ldap'), \core\output\notification::NOTIFY_INFO);
         }
     }
+
+    /**
+     * Get the list of profile fields.
+     *
+     * @param   bool    $fetchall   Fetch all, not just those for update.
+     * @return  array
+     */
+    protected function get_profile_keys($fetchall = false) {
+        $keys = array_keys(get_object_vars($this->config));
+        $updatekeys = [];
+        foreach ($keys as $key) {
+            if (preg_match('/^field_updatelocal_(.+)$/', $key, $match)) {
+                // If we have a field to update it from and it must be updated 'onlogin' we update it on cron.
+                if (!empty($this->config->{'field_map_'.$match[1]})) {
+                    if ($fetchall || $this->config->{$match[0]} === 'onlogin') {
+                        array_push($updatekeys, $match[1]); // the actual key name
+                    }
+                }
+            }
+        }
+        if ($this->config->suspended_attribute && $this->config->sync_suspended) {
+            $updatekeys[] = 'suspended';
+        }
+
+        return $updatekeys;
+    }
 } // End of the class

auth/ldap/lang/en/auth_ldap.php

@@ -43,12 +43,12 @@ $string['auth_ldapdescription'] = 'This method provides authentication against a
                                   entry in its database. This module can read user attributes from LDAP and prefill
                                   wanted fields in Moodle.  For following logins only the username and
                                   password are checked.';
-$string['auth_ldap_expiration_desc'] = 'Select No to disable expired password checking or LDAP to read passwordexpiration time directly from LDAP';
-$string['auth_ldap_expiration_key'] = 'Expiration';
-$string['auth_ldap_expiration_warning_desc'] = 'Number of days before password expiration warning is issued.';
-$string['auth_ldap_expiration_warning_key'] = 'Expiration warning';
-$string['auth_ldap_expireattr_desc'] = 'Optional: Overrides the LDAP attribute that stores password expiration time.';
-$string['auth_ldap_expireattr_key'] = 'Expiration attribute';
+$string['auth_ldap_expiration_desc'] = 'Select \'{$a->no}\' to disable expired password checking or \'{$a->ldapserver}\' to read the password expiry time directly from the LDAP server.';
+$string['auth_ldap_expiration_key'] = 'Expiry';
+$string['auth_ldap_expiration_warning_desc'] = 'Number of days before password expiry warning is issued.';
+$string['auth_ldap_expiration_warning_key'] = 'Expiry warning';
+$string['auth_ldap_expireattr_desc'] = 'Optional: Overrides the LDAP attribute that stores password expiry time.';
+$string['auth_ldap_expireattr_key'] = 'Expiry attribute';
 $string['auth_ldapextrafields'] = 'These fields are optional.  You can choose to pre-fill some Moodle user fields with information from the <b>LDAP fields</b> that you specify here. <p>If you leave these fields blank, then nothing will be transferred from LDAP and Moodle defaults will be used instead.</p><p>In either case, the user will be able to edit all of these fields after they log in.</p>';
 $string['auth_ldap_graceattr_desc'] = 'Optional: Overrides  gracelogin attribute';
 $string['auth_ldap_gracelogin_key'] = 'Grace login attribute';
@@ -77,7 +77,7 @@ $string['auth_ldap_opt_deref'] = 'Determines how aliases are handled during sear
 $string['auth_ldap_opt_deref_key'] = 'Dereference aliases';
 $string['auth_ldap_passtype'] = 'Specify the format of new or changed passwords in LDAP server.';
 $string['auth_ldap_passtype_key'] = 'Password format';
-$string['auth_ldap_passwdexpire_settings'] = 'LDAP password expiration settings';
+$string['auth_ldap_passwdexpire_settings'] = 'LDAP password expiry settings';
 $string['auth_ldap_preventpassindb'] = 'Select yes to prevent passwords from being stored in Moodle\'s DB.';
 $string['auth_ldap_preventpassindb_key'] = 'Prevent password caching';
 $string['auth_ldap_search_sub'] = 'Search users from subcontexts.';
@@ -91,7 +91,7 @@ $string['auth_ldap_suspended_attribute'] = 'Optional: When provided this attribu
 $string['auth_ldap_suspended_attribute_key'] = 'Suspended attribute';
 $string['auth_ldap_user_exists'] = 'LDAP username already exists.';
 $string['auth_ldap_user_settings'] = 'User lookup settings';
-$string['auth_ldap_user_type'] = 'Select how users are stored in LDAP. This setting also specifies how login expiration, grace logins and user creation will work.';
+$string['auth_ldap_user_type'] = 'Select how users are stored in LDAP. This setting also specifies how login expiry, grace logins and user creation will work.';
 $string['auth_ldap_user_type_key'] = 'User type';
 $string['auth_ldap_usertypeundefined'] = 'config.user_type not defined or function ldap_expirationtime2unix does not support selected type!';
 $string['auth_ldap_usertypeundefined2'] = 'config.user_type not defined or function ldap_unixi2expirationtime does not support selected type!';
@@ -121,7 +121,7 @@ $string['didntgetusersfromldap'] = "Did not get any users from LDAP -- error? --
 $string['gotcountrecordsfromldap'] = "Got {\$a} records from LDAP\n";
 $string['ldapnotconfigured'] = 'The LDAP host url is currently not configured';
 $string['morethanoneuser'] = 'Strange! More than one user record found in ldap. Only using the first one.';
-$string['needbcmath'] = 'You need the BCMath extension to use grace logins with Active Directory';
+$string['needbcmath'] = 'You need the BCMath extension to use expired password checking with Active Directory.';
 $string['needmbstring'] = 'You need the mbstring extension to change passwords in Active Directory';
 $string['nodnforusername'] = 'Error in user_update_password(). No DN for: {$a->username}';
 $string['noemail'] = 'Tried to send you an email but failed!';
@@ -147,7 +147,7 @@ $string['start_tls_key'] = 'Use TLS';
 $string['updateremfail'] = 'Error updating LDAP record. Error code: {$a->errno}; Error string: {$a->errstring}<br/>Key ({$a->key}) - old moodle value: \'{$a->ouvalue}\' new value: \'{$a->nuvalue}\'';
 $string['updateremfailamb'] = 'Failed to update LDAP with ambiguous field {$a->key}; old moodle value: \'{$a->ouvalue}\', new value: \'{$a->nuvalue}\'';
 $string['updatepasserror'] = 'Error in user_update_password(). Error code: {$a->errno}; Error string: {$a->errstring}';
-$string['updatepasserrorexpire'] = 'Error in user_update_password() when reading password expiration time. Error code: {$a->errno}; Error string: {$a->errstring}';
+$string['updatepasserrorexpire'] = 'Error in user_update_password() when reading password expiry time. Error code: {$a->errno}; Error string: {$a->errstring}';
 $string['updatepasserrorexpiregrace'] = 'Error in user_update_password() when modifying expirationtime and/or gracelogins. Error code: {$a->errno}; Error string: {$a->errstring}';
 $string['updateusernotfound'] = 'Could not find user while updating externally. Details follow: search base: \'{$a->userdn}\'; search filter: \'(objectClass=*)\'; search attributes: {$a->attribs}';
 $string['user_activatenotsupportusertype'] = 'auth: ldap user_activate() does not support selected usertype: {$a}';

auth/ldap/settings.php

@@ -185,12 +185,24 @@ if ($ADMIN->fulltree) {
                 new lang_string('auth_ldap_passwdexpire_settings', 'auth_ldap'), ''));
 
         // Password Expiration.
+
+        // Create the description lang_string object.
+        $strno = get_string('no');
+        $strldapserver = get_string('pluginname', 'auth_ldap');
+        $langobject = new stdClass();
+        $langobject->no = $strno;
+        $langobject->ldapserver = $strldapserver;
+        $description = new lang_string('auth_ldap_expiration_desc', 'auth_ldap', $langobject);
+
+        // Now create the options.
         $expiration = array();
-        $expiration['0'] = 'no';
-        $expiration['1'] = 'LDAP';
+        $expiration['0'] = $strno;
+        $expiration['1'] = $strldapserver;
+
+        // Add the setting.
         $settings->add(new admin_setting_configselect('auth_ldap/expiration',
                 new lang_string('auth_ldap_expiration_key', 'auth_ldap'),
-                new lang_string('auth_ldap_expiration_desc', 'auth_ldap'), 0 , $expiration));
+                $description, 0 , $expiration));
 
         // Password Expiration warning.
         $settings->add(new admin_setting_configtext('auth_ldap/expiration_warning',

auth/oauth2/classes/auth.php

@@ -403,7 +403,20 @@ class auth extends \auth_plugin_base {
         if (!empty($linkedlogin) && empty($linkedlogin->get('confirmtoken'))) {
             $mappeduser = get_complete_user_data('id', $linkedlogin->get('userid'));
 
-            if ($mappeduser && $mappeduser->confirmed) {
+            if ($mappeduser && $mappeduser->suspended) {
+                $failurereason = AUTH_LOGIN_SUSPENDED;
+                $event = \core\event\user_login_failed::create([
+                    'userid' => $mappeduser->id,
+                    'other' => [
+                        'username' => $userinfo['username'],
+                        'reason' => $failurereason
+                    ]
+                ]);
+                $event->trigger();
+                $SESSION->loginerrormsg = get_string('invalidlogin');
+                $client->log_out();
+                redirect(new moodle_url('/login/index.php'));
+            } else if ($mappeduser && $mappeduser->confirmed) {
                 $userinfo = (array) $mappeduser;
                 $userwasmapped = true;
             } else {

auth/tests/behat/validateagedigitalconsentmap.feature

@@ -0,0 +1,68 @@
+@core @verify_age_location
+Feature: Test validation of 'Age of digital consent' setting.
+  In order to set the 'Age of digital consent' setting
+  As an admin
+  I need to provide valid data and valid format
+
+  Background:
+    Given I log in as "admin"
+    And I navigate to "Privacy settings" node in "Site administration > Privacy and policies"
+
+  Scenario: Admin provides valid value for 'Age of digital consent'.
+    Given I set the field "s__agedigitalconsentmap" to multiline:
+    """
+    *, 16
+    AT, 14
+    BE, 14
+    """
+    When I press "Save changes"
+    Then I should see "Changes saved"
+    And I should not see "Some settings were not changed due to an error."
+    And I should not see "The digital age of consent is not valid:"
+
+  Scenario: Admin provides invalid format for 'Age of digital consent'.
+    # Try to set a value with missing space separator
+    Given I set the field "s__agedigitalconsentmap" to multiline:
+    """
+    *16
+    AT, 14
+    BE, 14
+    """
+    When I press "Save changes"
+    Then I should not see "Changes saved"
+    And I should see "Some settings were not changed due to an error."
+    And I should see "The digital age of consent is not valid: \"*16\" has more or less than one comma separator."
+    # Try to set a value with missing default age of consent
+    When I set the field "s__agedigitalconsentmap" to multiline:
+    """
+    AT, 14
+    BE, 14
+    """
+    And I press "Save changes"
+    Then I should not see "Changes saved"
+    And I should see "Some settings were not changed due to an error."
+    And I should see "The digital age of consent is not valid: Default (*) value is missing."
+
+  Scenario: Admin provides invalid age of consent or country for 'Age of digital consent'.
+    # Try to set a value containing invalid age of consent
+    Given I set the field "s__agedigitalconsentmap" to multiline:
+    """
+    *, 16
+    AT, age
+    BE, 14
+    """
+    When I press "Save changes"
+    Then I should not see "Changes saved"
+    And I should see "Some settings were not changed due to an error."
+    And I should see "The digital age of consent is not valid: \"age\" is not a valid value for age."
+    # Try to set a value containing invalid country
+    When I set the field "s__agedigitalconsentmap" to multiline:
+    """
+    *, 16
+    COUNTRY, 14
+    BE, 14
+    """
+    And I press "Save changes"
+    Then I should not see "Changes saved"
+    And I should see "Some settings were not changed due to an error."
+    And I should see "The digital age of consent is not valid: \"COUNTRY\" is not a valid value for country."

auth/tests/behat/verifyageofconsent.feature

@@ -0,0 +1,45 @@
+@core @verify_age_location
+Feature: Test the 'Digital age of consent verification' feature works.
+  In order to self-register on the site
+  As an user
+  I need be to be over the age of digital consent
+
+  Background:
+    Given the following config values are set as admin:
+      | registerauth | email |
+      | agedigitalconsentverification | 1 |
+
+  Scenario: User that is not considered a digital minor attempts to self-register on the site.
+    # Try to access the sign up page.
+    Given I am on homepage
+    When I click on "Log in" "link" in the ".logininfo" "css_element"
+    And I press "Create new account"
+    Then I should see "Age and location verification"
+    When I set the field "What is your age?" to "16"
+    And I set the field "In which country do you live?" to "DZ"
+    And I press "Proceed"
+    Then I should see "New account"
+    And I should see "Choose your username and password"
+    # Try to access the sign up page again.
+    When I press "Cancel"
+    And I press "Create new account"
+    Then I should see "New account"
+    And I should see "Choose your username and password"
+
+  Scenario: User that is considered a digital minor attempts to self-register on the site.
+    # Try to access the sign up page.
+    Given I am on homepage
+    When I click on "Log in" "link" in the ".logininfo" "css_element"
+    And I press "Create new account"
+    Then I should see "Age and location verification"
+    When I set the field "What is your age?" to "12"
+    And I set the field "In which country do you live?" to "AT"
+    And I press "Proceed"
+    Then I should see "You are considered to be a digital minor."
+    And I should see "To create an account on this site please have your parent/guardian contact the following person."
+    # Try to access the sign up page again.
+    When I click on "Back to the site home" "link"
+    And I click on "Log in" "link" in the ".logininfo" "css_element"
+    And I press "Create new account"
+    Then I should see "You are considered to be a digital minor."
+    And I should see "To create an account on this site please have your parent/guardian contact the following person."

auth/tests/digital_consent_test.php

@@ -0,0 +1,182 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Unit tests for core_auth\digital_consent.
+ *
+ * @package    core_auth
+ * @copyright  2018 Mihail Geshoski
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+/**
+ * Digital consent helper testcase.
+ *
+ * @package    core_auth
+ * @copyright  2018 Mihail Geshoski
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class core_auth_digital_consent_testcase extends advanced_testcase {
+
+    public function test_is_age_digital_consent_verification_enabled() {
+        global $CFG;
+        $this->resetAfterTest();
+
+        // Age of digital consent verification is enabled.
+        $CFG->agedigitalconsentverification = 0;
+
+        $isenabled = \core_auth\digital_consent::is_age_digital_consent_verification_enabled();
+        $this->assertFalse($isenabled);
+    }
+
+    public function test_is_minor() {
+        global $CFG;
+        $this->resetAfterTest();
+
+        $agedigitalconsentmap = implode(PHP_EOL, [
+            '*, 16',
+            'AT, 14',
+            'CZ, 13',
+            'DE, 14',
+            'DK, 13',
+        ]);
+        $CFG->agedigitalconsentmap = $agedigitalconsentmap;
+
+        $usercountry1 = 'DK';
+        $usercountry2 = 'AU';
+        $userage1 = 12;
+        $userage2 = 14;
+        $userage3 = 16;
+
+        // Test country exists in agedigitalconsentmap and user age is below the particular digital minor age.
+        $isminor = \core_auth\digital_consent::is_minor($userage1, $usercountry1);
+        $this->assertTrue($isminor);
+        // Test country exists in agedigitalconsentmap and user age is above the particular digital minor age.
+        $isminor = \core_auth\digital_consent::is_minor($userage2, $usercountry1);
+        $this->assertFalse($isminor);
+        // Test country does not exists in agedigitalconsentmap and user age is below the particular digital minor age.
+        $isminor = \core_auth\digital_consent::is_minor($userage2, $usercountry2);
+        $this->assertTrue($isminor);
+        // Test country does not exists in agedigitalconsentmap and user age is above the particular digital minor age.
+        $isminor = \core_auth\digital_consent::is_minor($userage3, $usercountry2);
+        $this->assertFalse($isminor);
+    }
+
+    public function test_parse_age_digital_consent_map_valid_format() {
+
+        // Value of agedigitalconsentmap has a valid format.
+        $agedigitalconsentmap = implode(PHP_EOL, [
+            '*, 16',
+            'AT, 14',
+            'BE, 13'
+        ]);
+
+        $ageconsentmapparsed = \core_auth\digital_consent::parse_age_digital_consent_map($agedigitalconsentmap);
+
+        $this->assertEquals([
+            '*' => 16,
+            'AT' => 14,
+            'BE' => 13
+        ], $ageconsentmapparsed
+        );
+    }
+
+    public function test_parse_age_digital_consent_map_invalid_format_missing_spaces() {
+
+        // Value of agedigitalconsentmap has an invalid format (missing space separator between values).
+        $agedigitalconsentmap = implode(PHP_EOL, [
+            '*, 16',
+            'AT14',
+        ]);
+
+        $this->expectException('moodle_exception');
+        $this->expectExceptionMessage(get_string('agedigitalconsentmapinvalidcomma', 'error', 'AT14'));
+
+        \core_auth\digital_consent::parse_age_digital_consent_map($agedigitalconsentmap);
+    }
+
+    public function test_parse_age_digital_consent_map_invalid_format_missing_default_value() {
+
+        // Value of agedigitalconsentmap has an invalid format (missing default value).
+        $agedigitalconsentmap = implode(PHP_EOL, [
+            'BE, 16',
+            'AT, 14'
+        ]);
+
+        $this->expectException('moodle_exception');
+        $this->expectExceptionMessage(get_string('agedigitalconsentmapinvaliddefault', 'error'));
+
+        \core_auth\digital_consent::parse_age_digital_consent_map($agedigitalconsentmap);
+    }
+
+    public function test_parse_age_digital_consent_map_invalid_format_invalid_country() {
+
+        // Value of agedigitalconsentmap has an invalid format (invalid value for country).
+        $agedigitalconsentmap = implode(PHP_EOL, [
+            '*, 16',
+            'TEST, 14'
+        ]);
+
+        $this->expectException('moodle_exception');
+        $this->expectExceptionMessage(get_string('agedigitalconsentmapinvalidcountry', 'error', 'TEST'));
+
+        \core_auth\digital_consent::parse_age_digital_consent_map($agedigitalconsentmap);
+    }
+
+    public function test_parse_age_digital_consent_map_invalid_format_invalid_age_string() {
+
+        // Value of agedigitalconsentmap has an invalid format (string value for age).
+        $agedigitalconsentmap = implode(PHP_EOL, [
+            '*, 16',
+            'AT, ten'
+        ]);
+
+        $this->expectException('moodle_exception');
+        $this->expectExceptionMessage(get_string('agedigitalconsentmapinvalidage', 'error', 'ten'));
+
+        \core_auth\digital_consent::parse_age_digital_consent_map($agedigitalconsentmap);
+    }
+
+    public function test_parse_age_digital_consent_map_invalid_format_missing_age() {
+
+        // Value of agedigitalconsentmap has an invalid format (missing value for age).
+        $agedigitalconsentmap = implode(PHP_EOL, [
+            '*, 16',
+            'AT, '
+        ]);
+
+        $this->expectException('moodle_exception');
+        $this->expectExceptionMessage(get_string('agedigitalconsentmapinvalidage', 'error', ''));
+
+        \core_auth\digital_consent::parse_age_digital_consent_map($agedigitalconsentmap);
+    }
+
+    public function test_parse_age_digital_consent_map_invalid_format_missing_country() {
+
+        // Value of agedigitalconsentmap has an invalid format (missing value for country).
+        $agedigitalconsentmap = implode(PHP_EOL, [
+            '*, 16',
+            ', 12'
+        ]);
+
+        $this->expectException('moodle_exception');
+        $this->expectExceptionMessage(get_string('agedigitalconsentmapinvalidcountry', 'error', ''));
+
+        \core_auth\digital_consent::parse_age_digital_consent_map($agedigitalconsentmap);
+    }
+}

auth/tests/external_test.php

@@ -89,4 +89,30 @@ class core_auth_external_testcase extends externallib_advanced_testcase {
         $this->expectExceptionMessage(get_string('invalidconfirmdata', 'error'));
         $result = core_auth_external::confirm_user($username, 'zzZZzz');
     }
+
+    /**
+     * Test age digital consent not enabled.
+     */
+    public function test_age_digital_consent_verification_is_not_enabled() {
+        global $CFG;
+
+        $CFG->agedigitalconsentverification = 0;
+        $result = core_auth_external::is_age_digital_consent_verification_enabled();
+        $result = external_api::clean_returnvalue(
+            core_auth_external::is_age_digital_consent_verification_enabled_returns(), $result);
+        $this->assertFalse($result['status']);
+    }
+
+    /**
+     * Test age digital consent is enabled.
+     */
+    public function test_age_digital_consent_verification_is_enabled() {
+        global $CFG;
+
+        $CFG->agedigitalconsentverification = 1;
+        $result = core_auth_external::is_age_digital_consent_verification_enabled();
+        $result = external_api::clean_returnvalue(
+            core_auth_external::is_age_digital_consent_verification_enabled_returns(), $result);
+        $this->assertTrue($result['status']);
+    }
 }

auth/upgrade.txt

@@ -1,6 +1,11 @@
 This files describes API changes in /auth/* - plugins,
 information provided here is intended especially for developers.
 
+=== 3.3.5 ===
+
+* Self registration plugins should use core_privacy\local\sitepolicy\manager instead of directly checking
+  $CFG->sitepolicy , especially in custom signup forms. See https://docs.moodle.org/dev/Site_policy_handler
+
 === 3.3 ===
 
 * Authentication plugins have been migrated to use the admin settings API.  Plugins should use a settings.php file to

backup/backup.class.php

@@ -141,6 +141,15 @@ abstract class backup implements checksumable {
      * Usually same than major release zero version, mainly for informative/historic purposes.
      */
     const RELEASE = '3.3';
+
+    /**
+     * Cipher to be used in backup and restore operations.
+     */
+    const CIPHER = 'aes-256-cbc';
+    /**
+     * Bytes enforced for key, using the cypher above. Restrictive? Yes, but better than unsafe lengths
+     */
+    const CIPHERKEYLEN = 32;
 }
 
 /*

backup/cc/entity.forum.class.php

@@ -112,7 +112,7 @@ class cc_forum extends entities {
 
     public function get_topic_data ($instance) {
 
-        $topic_data = '';
+        $topic_data = array();
 
         $topic_file = $this->get_external_xml($instance['resource_indentifier']);
 

backup/cc/entity.quiz.class.php

@@ -68,7 +68,7 @@ class cc_quiz extends entities {
         $last_question_id = 0;
         $last_answer_id = 0;
 
-        $instances = '';
+        $instances = array();
 
         $types = array(MOODLE_TYPE_QUIZ, MOODLE_TYPE_QUESTION_BANK);
 

backup/cc/entity11.basiclti.class.php

@@ -87,7 +87,7 @@ class cc11_basiclti extends entities11 {
 
     public function get_basiclti_data($instance) {
 
-        $topic_data = '';
+        $topic_data = array();
 
         $basiclti_file = $this->get_external_xml($instance['resource_indentifier']);
 

backup/cc/entity11.forum.class.php

@@ -111,7 +111,7 @@ class cc11_forum extends entities11 {
 
     public function get_topic_data ($instance) {
 
-        $topic_data = '';
+        $topic_data = array();
 
         $topic_file = $this->get_external_xml($instance['resource_indentifier']);
 

backup/cc/entity11.lti.class.php

@@ -82,7 +82,7 @@ class cc11_lti extends entities11 {
 
     public function get_basiclti_data($instance) {
 
-        $topic_data = '';
+        $topic_data = array();
 
         $basiclti_file = $this->get_external_xml($instance['resource_indentifier']);
 

backup/cc/entity11.quiz.class.php

@@ -68,7 +68,7 @@ class cc11_quiz extends entities11 {
         $last_question_id = 0;
         $last_answer_id = 0;
 
-        $instances = '';
+        $instances = array();
 
         $types = array(MOODLE_TYPE_QUIZ, MOODLE_TYPE_QUESTION_BANK);
 

backup/cc/entity11.resource.class.php

@@ -99,7 +99,7 @@ class cc11_resource extends entities11 {
                                 $link = 'http://invalidurldetected/';
                             }
                         } else {
-                            $link = $rawlink;
+                            $link = htmlspecialchars(trim($rawlink), ENT_COMPAT, 'UTF-8', false);
                         }
                     }
                 }

backup/moodle2/backup_custom_fields.php

@@ -97,6 +97,138 @@ class base64_encode_final_element extends backup_final_element {
     }
 }
 
+/**
+ * Implementation of {@link backup_final_element} that provides symmetric-key AES-256 encryption of contents.
+ *
+ * This final element transparently encrypts, for secure storage and transport, any content
+ * that shouldn't be shown normally in plain text. Usually, passwords or keys that cannot use
+ * hashing algorithms, although potentially can encrypt any content. All information is encoded
+ * using base64.
+ *
+ * Features:
+ *   - requires openssl extension to work. Without it contents are completely omitted.
+ *   - automatically creates an appropriate default key for the site and stores it into backup_encryptkey config (bas64 encoded).
+ *   - uses a different appropriate init vector for every operation, which is transmited with the encrypted contents.
+ *   - all generated data is base64 encoded for safe transmission.
+ *   - automatically adds "encrypted" attribute for easier detection.
+ *   - implements HMAC for providing integrity.
+ *
+ * @copyright 2017 onwards Eloy Lafuente (stronk7) {@link http://stronk7.com}
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class encrypted_final_element extends backup_final_element {
+
+    /** @var string cypher appropiate raw key for backups in the site. Defaults to backup_encryptkey config. */
+    protected $key = null;
+
+    /**
+     * Constructor - instantiates a encrypted_final_element, specifying its basic info.
+     *
+     * Overridden to automatically add the 'encrypted' attribute if missing.
+     *
+     * @param string $name name of the element
+     * @param array  $attributes attributes this element will handle (optional, defaults to null)
+     */
+    public function __construct($name, $attributes = null) {
+        parent::__construct($name, $attributes);
+        if (! $this->get_attribute('encrypted')) {
+            $this->add_attributes('encrypted');
+        }
+    }
+
+    /**
+     * Set the encryption key manually, overriding default backup_encryptkey config.
+     *
+     * @param string $key key to be used for encrypting. Required to be 256-bit key.
+     *               Use a safe generation technique. See self::generate_encryption_random_key() below.
+     */
+    protected function set_key($key) {
+        $bytes = strlen($key); // Get key length in bytes.
+
+        // Only accept keys with the expected (backup::CIPHERKEYLEN) key length. There are a number of hashing,
+        // random generators to achieve this esasily, like the one shown below to create the default
+        // site encryption key and ivs.
+        if ($bytes !== backup::CIPHERKEYLEN) {
+            $info = (object)array('expected' => backup::CIPHERKEYLEN, 'found' => $bytes);
+            throw new base_element_struct_exception('encrypted_final_element incorrect key length', $info);
+        }
+        // Everything went ok, store the key.
+        $this->key = $key;
+    }
+
+    /**
+     * Set the value of the field.
+     *
+     * This method sets the value of the element, encrypted using the specified key for it,
+     * defaulting to (and generating) backup_encryptkey config. HMAC is used for integrity.
+     *
+     * @param string $value plain-text content the will be stored encrypted and encoded.
+     */
+    public function set_value($value) {
+
+        // No openssl available, skip this field completely.
+        if (!function_exists('openssl_encrypt')) {
+            return;
+        }
+
+        // No hmac available, skip this field completely.
+        if (!function_exists('hash_hmac')) {
+            return;
+        }
+
+        // Cypher not available, skip this field completely.
+        if (!in_array(backup::CIPHER, openssl_get_cipher_methods())) {
+            return;
+        }
+
+        // Ensure we have a good key, manual or default.
+        if (empty($this->key)) {
+            // The key has not been set manually, look for it at config (base64 encoded there).
+            $enckey = get_config('backup', 'backup_encryptkey');
+            if ($enckey === false) {
+                // Has not been set, calculate and save an appropiate random key automatically.
+                $enckey = base64_encode(self::generate_encryption_random_key(backup::CIPHERKEYLEN));
+                set_config('backup_encryptkey', $enckey, 'backup');
+            }
+            $this->set_key(base64_decode($enckey));
+        }
+
+        // Now we need an iv for this operation.
+        $iv = self::generate_encryption_random_key(openssl_cipher_iv_length(backup::CIPHER));
+
+        // Everything is ready, let's encrypt and prepend the 1-shot iv.
+        $value = $iv . openssl_encrypt($value, backup::CIPHER, $this->key, OPENSSL_RAW_DATA, $iv);
+
+        // Calculate the hmac of the value (iv + encrypted) and prepend it.
+        $hmac = hash_hmac('sha256', $value, $this->key, true);
+        $value = $hmac . $value;
+
+        // Ready, set the encoded value.
+        parent::set_value(base64_encode($value));
+
+        // Finally, if the field has an "encrypted" attribute, set it to true.
+        if ($att = $this->get_attribute('encrypted')) {
+            $att->set_value('true');
+        }
+    }
+
+    /**
+     * Generate an appropiate random key to be used for encrypting backup information.
+     *
+     * Normally used as site default encryption key (backup_encryptkey config) and also
+     * for calculating the init vectors.
+     *
+     * Note that until PHP 5.6.12 openssl_random_pseudo_bytes() did NOT
+     * use a "cryptographically strong algorithm" {@link https://bugs.php.net/bug.php?id=70014}
+     * But it's beyond my crypto-knowledge when it's worth finding a *real* better alternative.
+     *
+     * @param int $bytes Number of bytes to determine the key length expected.
+     */
+    protected static function generate_encryption_random_key($bytes) {
+        return openssl_random_pseudo_bytes($bytes);
+    }
+}
+
 /**
  * Implementation of backup_nested_element that provides special handling of files
  *

backup/moodle2/backup_stepslib.php

@@ -529,7 +529,7 @@ class backup_enrolments_structure_step extends backup_structure_step {
         $enrol->annotate_ids('role', 'roleid');
 
         // Add enrol plugin structure.
-        $this->add_plugin_structure('enrol', $enrol, false);
+        $this->add_plugin_structure('enrol', $enrol, true);
 
         return $enrolments;
     }

backup/moodle2/tests/backup_encrypted_content_test.php

@@ -0,0 +1,116 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Tests for the handling of encrypted contents in backup and restore.
+ *
+ * @package core_backup
+ * @copyright 2016 onwards Eloy Lafuente (stronk7) {@link http://stronk7.com}
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+global $CFG;
+require_once($CFG->dirroot . '/backup/util/includes/backup_includes.php');
+require_once($CFG->dirroot . '/backup/util/includes/restore_includes.php');
+require_once($CFG->dirroot . '/backup/moodle2/backup_custom_fields.php');
+
+class core_backup_encrypted_content_testscase extends advanced_testcase {
+
+    public function setUp() {
+        if (!function_exists('openssl_encrypt')) {
+            $this->markTestSkipped('OpenSSL extension is not loaded.');
+
+        } else if (!function_exists('hash_hmac')) {
+            $this->markTestSkipped('Hash extension is not loaded.');
+
+        } else if (!in_array(backup::CIPHER, openssl_get_cipher_methods())) {
+            $this->markTestSkipped('Expected cipher not available: ' . backup::CIPHER);
+        }
+    }
+
+    public function test_encrypted_final_element() {
+
+        $this->resetAfterTest(true);
+
+        // Some basic verifications.
+        $efe = new encrypted_final_element('test', array('encrypted'));
+        $this->assertInstanceOf('encrypted_final_element', $efe);
+        $this->assertSame('test', $efe->get_name());
+        $atts = $efe->get_attributes();
+        $this->assertCount(1, $atts);
+        $att = reset($atts);
+        $this->assertInstanceOf('backup_attribute', $att);
+        $this->assertSame('encrypted', $att->get_name());
+
+        // Using a manually defined (incorrect length) key.
+        $efe = new encrypted_final_element('test', array('encrypted'));
+        $key = 'this_in_not_correct_32_byte_key';
+        try {
+            set_config('backup_encryptkey', base64_encode($key), 'backup');
+            $efe->set_value('tiny_secret');
+            $this->fail('Expecting base_element_struct_exception exception, none happened');
+        } catch (exception $e) {
+            $this->assertInstanceOf('base_element_struct_exception', $e);
+            $this->assertEquals('encrypted_final_element incorrect key length', $e->errorcode);
+
+        }
+
+        // Using a manually defined (correct length) key.
+        $efe = new encrypted_final_element('test', array('testattr', 'encrypted'));
+        $key = hash('md5', 'Moodle rocks and this is not secure key, who cares, it is a test');
+        set_config('backup_encryptkey', base64_encode($key), 'backup');
+        $this->assertEmpty($efe->get_value());
+        $secret = 'This is a secret message that nobody else will be able to read but me 💩 ';
+        $efe->set_value($secret);
+        $atts = $efe->get_attributes();
+        $this->assertCount(2, $atts);
+        $this->assertArrayHasKey('encrypted', $atts); // We added it explicitly.
+        $this->assertTrue($atts['encrypted']->is_set());
+        $this->assertSame('true', $atts['encrypted']->get_value());
+        $this->assertNotEmpty($efe->get_value());
+        $this->assertTrue($efe->is_set());
+        // Get the crypted content and decrypt it manually.
+        $ctext = $efe->get_value();
+        $hmaclen = 32; // SHA256 is 32 bytes.
+        $ivlen = openssl_cipher_iv_length(backup::CIPHER);
+        list($hmac, $iv, $text) = array_values(unpack("a{$hmaclen}hmac/a{$ivlen}iv/a*text", base64_decode($ctext)));
+        $this->assertSame(hash_hmac('sha256', $iv . $text, $key, true), $hmac);
+        $this->assertSame($secret, openssl_decrypt($text, backup::CIPHER, $key, OPENSSL_RAW_DATA, $iv));
+
+        // Using the default site-generated key.
+        $efe = new encrypted_final_element('test', array('testattr'));
+        $this->assertEmpty($efe->get_value());
+        $secret = 'This is a secret message that nobody else will be able to read but me 💩 ';
+        $efe->set_value($secret);
+        $atts = $efe->get_attributes();
+        $this->assertCount(2, $atts);
+        $this->assertArrayHasKey('encrypted', $atts); // Was added automatcally, we did not specify it.
+        $this->assertTrue($atts['encrypted']->is_set());
+        $this->assertSame('true', $atts['encrypted']->get_value());
+        $this->assertNotEmpty($efe->get_value());
+        $this->assertTrue($efe->is_set());
+        // Get the crypted content and decrypt it manually.
+        $ctext = $efe->get_value();
+        $hmaclen = 32; // SHA256 is 32 bytes.
+        $ivlen = openssl_cipher_iv_length(backup::CIPHER);
+        list($hmac, $iv, $text) = array_values(unpack("a{$hmaclen}hmac/a{$ivlen}iv/a*text", base64_decode($ctext)));
+        $key = base64_decode(get_config('backup', 'backup_encryptkey'));
+        $this->assertSame(hash_hmac('sha256', $iv . $text, $key, true), $hmac);
+        $this->assertSame($secret, openssl_decrypt($text, backup::CIPHER, $key, OPENSSL_RAW_DATA, $iv));
+    }
+}

backup/util/plan/restore_step.class.php

@@ -94,6 +94,66 @@ abstract class restore_step extends base_step {
         // Return the passed value with cached offset applied.
         return $value + $cache[$this->get_restoreid()];
     }
+
+    /**
+     * Returns symmetric-key AES-256 decryption of base64 encoded contents.
+     *
+     * This method is used in restore operations to decrypt contents encrypted with
+     * {@link encrypted_final_element} automatically decoding (base64) and decrypting
+     * contents using the key stored in backup_encryptkey config.
+     *
+     * Requires openssl, cipher availability, and key existence (backup
+     * automatically sets it if missing). Integrity is provided via HMAC.
+     *
+     * @param string $value {@link encrypted_final_element} value to decode and decrypt.
+     * @return string|null decoded and decrypted value or null if the operation can not be performed.
+     */
+    public function decrypt($value) {
+
+        // No openssl available, skip this field completely.
+        if (!function_exists('openssl_encrypt')) {
+            return null;
+        }
+
+        // No hash available, skip this field completely.
+        if (!function_exists('hash_hmac')) {
+            return null;
+        }
+
+        // Cypher not available, skip this field completely.
+        if (!in_array(backup::CIPHER, openssl_get_cipher_methods())) {
+            return null;
+        }
+
+        // Get the decrypt key. Skip if missing.
+        $key = get_config('backup', 'backup_encryptkey');
+        if ($key === false) {
+            return null;
+        }
+
+        // And decode it.
+        $key = base64_decode($key);
+
+        // Arrived here, let's proceed with authentication (provides integrity).
+        $hmaclen = 32; // SHA256 is 32 bytes.
+        $ivlen = openssl_cipher_iv_length(backup::CIPHER);
+        list($hmac, $iv, $text) = array_values(unpack("a{$hmaclen}hmac/a{$ivlen}iv/a*text", base64_decode($value)));
+
+        // Verify HMAC matches expectations, skip if not (integrity failed).
+        if (!hash_equals($hmac, hash_hmac('sha256', $iv . $text, $key, true))) {
+            return null;
+        }
+
+        // Arrived here, integrity is ok, let's decrypt.
+        $result = openssl_decrypt($text, backup::CIPHER, $key, OPENSSL_RAW_DATA, $iv);
+
+        // For some reason decrypt failed (strange, HMAC check should have deteted it), skip this field completely.
+        if ($result === false) {
+            return null;
+        }
+
+        return $result;
+    }
 }
 
 /*

backup/util/plan/tests/step_test.php

@@ -91,6 +91,52 @@ class backup_step_testcase extends advanced_testcase {
         $bc->destroy();
     }
 
+    /**
+     * test restore_step class, decrypt method
+     */
+    public function test_restore_step_decrypt() {
+
+        $this->resetAfterTest(true);
+
+        if (!function_exists('openssl_encrypt')) {
+            $this->markTestSkipped('OpenSSL extension is not loaded.');
+
+        } else if (!function_exists('hash_hmac')) {
+            $this->markTestSkipped('Hash extension is not loaded.');
+
+        } else if (!in_array(backup::CIPHER, openssl_get_cipher_methods())) {
+            $this->markTestSkipped('Expected cipher not available: ' . backup::CIPHER);
+        }
+
+        $bt = new mock_restore_task_basepath('taskname');
+        $bs = new mock_restore_structure_step('steptest', null, $bt);
+        $this->assertTrue(method_exists($bs, 'decrypt'));
+
+        // Let's prepare a string for being decrypted.
+        $secret = 'This is a secret message that nobody else will be able to read but me 💩  ';
+        $key = hash('md5', 'Moodle rocks and this is not secure key, who cares, it is a test');
+        $iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length(backup::CIPHER));
+        $message = $iv . openssl_encrypt($secret, backup::CIPHER, $key, OPENSSL_RAW_DATA, $iv);
+        $hmac = hash_hmac('sha256', $message, $key, true);
+        $crypt = base64_encode($hmac . $message);
+
+        // Running it without a key configured, returns null.
+        $this->assertNull($bs->decrypt($crypt));
+
+        // Store the key into config.
+        set_config('backup_encryptkey', base64_encode($key), 'backup');
+
+        // Verify decrypt works and returns original.
+        $this->assertSame($secret, $bs->decrypt($crypt));
+
+        // Finally, test the integrity failure detection is working.
+        // (this can be caused by changed hmac, key or message, in
+        // this case we are just forcing it via changed hmac).
+        $hmac = md5($message);
+        $crypt = base64_encode($hmac . $message);
+        $this->assertNull($bs->decrypt($crypt));
+    }
+
     /**
      * test backup_structure_step class
      */

backup/util/settings/base_setting.class.php

@@ -65,6 +65,7 @@ abstract class base_setting {
 
     protected $name;  // name of the setting
     protected $value; // value of the setting
+    protected $unlockedvalue; // Value to set after the setting is unlocked.
     protected $vtype; // type of value (setting_base::IS_BOOLEAN/setting_base::IS_INTEGER...)
 
     protected $visibility; // visibility of the setting (setting_base::VISIBLE/setting_base::HIDDEN)
@@ -118,6 +119,7 @@ abstract class base_setting {
         $this->value       = $value;
         $this->visibility  = $visibility;
         $this->status      = $status;
+        $this->unlockedvalue = $this->value;
 
         // Generate a default ui
         $this->uisetting = new base_setting_ui($this);
@@ -225,6 +227,11 @@ abstract class base_setting {
         $this->status = $status;
         if ($status !== $oldstatus) { // Status has changed, let's inform dependencies
             $this->inform_dependencies(self::CHANGED_STATUS, $oldstatus);
+
+            if ($status == base_setting::NOT_LOCKED) {
+                // When setting gets unlocked set it to the original value.
+                $this->set_value($this->unlockedvalue);
+            }
         }
     }
 

backup/util/settings/setting_dependency.class.php

@@ -153,7 +153,7 @@ abstract class setting_dependency {
      */
     abstract public function get_moodleform_properties();
     /**
-     * Returns true if the dependent setting is locked.
+     * Returns true if the dependent setting is locked by this setting_dependency.
      * @return bool
      */
     abstract public function is_locked();
@@ -185,7 +185,7 @@ class setting_dependency_disabledif_equals extends setting_dependency {
         $this->value = ($value)?(string)$value:0;
     }
     /**
-     * Returns true if the dependent setting is locked.
+     * Returns true if the dependent setting is locked by this setting_dependency.
      * @return bool
      */
     public function is_locked() {
@@ -193,8 +193,8 @@ class setting_dependency_disabledif_equals extends setting_dependency {
         if ($this->setting->get_status() !== base_setting::NOT_LOCKED || $this->setting->get_value() == $this->value) {
             return true;
         }
-        // Else return based upon the dependent settings status
-        return ($this->dependentsetting->get_status() !== base_setting::NOT_LOCKED);
+        // Else the dependent setting is not locked by this setting_dependency.
+        return false;
     }
     /**
      * Processes a value change in the primary setting
@@ -343,7 +343,7 @@ class setting_dependency_disabledif_equals2 extends setting_dependency {
         $this->value = $value;
     }
     /**
-     * Returns true if the dependent setting is locked.
+     * Returns true if the dependent setting is locked by this setting_dependency.
      * @return bool
      */
     public function is_locked() {
@@ -351,8 +351,8 @@ class setting_dependency_disabledif_equals2 extends setting_dependency {
         if ($this->setting->get_status() !== base_setting::NOT_LOCKED || in_array($this->setting->get_value(), $this->value)) {
             return true;
         }
-        // Else return based upon the dependent settings status
-        return ($this->dependentsetting->get_status() !== base_setting::NOT_LOCKED);
+        // Else the dependent setting is not locked by this setting_dependency.
+        return false;
     }
     /**
      * Processes a value change in the primary setting
@@ -537,7 +537,7 @@ class setting_dependency_disabledif_not_empty extends setting_dependency_disable
     }
 
     /**
-     * Returns true if the dependent setting is locked.
+     * Returns true if the dependent setting is locked by this setting_dependency.
      * @return bool
      */
     public function is_locked() {
@@ -545,8 +545,8 @@ class setting_dependency_disabledif_not_empty extends setting_dependency_disable
         if ($this->setting->get_status() !== base_setting::NOT_LOCKED || !empty($value)) {
             return true;
         }
-        // Else return based upon the dependent settings status
-        return ($this->dependentsetting->get_status() !== base_setting::NOT_LOCKED);
+        // Else the dependent setting is not locked by this setting_dependency.
+        return false;
     }
 }
 
@@ -601,7 +601,7 @@ class setting_dependency_disabledif_empty extends setting_dependency_disabledif_
         return ($prevalue != $this->dependentsetting->get_value());
     }
     /**
-     * Returns true if the dependent setting is locked.
+     * Returns true if the dependent setting is locked by this setting_dependency.
      * @return bool
      */
     public function is_locked() {
@@ -609,7 +609,7 @@ class setting_dependency_disabledif_empty extends setting_dependency_disabledif_
         if ($this->setting->get_status() !== base_setting::NOT_LOCKED || empty($value)) {
             return true;
         }
-        // Else return based upon the dependent settings status
-        return ($this->dependentsetting->get_status() !== base_setting::NOT_LOCKED);
+        // Else the dependent setting is not locked by this setting_dependency.
+        return false;
     }
 }

backup/util/ui/backup_moodleform.class.php

@@ -122,6 +122,8 @@ class backup_confirmation_form extends backup_moodleform {
         if (!array_key_exists('setting_root_filename', $errors)) {
             if (trim($data['setting_root_filename']) == '') {
                 $errors['setting_root_filename'] = get_string('errorfilenamerequired', 'backup');
+            } else if (strlen(trim($data['setting_root_filename'])) > 255) {
+                $errors['setting_root_filename'] = get_string('errorfilenametoolong', 'backup');
             } else if (!preg_match('#\.mbz$#i', $data['setting_root_filename'])) {
                 $errors['setting_root_filename'] = get_string('errorfilenamemustbezip', 'backup');
             }

backup/util/ui/backup_ui_setting.class.php

@@ -307,10 +307,12 @@ abstract class backup_setting_ui extends base_setting_ui {
      * 2. The setting is locked but only by settings that are of the same level (same page)
      *
      * Condition 2 is really why we have this function
-     *
+     * @param int $level Optional, if provided only depedency_settings below or equal to this level are considered,
+     *          when checking if the ui_setting is changeable. Although dependencies might cause a lock on this setting,
+     *          they could be changeable in the same view.
      * @return bool
      */
-    public function is_changeable() {
+    public function is_changeable($level = null) {
         if ($this->setting->get_status() === backup_setting::NOT_LOCKED) {
             // Its not locked so its chanegable.
             return true;
@@ -319,6 +321,9 @@ abstract class backup_setting_ui extends base_setting_ui {
             return false;
         } else if ($this->setting->has_dependencies_on_settings()) {
             foreach ($this->setting->get_settings_depended_on() as $dependency) {
+                if ($level && $dependency->get_setting()->get_level() >= $level) {
+                    continue;
+                }
                 if ($dependency->is_locked() && $dependency->get_setting()->get_level() !== $this->setting->get_level()) {
                     // Its not changeable because one or more dependancies arn't changeable.
                     return false;
@@ -355,7 +360,8 @@ class backup_setting_ui_text extends backup_setting_ui {
      */
     public function get_element_properties(base_task $task = null, renderer_base $output = null) {
         $icon = $this->get_icon();
-        $label = $this->get_label($task);
+        $context = context_course::instance($task->get_courseid());
+        $label = format_string($this->get_label($task), true, array('context' => $context));
         if (!empty($icon)) {
             $label .= $output->render($icon);
         }
@@ -418,7 +424,8 @@ class backup_setting_ui_checkbox extends backup_setting_ui {
     public function get_element_properties(base_task $task = null, renderer_base $output = null) {
         // Name, label, text, attributes.
         $icon = $this->get_icon();
-        $label = $this->get_label($task);
+        $context = context_course::instance($task->get_courseid());
+        $label = format_string($this->get_label($task), true, array('context' => $context));
         if (!empty($icon)) {
             $label .= $output->render($icon);
         }
@@ -456,13 +463,16 @@ class backup_setting_ui_checkbox extends backup_setting_ui {
 
     /**
      * Returns true if the setting is changeable
+     * @param int $level Optional, if provided only depedency_settings below or equal to this level are considered,
+     *          when checking if the ui_setting is changeable. Although dependencies might cause a lock on this setting,
+     *          they could be changeable in the same view.
      * @return bool
      */
-    public function is_changeable() {
+    public function is_changeable($level = null) {
         if ($this->changeable === false) {
             return false;
         } else {
-            return parent::is_changeable();
+            return parent::is_changeable($level);
         }
     }
 
@@ -525,7 +535,8 @@ class backup_setting_ui_radio extends backup_setting_ui {
      */
     public function get_element_properties(base_task $task = null, renderer_base $output = null) {
         $icon = $this->get_icon();
-        $label = $this->get_label($task);
+        $context = context_course::instance($task->get_courseid());
+        $label = format_string($this->get_label($task), true, array('context' => $context));
         if (!empty($icon)) {
             $label .= $output->render($icon);
         }
@@ -602,7 +613,8 @@ class backup_setting_ui_select extends backup_setting_ui {
      */
     public function get_element_properties(base_task $task = null, renderer_base $output = null) {
         $icon = $this->get_icon();
-        $label = $this->get_label($task);
+        $context = context_course::instance($task->get_courseid());
+        $label = format_string($this->get_label($task), true, array('context' => $context));
         if (!empty($icon)) {
             $label .= $output->render($icon);
         }
@@ -635,13 +647,16 @@ class backup_setting_ui_select extends backup_setting_ui {
     /**
      * Returns true if the setting is changeable, false otherwise
      *
+     * @param int $level Optional, if provided only depedency_settings below or equal to this level are considered,
+     *          when checking if the ui_setting is changeable. Although dependencies might cause a lock on this setting,
+     *          they could be changeable in the same view.
      * @return bool
      */
-    public function is_changeable() {
+    public function is_changeable($level = null) {
         if (count($this->values) == 1) {
             return false;
         } else {
-            return parent::is_changeable();
+            return parent::is_changeable($level);
         }
     }
 

backup/util/ui/base_moodleform.class.php

@@ -183,11 +183,22 @@ abstract class base_moodleform extends moodleform {
     public function add_settings(array $settingstasks) {
         global $OUTPUT;
 
+        // Determine highest setting level, which is displayed in this stage. This is relevant for considering only
+        // locks of dependency settings for parent settings, which are not displayed in this stage.
+        $highestlevel = backup_setting::ACTIVITY_LEVEL;
+        foreach ($settingstasks as $st) {
+            list($setting, $task) = $st;
+            if ($setting->get_level() < $highestlevel) {
+                $highestlevel = $setting->get_level();
+            }
+        }
+
         $defaults = array();
         foreach ($settingstasks as $st) {
             list($setting, $task) = $st;
             // If the setting cant be changed or isn't visible then add it as a fixed setting.
-            if (!$setting->get_ui()->is_changeable() || $setting->get_visibility() != backup_setting::VISIBLE) {
+            if (!$setting->get_ui()->is_changeable($highestlevel) ||
+                $setting->get_visibility() != backup_setting::VISIBLE) {
                 $this->add_fixed_setting($setting, $task);
                 continue;
             }
@@ -302,7 +313,8 @@ abstract class base_moodleform extends moodleform {
                     $icon = '';
                     break;
             }
-            $label = $settingui->get_label($task);
+            $context = context_course::instance($task->get_courseid());
+            $label = format_string($settingui->get_label($task), true, array('context' => $context));
             $labelicon = $settingui->get_icon();
             if (!empty($labelicon)) {
                 $label .= '&nbsp;'.$OUTPUT->render($labelicon);

backup/util/ui/tests/behat/restore_moodle2_courses_settings.feature

@@ -0,0 +1,125 @@
+@core @core_backup
+Feature: Restore Moodle 2 course backups with different user data settings
+  In order to decide upon including user data during backup and restore of courses
+  As a teacher and an admin
+  I need to be able to set and override backup and restore settings
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email |
+      | student1 | Student | 1 | student1@example.com |
+      | teacher1 | Teacher | 1 | teacher1@example.com |
+    And the following "courses" exist:
+      | fullname | shortname | category |
+      | Course 1 | C1 | 0 |
+    And the following "course enrolments" exist:
+      | user | course | role |
+      | teacher1 | C1 | editingteacher |
+      | student1 | C1 | student |
+    And the following "activities" exist:
+      | activity | name               | intro | course | idnumber |
+      | data     | Test database name | n     | C1     | data1    |
+    And I log in as "teacher1"
+    And I am on "Course 1" course homepage
+    And I add a "Text input" field to "Test database name" database and I fill the form with:
+      | Field name | Test field name |
+      | Field description | Test field description |
+    And I follow "Templates"
+    And I wait until the page is ready
+    And I log out
+    And I log in as "student1"
+    And I am on "Course 1" course homepage
+    And I add an entry to "Test database name" database with:
+      | Test field name | Student entry |
+    And I press "Save and view"
+    And I log out
+    And I log in as "admin"
+    And I backup "Course 1" course using this options:
+      | Initial |  Include enrolled users | 1 |
+      | Confirmation | Filename | test_backup.mbz |
+
+  @javascript
+  Scenario: Restore a backup with user data
+    # "User data" marks the user data field for the section
+    # "-" marks the user data field for the data activity
+    When I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 1 |
+      | Schema | User data | 1 |
+      | Schema | - | 1 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should see "Student entry"
+
+  @javascript
+  Scenario: Restore a backup without user data for data activity
+    # "User data" marks the user data field for the section
+    # "-" marks the user data field for the data activity
+    When I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 1 |
+      | Schema | User data | 1 |
+      | Schema | - | 0 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should not see "Student entry"
+
+  @javascript
+  Scenario: Restore a backup without user data for section and data activity
+    # "User data" marks the user data field for the section
+    # "-" marks the user data field for the data activity
+    When I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 1 |
+      | Schema | User data | 0 |
+      | Schema | - | 0 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should not see "Student entry"
+
+  @javascript
+  Scenario: Restore a backup without user data for section
+    # "User data" marks the user data field for the section
+    # "-" marks the user data field for the data activity
+    When I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 1 |
+      | Schema | - | 1 |
+      | Schema | User data | 0 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should not see "Student entry"
+
+  @javascript
+  Scenario: Restore a backup with user data with local config for including users set to 0
+    And I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 0 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should not see "Student entry"
+
+  @javascript
+  Scenario: Restore a backup with user data with site config for including users set to 0
+    Given I navigate to "General restore defaults" node in "Site administration > Courses > Backups"
+    And I set the field "s_restore_restore_general_users" to ""
+    And I press "Save changes"
+    And I am on "Course 1" course homepage
+    And I navigate to "Restore" node in "Course administration"
+    # "User data" marks the user data field for the section
+    # "-" marks the user data field for the data activity
+    And I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 1 |
+      | Schema | User data | 1 |
+      | Schema | - | 1 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should see "Student entry"
+
+  @javascript
+  Scenario: Restore a backup with user data with local and site config config for including users set to 0
+    Given I navigate to "General restore defaults" node in "Site administration > Courses > Backups"
+    And I set the field "s_restore_restore_general_users" to ""
+    And I press "Save changes"
+    And I am on "Course 1" course homepage
+    And I navigate to "Restore" node in "Course administration"
+    When I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 0 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should not see "Student entry"

badges/backpack.js

@@ -27,18 +27,22 @@ function check_site_access() {
     var callback = {
             method: "GET",
             on: {
-                success: function(id, o, args) {
-                            var data = Y.JSON.parse(o.responseText);
-                            if (data.code == 'http-unreachable') {
-                                add.setHTML(data.response);
-                                add.removeClass('hide');
-                            }
-                        },
-                failure: function(o) { }
+                success: function(id, o) {
+                    var data = Y.JSON.parse(o.responseText);
+                    if (data.code == 'http-unreachable') {
+                        add.setHTML(data.response);
+                        add.removeClass('hide');
+                    }
+                    M.util.js_complete('badge/backpack::check_site_access');
+                },
+                failure: function() {
+                    M.util.js_complete('badge/backpack::check_site_access');
+                }
             }
         };
 
     Y.use('io-base', function(Y) {
+        M.util.js_pending('badge/backpack::check_site_access');
         Y.io('ajax.php', callback);
     });
 

badges/backpack_form.php

@@ -61,10 +61,10 @@ class edit_backpack_form extends moodleform {
                 array('class' => 'notconnected', 'id' => 'connection-status'));
             $mform->addElement('static', 'status', get_string('status'), $status);
             $mform->addElement('hidden', 'email', $this->_customdata['email']);
-            $mform->setType('email', PARAM_RAW_TRIMMED);
+            $mform->setType('email', PARAM_EMAIL);
             $mform->hardFreeze(['email']);
-            $status = html_writer::tag('span', $this->_customdata['email'], []);
-            $mform->addElement('static', 'emailverify', get_string('email'), $status);
+            $emailverify = html_writer::tag('span', s($this->_customdata['email']), []);
+            $mform->addElement('static', 'emailverify', get_string('email'), $emailverify);
             $buttonarray = [];
             $buttonarray[] = &$mform->createElement('submit', 'submitbutton',
                                                     get_string('backpackconnectionresendemail', 'badges'));
@@ -80,7 +80,7 @@ class edit_backpack_form extends moodleform {
             $mform->addElement('text', 'email', get_string('email'), 'maxlength="100" size="30"');
             $mform->addHelpButton('email', 'backpackemail', 'badges');
             $mform->addRule('email', get_string('required'), 'required', null, 'client');
-            $mform->setType('email', PARAM_RAW_TRIMMED);
+            $mform->setType('email', PARAM_EMAIL);
             $this->add_action_buttons(false, get_string('backpackconnectionconnect', 'badges'));
         }
     }

badges/edit_form.php

@@ -48,8 +48,8 @@ class edit_details_form extends moodleform {
 
         $mform->addElement('header', 'badgedetails', get_string('badgedetails', 'badges'));
         $mform->addElement('text', 'name', get_string('name'), array('size' => '70'));
-        // Using PARAM_FILE to avoid problems later when downloading badge files.
-        $mform->setType('name', PARAM_FILE);
+        // When downloading badge, it will be necessary to clean the name as PARAM_FILE.
+        $mform->setType('name', PARAM_TEXT);
         $mform->addRule('name', null, 'required');
         $mform->addRule('name', get_string('maximumchars', '', 255), 'maxlength', 255, 'client');
 

badges/mybadges.php

@@ -72,6 +72,7 @@ if ($hide) {
     require_sesskey();
     $badge = new badge($download);
     $name = str_replace(' ', '_', $badge->name) . '.png';
+    $name = clean_param($name, PARAM_FILE);
     $filehash = badges_bake($hash, $download, $USER->id, true);
     $fs = get_file_storage();
     $file = $fs->get_file_by_hash($filehash);

blocks/activity_modules/classes/privacy/provider.php

@@ -0,0 +1,46 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Privacy Subsystem implementation for block_activity_modules.
+ *
+ * @package    block_activity_modules
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace block_activity_modules\privacy;
+
+defined('MOODLE_INTERNAL') || die();
+
+/**
+ * Privacy Subsystem for block_activity_modules implementing null_provider.
+ *
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class provider implements \core_privacy\local\metadata\null_provider {
+
+    /**
+     * Get the language string identifier with the component's language
+     * file to explain why this plugin stores no data.
+     *
+     * @return  string
+     */
+    public static function get_reason() {
+        return 'privacy:metadata';
+    }
+}

blocks/activity_modules/lang/en/block_activity_modules.php

@@ -24,3 +24,4 @@
 
 $string['activity_modules:addinstance'] = 'Add a new activities block';
 $string['pluginname'] = 'Activities';
+$string['privacy:metadata'] = 'The Activites block only shows data stored in other locations.';

blocks/activity_results/classes/privacy/provider.php

@@ -0,0 +1,46 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Privacy Subsystem implementation for block_activity_results.
+ *
+ * @package    block_activity_results
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace block_activity_results\privacy;
+
+defined('MOODLE_INTERNAL') || die();
+
+/**
+ * Privacy Subsystem for block_activity_results implementing null_provider.
+ *
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class provider implements \core_privacy\local\metadata\null_provider {
+
+    /**
+     * Get the language string identifier with the component's language
+     * file to explain why this plugin stores no data.
+     *
+     * @return  string
+     */
+    public static function get_reason() {
+        return 'privacy:metadata';
+    }
+}

blocks/activity_results/lang/en/block_activity_results.php

@@ -65,3 +65,4 @@ $string['worstgrade'] = 'The lowest grade:';
 $string['worstgrades'] = 'The {$a} lowest grades:';
 $string['worstgroupgrade'] = 'The group with the lowest average:';
 $string['worstgroupgrades'] = 'The {$a} groups with the lowest average:';
+$string['privacy:metadata'] = 'The Activites results block only shows data stored in other locations.';

blocks/admin_bookmarks/classes/privacy/provider.php

@@ -0,0 +1,46 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Privacy Subsystem implementation for block_admin_bookmarks.
+ *
+ * @package    block_admin_bookmarks
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace block_admin_bookmarks\privacy;
+
+defined('MOODLE_INTERNAL') || die();
+
+/**
+ * Privacy Subsystem for block_admin_bookmarks implementing null_provider.
+ *
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class provider implements \core_privacy\local\metadata\null_provider {
+
+    /**
+     * Get the language string identifier with the component's language
+     * file to explain why this plugin stores no data.
+     *
+     * @return  string
+     */
+    public static function get_reason() {
+        return 'privacy:metadata';
+    }
+}

blocks/admin_bookmarks/lang/en/block_admin_bookmarks.php

@@ -25,3 +25,4 @@
 $string['admin_bookmarks:addinstance'] = 'Add a new admin bookmarks block';
 $string['admin_bookmarks:myaddinstance'] = 'Add a new admin bookmarks block to Dashboard';
 $string['pluginname'] = 'Admin bookmarks';
+$string['privacy:metadata'] = 'The Admin bookmarks block only shows data stored in other locations.';

blocks/badges/classes/privacy/provider.php

@@ -0,0 +1,46 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Privacy Subsystem implementation for block_badges.
+ *
+ * @package    block_badges
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace block_badges\privacy;
+
+defined('MOODLE_INTERNAL') || die();
+
+/**
+ * Privacy Subsystem for block_badges implementing null_provider.
+ *
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class provider implements \core_privacy\local\metadata\null_provider {
+
+    /**
+     * Get the language string identifier with the component's language
+     * file to explain why this plugin stores no data.
+     *
+     * @return  string
+     */
+    public static function get_reason() {
+        return 'privacy:metadata';
+    }
+}

blocks/badges/lang/en/block_badges.php

@@ -28,3 +28,4 @@ $string['numbadgestodisplay'] = 'Number of latest badges to display';
 $string['nothingtodisplay'] = 'You have no badges to display';
 $string['badges:addinstance'] = 'Add a new My latest badges block';
 $string['badges:myaddinstance'] = 'Add a new My latest badges block to Dashboard';
+$string['privacy:metadata'] = 'The Badges block only shows data stored in other locations.';

blocks/blog_menu/classes/privacy/provider.php

@@ -0,0 +1,46 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Privacy Subsystem implementation for block_blog_menu.
+ *
+ * @package    block_blog_menu
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace block_blog_menu\privacy;
+
+defined('MOODLE_INTERNAL') || die();
+
+/**
+ * Privacy Subsystem for block_blog_menu implementing null_provider.
+ *
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class provider implements \core_privacy\local\metadata\null_provider {
+
+    /**
+     * Get the language string identifier with the component's language
+     * file to explain why this plugin stores no data.
+     *
+     * @return  string
+     */
+    public static function get_reason() {
+        return 'privacy:metadata';
+    }
+}

blocks/blog_menu/lang/en/block_blog_menu.php

@@ -25,3 +25,4 @@
 
 $string['blog_menu:addinstance'] = 'Add a new blog menu block';
 $string['pluginname'] = 'Blog menu';
+$string['privacy:metadata'] = 'The Blog menu block only shows data stored in other locations.';

blocks/blog_recent/classes/privacy/provider.php

@@ -0,0 +1,46 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Privacy Subsystem implementation for block_blog_recent.
+ *
+ * @package    block_blog_recent
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace block_blog_recent\privacy;
+
+defined('MOODLE_INTERNAL') || die();
+
+/**
+ * Privacy Subsystem for block_blog_recent implementing null_provider.
+ *
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class provider implements \core_privacy\local\metadata\null_provider {
+
+    /**
+     * Get the language string identifier with the component's language
+     * file to explain why this plugin stores no data.
+     *
+     * @return  string
+     */
+    public static function get_reason() {
+        return 'privacy:metadata';
+    }
+}

blocks/blog_recent/lang/en/block_blog_recent.php

@@ -28,3 +28,4 @@ $string['norecentblogentries'] = 'No recent entries';
 $string['numentriestodisplay'] = 'Number of recent entries to display';
 $string['pluginname'] = 'Recent blog entries';
 $string['recentinterval'] = 'Interval of time considered "recent"';
+$string['privacy:metadata'] = 'The Recent blog entries block only shows data stored in other locations.';

blocks/blog_tags/classes/privacy/provider.php

@@ -0,0 +1,46 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Privacy Subsystem implementation for block_blog_tags.
+ *
+ * @package    block_blog_tags
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace block_blog_tags\privacy;
+
+defined('MOODLE_INTERNAL') || die();
+
+/**
+ * Privacy Subsystem for block_blog_tags implementing null_provider.
+ *
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class provider implements \core_privacy\local\metadata\null_provider {
+
+    /**
+     * Get the language string identifier with the component's language
+     * file to explain why this plugin stores no data.
+     *
+     * @return  string
+     */
+    public static function get_reason() {
+        return 'privacy:metadata';
+    }
+}

blocks/blog_tags/lang/en/block_blog_tags.php

@@ -24,3 +24,4 @@
 
 $string['blog_tags:addinstance'] = 'Add a new blog tags block';
 $string['pluginname'] = 'Blog tags';
+$string['privacy:metadata'] = 'The Blog tags block only shows data stored in other locations.';

blocks/calendar_month/classes/privacy/provider.php

@@ -0,0 +1,46 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Privacy Subsystem implementation for block_calendar_month.
+ *
+ * @package    block_calendar_month
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace block_calendar_month\privacy;
+
+defined('MOODLE_INTERNAL') || die();
+
+/**
+ * Privacy Subsystem for block_calendar_month implementing null_provider.
+ *
+ * @copyright  2018 Zig Tan <zig@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class provider implements \core_privacy\local\metadata\null_provider {
+
+    /**
+     * Get the language string identifier with the component's language
+     * file to explain why this plugin stores no data.
+     *
+     * @return  string
+     */
+    public static function get_reason() {
+        return 'privacy:metadata';
+    }
+}