Moodle release 3.9.5

Teachers can see user idnumber fields only when they are configured
identity fields. Students cannot.

.github/workflows/config-template.php

@@ -0,0 +1,71 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Template configuraton file for github actions CI/CD.
+ *
+ * @package    core
+ * @copyright  2020 onwards Eloy Lafuente (stronk7) {@link https://stronk7.com}
+ * @license    https://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+// This cannot be used out from a github actions workflow, so just exit.
+getenv('GITHUB_WORKFLOW') || die; // phpcs:ignore moodle.Files.MoodleInternal.MoodleInternalGlobalState
+
+unset($CFG);
+global $CFG;
+$CFG = new stdClass();
+
+$CFG->dbtype    = getenv('dbtype');
+$CFG->dblibrary = 'native';
+$CFG->dbhost    = '127.0.0.1';
+$CFG->dbname    = 'test';
+$CFG->dbuser    = 'test';
+$CFG->dbpass    = 'test';
+$CFG->prefix    = 'm_';
+$CFG->dboptions = ['dbcollation' => 'utf8mb4_bin'];
+
+$host = 'localhost';
+$CFG->wwwroot   = "http://{$host}";
+$CFG->dataroot  = realpath(dirname(__DIR__)) . '/moodledata';
+$CFG->admin     = 'admin';
+$CFG->directorypermissions = 0777;
+
+// Debug options - possible to be controlled by flag in future.
+$CFG->debug = (E_ALL | E_STRICT); // DEBUG_DEVELOPER.
+$CFG->debugdisplay = 1;
+$CFG->debugstringids = 1; // Add strings=1 to url to get string ids.
+$CFG->perfdebug = 15;
+$CFG->debugpageinfo = 1;
+$CFG->allowthemechangeonurl = 1;
+$CFG->passwordpolicy = 0;
+$CFG->cronclionly = 0;
+$CFG->pathtophp = getenv('pathtophp');
+
+$CFG->phpunit_dataroot  = realpath(dirname(__DIR__)) . '/phpunitdata';
+$CFG->phpunit_prefix = 't_';
+
+define('TEST_EXTERNAL_FILES_HTTP_URL', 'http://localhost:8080');
+define('TEST_EXTERNAL_FILES_HTTPS_URL', 'http://localhost:8080');
+
+define('TEST_SESSION_REDIS_HOST', 'localhost');
+define('TEST_CACHESTORE_REDIS_TESTSERVERS', 'localhost');
+
+// TODO: add others (solr, mongodb, memcached, ldap...).
+
+// Too much for now: define('PHPUNIT_LONGTEST', true); // Only leaves a few tests out and they are run later by CI.
+
+require_once(__DIR__ . '/lib/setup.php');

.github/workflows/push.yml

@@ -0,0 +1,103 @@
+name: Core
+
+on: [push]
+
+env:
+  php: 7.4
+
+jobs:
+  Grunt:
+    runs-on: ubuntu-18.04
+
+    steps:
+      - name: Checking out code
+        uses: actions/checkout@v2
+
+      - name: Configuring node & npm
+        shell: bash -l {0}
+        run: nvm install
+
+      - name: Installing node stuff
+        run: npm install
+
+      - name: Running grunt
+        run: npx grunt
+
+      - name: Looking for uncommitted changes
+        # Add all files to the git index and then run diff --cached to see all changes.
+        # This ensures that we get the status of all files, including new files.
+        # We ignore npm-shrinkwrap.json to make the tasks immune to npm changes.
+        run: |
+          git add .
+          git reset -- npm-shrinkwrap.json
+          git diff --cached --exit-code
+
+  PHPUnit:
+    runs-on: ${{ matrix.os }}
+    services:
+      exttests:
+        image: moodlehq/moodle-exttests
+        ports:
+          - 8080:80
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-18.04
+            php: 7.2
+            db: mysqli
+          - os: ubuntu-18.04
+            php: 7.4
+            db: pgsql
+
+    steps:
+      - name: Setting up DB mysql
+        if: ${{ matrix.db == 'mysqli' }}
+        uses: johanmeiring/mysql-action@tmpfs-patch
+        with:
+          collation server: utf8mb4_bin
+          mysql version: 5.7
+          mysql database: test
+          mysql user: test
+          mysql password: test
+          use tmpfs: true
+
+      - name: Setting up DB pgsql
+        if: ${{ matrix.db == 'pgsql' }}
+        uses: m4nu56/postgresql-action@v1
+        with:
+          postgresql version: 9.6
+          postgresql db: test
+          postgresql user: test
+          postgresql password: test
+
+      - name: Configuring git vars
+        uses: rlespinasse/github-slug-action@v3.x
+
+      - name: Setting up PHP ${{ matrix.php }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+
+      - name: Checking out code from ${{ env.GITHUB_REF_SLUG }}
+        uses: actions/checkout@v2
+
+      - name: Setting up PHPUnit
+        env:
+          dbtype: ${{ matrix.db }}
+        run: |
+          echo "pathtophp=$(which php)" >> $GITHUB_ENV # Inject installed pathtophp to env. The template config needs it.
+          cp .github/workflows/config-template.php config.php
+          mkdir ../moodledata
+          sudo locale-gen en_AU.UTF-8
+          php admin/tool/phpunit/cli/init.php --no-composer-self-update
+
+      - name: Running PHPUnit tests
+        env:
+          dbtype: ${{ matrix.db }}
+        run: vendor/bin/phpunit -v

.nvmrc

@@ -1 +1 @@
-v14.0.0
+v14.15.0

.travis.yml

@@ -2,10 +2,9 @@
 # process (which uses our internal CI system) this file is here for the benefit
 # of community developers git clones - see MDL-51458.
 
-# We currently disable Travis notifications entirely until https://github.com/travis-ci/travis-ci/issues/4976
-# is fixed.
 notifications:
-  email: false
+  email:
+    if: env(MOODLE_EMAIL) != no
 
 language: php
 
@@ -17,31 +16,9 @@ services:
     - mysql
     - docker
 
-php:
-    # We only run the highest and lowest supported versions to reduce the load on travis-ci.org.
-    - 7.4
-    - 7.2
-
 addons:
   postgresql: "9.6"
 
-env:
-    # Although we want to run these jobs and see failures as quickly as possible, we also want to get the slowest job to
-    # start first so that the total run time is not too high.
-    #
-    # We only run MySQL on PHP 7.2, so run that first.
-    # CI Tests should be second-highest in priority as these only take <= 60 seconds to run under normal circumstances.
-    # Postgres is significantly is pretty reasonable in its run-time.
-
-    # Run CI Tests without running PHPUnit.
-    - DB=none     TASK=CITEST
-
-    # Run unit tests on Postgres
-    - DB=pgsql    TASK=PHPUNIT
-
-    # Perform an upgrade test too.
-    - DB=pgsql    TASK=UPGRADE
-
 jobs:
     # Enable fast finish.
     # This will fail the build if a single job fails (except those in allow_failures).
@@ -49,12 +26,35 @@ jobs:
     fast_finish: true
 
     include:
-          # Run mysql only on highest - it's just too slow
-        - php: 7.4
+        # First all the lowest php ones (7.2)
+        - php: 7.2
+          env: DB=none     TASK=CITEST
+        - php: 7.2
+          env: DB=none     TASK=GRUNT    NVM_VERSION='lts/carbon'
+
+        - if: env(MOODLE_DATABASE) = "pgsql" OR env(MOODLE_DATABASE) = "all" OR env(MOODLE_DATABASE) IS NOT present
+          php: 7.2
+          env: DB=pgsql    TASK=PHPUNIT
+
+        - if: env(MOODLE_DATABASE) = "mysqli" OR env(MOODLE_DATABASE) = "all"
+          php: 7.2
+          env: DB=mysqli   TASK=PHPUNIT
+
+        # Then, conditionally, all the highest php ones (7.4)
+        - if: env(MOODLE_PHP) = "all"
+          php: 7.4
+          env: DB=none     TASK=CITEST
+        - if: env(MOODLE_PHP) = "all"
+          php: 7.4
+          env: DB=none     TASK=GRUNT    NVM_VERSION='lts/carbon'
+
+        - if: env(MOODLE_PHP) = "all" AND (env(MOODLE_DATABASE) = "pgsql" OR env(MOODLE_DATABASE) = "all" OR env(MOODLE_DATABASE) IS NOT present)
+          php: 7.4
+          env: DB=pgsql    TASK=PHPUNIT
+
+        - if: env(MOODLE_PHP) = "all" AND (env(MOODLE_DATABASE) = "mysqli" OR env(MOODLE_DATABASE) = "all")
+          php: 7.4
           env: DB=mysqli   TASK=PHPUNIT
-          # Run grunt/npm install on highest version too ('node' is an alias for the latest node.js version.)
-        - php: 7.4
-          env: DB=none     TASK=GRUNT   NVM_VERSION='lts/carbon'
 
 cache:
     directories:
@@ -114,7 +114,7 @@ install:
 before_script:
     - phpenv config-rm xdebug.ini
     - >
-      if [ "$TASK" = 'PHPUNIT' -o "$TASK" = 'UPGRADE' ];
+      if [ "$TASK" = 'PHPUNIT' ];
       then
         # Copy generic configuration in place.
         cp config-dist.php config.php ;
@@ -225,32 +225,6 @@ before_script:
         export phpcmd=`which php`;
       fi
 
-    ########################################################################
-    # Upgrade test
-    ########################################################################
-    - >
-      if [ "$TASK" = 'UPGRADE' ];
-      then
-        # We need the official upstream.
-        git remote add upstream https://github.com/moodle/moodle.git;
-
-        # Checkout 30 STABLE branch (the first version compatible with PHP 7.x)
-        git fetch upstream MOODLE_30_STABLE;
-        git checkout MOODLE_30_STABLE;
-
-        # Perform the upgrade
-        php admin/cli/install_database.php --agree-license --adminpass=Password --adminemail=admin@example.com --fullname="Upgrade test" --shortname=Upgrade;
-
-        # Return to the previous commit
-        git checkout -;
-
-        # Perform the upgrade
-        php admin/cli/upgrade.php --non-interactive --allow-unstable ;
-
-        # The local_ci repository can be used to check upgrade savepoints.
-        git clone https://github.com/moodlehq/moodle-local_ci.git local/ci ;
-      fi
-
 script:
     - >
       if [ "$TASK" = 'PHPUNIT' ];
@@ -276,23 +250,6 @@ script:
         git diff --cached --exit-code ;
       fi
 
-    ########################################################################
-    # Upgrade test
-    ########################################################################
-    - >
-      if [ "$TASK" = 'UPGRADE' ];
-      then
-        cp local/ci/check_upgrade_savepoints/check_upgrade_savepoints.php ./check_upgrade_savepoints.php
-        result=`php check_upgrade_savepoints.php`;
-        # Check if there are problems
-        count=`echo "$result" | grep -P "ERROR|WARN" | wc -l` ;
-        if (($count > 0));
-        then
-          echo "$result"
-          exit 1 ;
-        fi
-      fi
-
 after_script:
     - >
       if [ "$TASK" = 'PHPUNIT' ];

admin/classes/local/settings/filesize.php

@@ -178,6 +178,7 @@ class filesize extends \admin_setting {
             'id' => $this->get_id(),
             'name' => $this->get_full_name(),
             'value' => $data['v'],
+            'readonly' => $this->is_readonly(),
             'options' => array_map(function($unit, $title) use ($data, $defaultunit) {
                 return [
                     'value' => $unit,

admin/cli/install.php

@@ -215,6 +215,7 @@ define('SITEID', 1);
 
 //Database types
 $databases = array('mysqli' => moodle_database::get_driver_instance('mysqli', 'native'),
+                   'auroramysql' => moodle_database::get_driver_instance('auroramysql', 'native'),
                    'mariadb'=> moodle_database::get_driver_instance('mariadb', 'native'),
                    'pgsql'  => moodle_database::get_driver_instance('pgsql',  'native'),
                    'oci'    => moodle_database::get_driver_instance('oci',    'native'),

admin/cli/uninstall_plugins.php

@@ -34,6 +34,7 @@ $help = "Command line tool to uninstall plugins.
 Options:
     -h --help                   Print this help.
     --show-all                  Displays a list of all installed plugins.
+    --show-contrib              Displays a list of all third-party installed plugins.
     --show-missing              Displays a list of plugins missing from disk.
     --purge-missing             Uninstall all missing from disk plugins.
     --plugins=<plugin name>     A comma separated list of plugins to be uninstalled. E.g. mod_assign,mod_forum
@@ -44,6 +45,9 @@ Examples:
     # php uninstall_plugins.php  --show-all
         Prints tab-separated list of all installed plugins.
 
+    # php uninstall_plugins.php  --show-contrib
+        Prints tab-separated list of all third-party installed plugins.
+
     # php uninstall_plugins.php  --show-missing
         Prints tab-separated list of all missing from disk plugins.
 
@@ -63,6 +67,7 @@ Examples:
 list($options, $unrecognised) = cli_get_params([
     'help' => false,
     'show-all' => false,
+    'show-contrib' => false,
     'show-missing' => false,
     'purge-missing' => false,
     'plugins' => false,
@@ -84,12 +89,15 @@ if ($options['help']) {
 $pluginman = core_plugin_manager::instance();
 $plugininfo = $pluginman->get_plugins();
 
-if ($options['show-all'] || $options['show-missing']) {
+if ($options['show-all'] || $options['show-missing'] || $options['show-contrib']) {
     foreach ($plugininfo as $type => $plugins) {
         foreach ($plugins as $name => $plugin) {
+            if ($options['show-contrib'] && $plugin->is_standard()) {
+                continue;
+            }
             $pluginstring = $plugin->component . "\t" . $plugin->displayname;
 
-            if ($options['show-all']) {
+            if ($options['show-all'] || $options['show-contrib']) {
                 cli_writeln($pluginstring);
             } else {
                 if ($plugin->get_status() === core_plugin_manager::PLUGIN_STATUS_MISSING) {

admin/environment.xml

@@ -2815,6 +2815,7 @@
       <VENDOR name="oracle" version="11.2" />
     </DATABASE>
     <PHP version="7.1.0" level="required">
+      <RESTRICT function="restrict_php_version_80" message="unsupportedphpversion80" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -2996,6 +2997,7 @@
       <VENDOR name="oracle" version="11.2" />
     </DATABASE>
     <PHP version="7.2.0" level="required">
+      <RESTRICT function="restrict_php_version_80" message="unsupportedphpversion80" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -3177,6 +3179,7 @@
       <VENDOR name="oracle" version="11.2" />
     </DATABASE>
     <PHP version="7.2.0" level="required">
+      <RESTRICT function="restrict_php_version_80" message="unsupportedphpversion80" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -3344,4 +3347,186 @@
       </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
+  <MOODLE version="3.11" requires="3.6">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="10.2.29" />
+      <VENDOR name="mysql" version="5.7" />
+      <VENDOR name="postgres" version="9.6" />
+      <VENDOR name="mssql" version="14.0" />
+      <VENDOR name="oracle" version="11.2" />
+    </DATABASE>
+    <PHP version="7.3.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="mbstringrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+      <PHP_EXTENSION name="sodium" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_sixtyfour_bits" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="sixtyfourbitswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/modules.php

@@ -49,6 +49,7 @@
                 array($module->id));
         core_plugin_manager::reset_caches();
         admin_get_root(true, false);  // settings not required - only pages
+        redirect(new moodle_url('/admin/modules.php'));
     }
 
     if (!empty($show) and confirm_sesskey()) {
@@ -66,6 +67,7 @@
                 array($module->id));
         core_plugin_manager::reset_caches();
         admin_get_root(true, false);  // settings not required - only pages
+        redirect(new moodle_url('/admin/modules.php'));
     }
 
     echo $OUTPUT->header();
@@ -121,8 +123,8 @@
             $count = -1;
         }
         if ($count>0) {
-            $countlink = "<a href=\"{$CFG->wwwroot}/course/search.php?modulelist=$module->name" .
-                "&amp;sesskey=".sesskey()."\" title=\"$strshowmodulecourse\">$count</a>";
+            $countlink = $OUTPUT->action_link(new moodle_url('/course/search.php', ['modulelist' => $module->name]),
+                $count, null, ['title' => $strshowmodulecourse]);
         } else if ($count < 0) {
             $countlink = get_string('error');
         } else {

admin/plugins.php

@@ -53,7 +53,6 @@ $pageurl = new moodle_url('/admin/plugins.php', $pageparams);
 $pluginman = core_plugin_manager::instance();
 
 if ($uninstall) {
-    require_sesskey();
 
     if (!$confirmed) {
         admin_externalpage_setup('pluginsoverview', '', $pageparams);
@@ -92,6 +91,7 @@ if ($uninstall) {
         exit();
 
     } else {
+        require_sesskey();
         $SESSION->pluginuninstallreturn = $pluginfo->get_return_url_after_uninstall($return);
         $progress = new progress_trace_buffer(new text_progress_trace(), false);
         $pluginman->uninstall_plugin($pluginfo->component, $progress);

admin/settings/analytics.php

@@ -131,15 +131,10 @@ if ($hassiteconfig && \core_analytics\manager::is_analytics_enabled()) {
             $timesplittingdefaults, $timesplittingoptions)
         );
 
-        // Predictions processor output dir.
-        $defaultmodeloutputdir = rtrim($CFG->dataroot, '/') . DIRECTORY_SEPARATOR . 'models';
-        if (empty(get_config('analytics', 'modeloutputdir')) && !file_exists($defaultmodeloutputdir) &&
-                is_writable($defaultmodeloutputdir)) {
-            // Automatically create the dir for them so users don't see the invalid value red cross.
-            mkdir($defaultmodeloutputdir, $CFG->directorypermissions, true);
-        }
+        // Predictions processor output dir - specify default in setting description (used if left blank).
+        $defaultmodeloutputdir = \core_analytics\model::default_output_dir();
         $settings->add(new admin_setting_configdirectory('analytics/modeloutputdir', new lang_string('modeloutputdir', 'analytics'),
-            new lang_string('modeloutputdirinfo', 'analytics'), $defaultmodeloutputdir));
+            new lang_string('modeloutputdirwithdefaultinfo', 'analytics', $defaultmodeloutputdir), ''));
 
         // Disable web interface evaluation and get predictions.
         $settings->add(new admin_setting_configcheckbox('analytics/onlycli', new lang_string('onlycli', 'analytics'),

admin/settings/location.php

@@ -1,21 +1,57 @@
 <?php
+// This file is part of Moodle - https://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
-if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
+/**
+ * Define administration settings on the Location settings page.
+ *
+ * @package     core
+ * @category    admin
+ * @copyright   2006 Martin Dougiamas <martin@moodle.com>
+ * @license     https://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
 
-    // "locations" settingpage
-    $temp = new admin_settingpage('locationsettings', new lang_string('locationsettings', 'admin'));
-    $temp->add(new admin_setting_servertimezone());
-    $temp->add(new admin_setting_forcetimezone());
-    $temp->add(new admin_settings_country_select('country', new lang_string('country', 'admin'), new lang_string('configcountry', 'admin'), 0));
-    $temp->add(new admin_setting_configtext('defaultcity', new lang_string('defaultcity', 'admin'), new lang_string('defaultcity_help', 'admin'), ''));
+defined('MOODLE_INTERNAL') || die();
 
-    $temp->add(new admin_setting_heading('iplookup', new lang_string('iplookup', 'admin'), new lang_string('iplookupinfo', 'admin')));
-    $temp->add(new admin_setting_configfile('geoip2file', new lang_string('geoipfile', 'admin'),
-        new lang_string('configgeoipfile', 'admin', $CFG->dataroot.'/geoip/'), $CFG->dataroot.'/geoip/GeoLite2-City.mmdb'));
-    $temp->add(new admin_setting_configtext('googlemapkey3', new lang_string('googlemapkey3', 'admin'), new lang_string('googlemapkey3_help', 'admin'), '', PARAM_RAW, 60));
+if ($hassiteconfig) {
+    $temp = new admin_settingpage('locationsettings', new lang_string('locationsettings', 'core_admin'));
 
-    $temp->add(new admin_setting_configtext('allcountrycodes', new lang_string('allcountrycodes', 'admin'), new lang_string('configallcountrycodes', 'admin'), '', '/^(?:\w+(?:,\w+)*)?$/'));
+    if ($ADMIN->fulltree) {
+        $temp->add(new admin_setting_servertimezone());
+
+        $temp->add(new admin_setting_forcetimezone());
+
+        $temp->add(new admin_settings_country_select('country', new lang_string('country', 'core_admin'),
+            new lang_string('configcountry', 'core_admin'), 0));
+
+        $temp->add(new admin_setting_configtext('defaultcity', new lang_string('defaultcity', 'core_admin'),
+            new lang_string('defaultcity_help', 'core_admin'), ''));
+
+        $temp->add(new admin_setting_heading('iplookup', new lang_string('iplookup', 'core_admin'),
+            new lang_string('iplookupinfo', 'core_admin')));
+
+        $temp->add(new admin_setting_configfile('geoip2file', new lang_string('geoipfile', 'core_admin'),
+            new lang_string('configgeoipfile', 'core_admin', $CFG->dataroot . '/geoip/'),
+            $CFG->dataroot . '/geoip/GeoLite2-City.mmdb'));
+
+        $temp->add(new admin_setting_configtext('googlemapkey3', new lang_string('googlemapkey3', 'core_admin'),
+            new lang_string('googlemapkey3_help', 'core_admin'), '', PARAM_RAW, 60));
+
+        $temp->add(new admin_setting_countrycodes('allcountrycodes', new lang_string('allcountrycodes', 'core_admin'),
+            new lang_string('configallcountrycodes', 'core_admin')));
+    }
 
     $ADMIN->add('location', $temp);
-
-} // end of speedup
+}

admin/tasklogs.php

@@ -32,6 +32,7 @@ $result = optional_param('result', null, PARAM_INT);
 
 $pageurl = new \moodle_url('/admin/tasklogs.php');
 $pageurl->param('filter', $filter);
+$pageurl->param('result', $result);
 
 $PAGE->set_url($pageurl);
 $PAGE->set_context(context_system::instance());

admin/templates/setting_configcheckbox.mustache

@@ -25,6 +25,7 @@
     * value - yes value
     * id - element id
     * checked - boole
+    * readonly - bool
 
     Example context (json):
     {
@@ -32,10 +33,11 @@
         "no": "False",
         "value": "True",
         "id": "test0",
-        "checked": "checked"
+        "checked": "checked",
+        "readonly": false
     }
 }}
 <div class="form-checkbox defaultsnext">
     <input type="hidden" name="{{name}}" value="{{no}}">
-    <input type="checkbox" name="{{name}}" value="{{value}}" id="{{id}}" {{#checked}}checked{{/checked}}>
+    <input {{#readonly}}disabled{{/readonly}} type="checkbox" name="{{name}}" value="{{value}}" id="{{id}}" {{#checked}}checked{{/checked}}>
 </div>

admin/templates/setting_configcolourpicker.mustache

@@ -25,6 +25,7 @@
     * id - element id
     * value - element value
     * haspreviewconfig - show preview of selected color
+    * readonly - bool
 
     Example context (json):
     {
@@ -32,6 +33,7 @@
         "name": "name0",
         "id": "id0",
         "value": "#555655",
+        "readonly": false,
         "haspreviewconfig": false
     }
 }}
@@ -44,7 +46,7 @@
             {{>core/pix_icon}}
         {{/icon}}
     </div>
-    <input type="text" name="{{name}}" id="{{id}}" value="{{value}}" size="12" class="form-control text-ltr">
+    <input type="text" name="{{name}}" id="{{id}}" value="{{value}}" size="12" class="form-control text-ltr" {{#readonly}}disabled{{/readonly}}>
     {{#haspreviewconfig}}
         <input type="button" id="{{id}}_preview" value={{#quote}}{{#str}}preview{{/str}}{{/quote}} class="admin_colourpicker_preview">
     {{/haspreviewconfig}}

admin/templates/setting_configdirectory.mustache

@@ -33,7 +33,7 @@
         "name": "test",
         "value": "/my-super-secret-path/",
         "id": "test0",
-        "readonly": true,
+        "readonly": false,
         "showvalidity": true,
         "valid": false
     }

admin/templates/setting_configduration.mustache

@@ -23,6 +23,7 @@
     * name - form element name
     * options - list of options for units containing name, value, selected
     * value - yes
+    * readonly - bool
     * id - element id
 
     Example context (json):
@@ -30,6 +31,7 @@
         "name": "test",
         "value": "5",
         "id": "test0",
+        "readonly": false,
         "options": [ { "name": "Minutes", "value": "mins", "selected": true } ]
     }
 }}
@@ -38,9 +40,9 @@
 }}
 <div class="form-duration defaultsnext">
     <div class="form-inline">
-        <input type="text" size="5" id="{{id}}v" name="{{name}}[v]" value="{{value}}" class="form-control text-ltr">
+        <input type="text" size="5" id="{{id}}v" name="{{name}}[v]" value="{{value}}" class="form-control text-ltr" {{#readonly}}disabled{{/readonly}}>
         <label class="sr-only" for="{{id}}u">{{#str}}durationunits, admin{{/str}}</label>
-        <select id="{{id}}u" name="{{name}}[u]" class="form-control custom-select">
+        <select id="{{id}}u" name="{{name}}[u]" class="form-control custom-select" {{#readonly}}disabled{{/readonly}}>
             {{#options}}
                 <option value="{{value}}" {{#selected}}selected{{/selected}}>{{name}}</option>
             {{/options}}

admin/templates/setting_configexecutable.mustache

@@ -33,7 +33,7 @@
         "name": "test",
         "value": "/usr/bin/cowsay",
         "id": "test0",
-        "readonly": true,
+        "readonly": false,
         "showvalidity": true,
         "valid": false
     }

admin/templates/setting_configfile.mustache

@@ -26,6 +26,7 @@
     * readonly - Make the field readonly
     * value - value
     * showvalidity - Show a green check if the path is readable
+    * readonly - bool
     * valid - True if the path is readable
 
     Example context (json):
@@ -33,8 +34,9 @@
         "name": "test",
         "value": "/my-super-secret-path/file",
         "id": "test0",
-        "readonly": true,
+        "readonly": false,
         "showvalidity": true,
+        "readonly": false,
         "valid": false
     }
 }}

admin/templates/setting_configfilesize.mustache

@@ -24,12 +24,14 @@
     * options - list of options for units containing name, value, selected
     * value - yes
     * id - element id
+    * readonly - bool
 
     Example context (json):
     {
         "name": "test",
         "value": "5",
         "id": "test0",
+        "readonly": false,
         "options": [ { "name": "KB", "value": "1024", "selected": true } ]
     }
 }}
@@ -38,9 +40,9 @@
 }}
 <div class="form-filesize defaultsnext">
     <div class="form-inline">
-        <input type="text" size="5" id="{{id}}v" name="{{name}}[v]" value="{{value}}" class="form-control text-ltr">
+        <input type="text" size="5" id="{{id}}v" name="{{name}}[v]" value="{{value}}" class="form-control text-ltr" {{#readonly}}disabled{{/readonly}}>
         <label class="sr-only" for="{{id}}u">{{#str}}filesizeunits, admin{{/str}}</label>
-        <select id="{{id}}u" name="{{name}}[u]" class="form-control custom-select">
+        <select id="{{id}}u" name="{{name}}[u]" class="form-control custom-select" {{#readonly}}disabled{{/readonly}}>
             {{#options}}
                 <option value="{{value}}" {{#selected}}selected{{/selected}}>{{name}}</option>
             {{/options}}

admin/templates/setting_configmultiselect.mustache

@@ -24,11 +24,13 @@
     * id - element id
     * size - element size
     * options - list of options containing name, value, selected
+    * readonly - bool
 
     Example context (json):
     {
         "name": "test",
         "id": "test0",
+        "readonly": false,
         "size": "3",
         "options": [ { "name": "Option 1", "value": "V", "selected": true },
                      { "name": "Option 2", "value": "V", "selected": true } ]
@@ -39,7 +41,7 @@
 }}
 <div class="form-select">
     <input type="hidden" name="{{name}}[xxxxx]" value="1">
-    <select id="{{id}}" name="{{name}}[]" size="{{size}}" class="form-control" multiple>
+    <select {{#readonly}}disabled{{/readonly}} id="{{id}}" name="{{name}}[]" size="{{size}}" class="form-control" multiple>
         {{#options}}
             <option value="{{value}}" {{#selected}}selected{{/selected}}>{{name}}</option>
         {{/options}}

admin/templates/setting_configmultiselect_optgroup.mustache

@@ -25,11 +25,13 @@
     * size - element size
     * options - list of options not grouped
     * optgroups - list of options grouped containing the group label and for each option: name, value, selected
+    * readonly - bool
 
     Example context (json):
     {
         "name": "test",
         "id": "test0",
+        "readonly": false,
         "size": "3",
         "options": [
             { "name": "Option 1", "value": "V", "selected": false },
@@ -58,7 +60,7 @@
 }}
 <div class="form-select">
     <input type="hidden" name="{{name}}[xxxxx]" value="1">
-    <select id="{{id}}" name="{{name}}[]" size="{{size}}" class="form-control" multiple>
+    <select {{#readonly}}disabled{{/readonly}} id="{{id}}" name="{{name}}[]" size="{{size}}" class="form-control" multiple>
     {{#options}}
         <option value="{{value}}" {{#selected}}selected{{/selected}}>{{name}}</option>
     {{/options}}

admin/templates/setting_configpasswordunmask.mustache

@@ -24,7 +24,7 @@
     * size - form element size
     * value - form element value
     * id - element id
-    * forced - has value been defined in config.php
+    * readonly - has value been defined in config.php
 
     Example context (json):
     {
@@ -32,10 +32,10 @@
         "id": "test0",
         "size": "8",
         "value": "secret",
-        "forced": false
+        "readonly": false
     }
 }}
-{{#forced}}
+{{#readonly}}
     <div class="form-password">
         <input type="text"
                name = "{{ name }}"
@@ -46,8 +46,8 @@
                disabled
         >
     </div>
-{{/forced}}
-{{^forced}}
+{{/readonly}}
+{{^readonly}}
 <div class="form-password">
     <span data-passwordunmask="wrapper" data-passwordunmaskid="{{ id }}">
         <span data-passwordunmask="editor">
@@ -76,4 +76,4 @@ require(['core_form/passwordunmask'], function(PasswordUnmask) {
     new PasswordUnmask("{{ id }}");
 });
 {{/js}}
-{{/forced}}
+{{/readonly}}

admin/templates/setting_configselect.mustache

@@ -23,11 +23,13 @@
     * name - form element name
     * id - element id
     * options - list of options containing name, value, selected
+    * readonly - bool
 
     Example context (json):
     {
         "name": "test",
         "id": "test0",
+        "readonly": false,
         "options": [
             { "name": "Option 1", "value": "V", "selected": true },
             { "name": "Option 2", "value": "V", "selected": true }
@@ -38,7 +40,7 @@
     Setting configselect.
 }}
 <div class="form-select defaultsnext">
-    <select id="{{id}}" name="{{name}}" class="custom-select">
+    <select {{#readonly}}disabled{{/readonly}} id="{{id}}" name="{{name}}" class="custom-select">
         {{#options}}
             <option value="{{value}}" {{#selected}}selected{{/selected}}>{{name}}</option>
         {{/options}}

admin/templates/setting_configselect_optgroup.mustache

@@ -22,6 +22,7 @@
     Context variables required for this template:
     * name - form element name
     * id - element id
+    * readonly - bool
     * options - list of options (not grouped)
     * optgroups - list of options grouped containing the group label and for each option: name, value, selected
 
@@ -29,6 +30,7 @@
     {
         "name": "test",
         "id": "test0",
+        "readonly": false,
         "options": [
             { "name": "Option 1", "value": "V", "selected": false },
             { "name": "Option 2", "value": "V", "selected": false }
@@ -55,7 +57,7 @@
     Setting configselect with optgroup support.
 }}
 <div class="form-select defaultsnext">
-    <select id="{{id}}" name="{{name}}" class="custom-select">
+    <select {{#readonly}}disabled{{/readonly}} id="{{id}}" name="{{name}}" class="custom-select">
         {{#options}}
             <option value="{{value}}" {{#selected}}selected{{/selected}}>{{name}}</option>
         {{/options}}

admin/templates/setting_configtext.mustache

@@ -26,6 +26,7 @@
     * size - element size
     * forceltr - always display as ltr
     * attributes - list of additional attributes containing name, value
+    * readonly - bool
 
     Example context (json):
     {
@@ -34,6 +35,7 @@
         "value": "A tall, dark stranger will have more fun than you.",
         "size": "21",
         "forceltr": false,
+        "readonly": false,
         "attributes": [ { "name": "readonly", "value": "readonly" } ]
     }
 }}
@@ -41,5 +43,5 @@
     Setting configtext.
 }}
 <div class="form-text defaultsnext">
-    <input type="text" name="{{name}}" value="{{value}}" size="{{size}}" id="{{id}}" class="form-control {{#forceltr}}text-ltr{{/forceltr}}">
+    <input type="text" name="{{name}}" value="{{value}}" size="{{size}}" id="{{id}}" class="form-control {{#forceltr}}text-ltr{{/forceltr}}" {{#readonly}}disabled{{/readonly}}>
 </div>

admin/templates/setting_configtextarea.mustache

@@ -33,6 +33,7 @@
         "cols": "30",
         "rows": "3",
         "value": "Excellent day for putting Slinkies on an escalator.",
+        "readonly": false,
         "id": "test0"
     }
 }}
@@ -40,5 +41,5 @@
     Setting configtextarea.
 }}
 <div class="form-textarea">
-    <textarea rows="{{rows}}" cols="{{cols}}" id="{{id}}" name="{{name}}" spellcheck="true" class="form-control {{#forceltr}}text-ltr{{/forceltr}}">{{value}}</textarea>
+    <textarea {{#readonly}}disabled{{/readonly}} rows="{{rows}}" cols="{{cols}}" id="{{id}}" name="{{name}}" spellcheck="true" class="form-control {{#forceltr}}text-ltr{{/forceltr}}">{{value}}</textarea>
 </div>

admin/templates/setting_configtime.mustache

@@ -24,11 +24,13 @@
     * id - element id
     * hours - list of valid hour options containing name, value, selected
     * minutes - list of valid minute options containing name, value, selected
+    * readonly - bool
 
     Example context (json):
     {
         "name": "test",
         "id": "test0",
+        "readonly": false,
         "minutes": [
             { "name": "00", "value": "0", "selected": true },
             { "name": "01", "value": "1", "selected": false }
@@ -45,13 +47,13 @@
 <div class="form-time defaultsnext">
     <div class="form-inline text-ltr">
         <label class="sr-only" for="{{id}}h">{{#str}}hours{{/str}}</label>
-        <select id="{{id}}h" name="{{name}}[h]" class="custom-select">
+        <select id="{{id}}h" name="{{name}}[h]" class="custom-select" {{#readonly}}disabled{{/readonly}}>
             {{#hours}}
                 <option value="{{value}}" {{#selected}}selected{{/selected}}>{{name}}</option>
             {{/hours}}
         </select>:
         <label class="sr-only" for="{{id}}m">{{#str}}minutes{{/str}}</label>
-        <select id="{{id}}m" name="{{name}}[m]" class="custom-select">
+        <select id="{{id}}m" name="{{name}}[m]" class="custom-select" {{#readonly}}disabled{{/readonly}}>
             {{#minutes}}
                 <option value="{{value}}" {{#selected}}selected{{/selected}}>{{name}}</option>
             {{/minutes}}

admin/tests/behat/invalid_allcountrycodes.feature

@@ -0,0 +1,29 @@
+@core @core_admin
+Feature: Administrator is warned and when trying to set invalid allcountrycodes value.
+  In order to avoid misconfiguration of the country selector fields
+  As an admin
+  I want to be warned when I try to set an invalid country code in the allcountrycodes field
+
+  Scenario: Attempting to set allcountrycodes field with valid country codes
+    Given I log in as "admin"
+    And I navigate to "Location > Location settings" in site administration
+    When I set the following administration settings values:
+      | All country codes | CZ,BE,GB,ES |
+    Then I should not see "Invalid country code"
+
+  Scenario: Attempting to set allcountrycodes field with invalid country code
+    Given I log in as "admin"
+    And I navigate to "Location > Location settings" in site administration
+    When I set the following administration settings values:
+      | All country codes | CZ,BE,FOOBAR,GB,ES |
+    Then I should see "Invalid country code: FOOBAR"
+
+  Scenario: Attempting to unset allcountrycodes field
+    Given I log in as "admin"
+    And I navigate to "Location > Location settings" in site administration
+    And I set the following administration settings values:
+      | All country codes | CZ,BE,GB,ES |
+    And I navigate to "Location > Location settings" in site administration
+    When I set the following administration settings values:
+      | All country codes | |
+    Then I should not see "Invalid country code"

admin/tests/behat/language_settings.feature

@@ -0,0 +1,34 @@
+@core @core_admin
+Feature: Configure language settings for the site
+  In order to configure language settings for the site
+  As an admin
+  I want to set language settings relevant to my site users
+
+  Scenario: Set languages on language menu
+    Given I log in as "admin"
+    And I navigate to "Language > Language settings" in site administration
+    When I set the field "Languages on language menu" to "en"
+    And I press "Save changes"
+    Then I should not see "Invalid language code"
+
+  Scenario: Reset languages on language menu
+    Given I log in as "admin"
+    And I navigate to "Language > Language settings" in site administration
+    When I set the field "Languages on language menu" to ""
+    And I press "Save changes"
+    Then I should not see "Invalid language code"
+
+  Scenario Outline: Set languages on language menu with invalid language
+    Given I log in as "admin"
+    And I navigate to "Language > Language settings" in site administration
+    When I set the field "Languages on language menu" to "<fieldvalue>"
+    And I press "Save changes"
+    Then I should see "Invalid language code: <invalidlang>"
+    Examples:
+      | fieldvalue | invalidlang |
+      | xx         | xx          |
+      | xx\|Bad    | xx          |
+      | en,qq      | qq          |
+      | en,qq\|Bad | qq          |
+      | en$$       | en$$        |
+      | en$$\|Bad  | en$$        |

admin/tool/behat/lang/en/tool_behat.php

@@ -46,6 +46,7 @@ $string['stepsdefinitionstype'] = 'Type';
 $string['theninfo'] = 'Then. Checkings to ensure the outcomes are the expected ones';
 $string['unknownexceptioninfo'] = 'There was a problem with Selenium or your browser. Please ensure you are using the latest version of Selenium. Error:';
 $string['viewsteps'] = 'Filter';
+$string['warndirrootconfigfound'] = 'A configuration file was found at {$a}. This file is not automatically updated and may become stale. We recommend removing this file.';
 $string['wheninfo'] = 'When. Action that provokes an event';
 $string['wrongbehatsetup'] = 'Something is wrong with the behat setup and so step definitions cannot be listed: <b>{$a->errormsg}</b><br/><br/>Please check:<ul>
 <li>$CFG->behat_dataroot, $CFG->behat_prefix and $CFG->behat_wwwroot are set in config.php with different values from $CFG->dataroot, $CFG->prefix and $CFG->wwwroot.</li>

admin/tool/behat/tests/behat/data_generators.feature

@@ -156,7 +156,7 @@ Feature: Set up contextual data for tests
     And I log in as "user5"
     And I should see "You are logged in as"
     And I am on "Course 1" course homepage
-    And I should see "You can not enrol yourself in this course."
+    And I should see "You cannot enrol yourself in this course."
 
   Scenario: Add modules
     Given the following "courses" exist:

admin/tool/behat/tests/behat/edit_permissions.feature

@@ -6,14 +6,18 @@ Feature: Edit capabilities
 
   Background:
     Given the following "users" exist:
-      | username | firstname | lastname | email |
-      | teacher1 | Teacher | 1 | teacher1@example.com |
+      | username | firstname | lastname  |
+      | teacher1 | Teacher   | 1         |
+      | tutor    | Teaching  | Assistant |
+      | student  | Student   | One       |
     And the following "courses" exist:
-      | fullname | shortname | category |
-      | Course 1 | C1 | 0 |
+      | fullname | shortname |
+      | Course 1 | C1        |
     And the following "course enrolments" exist:
-      | user | course | role |
-      | teacher1 | C1 | editingteacher |
+      | user     | course | role           |
+      | teacher1 | C1     | editingteacher |
+      | tutor    | C1     | teacher        |
+      | student  | C1     | student        |
 
   Scenario: Default system capabilities modification
     Given I log in as "admin"
@@ -60,3 +64,25 @@ Feature: Edit capabilities
     Then "mod/forum:deleteanypost" capability has "Prohibit" permission
     And "mod/forum:editanypost" capability has "Prevent" permission
     And "mod/forum:addquestion" capability has "Allow" permission
+
+  @javascript
+  Scenario: Edit permissions escapes role names correctly
+    When I am on the "C1" "Course" page logged in as "admin"
+    And I navigate to "Edit settings" in current page administration
+    And I set the following fields to these values:
+      | Your word for 'Teacher'             | Teacher >= editing  |
+      | Your word for 'Non-editing teacher' | Teacher < "editing" |
+      | Your word for 'Student'             | Studier & 'learner' |
+    And I press "Save and display"
+    And I navigate to course participants
+    Then I should see "Teacher >= editing" in the "Teacher 1" "table_row"
+    And I should see "Teacher < \"editing\"" in the "Teaching Assistant" "table_row"
+    And I should see "Studier & 'learner'" in the "Student One" "table_row"
+    And I navigate to "Users > Permissions" in current page administration
+    And I should see "Teacher >= editing" in the "mod/forum:replypost" "table_row"
+    And I should see "Teacher < \"editing\"" in the "mod/forum:replypost" "table_row"
+    And I should see "Studier & 'learner'" in the "mod/forum:replypost" "table_row"
+    And I follow "Prohibit"
+    And "Teacher >= editing" "button" in the "Prohibit role" "dialogue" should be visible
+    And "Teacher < \"editing\"" "button" in the "Prohibit role" "dialogue" should be visible
+    And "Studier & 'learner'" "button" in the "Prohibit role" "dialogue" should be visible

admin/tool/behat/tests/behat/inplaceeditable.feature

@@ -0,0 +1,30 @@
+@tool_behat
+Feature: Verify that the inplace editable field works as expected
+  In order to use behat step definitions
+  As a test write
+  I need to ensure that the inplace editable works in forms
+
+  Background:
+    Given the following "course" exists:
+      | fullname  | Course 1 |
+      | shortname | C1       |
+    And the following "activities" exist:
+      | activity | course | name                | idnumber |
+      | forum    | C1     | My first forum      | forum1   |
+      | assign   | C1     | My first assignment | assign1  |
+      | quiz     | C1     | My first quiz       | quiz1    |
+    And I log in as "admin"
+    And I am on "Course 1" course homepage with editing mode on
+
+  @javascript
+  Scenario: Using an inplace editable updates the name of an activity
+    When I set the field "Edit title" in the "My first assignment" "activity" to "Coursework submission"
+    Then I should see "Coursework submission"
+    And I should not see "My first assignment"
+    But I should see "My first forum"
+    And I should see "My first quiz"
+    And I set the field "Edit title" in the "Coursework submission" "activity" to "My first assignment"
+    And I should not see "Coursework submission"
+    But I should see "My first assignment"
+    And I should see "My first forum"
+    And I should see "My first quiz"

admin/tool/behat/tests/behat/keyboard.feature

@@ -0,0 +1,52 @@
+@tool_behat
+Feature: Verify that keyboard steps work as expected
+  In order to use behat step definitions
+  As a test writer
+  I need to verify that the keyboard steps work as expected
+
+  @javascript
+  Scenario: Typing keys into a field causes them to be input
+    Given the following "users" exist:
+      | username | email                        | firstname | lastname | password    |
+      | saffronr | saffron.rutledge@example.com | Saffron   | Rutledge | flowerpower |
+    Given I click on "Log in" "link"
+    And I click on "Username" "field"
+    When I type "saffronr"
+    And I press the tab key
+    And I type "flowerpower"
+    And I press enter
+    Then I should see "You are logged in as Saffron Rutledge"
+
+  @javascript
+  Scenario: Using tab changes focus to the next or previous field
+    Given I click on "Log in" "link"
+    And I click on "Username" "field"
+    And the focused element is "Username" "field"
+    When I press the tab key
+    Then the focused element is "Password" "field"
+
+    And I press the shift tab key
+    And the focused element is "Username" "field"
+
+  @javascript
+  Scenario: Using the arrow keys allows me to navigate through menus
+    Given the following "users" exist:
+      | username | email                        | firstname | lastname |
+      | saffronr | saffron.rutledge@example.com | Saffron   | Rutledge |
+    And I log in as "saffronr"
+    And I click on "Saffron Rutledge" "link" in the ".usermenu" "css_element"
+    When I press the up key
+    Then the focused element is "Log out" "link"
+
+  @javascript
+  Scenario: The escape key can be used to close a dialogue
+    Given the following "course" exists:
+     | fullname  | C1|
+     | shortname | C1 |
+    And I log in as "admin"
+    And I am on "C1" course homepage
+    And I navigate to course participants
+    And I press "Enrol users"
+    And "Enrol users" "dialogue" should be visible
+    When I press the escape key
+    Then "Enrol users" "dialogue" should not be visible

admin/tool/behat/tests/behat/manipulate_forms.feature

@@ -14,8 +14,6 @@ Feature: Forms manipulation
     Then the field "First name" matches value "Field value"
     And the "Select a country" select box should contain "Japan"
     And the field "New password" matches value "TestPass"
-    And I take focus off "Update profile" "button"
-    And I press "Update profile"
 
   @javascript
   Scenario: Expand all fieldsets and advanced elements

admin/tool/capability/classes/settings_form.php

@@ -60,12 +60,12 @@ class tool_capability_settings_form extends moodleform {
         $form->addElement('select', 'roles', get_string('roleslabel', 'tool_capability'), $roles, $attributes);
         $form->setType('roles', PARAM_TEXT);
 
-        $form->addElement('checkbox', 'onlydiff',
-                get_string('filters', 'tool_capability'),
-                get_string('onlydiff', 'tool_capability'));
+        $filters = [];
+        $filters[] = $form->createElement('checkbox', 'onlydiff',  get_string('onlydiff', 'tool_capability'));
         $form->setType('onlydiff', PARAM_BOOL);
+        $form->addGroup($filters, 'filters', get_string('filters', 'tool_capability'), array('<br>'), false);
 
         $form->addElement('submit', 'submitbutton', get_string('getreport', 'tool_capability'));
     }
 
-}
+}

admin/tool/capability/locallib.php

@@ -53,7 +53,12 @@ function tool_capability_calculate_role_data($capability, array $roles) {
     $sql = 'SELECT DISTINCT con.path, 1
               FROM {context} con
               JOIN {role_capabilities} rc ON rc.contextid = con.id
-             WHERE capability = ? '.$sqlroletest;
+             WHERE capability = ? ' .
+            $sqlroletest .
+            // Context path should never be null, but can happen in old database with
+            // bad data (e.g. a course_module where the corresponding course no longer exists).
+            // We need to leave these out of the report to prevent errors.
+            ' AND con.path IS NOT NULL';
     $relevantpaths = $DB->get_records_sql_menu($sql, $params);
     $requiredcontexts = array($systemcontext->id);
     foreach ($relevantpaths as $path => $notused) {
@@ -88,6 +93,10 @@ function tool_capability_calculate_role_data($capability, array $roles) {
 
     // Put the role capabilities into the context tree.
     foreach ($rolecaps as $rolecap) {
+        if (!isset($contexts[$rolecap->contextid])) {
+            // Skip capabilities in orphaned contexts that are not in the tree.
+            continue;
+        }
         $contexts[$rolecap->contextid]->rolecapabilities[$rolecap->roleid] = $rolecap->permission;
     }
 
@@ -99,4 +108,4 @@ function tool_capability_calculate_role_data($capability, array $roles) {
     }
 
     return $contexts;
-}
+}

admin/tool/capability/tests/locallib_test.php

@@ -0,0 +1,88 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Tests for the capability overview helper functions.
+ *
+ * @package   tool_capability
+ * @copyright 2021 The Open University
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later.
+ */
+
+defined('MOODLE_INTERNAL') || die();
+global $CFG;
+require_once($CFG->dirroot . '/' . $CFG->admin . '/tool/capability/locallib.php');
+
+
+/**
+ * Tests for the capability overview helper functions.
+ */
+class tool_capability_locallib_testcase extends advanced_testcase {
+
+    /**
+     * Test the function that gets the data - simple case.
+     */
+    public function test_tool_capability_calculate_role_data() {
+        global $DB;
+
+        $data = tool_capability_calculate_role_data('mod/quiz:attempt', get_all_roles());
+
+        $systcontext = context_system::instance();
+        $studentroleid = $DB->get_field('role', 'id', ['shortname' => 'student']);
+
+        $this->assertArrayHasKey($systcontext->id, $data);
+        $this->assertCount(1, $data);
+        foreach ($data[$systcontext->id]->rolecapabilities as $roleid => $permission) {
+            if ($roleid == $studentroleid) {
+                $this->assertEquals(CAP_ALLOW, $permission);
+            } else {
+                $this->assertEquals(CAP_INHERIT, $permission);
+            }
+        }
+    }
+
+    /**
+     * Test the function that gets the data - simple case.
+     */
+    public function test_tool_capability_calculate_role_data_orphan_contexts() {
+        global $DB;
+        $this->resetAfterTest();
+
+        // This simulates a situation that seems to happen sometimes, where
+        // we end up with contexts with path = NULL in the database.
+        $systcontext = context_system::instance();
+        $generator = $this->getDataGenerator();
+        $course = $generator->create_course();
+        $coursecontext = context_course::instance($course->id);
+        $studentroleid = $DB->get_field('role', 'id', ['shortname' => 'student']);
+        role_change_permission($studentroleid, $coursecontext, 'mod/quiz:attempt', CAP_PREVENT);
+        // This is where we simulate the breakage.
+        $DB->set_field('context', 'path', null, ['id' => $coursecontext->id]);
+
+        // Now call the function. We mainly just want to know there is no exception.
+        $data = tool_capability_calculate_role_data('mod/quiz:attempt', get_all_roles());
+
+        $this->assertArrayHasKey($systcontext->id, $data);
+        $this->assertCount(1, $data);
+        foreach ($data[$systcontext->id]->rolecapabilities as $roleid => $permission) {
+            if ($roleid == $studentroleid) {
+                $this->assertEquals(CAP_ALLOW, $permission);
+            } else {
+                $this->assertEquals(CAP_INHERIT, $permission);
+            }
+        }
+    }
+}

admin/tool/customlang/locallib.php

@@ -39,7 +39,7 @@ class tool_customlang_utils {
     const ROUGH_NUMBER_OF_STRINGS = 16500;
 
     /** @var array cache of {@link self::list_components()} results */
-    protected static $components = null;
+    private static $components = null;
 
     /**
      * This class can not be instantiated
@@ -54,28 +54,30 @@ class tool_customlang_utils {
      */
     public static function list_components() {
 
-        $list['moodle'] = 'core';
+        if (self::$components === null) {
+            $list['moodle'] = 'core';
 
-        $coresubsystems = core_component::get_core_subsystems();
-        ksort($coresubsystems); // should be but just in case
-        foreach ($coresubsystems as $name => $location) {
-            $list[$name] = 'core_'.$name;
-        }
+            $coresubsystems = core_component::get_core_subsystems();
+            ksort($coresubsystems); // Should be but just in case.
+            foreach ($coresubsystems as $name => $location) {
+                $list[$name] = 'core_' . $name;
+            }
 
-        $plugintypes = core_component::get_plugin_types();
-        foreach ($plugintypes as $type => $location) {
-            $pluginlist = core_component::get_plugin_list($type);
-            foreach ($pluginlist as $name => $ununsed) {
-                if ($type == 'mod') {
-                    // Plugin names are now automatically validated.
-                    $list[$name] = $type.'_'.$name;
-                } else {
-                    $list[$type.'_'.$name] = $type.'_'.$name;
+            $plugintypes = core_component::get_plugin_types();
+            foreach ($plugintypes as $type => $location) {
+                $pluginlist = core_component::get_plugin_list($type);
+                foreach ($pluginlist as $name => $ununsed) {
+                    if ($type == 'mod') {
+                        // Plugin names are now automatically validated.
+                        $list[$name] = $type . '_' . $name;
+                    } else {
+                        $list[$type . '_' . $name] = $type . '_' . $name;
+                    }
                 }
             }
+            self::$components = $list;
         }
-
-        return $list;
+        return self::$components;
     }
 
     /**
@@ -211,14 +213,18 @@ class tool_customlang_utils {
             return false;
         }
 
-        // get all customized strings from updated components
+        list($insql, $inparams) = $DB->get_in_or_equal(self::list_components());
+
+        // Get all customized strings from updated valid components.
         $sql = "SELECT s.*, c.name AS component
                   FROM {tool_customlang} s
                   JOIN {tool_customlang_components} c ON s.componentid = c.id
                  WHERE s.lang = ?
                        AND (s.local IS NOT NULL OR s.modified = 1)
+                       AND c.name $insql
               ORDER BY componentid, stringid";
-        $strings = $DB->get_records_sql($sql, array($lang));
+        array_unshift($inparams, $lang);
+        $strings = $DB->get_records_sql($sql, $inparams);
 
         $files = array();
         foreach ($strings as $string) {
@@ -336,11 +342,9 @@ EOF
      * @return string|boolean filename eg 'moodle.php' or 'workshop.php', false if not found
      */
     protected static function get_component_filename($component) {
-        if (is_null(self::$components)) {
-            self::$components = self::list_components();
-        }
+
         $return = false;
-        foreach (self::$components as $legacy => $normalized) {
+        foreach (self::list_components() as $legacy => $normalized) {
             if ($component === $normalized) {
                 $return = $legacy.'.php';
                 break;

admin/tool/dataprivacy/classes/external.php

@@ -1613,7 +1613,7 @@ class external extends external_api {
      */
     private static function get_tree_node_structure($allowchildbranches = true) {
         $fields = [
-            'text' => new external_value(PARAM_TEXT, 'The node text', VALUE_REQUIRED),
+            'text' => new external_value(PARAM_RAW, 'The node text', VALUE_REQUIRED),
             'expandcontextid' => new external_value(PARAM_INT, 'The contextid this node expands', VALUE_REQUIRED),
             'expandelement' => new external_value(PARAM_ALPHA, 'What element is this node expanded to', VALUE_REQUIRED),
             'contextid' => new external_value(PARAM_INT, 'The node contextid', VALUE_REQUIRED),

admin/tool/dataprivacy/classes/output/renderer.php

@@ -63,7 +63,6 @@ class renderer extends plugin_renderer_base {
         $params = [
             'data-action' => 'contactdpo',
             'data-replytoemail' => $replytoemail,
-            'class' => 'contactdpo'
         ];
         return html_writer::link('#', get_string('contactdataprotectionofficer', 'tool_dataprivacy'), $params);
     }

admin/tool/dataprivacy/tests/behat/manage_data_requests.feature

@@ -46,7 +46,7 @@ Feature: Manage data requests
     And I open the action menu in "John Doe" "table_row"
     And I should see "View the request"
     But I should not see "Mark as complete"
-    And I press key "27" in ".moodle-actionmenu" "css_element"
+    And I press the escape key
     And I open the action menu in "Jane Doe" "table_row"
     And I choose "Mark as complete" in the open action menu
     And I should see "Do you really want to mark this user enquiry as complete?"

admin/tool/dataprivacy/tests/behat/manage_purposes.feature

@@ -10,16 +10,12 @@ Feature: Manage data storage purposes
     And I open the action menu in "region-main" "region"
     And I choose "Purposes" in the open action menu
     And I press "Add purpose"
-    And I set the field "Name" to "Purpose 1"
-    And I set the field "Description" to "Purpose 1 description"
-    And I click on ".form-autocomplete-downarrow" "css_element" in the "Lawful bases" "form_row"
-    And I click on "Contract (GDPR Art. 6.1(b))" "list_item"
-    And I click on "Legal obligation (GDPR Art 6.1(c))" "list_item"
-    And I press key "27" in the field "Lawful bases"
-    And I click on ".form-autocomplete-downarrow" "css_element" in the "Sensitive personal data processing reasons" "form_row"
-    And I click on "Explicit consent (GDPR Art. 9.2(a))" "list_item"
-    And I press key "27" in the field "Sensitive personal data processing reasons"
-    And I set the field "retentionperiodnumber" to "2"
+    And I set the following fields to these values:
+      | Name                                       | Purpose 1                                                      |
+      | Description                                | Purpose 1 description                                          |
+      | Lawful bases                               | Contract (GDPR Art. 6.1(b)),Legal obligation (GDPR Art 6.1(c)) |
+      | Sensitive personal data processing reasons | Explicit consent (GDPR Art. 9.2(a))                            |
+      | retentionperiodnumber                      | 2                                                              |
     When I press "Save"
     Then I should see "Purpose 1" in the "List of data purposes" "table"
     And I should see "Contract (GDPR Art. 6.1(b))" in the "Purpose 1" "table_row"
@@ -31,14 +27,13 @@ Feature: Manage data storage purposes
   Scenario: Update a data storage purpose
     Given I open the action menu in "Purpose 1" "table_row"
     And I choose "Edit" in the open action menu
-    And I set the field "Name" to "Purpose 1 edited"
-    And I set the field "Description" to "Purpose 1 description edited"
-    And I click on "Legal obligation (GDPR Art 6.1(c))" "text" in the ".form-autocomplete-selection" "css_element"
-    And I click on ".form-autocomplete-downarrow" "css_element" in the "Lawful bases" "form_row"
-    And I click on "Vital interests (GDPR Art. 6.1(d))" "list_item"
-    And I press key "27" in the field "Lawful bases"
-    And I set the field "retentionperiodnumber" to "3"
-    And I click on "protected" "checkbox"
+    And I set the following fields to these values:
+      | Name                                       | Purpose 1 edited                                                |
+      | Description                                | Purpose 1 description edited                                    |
+      | Lawful bases                               | Contract (GDPR Art. 6.1(b)), Vital interests (GDPR Art. 6.1(d)) |
+      | Sensitive personal data processing reasons | Explicit consent (GDPR Art. 9.2(a))                             |
+      | retentionperiodnumber                      | 3                                                               |
+      | protected                                  | 1                                                               |
     When I press "Save changes"
     Then I should see "Purpose 1 edited" in the "List of data purposes" "table"
     And I should see "Purpose 1 description edited" in the "Purpose 1 edited" "table_row"

admin/tool/httpsreplace/tests/behat/httpsreplace.feature

@@ -5,7 +5,10 @@ Feature: View the httpsreplace report
   I need to be able to automatically replace http links
 
   Background: Create some http links
-    Given I am on site homepage
+    # This is a slow running feature and on slow databases can take over 30 seconds to complete.
+    Given I mark this test as slow setting a timeout factor of 2
+
+    And I am on site homepage
     And the following "courses" exist:
       | fullname | shortname | category | summary                                                                                                     |
       | Course 1 | C1        | 0        | <img src="http://intentionally.unavailable/test.png"> <img src="http://download.moodle.org/unittest/test.jpg"> |

admin/tool/langimport/classes/output/langimport_page.php

@@ -22,8 +22,8 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 namespace tool_langimport\output;
-defined('MOODLE_INTERNAL') || die();
 
+use core_collator;
 use moodle_url;
 use renderable;
 use renderer_base;
@@ -95,6 +95,8 @@ class langimport_page implements renderable, templatable {
 
         if (!empty($this->availablelanguages)) {
             $data->toinstalloptions = [];
+
+            core_collator::asort($this->availablelanguages);
             foreach ($this->availablelanguages as $code => $language) {
                 $option = new stdClass();
                 $option->value = $code;

admin/tool/licensemanager/tests/behat/delete_license.feature

@@ -10,12 +10,10 @@ Feature: Delete custom licenses
     And I navigate to "Licence > Licence manager" in site administration
     And I click on "Create licence" "link"
     And I set the following fields to these values:
-    | shortname      | MIT                                 |
-    | fullname       | MIT Licence                         |
-    | source         | https://opensource.org/licenses/MIT |
-    | version[day]   | 1                                   |
-    | version[month] | March                               |
-    | version[year]  | 2019                                |
+    | shortname       | MIT                                 |
+    | fullname        | MIT Licence                         |
+    | source          | https://opensource.org/licenses/MIT |
+    | Licence version | ##1 March 2019##                    |
     And I press "Save changes"
     And I click on "Delete" "icon" in the "MIT" "table_row"
     When I click on "Save changes" "button" in the "Delete licence" "dialogue"

admin/tool/licensemanager/tests/behat/edit_license.feature

@@ -9,12 +9,10 @@ Feature: Custom licences
     And I navigate to "Licence > Licence manager" in site administration
     And I click on "Create licence" "link"
     And I set the following fields to these values:
-      | shortname      | MIT                                 |
-      | fullname       | MIT Licence                         |
-      | source         | https://opensource.org/licenses/MIT |
-      | version[day]   | 1                                   |
-      | version[month] | January                             |
-      | version[year]  | 2020                                |
+      | shortname       | MIT                                 |
+      | fullname        | MIT Licence                         |
+      | source          | https://opensource.org/licenses/MIT |
+      | Licence version | ##first day of January 2020##       |
     When I press "Save changes"
     Then I should see "Licence manager"
     And I should see "MIT Licence" in the "MIT" "table_row"
@@ -25,12 +23,10 @@ Feature: Custom licences
     And I navigate to "Licence > Licence manager" in site administration
     And I click on "Create licence" "link"
     And I set the following fields to these values:
-      | shortname      | MIT                                 |
-      | fullname       | MIT Licence                         |
-      | source         | opensource.org/licenses/MIT         |
-      | version[day]   | 1                                   |
-      | version[month] | January                             |
-      | version[year]  | 2020                                |
+      | shortname       | MIT                         |
+      | fullname        | MIT Licence                 |
+      | source          | opensource.org/licenses/MIT |
+      | Licence version | ##2020-01-01##              |
     When I press "Save changes"
     Then I should see "Invalid source URL"
     And I set the following fields to these values:
@@ -49,12 +45,10 @@ Feature: Custom licences
     And I navigate to "Licence > Licence manager" in site administration
     And I click on "Create licence" "link"
     And I set the following fields to these values:
-      | shortname      | MIT                                 |
-      | fullname       | MIT Licence                         |
-      | source         | https://opensource.org/licenses/MIT |
-      | version[day]   | 1                                   |
-      | version[month] | March                               |
-      | version[year]  | 2019                                |
+      | shortname       | MIT                                 |
+      | fullname        | MIT Licence                         |
+      | source          | https://opensource.org/licenses/MIT |
+      | Licence version | ##1 March 2019##                    |
     When I press "Save changes"
     Then I should see "Licence manager"
     And I should see "2019030100" in the "MIT" "table_row"
@@ -65,12 +59,10 @@ Feature: Custom licences
     And I navigate to "Licence > Licence manager" in site administration
     And I click on "Create licence" "link"
     And I set the following fields to these values:
-      | shortname      | MIT                                 |
-      | fullname       | MIT Licence                         |
-      | source         | https://opensource.org/licenses/MIT |
-      | version[day]   | 1                                   |
-      | version[month] | March                               |
-      | version[year]  | 2019                                |
+      | shortname       | MIT                                 |
+      | fullname        | MIT Licence                         |
+      | source          | https://opensource.org/licenses/MIT |
+      | Licence version | ##1 Mar 2019##                      |
     And I press "Save changes"
     And I should see "Licence manager"
     And I should see "MIT Licence" in the "MIT" "table_row"

admin/tool/lp/classes/form/template_cohorts.php

@@ -26,7 +26,6 @@ namespace tool_lp\form;
 defined('MOODLE_INTERNAL') || die();
 
 use moodleform;
-use core\form\persistent;
 
 require_once($CFG->libdir . '/formslib.php');
 
@@ -39,17 +38,20 @@ require_once($CFG->libdir . '/formslib.php');
  */
 class template_cohorts extends moodleform {
 
+    /**
+     * Form definition
+     *
+     * @return void
+     */
     public function definition() {
         $mform = $this->_form;
 
         $options = array(
-            'ajax' => 'tool_lp/form-cohort-selector',
             'multiple' => true,
-            'data-contextid' => $this->_customdata['pagecontextid'],
-            'data-includes' => 'parents'
+            'exclude' => implode(',', $this->_customdata['excludecohorts']),
+            'contextid' => $this->_customdata['pagecontextid'],
         );
-        $mform->addElement('autocomplete', 'cohorts', get_string('selectcohortstosync', 'tool_lp'), array(), $options);
+        $mform->addElement('cohort', 'cohorts', get_string('selectcohortstosync', 'tool_lp'), $options);
         $mform->addElement('submit', 'submit', get_string('addcohorts', 'tool_lp'));
     }
-
 }

admin/tool/lp/template_cohorts.php

@@ -54,7 +54,19 @@ if ($canmanagetemplate && ($removecohort = optional_param('removecohort', false,
 }
 
 // Capture the form submission.
-$form = new \tool_lp\form\template_cohorts($url->out(false), array('pagecontextid' => $pagecontextid));
+$existingcohortsql =
+    'SELECT c.id
+       FROM {' . \core_competency\template_cohort::TABLE . '} tc
+       JOIN {cohort} c ON c.id = tc.cohortid
+      WHERE tc.templateid = :templateid';
+
+$existingcohorts = $DB->get_records_sql_menu($existingcohortsql, ['templateid' => $template->get('id')]);
+
+$form = new \tool_lp\form\template_cohorts($url->out(false), [
+    'pagecontextid' => $pagecontextid,
+    'excludecohorts' => array_keys($existingcohorts),
+]);
+
 if ($canmanagetemplate && ($data = $form->get_data()) && !empty($data->cohorts)) {
     $maxtocreate = 50;
     $maxreached = false;

admin/tool/lp/tests/behat/course_competencies.feature

@@ -53,11 +53,11 @@ Feature: See the competencies for an activity on the course competencies page.
     Then I should see "Test-Comp1"
     And I should see "Test-Comp2"
     And I set the field "Filter competencies by resource or activity" to "PageName1"
-    And I press key "13" in the field "Filter competencies by resource or activity"
+    And I press the enter key
     And I should see "Test-Comp1"
     And I should not see "Test-Comp2"
     And I set the field "Filter competencies by resource or activity" to "PageName2"
-    And I press key "13" in the field "Filter competencies by resource or activity"
+    And I press the enter key
     And I should not see "Test-Comp1"
     And I should not see "Test-Comp2"
     And I should see "No competencies have been linked to this activity or resource."

admin/tool/lp/tests/behat/plan_crud.feature

@@ -30,7 +30,7 @@ Feature: Manage plearning plan
     And I click on ".template-userplans" "css_element" in the "Science template" "table_row"
     And I open the autocomplete suggestions list
     And I click on "Admin User" item in the autocomplete list
-    And I press key "27" in the field "Select users to create learning plans for"
+    And I press the escape key
     When I click on "Create learning plans" "button"
     Then I should see "A learning plan was created"
     And I should see "Admin User" in the "Science template" "table_row"
@@ -53,9 +53,7 @@ Feature: Manage plearning plan
     And I follow "Home"
     And I navigate to "Competencies > Learning plan templates" in site administration
     And I click on ".template-cohorts" "css_element" in the "Science template cohort" "table_row"
-    And I click on ".form-autocomplete-downarrow" "css_element"
-    And I click on "cohort plan" item in the autocomplete list
-    And I press key "27" in the field "Select cohorts to sync"
+    And I set the field "Select cohorts to sync" to "cohort plan"
     When I click on "Add cohorts" "button"
     Then I should see "2 learning plans were created."
     And I follow "Learning plan templates"

admin/tool/mobile/classes/api.php

@@ -221,7 +221,7 @@ class api {
         }
 
         // Identity providers.
-        $authsequence = get_enabled_auth_plugins(true);
+        $authsequence = get_enabled_auth_plugins();
         $identityproviders = \auth_plugin_base::get_identity_providers($authsequence);
         $identityprovidersdata = \auth_plugin_base::prepare_identity_providers_for_output($identityproviders, $OUTPUT);
         if (!empty($identityprovidersdata)) {
@@ -322,6 +322,12 @@ class api {
             }
         }
 
+        if (empty($section) or $section == 'supportcontact') {
+            $settings->supportname = $CFG->supportname;
+            $settings->supportemail = $CFG->supportemail;
+            $settings->supportpage = $CFG->supportpage;
+        }
+
         return $settings;
     }
 
@@ -487,6 +493,7 @@ class api {
                 '$mmSideMenuDelegate_mmaCompetency' => new lang_string('myplans', 'tool_lp'),
                 'CoreMainMenuDelegate_AddonBlog' => new lang_string('blog', 'blog'),
                 '$mmSideMenuDelegate_mmaFiles' => new lang_string('files'),
+                'CoreMainMenuDelegate_CoreTag' => new lang_string('tags'),
                 '$mmSideMenuDelegate_website' => new lang_string('webpage'),
                 '$mmSideMenuDelegate_help' => new lang_string('help'),
                 'CoreMainMenuDelegate_QrReader' => new lang_string('scanqrcode', 'tool_mobile'),
@@ -595,8 +602,21 @@ class api {
                 $timenow = time();
                 $expectedissuer = null;
                 foreach ($info['certinfo'] as $cert) {
+
+                    // Due to a bug in certain curl/openssl versions the signature algorithm isn't always correctly parsed.
+                    // See https://github.com/curl/curl/issues/3706 for reference.
+                    if (!array_key_exists('Signature Algorithm', $cert)) {
+                        // The malformed field that does contain the algorithm we're looking for looks like the following:
+                        // <WHITESPACE>Signature Algorithm: <ALGORITHM><CRLF><ALGORITHM>.
+                        preg_match('/\s+Signature Algorithm: (?<algorithm>[^\s]+)/', $cert['Public Key Algorithm'], $matches);
+
+                        $signaturealgorithm = $matches['algorithm'] ?? '';
+                    } else {
+                        $signaturealgorithm = $cert['Signature Algorithm'];
+                    }
+
                     // Check if the signature algorithm is weak (Android won't work with SHA-1).
-                    if ($cert['Signature Algorithm'] == 'sha1WithRSAEncryption' || $cert['Signature Algorithm'] == 'sha1WithRSA') {
+                    if ($signaturealgorithm == 'sha1WithRSAEncryption' || $signaturealgorithm == 'sha1WithRSA') {
                         $warnings[] = ['insecurealgorithmwarning', 'tool_mobile'];
                     }
                     // Check certificate start date.

admin/tool/mobile/classes/external.php

@@ -139,7 +139,7 @@ class external extends external_api {
             array(
                 'wwwroot' => new external_value(PARAM_RAW, 'Site URL.'),
                 'httpswwwroot' => new external_value(PARAM_RAW, 'Site https URL (if httpslogin is enabled).'),
-                'sitename' => new external_value(PARAM_TEXT, 'Site name.'),
+                'sitename' => new external_value(PARAM_RAW, 'Site name.'),
                 'guestlogin' => new external_value(PARAM_INT, 'Whether guest login is enabled.'),
                 'rememberusername' => new external_value(PARAM_INT, 'Values: 0 for No, 1 for Yes, 2 for optional.'),
                 'authloginviaemail' => new external_value(PARAM_INT, 'Whether log in via email is enabled.'),

admin/tool/mobile/tests/externallib_test.php

@@ -229,6 +229,10 @@ class tool_mobile_external_testcase extends externallib_advanced_testcase {
                 'value' => get_config('core_admin', 'coursecolor' . $number)
             ];
         }
+        $expected[] = ['name' => 'supportname', 'value' => $CFG->supportname];
+        $expected[] = ['name' => 'supportemail', 'value' => $CFG->supportemail];
+        $expected[] = ['name' => 'supportpage', 'value' => $CFG->supportpage];
+
         $this->assertCount(0, $result['warnings']);
         $this->assertEquals($expected, $result['settings']);
 

admin/tool/policy/amd/build/acceptances_filter_datasource.min.js

@@ -1,2 +1,2 @@
-define ("tool_policy/acceptances_filter_datasource",["jquery","core/ajax","core/notification"],function(a,b,c){return{list:function list(b,c){var d=[],e=a(b),f=a(b).data("originaloptionsjson"),g=e.val();a.each(f,function(b,e){if(""!==a.trim(c)&&-1===e.label.toLocaleLowerCase().indexOf(c.toLocaleLowerCase())){return!0}if(-1<a.inArray(e.value,g)){return!0}d.push(e);return!0});var h=new a.Deferred;h.resolve(d);return h.promise()},processResults:function processResults(b,c){var d=[];a.each(c,function(a,b){d.push({value:b.value,label:b.label})});return d},transport:function transport(a,b,d){this.list(a,b).then(d).catch(c.exception)}}});
+define ("tool_policy/acceptances_filter_datasource",["jquery","core/ajax","core/notification"],function(a,b,c){return{list:function list(b,c){var d=[],e=a(b),f=a(b).data("originaloptionsjson"),g=e.val();a.each(f,function(b,e){if(""!==c.trim()&&-1===e.label.toLocaleLowerCase().indexOf(c.toLocaleLowerCase())){return!0}if(-1<a.inArray(e.value,g)){return!0}d.push(e);return!0});var h=new a.Deferred;h.resolve(d);return h.promise()},processResults:function processResults(b,c){var d=[];a.each(c,function(a,b){d.push({value:b.value,label:b.label})});return d},transport:function transport(a,b,d){this.list(a,b).then(d).catch(c.exception)}}});
 //# sourceMappingURL=acceptances_filter_datasource.min.js.map

admin/tool/policy/amd/src/acceptances_filter_datasource.js

@@ -41,7 +41,7 @@ define(['jquery', 'core/ajax', 'core/notification'], function($, Ajax, Notificat
             var selectedFilters = el.val();
             $.each(originalOptions, function(index, option) {
                 // Skip option if it does not contain the query string.
-                if ($.trim(query) !== '' && option.label.toLocaleLowerCase().indexOf(query.toLocaleLowerCase()) === -1) {
+                if (query.trim() !== '' && option.label.toLocaleLowerCase().indexOf(query.toLocaleLowerCase()) === -1) {
                     return true;
                 }
                 // Skip filters that have already been selected.

admin/tool/policy/classes/acceptances_table.php

@@ -641,6 +641,6 @@ class acceptances_table extends \table_sql {
             }
             return ''; // User agreed by themselves.
         }
-        return null;
+        return parent::other_cols($column, $row);
     }
 }

admin/tool/templatelibrary/amd/build/search.min.js

@@ -1,2 +1,2 @@
-define ("tool_templatelibrary/search",["jquery","core/ajax","core/log","core/notification","core/templates","core/config"],function(a,b,c,d,e,f){var g=function(b){e.render("tool_templatelibrary/search_results",{templates:b}).done(function(b,c){e.replaceNode(a("[data-region=\"searchresults\"]"),b,c)}).fail(d.exception)},h=function(c){var e=a("[data-field=\"component\"]").val(),f=a("[data-field=\"search\"]").val();document.location.hash=f;b.call([{methodname:"tool_templatelibrary_list_templates",args:{component:e,search:f,themename:c},done:g,fail:d.exception}],!0,!1)},i=null,j=function(a,b){if(null!==i){window.clearTimeout(i)}i=window.setTimeout(function(){a();i=null},b)},k=function(){j(h.bind(this,f.theme),400)};a("[data-region=\"list-templates\"]").on("change","[data-field=\"component\"]",k);a("[data-region=\"list-templates\"]").on("input","[data-field=\"search\"]",k);a("[data-field=\"search\"]").val(document.location.hash.replace("#",""));h(f.theme);return{}});
+define ("tool_templatelibrary/search",["jquery","core/ajax","core/log","core/notification","core/templates","core/config"],function(a,b,c,d,e,f){var g=function(b){e.render("tool_templatelibrary/search_results",{templates:b}).done(function(b,c){e.replaceNode(a("[data-region=\"searchresults\"]"),b,c)}).fail(d.exception)},h=function(c){var e=a("[data-field=\"component\"]").val(),f=a("[data-field=\"search\"]").val();b.call([{methodname:"tool_templatelibrary_list_templates",args:{component:e,search:f,themename:c},done:g,fail:d.exception}],!0,!1)},i=null,j=function(a,b){if(null!==i){window.clearTimeout(i)}i=window.setTimeout(function(){a();i=null},b)},k=function(){j(h.bind(this,f.theme),400)};a("[data-region=\"list-templates\"]").on("change","[data-field=\"component\"]",k);a("[data-region=\"list-templates\"]").on("input","[data-field=\"search\"]",k);h(f.theme);return{}});
 //# sourceMappingURL=search.min.js.map

admin/tool/templatelibrary/amd/src/search.js

@@ -48,8 +48,6 @@ define(['jquery', 'core/ajax', 'core/log', 'core/notification', 'core/templates'
         var searchStr = $('[data-field="search"]').val();
 
         // Trigger the search.
-        document.location.hash = searchStr;
-
         ajax.call([
             {methodname: 'tool_templatelibrary_list_templates',
               args: {component: componentStr, search: searchStr, themename: themename},
@@ -86,7 +84,6 @@ define(['jquery', 'core/ajax', 'core/log', 'core/notification', 'core/templates'
     $('[data-region="list-templates"]').on('change', '[data-field="component"]', changeHandler);
     $('[data-region="list-templates"]').on('input', '[data-field="search"]', changeHandler);
 
-    $('[data-field="search"]').val(document.location.hash.replace('#', ''));
     refreshSearch(config.theme);
     return {};
 });

admin/tool/templatelibrary/classes/output/list_templates_page.php

@@ -38,6 +38,22 @@ use tool_templatelibrary\api;
  */
 class list_templates_page implements renderable, templatable {
 
+    /** @var string $component The currently selected component */
+    protected $component;
+    /** @var string $search The current search */
+    protected $search;
+
+    /**
+     * Template page constructor
+     *
+     * @param string $component
+     * @param string $search
+     */
+    public function __construct(string $component = '', string $search = '') {
+        $this->component = $component;
+        $this->search = $search;
+    }
+
     /**
      * Export this data so it can be used as the context for a mustache template.
      *
@@ -46,6 +62,7 @@ class list_templates_page implements renderable, templatable {
     public function export_for_template(renderer_base $output) {
         $data = new stdClass();
         $data->allcomponents = array();
+        $data->search = $this->search;
         $fulltemplatenames = api::list_templates();
         $pluginmanager = core_plugin_manager::instance();
         $components = array();
@@ -59,6 +76,7 @@ class list_templates_page implements renderable, templatable {
         foreach ($components as $component) {
             $info = new stdClass();
             $info->component = $component;
+            $info->selected = ($component === $this->component);
             if (strpos($component, 'core') === 0) {
                 $info->name = get_string('coresubsystem', 'tool_templatelibrary', $component);
             } else {

admin/tool/templatelibrary/templates/list_templates_page.mustache

@@ -36,10 +36,10 @@
         <div class="control-group">
             <label for="selectcomponent" class="control-label">{{#str}}component, tool_templatelibrary{{/str}}</label>
             <div class="controls">
-                <select id="selectcomponent" data-field="component">
+                <select id="selectcomponent" name="component" data-field="component">
                     <option value="">{{#str}}all, tool_templatelibrary{{/str}}</option>
                     {{#allcomponents}}
-                        <option value="{{component}}">{{name}}</option>
+                        <option value="{{component}}" {{#selected}}selected{{/selected}}>{{name}}</option>
                     {{/allcomponents}}
                 </select>
             </div>
@@ -47,7 +47,7 @@
         <div class="control-group">
             <label for="search" class="control-label">{{#str}}search, tool_templatelibrary{{/str}}</label>
             <div class="controls">
-                <input type="text" id="search" data-field="search"/>
+                <input type="text" id="search" name="search" value="{{ search }}" data-field="search"/>
             </div>
         </div>
     </form>

admin/tool/uploadcourse/classes/course.php

@@ -902,36 +902,31 @@ class tool_uploadcourse_course {
             unset($method['delete']);
             unset($method['disable']);
 
-            if (!empty($instance) && $todelete) {
+            if ($todelete) {
                 // Remove the enrolment method.
-                foreach ($instances as $instance) {
-                    if ($instance->enrol == $enrolmethod) {
-                        $plugin = $enrolmentplugins[$instance->enrol];
-                        $plugin->delete_instance($instance);
-                        break;
-                    }
+                if ($instance) {
+                    $plugin = $enrolmentplugins[$instance->enrol];
+                    $plugin->delete_instance($instance);
                 }
             } else if (!empty($instance) && $todisable) {
                 // Disable the enrolment.
-                foreach ($instances as $instance) {
-                    if ($instance->enrol == $enrolmethod) {
-                        $plugin = $enrolmentplugins[$instance->enrol];
-                        $plugin->update_status($instance, ENROL_INSTANCE_DISABLED);
-                        $enrol_updated = true;
-                        break;
-                    }
-                }
+                $plugin = $enrolmentplugins[$instance->enrol];
+                $plugin->update_status($instance, ENROL_INSTANCE_DISABLED);
+                $enrol_updated = true;
             } else {
                 $plugin = null;
+
+                $status = ($todisable) ? ENROL_INSTANCE_DISABLED : ENROL_INSTANCE_ENABLED;
+
                 if (empty($instance)) {
                     $plugin = $enrolmentplugins[$enrolmethod];
-                    $instance = new stdClass();
-                    $instance->id = $plugin->add_default_instance($course);
+                    $instanceid = $plugin->add_default_instance($course);
+                    $instance = $DB->get_record('enrol', ['id' => $instanceid]);
                     $instance->roleid = $plugin->get_config('roleid');
-                    $instance->status = ENROL_INSTANCE_ENABLED;
+                    $plugin->update_status($instance, $status);
                 } else {
                     $plugin = $enrolmentplugins[$instance->enrol];
-                    $plugin->update_status($instance, ENROL_INSTANCE_ENABLED);
+                    $plugin->update_status($instance, $status);
                 }
 
                 // Now update values.

admin/tool/uploadcourse/tests/behat/enrolments.feature

@@ -0,0 +1,114 @@
+@tool @tool_uploadcourse @_file_upload
+Feature: An admin can update courses enrolments using a CSV file
+  In order to update courses enrolments using a CSV file
+  As an admin
+  I need to be able to upload a CSV file with enrolment methods for the courses
+
+  Background:
+    Given the following "courses" exist:
+      | fullname | shortname | category |
+      | Course 1 | C1        | 0        |
+    And I log in as "admin"
+
+  @javascript
+  Scenario: Creating enrolment method by enable it
+    Given I am on "Course 1" course homepage
+    And I navigate to "Users > Enrolment methods" in current page administration
+    And I click on "Delete" "link" in the "Guest access" "table_row"
+    And I click on "Continue" "button"
+    And I should not see "Guest access" in the "generaltable" "table"
+    And I navigate to "Courses > Upload courses" in site administration
+    And I upload "admin/tool/uploadcourse/tests/fixtures/enrolment_enable.csv" file to "File" filemanager
+    And I set the field "Upload mode" to "Only update existing courses"
+    And I set the field "Update mode" to "Update with CSV data only"
+    And I set the field "Allow deletes" to "Yes"
+    And I click on "Preview" "button"
+    When I click on "Upload courses" "button"
+    Then I should see "Course updated"
+    And I am on "Course 1" course homepage
+    And I navigate to "Users > Enrolment methods" in current page administration
+    And "Disable" "icon" should exist in the "Guest access" "table_row"
+
+  @javascript
+  Scenario: Creating enrolment method by disabling it
+    Given I am on "Course 1" course homepage
+    And I navigate to "Users > Enrolment methods" in current page administration
+    And I click on "Delete" "link" in the "Guest access" "table_row"
+    And I click on "Continue" "button"
+    And I should not see "Guest access" in the "generaltable" "table"
+    And I navigate to "Courses > Upload courses" in site administration
+    And I upload "admin/tool/uploadcourse/tests/fixtures/enrolment_disable.csv" file to "File" filemanager
+    And I set the field "Upload mode" to "Only update existing courses"
+    And I set the field "Update mode" to "Update with CSV data only"
+    And I set the field "Allow deletes" to "Yes"
+    And I click on "Preview" "button"
+    When I click on "Upload courses" "button"
+    Then I should see "Course updated"
+    And I am on "Course 1" course homepage
+    And I navigate to "Users > Enrolment methods" in current page administration
+    And "Enable" "icon" should exist in the "Guest access" "table_row"
+
+  @javascript
+  Scenario: Enabling enrolment method
+    Given I navigate to "Courses > Upload courses" in site administration
+    And I upload "admin/tool/uploadcourse/tests/fixtures/enrolment_enable.csv" file to "File" filemanager
+    And I set the field "Upload mode" to "Only update existing courses"
+    And I set the field "Update mode" to "Update with CSV data only"
+    And I set the field "Allow deletes" to "Yes"
+    And I click on "Preview" "button"
+    When I click on "Upload courses" "button"
+    Then I should see "Course updated"
+    And I am on "Course 1" course homepage
+    And I navigate to "Users > Enrolment methods" in current page administration
+    And "Disable" "icon" should exist in the "Guest access" "table_row"
+
+  @javascript
+  Scenario: Disable an enrolment method
+    Given I am on "Course 1" course homepage
+    And I navigate to "Users > Enrolment methods" in current page administration
+    And I click on "Enable" "link" in the "Guest access" "table_row"
+    And "Disable" "icon" should exist in the "Guest access" "table_row"
+    And I navigate to "Courses > Upload courses" in site administration
+    And I upload "admin/tool/uploadcourse/tests/fixtures/enrolment_disable.csv" file to "File" filemanager
+    And I set the field "Upload mode" to "Only update existing courses"
+    And I set the field "Update mode" to "Update with CSV data only"
+    And I set the field "Allow deletes" to "Yes"
+    And I click on "Preview" "button"
+    When I click on "Upload courses" "button"
+    Then I should see "Course updated"
+    And I am on "Course 1" course homepage
+    And I navigate to "Users > Enrolment methods" in current page administration
+    And "Enable" "icon" should exist in the "Guest access" "table_row"
+
+  @javascript
+  Scenario: Delete an enrolment method
+    Given I navigate to "Courses > Upload courses" in site administration
+    And I upload "admin/tool/uploadcourse/tests/fixtures/enrolment_delete.csv" file to "File" filemanager
+    And I set the field "Upload mode" to "Only update existing courses"
+    And I set the field "Update mode" to "Update with CSV data only"
+    And I set the field "Allow deletes" to "Yes"
+    And I click on "Preview" "button"
+    When I click on "Upload courses" "button"
+    Then I should see "Course updated"
+    And I am on "Course 1" course homepage
+    And I navigate to "Users > Enrolment methods" in current page administration
+    And I should not see "Guest access" in the "generaltable" "table"
+
+  @javascript
+  Scenario: Delete an unexistent enrolment method (nothing should change)
+    Given I am on "Course 1" course homepage
+    And I navigate to "Users > Enrolment methods" in current page administration
+    And I click on "Delete" "link" in the "Guest access" "table_row"
+    And I click on "Continue" "button"
+    And I should not see "Guest access" in the "generaltable" "table"
+    And I navigate to "Courses > Upload courses" in site administration
+    And I upload "admin/tool/uploadcourse/tests/fixtures/enrolment_delete.csv" file to "File" filemanager
+    And I set the field "Upload mode" to "Only update existing courses"
+    And I set the field "Update mode" to "Update with CSV data only"
+    And I set the field "Allow deletes" to "Yes"
+    And I click on "Preview" "button"
+    When I click on "Upload courses" "button"
+    Then I should see "Course updated"
+    And I am on "Course 1" course homepage
+    And I navigate to "Users > Enrolment methods" in current page administration
+    And I should not see "Guest access" in the "generaltable" "table"

admin/tool/uploadcourse/tests/fixtures/enrolment_delete.csv

@@ -0,0 +1,2 @@
+shortname,category,enrolment_1,enrolment_1_delete
+C1,1,guest,1

admin/tool/uploadcourse/tests/fixtures/enrolment_disable.csv

@@ -0,0 +1,2 @@
+shortname,category,enrolment_1,enrolment_1_disable
+C1,1,guest,1

admin/tool/uploadcourse/tests/fixtures/enrolment_enable.csv

@@ -0,0 +1,2 @@
+shortname,category,enrolment_1,enrolment_1_disable
+C1,1,guest,0

admin/tool/uploaduser/user_form.php

@@ -293,7 +293,7 @@ class admin_uploaduser_form2 extends moodleform {
         $mform->setAdvanced('url');
 
         $mform->addElement('text', 'idnumber', get_string('idnumber'), 'maxlength="255" size="25"');
-        $mform->setType('idnumber', PARAM_NOTAGS);
+        $mform->setType('idnumber', core_user::get_property_type('idnumber'));
         $mform->setForceLtr('idnumber');
 
         $mform->addElement('text', 'institution', get_string('institution'), 'maxlength="255" size="25"');

admin/tool/usertours/classes/privacy/provider.php

@@ -47,7 +47,7 @@ class provider implements
     /**
      * Returns meta data about this system.
      *
-     * @param   collection     $itemcollection The initialised item collection to add items to.
+     * @param   collection     $items The initialised item collection to add items to.
      * @return  collection     A listing of user data stored through this system.
      */
     public static function get_metadata(collection $items) : collection {
@@ -64,7 +64,7 @@ class provider implements
      * @param   int         $userid The userid of the user whose data is to be exported.
      */
     public static function export_user_preferences(int $userid) {
-        $preferences = get_user_preferences();
+        $preferences = get_user_preferences(null, null, $userid);
         foreach ($preferences as $name => $value) {
             $descriptionidentifier = null;
             $tourid = null;

admin/tool/usertours/classes/tour.php

@@ -557,9 +557,10 @@ class tour {
 
         // Remove the configuration for the tour.
         $DB->delete_records('tool_usertours_tours', array('id' => $this->id));
-
         helper::reset_tour_sortorder();
 
+        $this->remove_user_preferences();
+
         return null;
     }
 
@@ -585,6 +586,16 @@ class tour {
         return $this;
     }
 
+    /**
+     * Remove stored user preferences for the tour
+     */
+    protected function remove_user_preferences(): void {
+        global $DB;
+
+        $DB->delete_records('user_preferences', ['name' => self::TOUR_LAST_COMPLETED_BY_USER . $this->get_id()]);
+        $DB->delete_records('user_preferences', ['name' => self::TOUR_REQUESTED_BY_USER . $this->get_id()]);
+    }
+
     /**
      * Whether this tour should be displayed to the user.
      *
@@ -665,11 +676,9 @@ class tour {
      * @return  $this
      */
     public function mark_major_change() {
-        global $DB;
-
         // Clear old reset and completion notes.
-        $DB->delete_records('user_preferences', ['name' => self::TOUR_LAST_COMPLETED_BY_USER . $this->get_id()]);
-        $DB->delete_records('user_preferences', ['name' => self::TOUR_REQUESTED_BY_USER . $this->get_id()]);
+        $this->remove_user_preferences();
+
         $this->set_config('majorupdatetime', time());
         $this->persist();
 

admin/tool/usertours/db/upgrade.php

@@ -25,6 +25,7 @@
 defined('MOODLE_INTERNAL') || die();
 
 use tool_usertours\manager;
+use tool_usertours\tour;
 
 /**
  * Upgrade the user tours plugin.
@@ -57,5 +58,26 @@ function xmldb_tool_usertours_upgrade($oldversion) {
     // Automatically generated Moodle v3.9.0 release upgrade line.
     // Put any upgrade step following this.
 
+    if ($oldversion < 2020061502) {
+        // Clean up user preferences of deleted tours.
+        $select = $DB->sql_like('name', ':lastcompleted') . ' OR ' . $DB->sql_like('name', ':requested');
+        $params = [
+            'lastcompleted' => tour::TOUR_LAST_COMPLETED_BY_USER . '%',
+            'requested' => tour::TOUR_REQUESTED_BY_USER . '%',
+        ];
+
+        $preferences = $DB->get_records_select('user_preferences', $select, $params, '', 'DISTINCT name');
+        foreach ($preferences as $preference) {
+            // Match tour ID at the end of the preference name, remove all of that preference type if tour ID doesn't exist.
+            if (preg_match('/(?<tourid>\d+)$/', $preference->name, $matches) &&
+                    !$DB->record_exists('tool_usertours_tours', ['id' => $matches['tourid']])) {
+
+                $DB->delete_records('user_preferences', ['name' => $preference->name]);
+            }
+        }
+
+        upgrade_plugin_savepoint(true, 2020061502, 'tool', 'usertours');
+    }
+
     return true;
 }

admin/tool/usertours/tests/privacy_provider_test.php

@@ -15,9 +15,9 @@
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
 /**
- * Unit tests for the block_html implementation of the privacy API.
+ * Unit tests for the tool_usertours implementation of the privacy API.
  *
- * @package    block_html
+ * @package    tool_usertours
  * @category   test
  * @copyright  2018 Andrew Nicols <andrew@nicols.co.uk>
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
@@ -27,19 +27,22 @@ defined('MOODLE_INTERNAL') || die();
 
 use \core_privacy\local\metadata\collection;
 use \core_privacy\local\request\writer;
-use \core_privacy\local\request\approved_contextlist;
-use \core_privacy\local\request\deletion_criteria;
 use \tool_usertours\tour;
 use \tool_usertours\privacy\provider;
 
 /**
- * Unit tests for the block_html implementation of the privacy API.
+ * Unit tests for the tool_usertours implementation of the privacy API.
  *
  * @copyright  2018 Andrew Nicols <andrew@nicols.co.uk>
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
-class tool_usertours_privacy_testcase extends \core_privacy\tests\provider_testcase {
+class tool_usertours_privacy_provider_testcase extends \core_privacy\tests\provider_testcase {
 
+    /**
+     * Helper method for creating a tour
+     *
+     * @return tour
+     */
     protected function create_test_tour(): tour {
         return (new tour())
             ->set_name('test_tour')
@@ -118,6 +121,37 @@ class tool_usertours_privacy_testcase extends \core_privacy\tests\provider_testc
         $this->assertCount(2, (array) $prefs);
     }
 
+    /**
+     * Make sure we are exporting preferences for the correct user
+     */
+    public function test_export_user_preferences_correct_user(): void {
+        $this->resetAfterTest();
+
+        $tour = $this->create_test_tour();
+
+        // Create test user, mark them as having completed the tour.
+        $user = $this->getDataGenerator()->create_user();
+        $this->setUser($user);
+        $tour->mark_user_completed();
+
+        // Switch to admin user, mark them as having reset the tour.
+        $this->setAdminUser();
+        $tour->request_user_reset();
+
+        // Export test users preferences.
+        provider::export_user_preferences($user->id);
+
+        $writer = writer::with_context(\context_system::instance());
+        $this->assertTrue($writer->has_any_data());
+
+        $prefs = $writer->get_user_preferences('tool_usertours');
+        $this->assertCount(1, (array) $prefs);
+
+        // We should have received back the "completed tour" preference of the test user.
+        $this->assertStringStartsWith('You last marked the "' . $tour->get_name() . '" user tour as completed on',
+            reset($prefs)->description);
+    }
+
     /**
      * Ensure that export_user_preferences excludes deleted tours.
      */

admin/tool/usertours/tests/tour_test.php

@@ -64,7 +64,7 @@ class tour_testcase extends advanced_testcase {
     /**
      * Helper to mock the database.
      *
-     * @return moodle_database
+     * @return \PHPUnit\Framework\MockObject\MockObject
      */
     public function mock_database() {
         global $DB;
@@ -569,9 +569,14 @@ class tour_testcase extends advanced_testcase {
 
         // Mock the database.
         $DB = $this->mock_database();
-        $DB->expects($this->once())
+
+        $DB->expects($this->exactly(3))
             ->method('delete_records')
-            ->with($this->equalTo('tool_usertours_tours'), $this->equalTo(['id' => $id]))
+            ->withConsecutive(
+                [$this->equalTo('tool_usertours_tours'), $this->equalTo(['id' => $id])],
+                [$this->equalTo('user_preferences'), $this->equalTo(['name' => tour::TOUR_LAST_COMPLETED_BY_USER . $id])],
+                [$this->equalTo('user_preferences'), $this->equalTo(['name' => tour::TOUR_REQUESTED_BY_USER . $id])]
+            )
             ->willReturn(null)
             ;
 

admin/tool/usertours/version.php

@@ -24,6 +24,6 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version   = 2020061501;            // The current module version (Date: YYYYMMDDXX).
+$plugin->version   = 2020061502;            // The current module version (Date: YYYYMMDDXX).
 $plugin->requires  = 2020060900;            // Requires this Moodle version.
 $plugin->component = 'tool_usertours';      // Full name of the plugin (used for diagnostics).

admin/tool/xmldb/actions/XMLDBCheckAction.class.php

@@ -149,7 +149,7 @@ abstract class XMLDBCheckAction extends XMLDBAction {
                                 continue;
                             }
                             // Fetch metadata from physical DB. All the columns info.
-                            if (!$metacolumns = $DB->get_columns($xmldb_table->getName())) {
+                            if (!$metacolumns = $DB->get_columns($xmldb_table->getName(), false)) {
                                 // / Skip table if no metacolumns is available for it
                                 continue;
                             }

admin/tool/xmldb/actions/create_xml_file/create_xml_file.class.php

@@ -93,7 +93,7 @@ class create_xml_file extends XMLDBAction {
         $c.= '        </KEYS>' . "\n";
         $c.= '      </TABLE>' . "\n";
         $c.= '    </TABLES>' . "\n";
-        $c.= '  </XMLDB>';
+        $c.= '  </XMLDB>' . "\n";
 
         if (!file_put_contents($file, $c)) {
             $errormsg = 'Error creando fichero ' . $file;

analytics/classes/model.php

@@ -1492,6 +1492,17 @@ class model {
             $prediction->get_prediction_data()->contextid, $prediction->get_sample_data());
     }
 
+    /**
+     * Returns the default output directory for prediction processors
+     *
+     * @return string
+     */
+    public static function default_output_dir(): string {
+        global $CFG;
+
+        return $CFG->dataroot . DIRECTORY_SEPARATOR . 'models';
+    }
+
     /**
      * Returns the output directory for prediction processors.
      *
@@ -1506,8 +1517,6 @@ class model {
      * @return string
      */
     public function get_output_dir($subdirs = array(), $onlymodelid = false) {
-        global $CFG;
-
         $subdirstr = '';
         foreach ($subdirs as $subdir) {
             $subdirstr .= DIRECTORY_SEPARATOR . $subdir;
@@ -1516,7 +1525,7 @@ class model {
         $outputdir = get_config('analytics', 'modeloutputdir');
         if (empty($outputdir)) {
             // Apply default value.
-            $outputdir = rtrim($CFG->dataroot, '/') . DIRECTORY_SEPARATOR . 'models';
+            $outputdir = self::default_output_dir();
         }
 
         // Append model id.

analytics/tests/behat/manage_models.feature

@@ -55,10 +55,7 @@ Feature: Manage analytics models
     And I choose "Create model" in the open action menu
     And I set the field "Enabled" to "Enable"
     And I select "__core_course__analytics__target__course_completion" from the "target" singleselect
-    And I open the autocomplete suggestions list
-    And I click on "Read actions amount" item in the autocomplete list
-    And I open the autocomplete suggestions list
-    And I click on "Any write action in the course" item in the autocomplete list
+    And I set the field "Indicators" to "Read actions amount, Any write action in the course"
     And I select "__core__analytics__time_splitting__single_range" from the "timesplitting" singleselect
     And I press "Save changes"
     Then I should see "No predictions available yet" in the "Students at risk of not meeting the course completion conditions" "table_row"

auth/db/auth.php

@@ -462,7 +462,7 @@ class auth_plugin_db extends auth_plugin_base {
                     continue;
                 }
                 try {
-                    $id = user_create_user($user, false); // It is truly a new user.
+                    $id = user_create_user($user, false, false); // It is truly a new user.
                     $trace->output(get_string('auth_dbinsertuser', 'auth_db', array('name'=>$user->username, 'id'=>$id)), 1);
                 } catch (moodle_exception $e) {
                     $trace->output(get_string('auth_dbinsertusererror', 'auth_db', $user->username), 1);
@@ -481,6 +481,8 @@ class auth_plugin_db extends auth_plugin_base {
 
                 // Make sure user context is present.
                 context_user::instance($id);
+
+                \core\event\user_created::create_from_userid($id)->trigger();
             }
             unset($add_users);
         }

auth/db/tests/db_test.php

@@ -119,6 +119,7 @@ class auth_db_testcase extends advanced_testcase {
         $table->add_field('email', XMLDB_TYPE_CHAR, '255', null, null, null);
         $table->add_field('firstname', XMLDB_TYPE_CHAR, '255', null, null, null);
         $table->add_field('lastname', XMLDB_TYPE_CHAR, '255', null, null, null);
+        $table->add_field('animal', XMLDB_TYPE_CHAR, '255', null, null, null);
         $table->add_key('primary', XMLDB_KEY_PRIMARY, array('id'));
         if ($dbman->table_exists($table)) {
             $dbman->drop_table($table);
@@ -137,6 +138,15 @@ class auth_db_testcase extends advanced_testcase {
         set_config('field_updateremote_email', '0', 'auth_db');
         set_config('field_lock_email', 'unlocked', 'auth_db');
 
+        // Create a user profile field and add mapping to it.
+        $DB->insert_record('user_info_field', ['shortname' => 'pet', 'name' => 'Pet', 'required' => 0,
+            'visible' => 1, 'locked' => 0, 'categoryid' => 1, 'datatype' => 'text']);
+
+        set_config('field_map_profile_field_pet', 'animal', 'auth_db');
+        set_config('field_updatelocal_profile_field_pet', 'oncreate', 'auth_db');
+        set_config('field_updateremote_profile_field_pet', '0', 'auth_db');
+        set_config('field_lock_profile_field_pet', 'unlocked', 'auth_db');
+
         // Init the rest of settings.
         set_config('passtype', 'plaintext', 'auth_db');
         set_config('changepasswordurl', '', 'auth_db');
@@ -156,6 +166,7 @@ class auth_db_testcase extends advanced_testcase {
 
     public function test_plugin() {
         global $DB, $CFG;
+        require_once($CFG->dirroot . '/user/profile/lib.php');
 
         $this->resetAfterTest(true);
 
@@ -193,7 +204,7 @@ class auth_db_testcase extends advanced_testcase {
 
         // Test bulk user account creation.
 
-        $user2 = (object)array('name'=>'u2', 'pass'=>'heslo', 'email'=>'u2@example.com');
+        $user2 = (object)['name' => 'u2', 'pass' => 'heslo', 'email' => 'u2@example.com', 'animal' => 'cat'];
         $user2->id = $DB->insert_record('auth_db_users', $user2);
 
         $user3 = (object)array('name'=>'admin', 'pass'=>'heslo', 'email'=>'admin@example.com'); // Should be skipped.
@@ -202,13 +213,24 @@ class auth_db_testcase extends advanced_testcase {
         $this->assertCount(2, $DB->get_records('user'));
 
         $trace = new null_progress_trace();
-        $auth->sync_users($trace, false);
 
+        // Sync users and make sure that two events user_created werer triggered.
+        $sink = $this->redirectEvents();
+        $auth->sync_users($trace, false);
+        $events = $sink->get_events();
+        $sink->close();
+        $this->assertCount(2, $events);
+        $this->assertTrue($events[0] instanceof  \core\event\user_created);
+        $this->assertTrue($events[1] instanceof  \core\event\user_created);
+
+        // Assert the two users were created.
         $this->assertEquals(4, $DB->count_records('user'));
         $u1 = $DB->get_record('user', array('username'=>$user1->name, 'auth'=>'db'));
         $this->assertSame($user1->email, $u1->email);
+        $this->assertEmpty(profile_user_record($u1->id)->pet);
         $u2 = $DB->get_record('user', array('username'=>$user2->name, 'auth'=>'db'));
         $this->assertSame($user2->email, $u2->email);
+        $this->assertSame($user2->animal, profile_user_record($u2->id)->pet);
         $admin = $DB->get_record('user', array('username'=>'admin', 'auth'=>'manual'));
         $this->assertNotEmpty($admin);
 
@@ -217,12 +239,14 @@ class auth_db_testcase extends advanced_testcase {
 
         $user2b = clone($user2);
         $user2b->email = 'u2b@example.com';
+        $user2b->animal = 'dog';
         $DB->update_record('auth_db_users', $user2b);
 
         $auth->sync_users($trace, false);
         $this->assertEquals(4, $DB->count_records('user'));
         $u2 = $DB->get_record('user', array('username'=>$user2->name));
         $this->assertSame($user2->email, $u2->email);
+        $this->assertSame($user2->animal, profile_user_record($u2->id)->pet);
 
         $auth->sync_users($trace, true);
         $this->assertEquals(4, $DB->count_records('user'));
@@ -231,6 +255,8 @@ class auth_db_testcase extends advanced_testcase {
 
         set_config('field_updatelocal_email', 'onlogin', 'auth_db');
         $auth->config->field_updatelocal_email = 'onlogin';
+        set_config('field_updatelocal_profile_field_pet', 'onlogin', 'auth_db');
+        $auth->config->field_updatelocal_profile_field_pet = 'onlogin';
 
         $auth->sync_users($trace, false);
         $this->assertEquals(4, $DB->count_records('user'));
@@ -241,6 +267,7 @@ class auth_db_testcase extends advanced_testcase {
         $this->assertEquals(4, $DB->count_records('user'));
         $u2 = $DB->get_record('user', array('username'=>$user2->name));
         $this->assertSame($user2b->email, $u2->email);
+        $this->assertSame($user2b->animal, profile_user_record($u2->id)->pet);
 
 
         // Test sync deletes and suspends.

auth/email/auth.php

@@ -178,10 +178,10 @@ class auth_plugin_email extends auth_plugin_base {
             if ($user->auth != $this->authtype) {
                 return AUTH_CONFIRM_ERROR;
 
-            } else if ($user->secret == $confirmsecret && $user->confirmed) {
+            } else if ($user->secret === $confirmsecret && $user->confirmed) {
                 return AUTH_CONFIRM_ALREADY;
 
-            } else if ($user->secret == $confirmsecret) {   // They have provided the secret key to get in
+            } else if ($user->secret === $confirmsecret) {   // They have provided the secret key to get in
                 $DB->set_field("user", "confirmed", 1, array("id"=>$user->id));
 
                 if ($wantsurl = get_user_preferences('auth_email_wantsurl', false, $user)) {
@@ -257,5 +257,3 @@ class auth_plugin_email extends auth_plugin_base {
     }
 
 }
-
-

auth/email/classes/external.php

@@ -147,12 +147,12 @@ class auth_email_external extends external_api {
                         array(
                             'id' => new external_value(PARAM_INT, 'Profile field id', VALUE_OPTIONAL),
                             'shortname' => new external_value(PARAM_ALPHANUMEXT, 'Profile field shortname', VALUE_OPTIONAL),
-                            'name' => new external_value(PARAM_TEXT, 'Profield field name', VALUE_OPTIONAL),
+                            'name' => new external_value(PARAM_RAW, 'Profield field name', VALUE_OPTIONAL),
                             'datatype' => new external_value(PARAM_ALPHANUMEXT, 'Profield field datatype', VALUE_OPTIONAL),
                             'description' => new external_value(PARAM_RAW, 'Profield field description', VALUE_OPTIONAL),
                             'descriptionformat' => new external_format_value('description'),
                             'categoryid' => new external_value(PARAM_INT, 'Profield field category id', VALUE_OPTIONAL),
-                            'categoryname' => new external_value(PARAM_TEXT, 'Profield field category name', VALUE_OPTIONAL),
+                            'categoryname' => new external_value(PARAM_RAW, 'Profield field category name', VALUE_OPTIONAL),
                             'sortorder' => new external_value(PARAM_INT, 'Profield field sort order', VALUE_OPTIONAL),
                             'required' => new external_value(PARAM_INT, 'Profield field required', VALUE_OPTIONAL),
                             'locked' => new external_value(PARAM_INT, 'Profield field locked', VALUE_OPTIONAL),

auth/email/tests/external_test.php

@@ -93,6 +93,51 @@ class auth_email_external_testcase extends externallib_advanced_testcase {
         $this->assertEquals('textarea', $namedarray['sometext']['datatype']);
     }
 
+    /**
+     * Test get_signup_settings with mathjax in a profile field.
+     */
+    public function test_get_signup_settings_with_mathjax_in_profile_fields() {
+        global $CFG, $DB;
+
+        require_once($CFG->dirroot . '/lib/externallib.php');
+
+        // Enable MathJax filter in content and headings.
+        $this->configure_filters([
+            ['name' => 'mathjaxloader', 'state' => TEXTFILTER_ON, 'move' => -1, 'applytostrings' => true],
+        ]);
+
+        // Create category with MathJax and a new field with MathJax.
+        $categoryname = 'Cat $$(a+b)=2$$';
+        $fieldname = 'Some text $$(a+b)=2$$';
+        $categoryid = $DB->insert_record('user_info_category', array('name' => $categoryname, 'sortorder' => 1));
+        $field3 = $DB->insert_record('user_info_field', array(
+                'shortname' => 'mathjaxname', 'name' => $fieldname, 'categoryid' => $categoryid,
+                'datatype' => 'textarea', 'signup' => 1, 'visible' => 1, 'required' => 1, 'sortorder' => 2));
+
+        $result = auth_email_external::get_signup_settings();
+        $result = external_api::clean_returnvalue(auth_email_external::get_signup_settings_returns(), $result);
+
+        // Format the original data.
+        $sitecontext = context_system::instance();
+        $categoryname = external_format_string($categoryname, $sitecontext->id);
+        $fieldname = external_format_string($fieldname, $sitecontext->id);
+
+        // Whip up a array with named entries to easily check against.
+        $namedarray = array();
+        foreach ($result['profilefields'] as $key => $value) {
+            $namedarray[$value['shortname']] = $value;
+        }
+
+        // Check the new profile field.
+        $this->assertArrayHasKey('mathjaxname', $namedarray);
+        $this->assertStringContainsString('<span class="filter_mathjaxloader_equation">',
+                $namedarray['mathjaxname']['categoryname']);
+        $this->assertStringContainsString('<span class="filter_mathjaxloader_equation">',
+                $namedarray['mathjaxname']['name']);
+        $this->assertEquals($categoryname, $namedarray['mathjaxname']['categoryname']);
+        $this->assertEquals($fieldname, $namedarray['mathjaxname']['name']);
+    }
+
     public function test_signup_user() {
         global $DB;
 

auth/ldap/auth.php

@@ -598,10 +598,10 @@ class auth_plugin_ldap extends auth_plugin_base {
             if ($user->auth != $this->authtype) {
                 return AUTH_CONFIRM_ERROR;
 
-            } else if ($user->secret == $confirmsecret && $user->confirmed) {
+            } else if ($user->secret === $confirmsecret && $user->confirmed) {
                 return AUTH_CONFIRM_ALREADY;
 
-            } else if ($user->secret == $confirmsecret) {   // They have provided the secret key to get in
+            } else if ($user->secret === $confirmsecret) {   // They have provided the secret key to get in
                 if (!$this->user_activate($username)) {
                     return AUTH_CONFIRM_FAIL;
                 }

auth/ldap/ntlmsso_attempt.php

@@ -8,7 +8,7 @@ $PAGE->set_context(context_system::instance());
 // Define variables used in page
 $site = get_site();
 
-$authsequence = get_enabled_auth_plugins(true); // auths, in sequence
+$authsequence = get_enabled_auth_plugins(); // Auths, in sequence.
 if (!in_array('ldap', $authsequence, true)) {
     print_error('ldap_isdisabled', 'auth');
 }

auth/ldap/ntlmsso_finish.php

@@ -8,7 +8,7 @@ $PAGE->set_context(context_system::instance());
 // Define variables used in page
 $site = get_site();
 
-$authsequence = get_enabled_auth_plugins(true); // auths, in sequence
+$authsequence = get_enabled_auth_plugins(); // Auths, in sequence.
 if (!in_array('ldap', $authsequence, true)) {
     print_error('ldap_isdisabled', 'auth');
 }

auth/ldap/ntlmsso_magic.php

@@ -10,7 +10,7 @@ require(__DIR__.'/../../config.php');
 
 $PAGE->set_context(context_system::instance());
 
-$authsequence = get_enabled_auth_plugins(true); // auths, in sequence
+$authsequence = get_enabled_auth_plugins(); // Auths, in sequence.
 if (!in_array('ldap', $authsequence, true)) {
     print_error('ldap_isdisabled', 'auth');
 }

auth/ldap/tests/plugin_test.php

@@ -543,7 +543,7 @@ class auth_ldap_plugin_testcase extends advanced_testcase {
     }
 
     protected function enable_plugin() {
-        $auths = get_enabled_auth_plugins(true);
+        $auths = get_enabled_auth_plugins();
         if (!in_array('ldap', $auths)) {
             $auths[] = 'ldap';
 

auth/oauth2/classes/auth.php

@@ -372,10 +372,10 @@ class auth extends \auth_plugin_base {
             if ($user->auth != $this->authtype) {
                 return AUTH_CONFIRM_ERROR;
 
-            } else if ($user->secret == $confirmsecret && $user->confirmed) {
+            } else if ($user->secret === $confirmsecret && $user->confirmed) {
                 return AUTH_CONFIRM_ALREADY;
 
-            } else if ($user->secret == $confirmsecret) {   // They have provided the secret key to get in.
+            } else if ($user->secret === $confirmsecret) {   // They have provided the secret key to get in.
                 $DB->set_field("user", "confirmed", 1, array("id" => $user->id));
                 return AUTH_CONFIRM_OK;
             }

auth/oauth2/login.php

@@ -27,6 +27,9 @@ require_once('../../config.php');
 $issuerid = required_param('id', PARAM_INT);
 $wantsurl = new moodle_url(optional_param('wantsurl', '', PARAM_URL));
 
+$PAGE->set_context(context_system::instance());
+$PAGE->set_url(new moodle_url('/auth/oauth2/login.php', ['id' => $issuerid]));
+
 require_sesskey();
 
 if (!\auth_oauth2\api::is_enabled()) {

auth/shibboleth/README.txt

@@ -182,7 +182,8 @@ How to customize the way the Shibboleth user data is used in Moodle
 Among the Shibboleth settings in Moodle there is a field that should contain a
 path to a php file that can be used as data manipulation hook.
 You can use this if you want to further process the way your Shibboleth
-attributes are used in Moodle.
+attributes are used in Moodle. Due to security reasons this file cannot be
+located within the current site data directory ($CFG->dataroot).
 
 Example 1: Your Shibboleth federation uses an attribute that specifies the
            user's preferred language, but the content of this attribute is not

auth/shibboleth/classes/admin_setting_special_convert_data_configfile.php

@@ -0,0 +1,75 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Special setting for auth_shibboleth convert_data.
+ *
+ * @package    auth_shibboleth
+ * @copyright  2020 Mihail Geshoski
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+/**
+ * Admin settings class for the convert_data option.
+ *
+ * @package    auth_shibboleth
+ * @copyright  2020 Mihail Geshoski
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class auth_shibboleth_admin_setting_convert_data extends admin_setting_configfile {
+
+    /**
+     * Constructor.
+     *
+     * @param string $name
+     * @param string $visiblename
+     * @param string $description
+     * @param mixed $defaultdirectory
+     */
+    public function __construct($name, $visiblename, $description, $defaultdirectory) {
+        parent::__construct($name, $visiblename, $description, $defaultdirectory);
+    }
+
+    /**
+     * Validate the file path (location).
+     *
+     * This method ensures that the file defined as a data modification API exists and is not located in the site
+     * data directory ($CFG->dataroot). We should prohibit using files from the site data directory as this introduces
+     * security vulnerabilities.
+     *
+     * @param string $filepath The path to the file.
+     * @return mixed bool true for success or string:error on failure.
+     */
+    public function validate($filepath) {
+        global $CFG;
+
+        if (empty($filepath)) {
+            return true;
+        }
+
+        // Fail if the file does not exist or it is not readable by the webserver process.
+        if (!is_readable($filepath)) {
+            return get_string('auth_shib_convert_data_warning', 'auth_shibboleth');
+        }
+
+        // Fail if the absolute file path matches the currently defined dataroot path.
+        if (preg_match('/' . preg_quote($CFG->dataroot, '/') . '/', realpath($filepath))) {
+            return get_string('auth_shib_convert_data_filepath_warning', 'auth_shibboleth');
+        }
+
+        return true;
+    }
+}

auth/shibboleth/db/upgrade.php

@@ -30,7 +30,7 @@ defined('MOODLE_INTERNAL') || die();
  * @return bool result
  */
 function xmldb_auth_shibboleth_upgrade($oldversion) {
-    global $CFG, $DB;
+    global $CFG, $DB, $OUTPUT;
 
     // Automatically generated Moodle v3.5.0 release upgrade line.
     // Put any upgrade step following this.
@@ -47,5 +47,27 @@ function xmldb_auth_shibboleth_upgrade($oldversion) {
     // Automatically generated Moodle v3.9.0 release upgrade line.
     // Put any upgrade step following this.
 
+    if ($oldversion < 2020061501) {
+        // The 'Data modification API' setting in the Shibboleth authentication plugin can no longer be configured
+        // to use files located within the site data directory, as it exposes the site to security risks. Therefore,
+        // we need to find every existing case and reset the 'Data modification API' setting to its default value.
+
+        $convertdataconfig = get_config('auth_shibboleth', 'convert_data');
+
+        if (preg_match('/' . preg_quote($CFG->dataroot, '/') . '/', realpath($convertdataconfig))) {
+            set_config('convert_data', '', 'auth_shibboleth');
+
+            $warn = 'Your \'Data modification API\' setting in the Shibboleth authentication plugin is currently
+            configured to use a file located within the current site data directory ($CFG->dataroot). You are no
+            longer able to use files from within this directory for this purpose as it exposes your site to security
+            risks. This setting has been reset to its default value. Please reconfigure it by providing a path
+            to a file which is not located within the site data directory.';
+
+            echo $OUTPUT->notification($warn, 'notifyproblem');
+        }
+
+        upgrade_plugin_savepoint(true, 2020061501, 'auth', 'shibboleth');
+    }
+
     return true;
 }

auth/shibboleth/lang/en/auth_shibboleth.php

@@ -38,6 +38,7 @@ $string['auth_shibboleth_select_organization'] = 'For authentication via Shibbol
 $string['auth_shib_convert_data'] = 'Data modification API';
 $string['auth_shib_convert_data_description'] = 'You can use this API to further modify the data provided by Shibboleth. Read the <a href="{$a}">README</a> for further instructions.';
 $string['auth_shib_convert_data_warning'] = 'The file does not exist or is not readable by the webserver process!';
+$string['auth_shib_convert_data_filepath_warning'] = 'You cannot use a file that is located within the current site data directory ($CFG->dataroot) as the data modification API.';
 $string['auth_shib_changepasswordurl'] = 'Password-change URL';
 $string['auth_shib_idp_list'] = 'Identity providers';
 $string['auth_shib_idp_list_description'] = 'Provide a list of Identity Provider entityIDs to let the user choose from on the login page.<br />On each line there must be a comma-separated tuple for entityID of the IdP (see the Shibboleth metadata file) and Name of IdP as it shall be displayed in the drop-down list.<br />As an optional third parameter you can add the location of a Shibboleth session initiator that shall be used in case your Moodle installation is part of a multi federation setup.';

auth/shibboleth/settings.php

@@ -28,6 +28,7 @@ if ($ADMIN->fulltree) {
     // We use a couple of custom admin settings since we need to massage the data before it is inserted into the DB.
     require_once($CFG->dirroot.'/auth/shibboleth/classes/admin_setting_special_wayf_select.php');
     require_once($CFG->dirroot.'/auth/shibboleth/classes/admin_setting_special_idp_configtextarea.php');
+    require_once($CFG->dirroot.'/auth/shibboleth/classes/admin_setting_special_convert_data_configfile.php');
 
     // Introductory explanation.
     $readmeurl = (new moodle_url('/auth/shibboleth/README.txt'))->out();
@@ -38,8 +39,8 @@ if ($ADMIN->fulltree) {
     $settings->add(new admin_setting_configtext('auth_shibboleth/user_attribute', get_string('username'),
             get_string('auth_shib_username_description', 'auth_shibboleth'), '', PARAM_RAW));
 
-    // COnvert Data configuration file.
-    $settings->add(new admin_setting_configfile('auth_shibboleth/convert_data',
+    // Convert Data configuration file.
+    $settings->add(new auth_shibboleth_admin_setting_convert_data('auth_shibboleth/convert_data',
             get_string('auth_shib_convert_data', 'auth_shibboleth'),
             get_string('auth_shib_convert_data_description', 'auth_shibboleth', $readmeurl), ''));
 

auth/shibboleth/upgrade.txt

@@ -1,6 +1,11 @@
 This files describes API changes in /auth/shibboleth/*,
 information provided here is intended especially for developers.
 
+=== 3.9.4 ===
+
+* The 'Data modification API' (convert_data) setting can no longer be configured to use files located within the
+  current site data directory ($CFG->dataroot), as it exposes the site to security risks.
+
 === 3.5.2 ===
 
 * Moved the public function unserializesession in auth/shibboleth/logout.php to auth/shibboleth/classes/helper.php and

auth/shibboleth/version.php

@@ -25,6 +25,6 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version   = 2020061500;        // The current plugin version (Date: YYYYMMDDXX)
+$plugin->version   = 2020061501;        // The current plugin version (Date: YYYYMMDDXX)
 $plugin->requires  = 2020060900;        // Requires this Moodle version
 $plugin->component = 'auth_shibboleth'; // Full name of the plugin (used for diagnostics)

backup/cc/cc2moodle.php

@@ -794,7 +794,7 @@ class cc2moodle {
         }
     }
 
-    protected function critical_error ($text) {
+    protected static function critical_error ($text) {
 
         $path_to_log = static::log_file();