Moodle release 4.1.10

* Filter out wrong field types when restoring or creating a field.

.eslintrc

@@ -1,8 +1,12 @@
 {
   'plugins': [
-    'babel',
+    '@babel',
     'promise',
-    'jsdoc',
+    'jsdoc'
+  ],
+  'extends': [
+    'eslint:recommended',
+    'plugin:promise/recommended'
   ],
   'env': {
     'browser': true,
@@ -16,42 +20,19 @@
     'M': true,
     'Y': true
   },
+  // Warn about unused eslint-disable statements.
+  'reportUnusedDisableDirectives': true,
   'rules': {
     // See http://eslint.org/docs/rules/ for all rules and explanations of all
     // rules.
 
     // === Possible Errors ===
     'comma-dangle': 'off',
-    'no-compare-neg-zero': 'error',
-    'no-cond-assign': 'error',
     'no-console': 'error',
-    'no-constant-condition': 'error',
-    'no-control-regex': 'error',
-    'no-debugger': 'error',
-    'no-dupe-args': 'error',
-    'no-dupe-keys': 'error',
-    'no-duplicate-case': 'error',
     'no-empty': 'warn',
-    'no-empty-character-class': 'error',
-    'no-ex-assign': 'error',
-    'no-extra-boolean-cast': 'error',
     'no-extra-parens': 'off',
-    'no-extra-semi': 'error',
-    'no-func-assign': 'error',
-    'no-inner-declarations': 'error',
-    'no-invalid-regexp': 'error',
-    'no-irregular-whitespace': 'error',
-    'no-obj-calls': 'error',
     'no-prototype-builtins': 'off',
-    'no-regex-spaces': 'error',
-    'no-sparse-arrays': 'error',
-    'no-unexpected-multiline': 'error',
     'no-unreachable': 'warn',
-    'no-unsafe-finally': 'error',
-    'no-unsafe-negation': 'error',
-    'use-isnan': 'error',
-    'valid-jsdoc': ['warn', { 'requireReturn': false, 'requireParamDescription': false, 'requireReturnDescription': false }],
-    'valid-typeof': 'error',
 
     // === Best Practices ===
     // (these mostly match our jshint config)
@@ -63,15 +44,12 @@
     'dot-notation': 'warn',
     'no-alert': 'warn',
     'no-caller': 'error',
-    'no-case-declarations': 'error',
     'no-div-regex': 'error',
-    'no-empty-pattern': 'error',
     'no-empty-function': 'warn',
     'no-eq-null': 'error',
     'no-eval': 'error',
     'no-extend-native': 'error',
     'no-extra-bind': 'warn',
-    'no-fallthrough': 'error',
     'no-floating-decimal': 'warn',
     'no-global-assign': 'warn',
     'no-implied-eval': 'error',
@@ -83,28 +61,22 @@
     'no-multi-str': 'error',
     'no-new-func': 'error',
     'no-new-wrappers': 'error',
-    'no-octal': 'error',
     'no-octal-escape': 'error',
     'no-proto': 'error',
     'no-redeclare': 'warn',
     'no-restricted-globals': ['error', { 'name': 'Notification' }],
     'no-return-assign': 'error',
     'no-script-url': 'error',
-    'no-self-assign': 'error',
     'no-self-compare': 'error',
     'no-sequences': 'warn',
     'no-throw-literal': 'warn',
     'no-unmodified-loop-condition': 'error',
     'no-unused-expressions': 'error',
-    'no-unused-labels': 'error',
     'no-useless-call': 'warn',
     'no-useless-escape': 'warn',
-    'no-with': 'error',
     'wrap-iife': ['error', 'any'],
 
     // === Variables ===
-    'no-delete-var': 'error',
-    'no-undef': 'error',
     'no-undef-init': 'error',
     'no-unused-vars': ['error', { 'caughtErrors': 'none' }],
 
@@ -137,8 +109,6 @@
     'max-statements-per-line': ['warn', { max: 2 }],
     'new-cap': ['warn', { 'properties': false }],
     'new-parens': 'warn',
-    'newline-after-var': 'off',
-    'newline-before-return': 'off',
     'newline-per-chained-call': 'off',
     'no-array-constructor': 'off',
     'no-bitwise': 'error',
@@ -146,7 +116,6 @@
     'no-inline-comments': 'off',
     'no-lonely-if': 'off',
     'no-mixed-operators': 'off',
-    'no-mixed-spaces-and-tabs': 'error',
     'no-multiple-empty-lines': 'warn',
     'no-negated-condition': 'off',
     'no-nested-ternary': 'warn',
@@ -168,7 +137,6 @@
     'padded-blocks': 'off',
     'quote-props': ['warn', 'as-needed', {'unnecessary': false, 'keywords': true, 'numbers': true}],
     'quotes': 'off',
-    'require-jsdoc': 'warn',
     'semi': 'error',
     'semi-spacing': ['warn', {'before': false, 'after': true}],
     'sort-vars': 'off',
@@ -181,21 +149,19 @@
     'unicode-bom': 'error',
     'wrap-regex': 'off',
 
-    // === Promises ===
+    // === Promises (override plugin:promise/recommended) ===
     'promise/always-return': 'warn',
     'promise/no-return-wrap': 'warn',
     'promise/param-names': 'warn',
     'promise/catch-or-return': ['warn', {terminationMethod: ['catch', 'fail']}],
     'promise/no-native': 'warn',
-    'promise/no-promise-in-callback': 'warn',
-    'promise/no-callback-in-promise': 'warn',
     'promise/avoid-new': 'warn',
 
     // === Deprecations ===
     "no-restricted-properties": ['warn', {
         'object': 'M',
         'property': 'str',
-        'message': 'Use AMD module "core/str" or M.util.get_string()'
+        'message': 'Use "core/str" module or M.util.get_string()'
     }],
   },
   overrides: [
@@ -235,7 +201,6 @@
       parser: '@babel/eslint-parser',
       // Check AMD with some slightly stricter rules.
       rules: {
-        'no-unused-vars': 'error',
         'no-implicit-globals': 'error',
         // Disable all of the rules that have babel versions.
         'new-cap': 'off',
@@ -247,65 +212,37 @@
         'semi': 'off',
         'no-unused-expressions': 'off',
         // Enable all of the babel version of these rules.
-        'babel/new-cap': ['warn', { 'properties': false }],
+        '@babel/new-cap': ['warn', { 'properties': false }],
         // Not using this rule for the time being because it isn't
         // compatible with jQuery and ES6.
-        'babel/no-invalid-this': 'off',
-        'babel/object-curly-spacing': 'warn',
-        // This is off in the original style int.
-        'babel/quotes': 'off',
-        'babel/semi': 'error',
-        'babel/no-unused-expressions': 'error',
+        '@babel/no-invalid-this': 'off',
+        '@babel/object-curly-spacing': 'warn',
+        '@babel/semi': 'error',
+        '@babel/no-unused-expressions': 'error',
         // === Promises ===
         // We have Promise now that we're using ES6.
         'promise/no-native': 'off',
         'promise/avoid-new': 'off',
 
         // === JSDocs ===
-        "jsdoc/check-access": [
-          'error',
-        ],
-        "jsdoc/check-alignment": 1, // Recommended.
-        "jsdoc/check-param-names": [
-          'error',
-        ],
-        "jsdoc/check-property-names": [
-          'error',
-        ],
-        "jsdoc/empty-tags": [
-          'error',
-        ],
-        "jsdoc/implements-on-classes": [
-          'error',
-        ],
-        "jsdoc/multiline-blocks": [
-          'error',
-        ],
-        "jsdoc/require-jsdoc": [
-          'error',
-        ],
-        "jsdoc/require-param": [
-          'error',
-        ],
-        "jsdoc/require-param-name": [
-          'error',
-        ],
-        "jsdoc/require-param-type": [
-          'error',
-        ],
-        "jsdoc/require-property": [
-          'error',
-        ],
-        "jsdoc/require-property-name": [
-          'error',
-        ],
-        "jsdoc/require-property-type": [
-          'error',
-        ],
+        'jsdoc/check-access': 'error',
+        'jsdoc/check-alignment': 1, // Recommended.
+        'jsdoc/check-param-names': 'error',
+        'jsdoc/check-property-names': 'error',
+        'jsdoc/empty-tags': 'error',
+        'jsdoc/implements-on-classes': 'error',
+        'jsdoc/multiline-blocks': 'error',
+        'jsdoc/require-jsdoc': 'error',
+        'jsdoc/require-param': 'error',
+        'jsdoc/require-param-name': 'error',
+        'jsdoc/require-param-type': 'error',
+        'jsdoc/require-property': 'error',
+        'jsdoc/require-property-name': 'error',
+        'jsdoc/require-property-type': 'error'
       },
       parserOptions: {
         'sourceType': 'module',
-        'requireConfigFile': false,
+        'requireConfigFile': false
       }
     }
   ]

.github/workflows/push.yml

@@ -23,10 +23,10 @@ jobs:
 
     steps:
       - name: Checking out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Configuring node & npm
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
 
@@ -103,7 +103,7 @@ jobs:
           coverage: none
 
       - name: Checking out code from ${{ env.GITHUB_REF_SLUG }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setting up PHPUnit
         env:

.github/workflows/windows.yml

@@ -16,10 +16,10 @@ jobs:
           git config --global core.eol lf
 
       - name: Checking out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Configuring node & npm
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
 
@@ -112,7 +112,7 @@ jobs:
           git config --global core.eol lf
 
       - name: Checking out code from ${{ env.GITHUB_REF_SLUG }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       # Needs to be done after php is available, git configured and Moodle checkout has happened.
       - name: Setting up moodle-exttests service

.grunt/tasks/javascript.js

@@ -21,7 +21,7 @@
  */
 
 /**
- * Function to generate the destination for the uglify task
+ * Function to generate the destination for the minification task
  * (e.g. build/file.min.js). This function will be passed to
  * the rename property of files array when building dynamically:
  * http://gruntjs.com/configuring-tasks#building-the-files-object-dynamically
@@ -60,7 +60,6 @@ module.exports = grunt => {
     grunt.registerTask('js', ['amd', 'yui']);
 
     // Register NPM tasks.
-    grunt.loadNpmTasks('grunt-contrib-uglify');
     grunt.loadNpmTasks('grunt-contrib-watch');
     grunt.loadNpmTasks('grunt-rollup');
 
@@ -104,6 +103,7 @@ module.exports = grunt => {
         // The queue runner will run the next `size` items in the queue.
         const runQueue = (size = 1) => {
             queue.splice(0, size).forEach(resolve => {
+                grunt.log.debug(`Item resolved. Kicking off next one.`);
                 resolve();
             });
         };
@@ -113,15 +113,17 @@ module.exports = grunt => {
 
             // The options hook is run in parallel.
             // We can return an unresolved Promise which is queued for later resolution.
-            options: async() => {
+            options: async(options) => {
                 return new Promise(resolve => {
                     queue.push(resolve);
                     startQueue();
+                    return options;
                 });
             },
 
             // When an item in the queue completes, start the next item in the queue.
-            buildEnd: () => {
+            generateBundle: (options, bundle) => {
+                grunt.log.debug(`Finished output phase for ${Object.keys(bundle).join(', ')}`);
                 runQueue();
             },
         };
@@ -151,24 +153,10 @@ module.exports = grunt => {
                             //
                             // It also adds the Moodle plugin name to the AMD module definition
                             // so that it can be imported as expected in other modules.
-                            path.resolve('.grunt/babel-plugin-add-module-to-define.js'),
-                            '@babel/plugin-syntax-dynamic-import',
-                            '@babel/plugin-syntax-import-meta',
-                            ['@babel/plugin-proposal-class-properties', {'loose': false}],
-                            '@babel/plugin-proposal-json-strings'
+                            path.resolve('.grunt/babel-plugin-add-module-to-define.js')
                         ],
                         presets: [
                             ['@babel/preset-env', {
-                                targets: {
-                                    browsers: [
-                                        ">0.3%",
-                                        "last 2 versions",
-                                        "not ie >= 0",
-                                        "not op_mini all",
-                                        "not Opera > 0",
-                                        "not dead"
-                                    ]
-                                },
                                 modules: false,
                                 useBuiltIns: false
                             }]

.grunt/tasks/jsdoc.js

@@ -20,17 +20,33 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 
-module.exports = grunt => {
-    // Project configuration.
-    grunt.config.merge({
-        jsdoc: {
-            dist: {
-                options: {
-                    configure: ".grunt/jsdoc/jsdoc.conf.js",
-                },
-            },
-        },
-    });
+module.exports = (grunt) => {
+    const path = require('path');
 
-    grunt.loadNpmTasks('grunt-jsdoc');
+    grunt.registerTask('jsdoc', 'Generate JavaScript documentation using jsdoc', function() {
+        const done = this.async();
+        const configuration = path.resolve('.grunt/jsdoc/jsdoc.conf.js');
+
+        grunt.util.spawn({
+            cmd: 'jsdoc',
+            args: [
+                '--configure',
+                configuration,
+            ]
+        }, function(error, result, code) {
+            if (result.stdout) {
+                grunt.log.write(result.stdout);
+            }
+
+            if (result.stderr) {
+                grunt.log.error(result.stderr);
+            }
+            if (error) {
+                grunt.fail.fatal(`JSDoc failed with error code ${code}`);
+            } else {
+                grunt.log.write('JSDoc completed successfully'.green);
+            }
+            done();
+        });
+    });
 };

.grunt/tasks/stylelint.js

@@ -29,6 +29,7 @@ module.exports = grunt => {
                     // Use a fully-qualified path.
                     src: files,
                     options: {
+                        quietDeprecationWarnings: true,
                         configOverrides: {
                             rules: {
                                 // These rules have to be disabled in .stylelintrc for scss compat.
@@ -45,7 +46,10 @@ module.exports = grunt => {
         return {
             stylelint: {
                 scss: {
-                    options: {syntax: 'scss'},
+                    options: {
+                        quietDeprecationWarnings: true,
+                        customSyntax: 'postcss-scss',
+                    },
                     src: files,
                 },
             },

.nvmrc

@@ -1 +1 @@
-lts/gallium
+lts/iron

.stylelintrc

@@ -1,9 +1,14 @@
 {
+    "customSyntax": "postcss-scss",
     "plugins": [
         "stylelint-csstree-validator"
     ],
     "rules": {
-        "csstree/validator": true,
+        "csstree/validator": {
+          "syntaxExtensions": [
+            "sass"
+          ]
+        },
         "at-rule-empty-line-before": [ "always",
           {"except": [ "blockless-after-blockless"], ignore: ["after-comment", "inside-block"]}
         ],
@@ -45,7 +50,7 @@
         "function-name-case": "lower",
         "function-parentheses-newline-inside": "always-multi-line",
         "function-parentheses-space-inside": "never-single-line",
-        "function-url-scheme-blacklist": ["data"],
+        "function-url-scheme-disallowed-list": ["data"],
         "function-whitespace-after": "always",
         "indentation": 4,
         "keyframe-declaration-no-important": true,
@@ -84,12 +89,19 @@
         "selector-type-no-unknown": true,
         "string-no-newline": true,
         "time-min-milliseconds": 100,
-        "unit-blacklist": ["pt"],
+        "unit-disallowed-list": ["pt"],
         "unit-case": "lower",
         "unit-no-unknown": true,
         "value-keyword-case": ["lower", {"ignoreKeywords": ["/(@|$)/"]}],
         "value-list-comma-newline-after": "always-multi-line",
         "value-list-comma-space-after": "always-single-line",
         "value-list-comma-space-before": "never",
-  }
+  },
+  "overrides": [
+    {
+      "files": ["**/yui/**/*.css"],
+      "rules": {
+      }
+    }
+  ]
 }

admin/environment.xml

@@ -3923,6 +3923,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.2" requires="3.11.8">
@@ -3939,6 +3941,7 @@
       <VENDOR name="oracle" version="19" />
     </DATABASE>
     <PHP version="8.0.0" level="required">
+      <RESTRICT function="restrict_php_version_83" message="unsupportedphpversion83" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -4112,6 +4115,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.3" requires="3.11.8">
@@ -4128,6 +4133,7 @@
       <VENDOR name="oracle" version="19" />
     </DATABASE>
     <PHP version="8.0.0" level="required">
+      <RESTRICT function="restrict_php_version_83" message="unsupportedphpversion83" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -4303,6 +4309,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.4" requires="4.1.2">
@@ -4494,6 +4502,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/tool/admin_presets/classes/local/action/delete.php

@@ -64,7 +64,7 @@ class delete extends base {
      * Delete the DB preset
      */
     public function execute(): void {
-        confirm_sesskey();
+        require_sesskey();
 
         $this->manager->delete_preset($this->id);
 

admin/tool/admin_presets/classes/local/action/export.php

@@ -52,8 +52,6 @@ class export extends base {
      * Stores a preset into the DB.
      */
     public function execute(): void {
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'export', 'mode' => 'execute']);
         $this->moodleform = new export_form($url);
 
@@ -87,7 +85,7 @@ class export extends base {
      * @throws xml_writer_exception
      */
     public function download_xml(): void {
-        confirm_sesskey();
+        require_sesskey();
 
         list($xmlstr, $filename) = $this->manager->download_preset($this->id);
 

admin/tool/admin_presets/classes/local/action/import.php

@@ -40,8 +40,6 @@ class import extends base {
      * Imports the xmlfile into DB
      */
     public function execute(): void {
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'import', 'mode' => 'execute']);
         $this->moodleform = new import_form($url);
 

admin/tool/admin_presets/classes/local/action/load.php

@@ -38,8 +38,6 @@ class load extends base {
     public function execute(): void {
         global $OUTPUT;
 
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'load', 'mode' => 'execute']);
         $this->moodleform = new load_form($url);
 

admin/tool/admin_presets/classes/local/action/rollback.php

@@ -73,7 +73,7 @@ class rollback extends base {
     public function execute(): void {
         global $OUTPUT;
 
-        confirm_sesskey();
+        require_sesskey();
 
         list($presetapp, $rollback, $failures) = $this->manager->revert_preset($this->id);
 

admin/tool/analytics/model.php

@@ -97,28 +97,28 @@ if ($onlycli === false) {
 switch ($action) {
 
     case 'enable':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->enable();
         redirect($returnurl);
         break;
 
     case 'disable':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->update(0, false, false);
         redirect($returnurl);
         break;
 
     case 'delete':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->delete();
         redirect($returnurl);
         break;
 
     case 'edit':
-        confirm_sesskey();
+        require_sesskey();
 
         $invalidcurrenttimesplitting = $model->invalid_timesplitting_selected();
         $potentialtimesplittings = $model->get_potential_timesplittings();
@@ -183,7 +183,7 @@ switch ($action) {
         break;
 
     case 'evaluate':
-        confirm_sesskey();
+        require_sesskey();
 
         if ($model->is_static()) {
             throw new moodle_exception('errornostaticevaluate', 'tool_analytics');
@@ -226,7 +226,7 @@ switch ($action) {
         break;
 
     case 'scheduledanalysis':
-        confirm_sesskey();
+        require_sesskey();
 
         if ($onlycli) {
             throw new moodle_exception('erroronlycli', 'tool_analytics');
@@ -292,7 +292,7 @@ switch ($action) {
         break;
 
     case 'clear':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->clear();
         redirect($returnurl);

admin/tool/behat/tests/behat/tabs.feature

@@ -0,0 +1,34 @@
+@tool_behat
+Feature: Confirm that we can open multiple browser tabs
+  In order to use multiple browser tabs
+  As a test writer
+  I need the relevant Behat steps to work
+
+  @javascript @_switch_window
+  Scenario: Open multiple browser tabs
+    Given the following "courses" exist:
+      | fullname | shortname |
+      | Course 1 | C1        |
+      | Course 2 | C2        |
+      | Course 3 | C3        |
+    And I am on the "C1" "Course" page logged in as "admin"
+
+    # Open a new tab on the same page.
+    When I open a tab named "CourseViewer1" on the current page
+    And I should see "Course 1" in the "h1" "css_element"
+    And I am on the "C2" "Course" page
+
+    # Open new tab for specified page with identifier.
+    And I open a tab named "CourseViewer2" on the "C3" "Course" page
+
+    # And for a specified page without identifier.
+    And I open a tab named "CourseViewer4" on the "My courses" page
+
+    # Switch between all the tabs and confirm their different contents.
+    Then I should see "No courses"
+    And I switch to "CourseViewer2" tab
+    And "Course 3" "heading" should exist
+    And I switch to "CourseViewer1" tab
+    And "Course 2" "heading" should exist
+    And I switch to the main tab
+    And "Course 1" "heading" should exist

admin/tool/filetypes/tests/behat/add_filetypes.feature

@@ -120,8 +120,7 @@ Feature: Add customised file types
       | Custom description | Froggy file                               |
     And I press "Save changes"
     # Create a resource activity and add it to a course
-    And I am on "Course 1" course homepage with editing mode on
-    When I add a "File" to section "1"
+    When I add a resource activity to course "Course 1" section "1"
     And I set the following fields to these values:
       | Name        | An example of customised file type |
       | Description | File description                   |

admin/tool/langimport/index.php

@@ -114,7 +114,7 @@ if ($mode == DELETION_OF_SELECTED_LANG and (!empty($uninstalllang) or !empty($co
     }
 }
 
-if ($mode == UPDATE_ALL_LANG) {
+if ($mode == UPDATE_ALL_LANG && confirm_sesskey()) {
     core_php_time_limit::raise();
     $controller->update_all_installed_languages();
 }

admin/tool/langimport/templates/langimport.mustache

@@ -87,6 +87,7 @@
                 <div>
                     <form id="updateform" action="{{updateurl}}" method="post">
                         <fieldset>
+                            <input type="hidden" name="sesskey" value="{{sesskey}}">
                             <input type="submit" value="{{#str}}updatelangs, tool_langimport{{/str}}" class="btn btn-secondary">
                             {{#hasmanyinstalledlanguages}}
                                 <p class="mt-2 small">{{#str}} updatelangsnote, tool_langimport, {"taskname": {{#quote}}{{updatelangstaskname}}{{/quote}} }{{/str}}</p>

admin/tool/lp/amd/src/competency_rule.js

@@ -71,14 +71,12 @@ define(['jquery'], function($) {
         return null;
     };
 
-    // eslint-disable-line valid-jsdoc
     /**
      * Return the type of the module.
      *
      * @return {String}
      * @method getType
      */
-    // eslint-enable-line valid-jsdoc
     Rule.prototype.getType = function() {
         throw new Error('Not implemented');
     };

admin/tool/mobile/classes/event_handler.php

@@ -0,0 +1,45 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_mobile;
+
+use core\session\utility\cookie_helper;
+use core\event\user_loggedin;
+
+/**
+ * Event handler for tool_mobile.
+ *
+ * @package    tool_mobile
+ * @copyright  2024 Juan Leyva
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class event_handler {
+
+    /**
+     * Allows the plugin to augment Set-Cookie headers when the user_loggedin event is fired as part of complete_user_login() calls.
+     *
+     * @param user_loggedin $event the event
+     * @return void
+     */
+    public static function handle_user_loggedin(user_loggedin $event): void {
+        global $CFG;
+
+        // Set Partitioned and Secure attributes to the MoodleSession cookie if the user is using the Moodle app.
+        if (\core_useragent::is_moodle_app()) {
+            cookie_helper::add_attributes_to_cookie_response_header('MoodleSession'.$CFG->sessioncookie, ['Secure', 'Partitioned']);
+        }
+    }
+}

admin/tool/mobile/db/events.php

@@ -0,0 +1,33 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * tool_mobile plugin event handler definition.
+ *
+ * @package tool_mobile
+ * @category event
+ * @copyright 2024 Juan Leyva
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$observers = [
+    [
+        'eventname' => '\core\event\user_loggedin',
+        'callback' => '\tool_mobile\event_handler::handle_user_loggedin',
+    ],
+];

admin/tool/mobile/lib.php

@@ -265,3 +265,16 @@ function tool_mobile_pre_processor_message_send($procname, $data) {
         $data->fullmessagehtml .= html_writer::tag('p', get_string('readingthisemailgettheapp', 'tool_mobile', $url->out()));
     }
 }
+
+/**
+ * Callback to add headers before the HTTP headers are sent.
+ *
+ */
+function tool_mobile_before_http_headers() {
+    global $CFG;
+
+    // Set Partitioned and Secure attributes to the MoodleSession cookie if the user is using the Moodle app.
+    if (\core_useragent::is_moodle_app()) {
+        \core\session\utility\cookie_helper::add_attributes_to_cookie_response_header('MoodleSession'.$CFG->sessioncookie, ['Secure', 'Partitioned']);
+    }
+}

admin/tool/mobile/version.php

@@ -23,7 +23,7 @@
  */
 
 defined('MOODLE_INTERNAL') || die();
-$plugin->version   = 2022112800; // The current plugin version (Date: YYYYMMDDXX).
+$plugin->version   = 2022112801; // The current plugin version (Date: YYYYMMDDXX).
 $plugin->requires  = 2022111800; // Requires this Moodle version.
 $plugin->component = 'tool_mobile'; // Full name of the plugin (used for diagnostics).
 $plugin->dependencies = array(

admin/tool/moodlenet/amd/src/instance_form.js

@@ -121,7 +121,6 @@ define(['tool_moodlenet/validator',
         });
         // Trigger the transition between 'pages'.
         carousel.carousel(2);
-        // eslint-disable-next-line max-len
         modal.setFooter(Templates.render('tool_moodlenet/chooser_footer_close_mnet', {}));
     };
 

admin/tool/phpunit/cli/util.php

@@ -50,12 +50,10 @@ list($options, $unrecognized) = cli_get_params(
     )
 );
 
-if (file_exists(__DIR__.'/../../../../vendor/phpunit/phpunit/composer.json')) {
-    // Composer packages present.
-    require_once(__DIR__.'/../../../../vendor/autoload.php');
-
-} else {
-    // Note: installation via PEAR is not supported any more.
+// Basic check to see if phpunit is installed.
+if (!file_exists(__DIR__.'/../../../../vendor/phpunit/phpunit/composer.json') ||
+        !file_exists(__DIR__.'/../../../../vendor/bin/phpunit') ||
+        !file_exists(__DIR__.'/../../../../vendor/autoload.php')) {
     phpunit_bootstrap_error(PHPUNIT_EXITCODE_PHPUNITMISSING);
 }
 
@@ -74,12 +72,13 @@ if ($options['run']) {
         }
     }
     $_SERVER['argv'] = array_values($_SERVER['argv']);
-    PHPUnit\TextUI\Command::main();
+    require(__DIR__ . '/../../../../vendor/bin/phpunit');
     exit(0);
 }
 
 define('PHPUNIT_UTIL', true);
 
+require(__DIR__.'/../../../../vendor/autoload.php');
 require(__DIR__ . '/../../../../lib/phpunit/bootstrap.php');
 
 // from now on this is a regular moodle CLI_SCRIPT

admin/tool/task/schedule_task.php

@@ -87,7 +87,8 @@ require_sesskey();
 
 // Prepare to handle output via mtrace.
 echo html_writer::start_tag('pre');
-require('lib.php');
+
+require_once("{$CFG->dirroot}/{$CFG->admin}/tool/task/lib.php");
 $CFG->mtrace_wrapper = 'tool_task_mtrace_wrapper';
 
 // Run the specified task (this will output an error if it doesn't exist).

auth/lti/auth.php

@@ -116,7 +116,7 @@ class auth_plugin_lti extends \auth_plugin_base {
             if (isloggedin()) {
                 // If a different user is currently logged in, authenticate the linked user instead.
                 global $USER;
-                if ((int) $USER->id !== $user->id) {
+                if ($USER->id !== $user->id) {
                     complete_user_login($user);
                 }
                 // If the linked user is already logged in, skip the call to complete_user_login() because this affects deep linking

auth/lti/classes/local/ltiadvantage/event/event_handler.php

@@ -0,0 +1,48 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\local\ltiadvantage\event;
+
+use auth_lti\local\ltiadvantage\utility\cookie_helper;
+use core\event\user_loggedin;
+
+/**
+ * Event handler for auth_lti.
+ *
+ * @package    auth_lti
+ * @copyright  2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class event_handler {
+
+    /**
+     * Allows the plugin to augment Set-Cookie headers when the user_loggedin event is fired as part of complete_user_login() calls.
+     *
+     * @param user_loggedin $event the event
+     * @return void
+     */
+    public static function handle_user_loggedin(user_loggedin $event): void {
+        // The event data isn't important here. The intent of this listener is to ensure that the MoodleSession cookie is set up
+        // properly during LTI launches + login. This means two things:
+        // i) it's set with SameSite=None; Secure; where possible (since OIDC needs HTTPS this will almost always be possible).
+        // ii) it set with the 'Partitioned' attribute, when required.
+        // The former ensures cross-site cookies are sent for embedded launches. The latter is an opt-in flag needed to use Chrome's
+        // partitioning mechanism, CHIPS.
+        if (cookie_helper::cookies_supported()) {
+            cookie_helper::setup_session_cookie();
+        }
+    }
+}

auth/lti/classes/local/ltiadvantage/utility/cookie_helper.php

@@ -0,0 +1,173 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\local\ltiadvantage\utility;
+use core\session\utility\cookie_helper as core_cookie_helper;
+
+/**
+ * Helper class providing utils dealing with cookies in LTI, particularly 3rd party cookies.
+ *
+ * @package    auth_lti
+ * @copyright  2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+final class cookie_helper {
+
+    /** @var int Cookies are not supported. */
+    public const COOKIE_METHOD_NOT_SUPPORTED = 0;
+
+    /** @var int Cookies are supported without explicit partitioning. */
+    public const COOKIE_METHOD_NO_PARTITIONING = 1;
+
+    /** @var int Cookies are supported via explicit partitioning. */
+    public const COOKIE_METHOD_EXPLICIT_PARTITIONING = 2;
+
+    /**
+     * Check whether cookies can be used with the current user agent and, if so, via what method they are set.
+     *
+     * Currently, this tries 2 modes of setting a test cookie:
+     * 1. Setting a SameSite=None, Secure cookie. This will work in any first party context, and in 3rd party contexts for
+     * any browsers supporting automatic partitioning of 3rd party cookies (E.g. Firefox, Brave).
+     * 2. If 1 fails, setting a cookie with the Chrome 'Partitioned' attribute included, opting that cookie into CHIPS. This will
+     * work for Chrome.
+     *
+     * Upon completion of the cookie check, the check sets a SESSION flag indicating the method used to set the cookie, and upgrades
+     * the session cookie ('MoodleSession') using the respective method. This ensure the session cookie will continue to be sent.
+     *
+     * Then, the following methods can be used by client code to query whether the UA supports cookies, and how:
+     * @see self::cookies_supported() - whether it could be set at all.
+     * @see self::get_cookies_supported_mode() - if a cookie could be set, what mode was used to set it.
+     *
+     * This permits client code to make sure it's setting its cookies appropriately (via the advertised method), and allows it to
+     * present notices - such as in the case where a given UA is found to be lacking the requisite cookie support.
+     * E.g.
+     * cookie_helper::do_cookie_check($mypageurl);
+     * if (!cookie_helper::cookies_supported()) {
+     *     // Print a notice stating that cookie support is required.
+     * }
+     * // Elsewhere in other client code...
+     * if (cookie_helper::get_cookies_supported_mode() === cookie_helper::COOKIE_METHOD_EXPLICIT_PARTITIONING) {
+     *     // Set a cookie, making sure to use the helper to also opt-in to partitioning.
+     *     setcookie('myauthcookie', 'myauthcookievalue', ['samesite' => 'None', 'secure' => true]);
+     *     cookie_helper::add_partitioning_to_cookie('myauthcookie');
+     * }
+     *
+     * @param \moodle_url $pageurl the URL of the page making the check, used to redirect back to after setting test cookies.
+     * @return void
+     */
+    public static function do_cookie_check(\moodle_url $pageurl): void {
+        global $_COOKIE, $SESSION, $CFG;
+        $cookiecheck1 = optional_param('cookiecheck1', null, PARAM_INT);
+        $cookiecheck2 = optional_param('cookiecheck2', null, PARAM_INT);
+
+        if (empty($cookiecheck1)) {
+            // Start the cookie check. Set two test cookies - one samesite none, and one partitioned - and redirect.
+            // Set cookiecheck to show the check has started.
+            self::set_test_cookie('cookiecheck1', self::COOKIE_METHOD_NO_PARTITIONING);
+            self::set_test_cookie('cookiecheck2', self::COOKIE_METHOD_EXPLICIT_PARTITIONING, true);
+            $pageurl->params([
+                'cookiecheck1' => self::COOKIE_METHOD_NO_PARTITIONING,
+                'cookiecheck2' => self::COOKIE_METHOD_EXPLICIT_PARTITIONING,
+            ]);
+
+            // LTI needs to guarantee the 'SameSite=None', 'Secure' (and sometimes 'Partitioned') attributes are set on the
+            // MoodleSession cookie. This is done via manipulation of the outgoing headers after the cookie check redirect. To
+            // guarantee these outgoing Set-Cookie headers will be created after the redirect, expire the current cookie.
+            core_cookie_helper::expire_moodlesession();
+
+            redirect($pageurl);
+        } else {
+            // Have already started a cookie check, so check the result.
+            $cookie1received = isset($_COOKIE['cookiecheck1']) && $_COOKIE['cookiecheck1'] == $cookiecheck1;
+            $cookie2received = isset($_COOKIE['cookiecheck2']) && $_COOKIE['cookiecheck2'] == $cookiecheck2;
+
+            if ($cookie1received || $cookie2received) {
+                // The test cookie could be set and received.
+                // Set a session flag storing the method used to set it, and make sure the session cookie uses this method.
+                $cookiemethod = $cookie1received ? self::COOKIE_METHOD_NO_PARTITIONING : self::COOKIE_METHOD_EXPLICIT_PARTITIONING;
+                $SESSION->auth_lti_cookie_method = $cookiemethod;
+
+                self::setup_session_cookie();
+            }
+        }
+    }
+
+    /**
+     * If a cookie check has been made, returns whether cookies could be set or not.
+     *
+     * @return bool whether cookies are supported or not.
+     */
+    public static function cookies_supported(): bool {
+        return self::get_cookies_supported_method() !== self::COOKIE_METHOD_NOT_SUPPORTED;
+    }
+
+    /**
+     * If a cookie check has been made, gets the method used to set a cookie, or self::COOKIE_METHOD_NOT_SUPPORTED if not supported.
+     *
+     * For cookie methods:
+     * @see self::COOKIE_METHOD_NOT_SUPPORTED
+     * @see self::COOKIE_METHOD_NO_PARTITIONING
+     * @see self::COOKIE_METHOD_EXPLICIT_PARTITIONING
+     *
+     * @return int the constant representing the method by which the cookie was set, or not.
+     */
+    public static function get_cookies_supported_method(): int {
+        global $SESSION;
+        return $SESSION->auth_lti_cookie_method ?? self::COOKIE_METHOD_NOT_SUPPORTED;
+    }
+
+    /**
+     * Sets up the session cookie according to the method used in the cookie check, and with SameSite=None; Secure attributes.
+     *
+     * @return void
+     */
+    public static function setup_session_cookie(): void {
+        global $CFG;
+        require_once($CFG->libdir . '/sessionlib.php');
+
+        if (is_moodle_cookie_secure()) {
+            $atts = ['SameSite=None', 'Secure'];
+            if (self::get_cookies_supported_method() == self::COOKIE_METHOD_EXPLICIT_PARTITIONING) {
+                $atts[] = 'Partitioned';
+            }
+            core_cookie_helper::add_attributes_to_cookie_response_header('MoodleSession' . $CFG->sessioncookie, $atts);
+        }
+    }
+
+    /**
+     * Set a test cookie, using SameSite=None; Secure; attributes if possible, and with or without partitioning opt-in.
+     *
+     * @param string $name cookie name
+     * @param string $value cookie value
+     * @param bool $partitioned whether to try to add partitioning opt-in, which requires secure cookies (https sites).
+     * @return void
+     */
+    private static function set_test_cookie(string $name, string $value, bool $partitioned = false): void {
+        global $CFG;
+        require_once($CFG->libdir . '/sessionlib.php');
+
+        $atts = ['expires' => time() + 30];
+        if (is_moodle_cookie_secure()) {
+            $atts['samesite'] = 'none';
+            $atts['secure'] = true;
+        }
+        setcookie($name, $value, $atts);
+
+        if (is_moodle_cookie_secure() && $partitioned) {
+            core_cookie_helper::add_attributes_to_cookie_response_header($name, ['Partitioned']);
+        }
+    }
+}

auth/lti/classes/output/renderer.php

@@ -33,33 +33,32 @@ class renderer extends \plugin_renderer_base {
      * @return string the html.
      */
     public function render_account_binding_options_page(int $provisioningmode): string {
+
         $formaction = new \moodle_url('/auth/lti/login.php');
         $notification = new notification(get_string('firstlaunchnotice', 'auth_lti'), \core\notification::INFO, false);
-        $noauthnotice = new notification(get_string('firstlaunchnoauthnotice', 'auth_lti', get_docs_url('Publish_as_LTI_tool')),
-            \core\notification::WARNING, false);
         $cancreateaccounts = !get_config('moodle', 'authpreventaccountcreation');
         if ($provisioningmode == \auth_plugin_lti::PROVISIONING_MODE_PROMPT_EXISTING_ONLY) {
             $cancreateaccounts = false;
         }
 
-        $accountinfo = ['isloggedin' => isloggedin()];
+        $accountinfo = [];
         if (isloggedin()) {
             global $USER;
-            $accountinfo = array_merge($accountinfo, [
+            $accountinfo = [
                 'firstname' => $USER->firstname,
                 'lastname' => $USER->lastname,
                 'email' => $USER->email,
                 'picturehtml' => $this->output->user_picture($USER,  ['size' => 35, 'class' => 'round']),
-            ]);
+            ];
         }
 
         $context = [
+            'isloggedin' => isloggedin(),
             'info' => $notification->export_for_template($this),
             'formaction' => $formaction->out(),
             'sesskey' => sesskey(),
             'accountinfo' => $accountinfo,
             'cancreateaccounts' => $cancreateaccounts,
-            'noauthnotice' => $noauthnotice->export_for_template($this)
         ];
         return parent::render_from_template('auth_lti/local/ltiadvantage/login', $context);
     }

auth/lti/db/events.php

@@ -0,0 +1,33 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * LTI Auth plugin event handler definition.
+ *
+ * @package auth_lti
+ * @category event
+ * @copyright 2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$observers = [
+    [
+        'eventname' => '\core\event\user_loggedin',
+        'callback' => '\auth_lti\local\ltiadvantage\event\event_handler::handle_user_loggedin',
+    ],
+];

auth/lti/lang/en/auth_lti.php

@@ -35,7 +35,7 @@ $string['firstlaunchnoauthnotice'] = 'To link your existing account you must be
 $string['getstartedwithnewaccount'] = 'Get started with a new account';
 $string['haveexistingaccount'] = 'I have an existing account';
 $string['linkthisaccount'] = 'Link this account';
-$string['mustbeloggedin'] = 'You need to be logged in to your existing account';
+$string['mustbeloggedin'] = 'Sign in to link your existing account';
 $string['pluginname'] = 'LTI';
 $string['privacy:metadata:auth_lti'] = 'LTI authentication';
 $string['privacy:metadata:auth_lti:authsubsystem'] = 'This plugin is connected to the authentication subsystem.';

auth/lti/templates/local/ltiadvantage/login.mustache

@@ -32,7 +32,6 @@
     * info - a notification describing the first launch options
     * cancreateaccounts - whether or not the user is allowed to create auth_lti accounts
     * accountinfo - information about the user, importantly whether they are logged in or not.
-    * noauthnotice - a notification telling the user they must be authenticated to link accounts. Only relevant when not logged in.
 
     Example context (json):
     {
@@ -46,19 +45,12 @@
             "issuccess": true
         },
         "cancreateaccounts": true,
+        "isloggedin": true,
         "accountinfo": {
-            "isloggedin": true,
             "firstname": "John",
             "lastname": "Smith",
             "email": "john@example.com",
             "picturehtml": "<img src=\"http://site.example.com/pluginfile.php/5/user/icon/boost/f2?rev=99\" class=\"round\" alt=\"\" width=\"35\" height=\"35\">"
-        },
-        "noauthnotice": {
-            "message": "To link your existing account you must be logged in to the site...",
-            "extraclasses": "",
-            "announce": false,
-            "closebutton": false,
-            "iswarning": true
         }
     }
 }}
@@ -79,8 +71,8 @@
                         <div class="card-body text-center d-flex flex-column">
                             <i class="fa fa-user-circle-o fa-2x link"></i>
                             <h4 class="card-title">{{#str}} useexistingaccount, auth_lti {{/str}}</h4>
-                            {{#accountinfo}}
                                 {{#isloggedin}}
+                                    {{#accountinfo}}
                                     <p class="card-text mt-2">
                                         <span class="text-muted">
                                             {{#str}} currentlyloggedinas, auth_lti {{/str}}
@@ -90,14 +82,12 @@
                                         {{firstname}} {{lastname}} ({{email}})
                                     </p>
                                     <input type="submit" class="btn btn-primary mt-auto" name="existing_account" value="{{#str}} linkthisaccount, auth_lti {{/str}}">
+                                    {{/accountinfo}}
                                 {{/isloggedin}}
                                 {{^isloggedin}}
                                     <p class="card-text text-muted">{{#str}} mustbeloggedin, auth_lti {{/str}}</p>
-                                    {{#noauthnotice}}
-                                        {{> core/notification}}
-                                    {{/noauthnotice}}
+                                    <input type="submit" class="btn btn-primary mt-auto" name="existing_account" value="{{#str}} login, moodle {{/str}}">
                                 {{/isloggedin}}
-                            {{/accountinfo}}
                         </div>
                     </div>
                 </div>

auth/lti/version.php

@@ -24,6 +24,6 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version = 2022112800; // The current plugin version (Date: YYYYMMDDXX).
+$plugin->version = 2022112801; // The current plugin version (Date: YYYYMMDDXX).
 $plugin->requires = 2022111800; // Requires this Moodle version.
 $plugin->component = 'auth_lti'; // Full name of the plugin (used for diagnostics).

badges/tests/behat/award_badge_groups.feature

@@ -119,3 +119,97 @@ Feature: Award badges with separate groups
     And I press "Award badge"
     # Teacher 2 shouldn't be able to go further
     Then I should see "Sorry, but you need to be part of a group to see this page."
+
+  @javascript
+  Scenario: Editing teacher can award badge to members of separate groups
+    Given I am on the "Course 1" course page logged in as teacher1
+    And I navigate to "Badges > Manage badges" in current page administration
+    And I follow "Course Badge"
+    And I press "Award badge"
+    When I set the field "role" to "Teacher"
+    # Confirm that editing teacher sees a separate groups dropdown menu.
+    Then "Separate groups" "select" should exist
+    And I should see "All participants" in the "Separate groups" "select"
+    # Confirm that all participants are displayed when All participants is selected.
+    And I should see "Student 1" in the "potentialrecipients[]" "select"
+    And I should see "Student 2" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 1" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 2" in the "potentialrecipients[]" "select"
+    And I set the field "Separate groups" to "Class A"
+    # Confirm that only members of selected group are displayed
+    And I should not see "Student 1" in the "potentialrecipients[]" "select"
+    And I should not see "Teacher 1" in the "potentialrecipients[]" "select"
+    And I should see "Student 2" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 2" in the "potentialrecipients[]" "select"
+    And I set the field "Separate groups" to "Class B"
+    And I should not see "Student 2" in the "potentialrecipients[]" "select"
+    And I should not see "Teacher 2" in the "potentialrecipients[]" "select"
+    And I should see "Student 1" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 1" in the "potentialrecipients[]" "select"
+
+  @javascript
+  Scenario Outline: Teacher can award badge to members of visible groups
+    Given I am on the "Course 1" "course editing" page logged in as teacher1
+    And I expand all fieldsets
+    # Set the group mode to visible groups.
+    And I set the field "Group mode" to "Visible groups"
+    And I press "Save and display"
+    When I am on the "Course 1" course page logged in as <loggedinuser>
+    And I navigate to "Badges > Manage badges" in current page administration
+    And I follow "Course Badge"
+    And I press "Award badge"
+    And I set the field "role" to "<awarder>"
+    # Confirm that teachers see a visible groups dropdown menu.
+    Then "Visible groups" "select" should exist
+    # Confirm that My groups option group exists.
+    And "optgroup[label='My groups']" "css_element" should exist in the "select[name='group']" "css_element"
+    # Confirm that Other groups option group exists.
+    And "optgroup[label='Other groups']" "css_element" should exist in the "select[name='group']" "css_element"
+    # Confirm that all participants are displayed when All participants is selected.
+    And I set the field "Visible groups" to "All participants"
+    And I should see "Student 1" in the "potentialrecipients[]" "select"
+    And I should see "Student 2" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 1" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 2" in the "potentialrecipients[]" "select"
+    # Confirm that only members of selected group are displayed.
+    And I set the field "Visible groups" to "Class A"
+    And I should not see "Student 1" in the "potentialrecipients[]" "select"
+    And I should not see "Teacher 1" in the "potentialrecipients[]" "select"
+    And I should see "Student 2" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 2" in the "potentialrecipients[]" "select"
+    And I set the field "Visible groups" to "Class B"
+    And I should not see "Student 2" in the "potentialrecipients[]" "select"
+    And I should not see "Teacher 2" in the "potentialrecipients[]" "select"
+    And I should see "Student 1" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 1" in the "potentialrecipients[]" "select"
+
+    Examples:
+      | loggedinuser | awarder             |
+      | teacher1     | Teacher             |
+      | teacher2     | Non-editing teacher |
+
+  @javascript
+  Scenario Outline: Teacher can award badge to members when group mode is set to no groups
+    Given I am on the "Course 1" "course editing" page logged in as teacher1
+    And I expand all fieldsets
+    # Set the group mode to no groups.
+    And I set the field "Group mode" to "No groups"
+    And I press "Save and display"
+    When I am on the "Course 1" course page logged in as <loggedinuser>
+    And I navigate to "Badges > Manage badges" in current page administration
+    And I follow "Course Badge"
+    And I press "Award badge"
+    And I set the field "role" to "<awarder>"
+    # Confirm that no group dropdowns don't exist.
+    Then "Separate groups" "select" should not exist
+    And "Visible groups" "select" should not exist
+    # Confirm all participants are displayed.
+    And I should see "Student 1" in the "potentialrecipients[]" "select"
+    And I should see "Student 2" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 1" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 2" in the "potentialrecipients[]" "select"
+
+    Examples:
+      | loggedinuser | awarder             |
+      | teacher1     | Teacher             |
+      | teacher2     | Non-editing teacher |

badges/tests/behat/delete_awarded_badge.feature

@@ -0,0 +1,52 @@
+@core @core_badges
+Feature: Delete course badge already awarded
+  As a teacher
+  I can delete awarded course badge
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email                |
+      | teacher1 | Teacher   | 1        | teacher1@example.com |
+      | student1 | Student   | 1        | student1@example.com |
+    And the following "courses" exist:
+      | fullname | shortname |
+      | Course 1 | C1        |
+    And the following "course enrolments" exist:
+      | user     | course | role           |
+      | teacher1 | C1     | editingteacher |
+      | student1 | C1     | student        |
+
+  @javascript
+  Scenario Outline: Delete course badge already awarded to student
+    Given the following "core_badges > Badges" exist:
+      | name        | course | description             | image                        | status | type |
+      | <badgename> | C1     | <badgename> description | badges/tests/behat/badge.png | active | 2    |
+    And the following "core_badges > Criterias" exist:
+      | badge       | role           |
+      | <badgename> | editingteacher |
+    And the following "core_badges > Issued badges" exist:
+      | badge       | user     |
+      | <badgename> | student1 |
+    When I am on the "Course 1" "enrolled users" page logged in as "teacher1"
+    And I click on "Student 1" "link"
+    Then I should see "<badgename>"
+    And I am on the "Course 1" course page
+    # Navigate to Manage Badges page in order to delete the badge
+    And I navigate to "Badges > Manage badges" in current page administration
+    # Delete the badge
+    And I click on "Delete" "icon" in the "<badgename>" "table_row"
+    And I press "<deleteoption>"
+    And I am on the "Course 1" "enrolled users" page
+    And I click on "Student 1" "link"
+    # Confirm that Badge 1 is retained as awarded badge but Badge 2 is not
+    And I <visibility> see "<badgename>"
+    And I am on the "Course 1" course page
+    # Navigate to Badges page to confirm that no badges exist, hence, Manage badges would not exist
+    And I navigate to "Badges" in current page administration
+    # Confirm that badges are sucessfully deleted
+    And I should see "There are currently no badges available for users to earn."
+
+    Examples:
+      | badgename | deleteoption                             | visibility |
+      | Badge 1   | Delete and keep existing issued badges   | should     |
+      | Badge 2   | Delete and remove existing issued badges | should not |

blocks/comments/lib.php

@@ -59,7 +59,26 @@ function block_comments_comment_validate($comment_param) {
  * @return array
  */
 function block_comments_comment_permissions($args) {
-    return array('post'=>true, 'view'=>true);
+    global $DB, $USER;
+    // By default, anyone can post and view comments.
+    $canpost = $canview = true;
+    // Check if it's the user context and not the owner's profile.
+    if ($args->context->contextlevel == CONTEXT_USER && $USER->id != $args->context->instanceid) {
+        // Check whether the context owner has a comment block in the user's profile.
+        $sqlparam = [
+            'blockname' => 'comments',
+            'parentcontextid' => $args->context->id,
+            'pagetypepattern' => 'user-profile',
+        ];
+        // If the comment block is not present at the target user's profile,
+        // then the logged-in user cannot post or view comments.
+        $canpost = $canview = $DB->record_exists_select(
+            'block_instances',
+            'blockname = :blockname AND parentcontextid = :parentcontextid AND pagetypepattern = :pagetypepattern',
+            $sqlparam,
+        );
+    }
+    return ['post' => $canpost, 'view' => $canview];
 }
 
 /**

blocks/comments/tests/behat/add_comment.feature

@@ -10,7 +10,7 @@ Feature: Add a comment to the comments block
       | Course 1 | C1 | 0 |
     And the following "users" exist:
       | username | firstname | lastname | email |
-      | teacher1 | Teacher | Frist | teacher1@example.com |
+      | teacher1 | Teacher | First | teacher1@example.com |
       | student1 | Student | First | student1@example.com |
     And the following "course enrolments" exist:
       | user | course | role |
@@ -25,11 +25,16 @@ Feature: Add a comment to the comments block
   Scenario: Add a comment with Javascript enabled
     When I add "I'm a comment from student1" comment to comments block
     Then I should see "I'm a comment from student1"
+    And I am on the "Course 1" course page logged in as teacher1
+    And I should see "I'm a comment from student1"
 
   Scenario: Add a comment with Javascript disabled
     When I follow "Show comments"
     And I add "I'm a comment from student1" comment to comments block
     Then I should see "I'm a comment from student1"
+    And I am on the "Course 1" course page logged in as teacher1
+    And I follow "Show comments"
+    And I should see "I'm a comment from student1"
 
   @javascript
   Scenario: Test comment block pagination

blocks/comments/tests/behat/block_comment_activity.feature

@@ -10,7 +10,7 @@ Feature: Enable Block comments on an activity page and view comments
       | Course 1 | C1 | 0 |
     And the following "users" exist:
       | username | firstname | lastname | email |
-      | teacher1 | Teacher | Frist | teacher1@example.com |
+      | teacher1 | Teacher | First | teacher1@example.com |
       | student1 | Student | First | student1@example.com |
     And the following "course enrolments" exist:
       | user | course | role |

blocks/comments/tests/behat/block_comment_course.feature

@@ -1,27 +0,0 @@
-@block @block_comments
-Feature: Enable Block comments on a course page and view comments
-  In order to enable the comments block on a course page
-  As a teacher
-  I can add the comments block to the course page
-
-  Scenario: Add the comments block on the course page and add comments
-    Given the following "courses" exist:
-      | fullname | shortname | category |
-      | Course 1 | C1 | 0 |
-    And the following "users" exist:
-      | username | firstname | lastname | email |
-      | teacher1 | Teacher | Frist | teacher1@example.com |
-      | student1 | Student | First | student1@example.com |
-    And the following "course enrolments" exist:
-      | user | course | role |
-      | teacher1 | C1 | editingteacher |
-      | student1 | C1 | student |
-    And the following "blocks" exist:
-      | blockname | contextlevel | reference | pagetypepattern | defaultregion |
-      | comments  | Course       | C1        | course-view-*   | side-pre      |
-    And I am on the "Course 1" course page logged in as teacher1
-    And I follow "Show comments"
-    And I add "I'm a comment from the teacher" comment to comments block
-    When I am on the "Course 1" course page logged in as student1
-    And I follow "Show comments"
-    Then I should see "I'm a comment from the teacher"

blocks/comments/tests/behat/block_comment_dashboard.feature

@@ -10,7 +10,7 @@ Feature: Enable Block comments on the dashboard and view comments
       | Course 1 | C1 | 0 |
     And the following "users" exist:
       | username | firstname | lastname | email |
-      | teacher1 | Teacher | Frist | teacher1@example.com |
+      | teacher1 | Teacher | First | teacher1@example.com |
 
   Scenario: Add the comments block on the dashboard and add comments with Javascript disabled
     When I log in as "teacher1"

blocks/tag_flickr/block_tag_flickr.php

@@ -101,13 +101,14 @@ class block_tag_flickr extends block_base {
             $request .= '&api_key='.FLICKR_DEV_KEY;
             $request .= '&photoset_id='.$this->config->photoset;
             $request .= '&per_page='.$numberofphotos;
-            $request .= '&format=php_serial';
+            $request .= '&format=json';
+            // We need to add nojsoncallback=? here, otherwise, Flickr will return the jsonFlickrApi object.
+            $request .= '&nojsoncallback=?';
 
             $response = $this->fetch_request($request);
-
-            $search = @unserialize($response);
-            if ($search === false && $search != serialize(false)) {
-                // The response didn't appear to be anything serialized, exit...
+            $search = @json_decode($response, true);
+            if (!is_array($search) || json_last_error() !== JSON_ERROR_NONE) {
+                // The response didn't appear to be in correct format.
                 return;
             }
 
@@ -126,13 +127,14 @@ class block_tag_flickr extends block_base {
             $request .= '&tags='.$tagscsv;
             $request .= '&per_page='.$numberofphotos;
             $request .= '&sort='.$sortby;
-            $request .= '&format=php_serial';
+            $request .= '&format=json';
+            // We need to add nojsoncallback=? here, otherwise, Flickr will return the jsonFlickrApi object.
+            $request .= '&nojsoncallback=?';
 
             $response = $this->fetch_request($request);
-
-            $search = @unserialize($response);
-            if ($search === false && $search != serialize(false)) {
-                // The response didn't appear to be anything serialized, exit...
+            $search = @json_decode($response, true);
+            if (!is_array($search) || json_last_error() !== JSON_ERROR_NONE) {
+                // The response didn't appear to be in correct format.
                 return;
             }
             $photos = array_values($search['photos']['photo']);

cache/classes/loaders.php

@@ -608,7 +608,8 @@ class cache implements cache_loader {
         // store; parent method will have set it to all stores if needed.
         if ($setaftervalidation) {
             $lock = null;
-            if (!empty($this->requirelockingbeforewrite)) {
+            // Only try to acquire a lock for this cache if we do not already have one.
+            if (!empty($this->requirelockingbeforewrite) && !$this->check_lock_state($key)) {
                 $lock = $this->acquire_lock($key);
             }
             if ($requiredversion === self::VERSION_NONE) {

calendar/classes/local/event/forms/eventtype.php

@@ -78,7 +78,8 @@ trait eventtype {
         if (!empty($eventtypes['user']) && count($options) == 1) {
             $mform->addElement('hidden', 'eventtype');
             $mform->setType('eventtype', PARAM_TEXT);
-            $mform->setDefault('eventtype', 'user');
+            $mform->hardFreeze('eventtype');
+            $mform->setConstant('eventtype', 'user');
             return;
         } else {
             $mform->addElement('select', 'eventtype', get_string('eventkind', 'calendar'), $options);

calendar/classes/local/event/forms/managesubscriptions.php

@@ -106,7 +106,7 @@ class managesubscriptions extends \moodleform {
         $courseid = (!empty($data[$coursekey])) ? $data[$coursekey] : null;
         $eventtypes = calendar_get_allowed_event_types($courseid);
 
-        if (empty($eventtype) || !isset($eventtypes[$eventtype])) {
+        if (empty($eventtype) || !isset($eventtypes[$eventtype]) || $eventtypes[$eventtype] == false) {
             $errors['eventtype'] = get_string('invalideventtype', 'calendar');
         }
 

calendar/externallib.php

@@ -898,7 +898,17 @@ class core_calendar_external extends external_api {
         $courseid = (!empty($data[$coursekey])) ? $data[$coursekey] : null;
         $editoroptions = \core_calendar\local\event\forms\create::build_editor_options($context);
         $formoptions = ['editoroptions' => $editoroptions, 'courseid' => $courseid];
-        $formoptions['eventtypes'] = calendar_get_allowed_event_types($courseid);
+        $allowedeeventtypes = calendar_get_allowed_event_types($courseid);
+
+        // Event type validation.
+        if (in_array(true, $allowedeeventtypes, true) === false) {
+            throw new \moodle_exception('nopermissiontoupdatecalendar');
+        }
+        if (empty($eventtype) || !isset($allowedeeventtypes[$eventtype]) || $allowedeeventtypes[$eventtype] == false) {
+            return ['validationerror' => true];
+        }
+
+        $formoptions['eventtypes'] = $allowedeeventtypes;
         if ($courseid) {
             require_once($CFG->libdir . '/grouplib.php');
             $groupcoursedata = groups_get_course_data($courseid);

calendar/tests/behat/behat_calendar.php

@@ -176,7 +176,23 @@ class behat_calendar extends behat_base {
      * @return void
      */
     public function i_am_viewing_site_calendar() {
-        $url = new moodle_url('/calendar/view.php', ['view' => 'month']);
+        $this->i_am_viewing_calendar_in_view('month');
+    }
+
+    /**
+     * Navigate to a specific view in the calendar.
+     *
+     * @Given /^I am viewing calendar in "([^"]+)" view$/
+     * @param string $view The calendar view ('month', 'day' and 'upcoming') to navigate to.
+     * @return void
+     */
+    public function i_am_viewing_calendar_in_view(string $view): void {
+
+        if (!in_array($view, ['month', 'day', 'upcoming'])) {
+            throw new Exception("Invalid calendar view. Allowed values are: 'month', 'day' and 'upcoming'");
+        }
+
+        $url = new moodle_url('/calendar/view.php', ['view' => $view]);
         $this->execute('behat_general::i_visit', [$url]);
     }
 }

completion/tests/behat/activity_completion_criteria.feature

@@ -5,8 +5,8 @@ Feature: Allow to mark course as completed without cron for activity completion
 
   Background:
     Given the following "courses" exist:
-      | fullname          | shortname | category |
-      | Completion course | CC1       | 0        |
+      | fullname          | shortname | category | enablecompletion |
+      | Completion course | CC1       | 0        | 1                |
     And the following "users" exist:
       | username | firstname | lastname  | email                |
       | student1 | Student   | First     | student1@example.com |
@@ -25,11 +25,7 @@ Feature: Allow to mark course as completed without cron for activity completion
     And the following "blocks" exist:
       | blockname        | contextlevel | reference | pagetypepattern | defaultregion |
       | completionstatus | Course       | CC1       | course-view-*   | side-pre      |
-    And I am on the "Completion course" "course editing" page logged in as admin
-    And I expand all fieldsets
-    And I set the field "Enable completion tracking" to "Yes"
-    And I click on "Save and display" "button"
-    And I am on the "Test assignment name" "assign activity editing" page
+    And I am on the "Test assignment name" "assign activity editing" page logged in as admin
     And I follow "Expand all"
     And I set the field "Completion tracking" to "Show activity as complete when conditions are met"
     And I set the field "completionusegrade" to "1"

completion/tests/behat/bulk_edit_activity_completion.feature

@@ -10,7 +10,7 @@ Feature: Allow teachers to bulk edit activity completion rules in a course.
       | Course 1 | C1 | 0 |
     And the following "users" exist:
       | username | firstname | lastname | email |
-      | teacher1 | Teacher | Frist | teacher1@example.com |
+      | teacher1 | Teacher | First | teacher1@example.com |
       | student1 | Student | First | student1@example.com |
     And the following "course enrolments" exist:
       | user     | course | role           |

completion/tests/behat/completion_course_page_display.feature

@@ -6,8 +6,8 @@ Feature: Show activity completion status or activity completion configuration on
 
   Background:
     Given the following "courses" exist:
-      | fullname | shortname | category |
-      | Course 1 | C1 | 0 |
+      | fullname | shortname | category | enablecompletion |
+      | Course 1 | C1        | 0        | 1                |
     And the following "users" exist:
       | username | firstname | lastname | email |
       | teacher1 | Teacher   | First    | teacher1@example.com |
@@ -18,12 +18,6 @@ Feature: Show activity completion status or activity completion configuration on
       | teacher1 | C1 | editingteacher |
       | teacher2 | C1 | teacher |
       | student1 | C1 | student |
-    And I log in as "teacher1"
-    And I am on "Course 1" course homepage with editing mode on
-    And I navigate to "Settings" in current page administration
-    And I set the following fields to these values:
-      | Enable completion tracking | Yes |
-    And I press "Save and display"
     And the following "activities" exist:
       | activity | course | idnumber | name                 | intro                       | completion | completionview | completionexpected |
       | assign   | C1     | assign1  | Test assignment name | Test assignment description | 2          | 1              | 0                  |

completion/tests/behat/default_activity_completion.feature

@@ -14,7 +14,7 @@ Feature: Allow teachers to edit the default activity completion rules in a cours
       | Course 1 | C1 | 0 |
     And the following "users" exist:
       | username | firstname | lastname | email |
-      | teacher1 | Teacher | Frist | teacher1@example.com |
+      | teacher1 | Teacher | First | teacher1@example.com |
       | student1 | Student | First | student1@example.com |
     And the following "course enrolments" exist:
       | user     | course | role           |
@@ -56,7 +56,7 @@ Feature: Allow teachers to edit the default activity completion rules in a cours
       | Course 1 | C1        | 0        | 1                |
     And the following "users" exist:
       | username | firstname | lastname | email |
-      | teacher1 | Teacher | Frist | teacher1@example.com |
+      | teacher1 | Teacher | First | teacher1@example.com |
     And the following "course enrolments" exist:
       | user     | course | role           |
       | teacher1 | C1     | editingteacher |

completion/tests/behat/enable_completion_on_pass_grade.feature

@@ -7,7 +7,7 @@ Feature: Students will be marked as completed if they have achieved a passing gr
       | Course 1 | C1        | 0        | 1                |
     And the following "users" exist:
       | username | firstname | lastname | email                |
-      | teacher1 | Teacher   | Frist    | teacher1@example.com |
+      | teacher1 | Teacher   | First    | teacher1@example.com |
       | student1 | Student   | First    | student1@example.com |
       | student2 | Student   | Second   | student2@example.com |
     And the following "course enrolments" exist:

completion/tests/behat/enable_completion_on_view_and_grade.feature

@@ -8,7 +8,7 @@ Feature: Students will be marked as completed and pass/fail
       | Course 1 | C1        | 0        | 1                |
     And the following "users" exist:
       | username | firstname | lastname | email                |
-      | teacher1 | Teacher   | Frist    | teacher1@example.com |
+      | teacher1 | Teacher   | First    | teacher1@example.com |
       | student1 | Student   | First    | student1@example.com |
       | student2 | Student   | Second   | student2@example.com |
       | student3 | Student   | Third    | student3@example.com |

completion/tests/behat/enable_manual_complete_mark.feature

@@ -7,29 +7,22 @@ Feature: Allow students to manually mark an activity as complete
   @javascript
   Scenario: Mark an activity as completed
     Given the following "courses" exist:
-      | fullname | shortname | category |
-      | Course 1 | C1 | 0 |
+      | fullname | shortname | category | enablecompletion |
+      | Course 1 | C1        | 0        | 1                |
     And the following "users" exist:
       | username | firstname | lastname | email |
-      | teacher1 | Teacher | Frist | teacher1@example.com |
+      | teacher1 | Teacher | First | teacher1@example.com |
       | student1 | Student | First | student1@example.com |
     And the following "course enrolments" exist:
       | user | course | role |
       | teacher1 | C1 | editingteacher |
       | student1 | C1 | student |
     And the following "activity" exists:
-      | activity | forum                  |
-      | course   | C1                     |
-      | name     | Test forum name        |
+      | activity   | forum                  |
+      | course     | C1                     |
+      | name       | Test forum name        |
+      | completion | 1                      |
     And I am on the "Course 1" course page logged in as teacher1
-    And I navigate to "Settings" in current page administration
-    And I set the following fields to these values:
-      | Enable completion tracking | Yes |
-    And I press "Save and display"
-    And I am on the "Test forum name" "forum activity editing" page
-    And I set the following fields to these values:
-      | completion | 1 |
-    And I press "Save and return to course"
     And "Student First" user has not completed "Test forum name" activity
     And I am on the "Course 1" course page logged in as student1
     When I toggle the manual completion state of "Test forum name"

completion/tests/behat/passgrade_completion_criteria_gradeitem_visibility.feature

@@ -10,7 +10,7 @@ Feature: Students will be shown relevant completion state based on grade item vi
       | Course 1 | C1        | 0        | 1                |
     And the following "users" exist:
       | username | firstname | lastname | email                |
-      | teacher1 | Teacher   | Frist    | teacher1@example.com |
+      | teacher1 | Teacher   | First    | teacher1@example.com |
       | student1 | Student   | First    | student1@example.com |
       | student2 | Student   | Second   | student2@example.com |
     And the following "course enrolments" exist:

completion/tests/behat/restrict_activity_by_date.feature

@@ -10,7 +10,7 @@ Feature: Restrict activity availability through date conditions
       | Course 1 | C1        | 0        |
     And the following "users" exist:
       | username | firstname | lastname | email                |
-      | teacher1 | Teacher   | Frist    | teacher1@example.com |
+      | teacher1 | Teacher   | First    | teacher1@example.com |
       | student1 | Student   | First    | student1@example.com |
     And the following "course enrolments" exist:
       | user     | course | role           |

completion/tests/behat/restrict_activity_by_grade.feature

@@ -11,7 +11,7 @@ Feature: Restrict activity availability through grade conditions
       | Course 1 | C1 | 0 |
     And the following "users" exist:
       | username | firstname | lastname | email |
-      | teacher1 | Teacher | Frist | teacher1@example.com |
+      | teacher1 | Teacher | First | teacher1@example.com |
       | student1 | Student | First | student1@example.com |
     And the following "course enrolments" exist:
       | user | course | role |

completion/tests/behat/restrict_section_availability.feature

@@ -6,11 +6,11 @@ Feature: Restrict sections availability through completion or grade conditions
 
   Background:
     Given the following "courses" exist:
-      | fullname | shortname | category |
-      | Course 1 | C1        | 0        |
+      | fullname | shortname | category | enablecompletion |
+      | Course 1 | C1        | 0        | 1                |
     And the following "users" exist:
       | username | firstname | lastname | email                |
-      | teacher1 | Teacher   | Frist    | teacher1@example.com |
+      | teacher1 | Teacher   | First    | teacher1@example.com |
       | student1 | Student   | First    | student1@example.com |
     And the following "course enrolments" exist:
       | user     | course | role           |
@@ -23,15 +23,11 @@ Feature: Restrict sections availability through completion or grade conditions
 
   @javascript
   Scenario: Show section greyed-out to student when completion condition is not satisfied
-    Given I log in as "teacher1"
-    And I am on "Course 1" course homepage with editing mode on
-    And I navigate to "Settings" in current page administration
-    And I set the following fields to these values:
-      | Enable completion tracking | Yes |
-    And I press "Save and display"
-    And the following "activities" exist:
+    Given the following "activities" exist:
       | activity | course | section | intro      | completion | idnumber |
       | label    | C1     | 1       | Test label | 1          | 1        |
+    And I log in as "teacher1"
+    And I am on "Course 1" course homepage with editing mode on
     When I edit the section "2"
     And I expand all fieldsets
     And I click on "Add restriction..." "button"

course/format/amd/build/local/courseindex/cm.min.js

@@ -8,6 +8,6 @@ define("core_courseformat/local/courseindex/cm",["exports","core_courseformat/lo
    * @class      core_courseformat/local/courseindex/cm
    * @copyright  2021 Ferran Recio <ferran@moodle.com>
    * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
-   */Object.defineProperty(_exports,"__esModule",{value:!0}),_exports.default=void 0,_dndcmitem=_interopRequireDefault(_dndcmitem),_templates=_interopRequireDefault(_templates),_prefetch=_interopRequireDefault(_prefetch),_config=_interopRequireDefault(_config);_prefetch.default.prefetchTemplate("core_courseformat/local/courseindex/cmcompletion");class Component extends _dndcmitem.default{create(){this.name="courseindex_cm",this.selectors={CM_NAME:"[data-for='cm_name']",CM_COMPLETION:"[data-for='cm_completion']"},this.classes={CMHIDDEN:"dimmed",LOCKED:"editinprogress",RESTRICTIONS:"restrictions",PAGEITEM:"pageitem",INDENTED:"indented"},this.id=this.element.dataset.id}static init(target,selectors){return new Component({element:document.getElementById(target),selectors:selectors})}stateReady(state){this.configDragDrop(this.id);const cm=state.cm.get(this.id),course=state.course;this._refreshCompletion({state:state,element:cm});const anchor=new URL(window.location.href).hash.replace("#","");(window.location.href==cm.url||window.location.href.includes(course.baseurl)&&anchor==cm.anchor)&&(this.reactive.dispatch("setPageItem","cm",this.id),this.element.scrollIntoView({block:"center"})),_config.default.contextid!=_config.default.courseContextId&&_config.default.contextInstanceId==this.id&&(this.reactive.dispatch("setPageItem","cm",this.id,!0),this.element.scrollIntoView({block:"center"})),cm.uservisible||this.addEventListener(this.getElement(this.selectors.CM_NAME),"click",this._activityAnchor)}getWatchers(){return[{watch:"cm[".concat(this.id,"]:deleted"),handler:this.remove},{watch:"cm[".concat(this.id,"]:updated"),handler:this._refreshCm},{watch:"cm[".concat(this.id,"].completionstate:updated"),handler:this._refreshCompletion},{watch:"course.pageItem:updated",handler:this._refreshPageItem}]}_refreshCm(_ref){var _element$dragging,_element$locked,_element$hascmrestric;let{element:element}=_ref;this.element.classList.toggle(this.classes.CMHIDDEN,!element.visible),this.getElement(this.selectors.CM_NAME).innerHTML=element.name,this.element.classList.toggle(this.classes.DRAGGING,null!==(_element$dragging=element.dragging)&&void 0!==_element$dragging&&_element$dragging),this.element.classList.toggle(this.classes.LOCKED,null!==(_element$locked=element.locked)&&void 0!==_element$locked&&_element$locked),this.element.classList.toggle(this.classes.RESTRICTIONS,null!==(_element$hascmrestric=element.hascmrestrictions)&&void 0!==_element$hascmrestric&&_element$hascmrestric),this.element.classList.toggle(this.classes.INDENTED,element.indent),this.locked=element.locked}_refreshPageItem(_ref2){let{element:element}=_ref2;if(!element.pageItem)return;const isPageId="cm"==element.pageItem.type&&element.pageItem.id==this.id;this.element.classList.toggle(this.classes.PAGEITEM,isPageId),isPageId&&!this.reactive.isEditing&&this.element.scrollIntoView({block:"nearest"})}async _refreshCompletion(_ref3){let{state:state,element:element}=_ref3;if(this.reactive.isEditing||!element.istrackeduser)return;const completionElement=this.getElement(this.selectors.CM_COMPLETION);if(completionElement.dataset.value==element.completionstate)return;const data=this.reactive.getExporter().cmCompletion(state,element);try{const{html:html,js:js}=await _templates.default.renderForPromise("core_courseformat/local/courseindex/cmcompletion",data);_templates.default.replaceNode(completionElement,html,js)}catch(error){throw error}}_activityAnchor(event){const cm=this.reactive.get("cm",this.id);if(document.getElementById(cm.anchor))return void setTimeout((()=>{this.reactive.dispatch("setPageItem","cm",cm.id)}),50);const course=this.reactive.get("course"),section=this.reactive.get("section",cm.sectionid);if(!section)return;const url="".concat(course.baseurl,"&section=").concat(section.number,"#").concat(cm.anchor);event.preventDefault(),window.location=url}}return _exports.default=Component,_exports.default}));
+   */Object.defineProperty(_exports,"__esModule",{value:!0}),_exports.default=void 0,_dndcmitem=_interopRequireDefault(_dndcmitem),_templates=_interopRequireDefault(_templates),_prefetch=_interopRequireDefault(_prefetch),_config=_interopRequireDefault(_config);_prefetch.default.prefetchTemplate("core_courseformat/local/courseindex/cmcompletion");class Component extends _dndcmitem.default{create(){this.name="courseindex_cm",this.selectors={CM_NAME:"[data-for='cm_name']",CM_COMPLETION:"[data-for='cm_completion']"},this.classes={CMHIDDEN:"dimmed",LOCKED:"editinprogress",RESTRICTIONS:"restrictions",PAGEITEM:"pageitem",INDENTED:"indented"},this.id=this.element.dataset.id}static init(target,selectors){return new Component({element:document.getElementById(target),selectors:selectors})}stateReady(state){this.configDragDrop(this.id);const cm=state.cm.get(this.id),course=state.course;this._refreshCompletion({state:state,element:cm});const anchor=new URL(window.location.href).hash.replace("#","");(window.location.href==cm.url||window.location.href.includes(course.baseurl)&&anchor==cm.anchor)&&(this.reactive.dispatch("setPageItem","cm",this.id),this.element.scrollIntoView({block:"center"})),_config.default.contextid!=_config.default.courseContextId&&_config.default.contextInstanceId==this.id&&(this.reactive.dispatch("setPageItem","cm",this.id,!0),this.element.scrollIntoView({block:"center"})),cm.uservisible||this.addEventListener(this.getElement(this.selectors.CM_NAME),"click",this._activityAnchor)}getWatchers(){return[{watch:"cm[".concat(this.id,"]:deleted"),handler:this.remove},{watch:"cm[".concat(this.id,"]:updated"),handler:this._refreshCm},{watch:"cm[".concat(this.id,"].completionstate:updated"),handler:this._refreshCompletion},{watch:"course.pageItem:updated",handler:this._refreshPageItem}]}_refreshCm(_ref){var _element$dragging,_element$locked,_element$hascmrestric;let{element:element}=_ref;this.element.classList.toggle(this.classes.CMHIDDEN,!element.visible),this.getElement(this.selectors.CM_NAME).innerHTML=element.name,this.element.classList.toggle(this.classes.DRAGGING,null!==(_element$dragging=element.dragging)&&void 0!==_element$dragging&&_element$dragging),this.element.classList.toggle(this.classes.LOCKED,null!==(_element$locked=element.locked)&&void 0!==_element$locked&&_element$locked),this.element.classList.toggle(this.classes.RESTRICTIONS,null!==(_element$hascmrestric=element.hascmrestrictions)&&void 0!==_element$hascmrestric&&_element$hascmrestric),this.element.classList.toggle(this.classes.INDENTED,element.indent),this.locked=element.locked}_refreshPageItem(_ref2){let{element:element}=_ref2;if(!element.pageItem)return;const isPageId="cm"==element.pageItem.type&&element.pageItem.id==this.id;this.element.classList.toggle(this.classes.PAGEITEM,isPageId),isPageId&&!this.reactive.isEditing&&this.element.scrollIntoView({block:"nearest"})}async _refreshCompletion(_ref3){let{state:state,element:element}=_ref3;if(this.reactive.isEditing||!element.istrackeduser)return;const completionElement=this.getElement(this.selectors.CM_COMPLETION);if(completionElement.dataset.value==element.completionstate)return;const data=this.reactive.getExporter().cmCompletion(state,element),{html:html,js:js}=await _templates.default.renderForPromise("core_courseformat/local/courseindex/cmcompletion",data);_templates.default.replaceNode(completionElement,html,js)}_activityAnchor(event){const cm=this.reactive.get("cm",this.id);if(document.getElementById(cm.anchor))return void setTimeout((()=>{this.reactive.dispatch("setPageItem","cm",cm.id)}),50);const course=this.reactive.get("course"),section=this.reactive.get("section",cm.sectionid);if(!section)return;const url="".concat(course.baseurl,"&section=").concat(section.number,"#").concat(cm.anchor);event.preventDefault(),window.location=url}}return _exports.default=Component,_exports.default}));
 
 //# sourceMappingURL=cm.min.js.map

course/format/amd/src/local/content.js

@@ -173,15 +173,12 @@ export default class Component extends BaseComponent {
             const toggler = section.querySelector(this.selectors.COLLAPSE);
             const isCollapsed = toggler?.classList.contains(this.classes.COLLAPSED) ?? false;
 
-            if (isChevron || isCollapsed) {
-                // Update the state.
-                const sectionId = section.getAttribute('data-id');
-                this.reactive.dispatch(
-                    'sectionContentCollapsed',
-                    [sectionId],
-                    !isCollapsed
-                );
-            }
+            const sectionId = section.getAttribute('data-id');
+            this.reactive.dispatch(
+                'sectionContentCollapsed',
+                [sectionId],
+                !isCollapsed,
+            );
         }
     }
 

course/format/amd/src/local/courseeditor/fileuploader.js

@@ -0,0 +1,549 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * The course file uploader.
+ *
+ * This module is used to upload files directly into the course.
+ *
+ * @module     core_courseformat/local/courseeditor/fileuploader
+ * @copyright  2022 Ferran Recio <ferran@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+/**
+ * @typedef {Object} Handler
+ * @property {String} extension the handled extension or * for any
+ * @property {String} message the handler message
+ * @property {String} module the module name
+ */
+
+import Config from 'core/config';
+import ModalFactory from 'core/modal_factory';
+import ModalEvents from 'core/modal_events';
+import Templates from 'core/templates';
+import {getFirst} from 'core/normalise';
+import {prefetchStrings} from 'core/prefetch';
+import {get_string as getString, get_strings as getStrings} from 'core/str';
+import {getCourseEditor} from 'core_courseformat/courseeditor';
+import {processMonitor} from 'core/process_monitor';
+import {debounce} from 'core/utils';
+
+// Uploading url.
+const UPLOADURL = Config.wwwroot + '/course/dndupload.php';
+const DEBOUNCETIMER = 500;
+const USERCANIGNOREFILESIZELIMITS = -1;
+
+/** @var {ProcessQueue} uploadQueue the internal uploadQueue instance.  */
+let uploadQueue = null;
+/** @var {Object} handlerManagers the courseId indexed loaded handler managers. */
+let handlerManagers = {};
+/** @var {Map} courseUpdates the pending course sections updates. */
+let courseUpdates = new Map();
+/** @var {Object} errors the error messages. */
+let errors = null;
+
+// Load global strings.
+prefetchStrings('moodle', ['addresourceoractivity', 'upload']);
+prefetchStrings('core_error', ['dndmaxbytes', 'dndread', 'dndupload', 'dndunkownfile']);
+
+/**
+ * Class to upload a file into the course.
+ * @private
+ */
+class FileUploader {
+    /**
+     * Class constructor.
+     *
+     * @param {number} courseId the course id
+     * @param {number} sectionId the section id
+     * @param {number} sectionNum the section number
+     * @param {File} fileInfo the file information object
+     * @param {Handler} handler the file selected file handler
+     */
+    constructor(courseId, sectionId, sectionNum, fileInfo, handler) {
+        this.courseId = courseId;
+        this.sectionId = sectionId;
+        this.sectionNum = sectionNum;
+        this.fileInfo = fileInfo;
+        this.handler = handler;
+    }
+
+    /**
+     * Execute the file upload and update the state in the given process.
+     *
+     * @param {LoadingProcess} process the process to store the upload result
+     */
+    execute(process) {
+        const fileInfo = this.fileInfo;
+        const xhr = this._createXhrRequest(process);
+        const formData = this._createUploadFormData();
+
+        // Try reading the file to check it is not a folder, before sending it to the server.
+        const reader = new FileReader();
+        reader.onload = function() {
+            // File was read OK - send it to the server.
+            xhr.open("POST", UPLOADURL, true);
+            xhr.send(formData);
+        };
+        reader.onerror = function() {
+            // Unable to read the file (it is probably a folder) - display an error message.
+            process.setError(errors.dndread);
+        };
+        if (fileInfo.size > 0) {
+            // If this is a non-empty file, try reading the first few bytes.
+            // This will trigger reader.onerror() for folders and reader.onload() for ordinary, readable files.
+            reader.readAsText(fileInfo.slice(0, 5));
+        } else {
+            // If you call slice() on a 0-byte folder, before calling readAsText, then Firefox triggers reader.onload(),
+            // instead of reader.onerror().
+            // So, for 0-byte files, just call readAsText on the whole file (and it will trigger load/error functions as expected).
+            reader.readAsText(fileInfo);
+        }
+    }
+
+    /**
+     * Returns the bind version of execute function.
+     *
+     * This method is used to queue the process into a ProcessQueue instance.
+     *
+     * @returns {Function} the bind function to execute the process
+     */
+    getExecutionFunction() {
+        return this.execute.bind(this);
+    }
+
+    /**
+     * Generate a upload XHR file request.
+     *
+     * @param {LoadingProcess} process the current process
+     * @return {XMLHttpRequest} the XHR request
+     */
+    _createXhrRequest(process) {
+        const xhr = new XMLHttpRequest();
+        // Update the progress bar as the file is uploaded.
+        xhr.upload.addEventListener(
+            'progress',
+            (event) => {
+                if (event.lengthComputable) {
+                    const percent = Math.round((event.loaded * 100) / event.total);
+                    process.setPercentage(percent);
+                }
+            },
+            false
+        );
+        // Wait for the AJAX call to complete.
+        xhr.onreadystatechange = () => {
+            if (xhr.readyState == 1) {
+                // Add a 1% just to indicate that it is uploading.
+                process.setPercentage(1);
+            }
+            // State 4 is DONE. Otherwise the connection is still ongoing.
+            if (xhr.readyState != 4) {
+                return;
+            }
+            if (xhr.status == 200) {
+                var result = JSON.parse(xhr.responseText);
+                if (result && result.error == 0) {
+                    // All OK.
+                    this._finishProcess(process);
+                } else {
+                    process.setError(result.error);
+                }
+            } else {
+                process.setError(errors.dndupload);
+            }
+        };
+        return xhr;
+    }
+
+    /**
+     * Upload a file into the course.
+     *
+     * @return {FormData|null} the new form data object
+     */
+    _createUploadFormData() {
+        const formData = new FormData();
+        try {
+            formData.append('repo_upload_file', this.fileInfo);
+        } catch (error) {
+            throw Error(error.dndread);
+        }
+        formData.append('sesskey', Config.sesskey);
+        formData.append('course', this.courseId);
+        formData.append('section', this.sectionNum);
+        formData.append('module', this.handler.module);
+        formData.append('type', 'Files');
+        return formData;
+    }
+
+    /**
+     * Finishes the current process.
+     * @param {LoadingProcess} process the process
+     */
+    _finishProcess(process) {
+        addRefreshSection(this.courseId, this.sectionId);
+        process.setPercentage(100);
+        process.finish();
+    }
+}
+
+/**
+ * The file handler manager class.
+ *
+ * @private
+ */
+class HandlerManager {
+
+    /** @var {Object} lastHandlers the last handlers selected per each file extension. */
+    lastHandlers = {};
+
+    /** @var {Handler[]|null} allHandlers all the available handlers. */
+    allHandlers = null;
+
+    /**
+     * Class constructor.
+     *
+     * @param {Number} courseId
+     */
+    constructor(courseId) {
+        this.courseId = courseId;
+        this.lastUploadId = 0;
+        this.courseEditor = getCourseEditor(courseId);
+        if (!this.courseEditor) {
+            throw Error('Unkown course editor');
+        }
+        this.maxbytes = this.courseEditor.get('course')?.maxbytes ?? 0;
+    }
+
+    /**
+     * Load the course file handlers.
+     */
+    async loadHandlers() {
+        this.allHandlers = await this.courseEditor.getFileHandlersPromise();
+    }
+
+    /**
+     * Extract the file extension from a fileInfo.
+     *
+     * @param {File} fileInfo
+     * @returns {String} the file extension or an empty string.
+     */
+    getFileExtension(fileInfo) {
+        let extension = '';
+        const dotpos = fileInfo.name.lastIndexOf('.');
+        if (dotpos != -1) {
+            extension = fileInfo.name.substring(dotpos + 1, fileInfo.name.length).toLowerCase();
+        }
+        return extension;
+    }
+
+    /**
+     * Check if the file is valid.
+     *
+     * @param {File} fileInfo the file info
+     */
+    validateFile(fileInfo) {
+        if (this.maxbytes !== USERCANIGNOREFILESIZELIMITS && fileInfo.size > this.maxbytes) {
+            throw Error(errors.dndmaxbytes);
+        }
+    }
+
+    /**
+     * Get the file handlers of an specific file.
+     *
+     * @param {File} fileInfo the file indo
+     * @return {Array} Array of handlers
+     */
+    filterHandlers(fileInfo) {
+        const extension = this.getFileExtension(fileInfo);
+        return this.allHandlers.filter(handler => handler.extension == '*' || handler.extension == extension);
+    }
+
+    /**
+     * Get the Handler to upload a specific file.
+     *
+     * It will ask the used if more than one handler is available.
+     *
+     * @param {File} fileInfo the file info
+     * @returns {Promise<Handler|null>} the selected handler or null if the user cancel
+     */
+    async getFileHandler(fileInfo) {
+        const fileHandlers = this.filterHandlers(fileInfo);
+        if (fileHandlers.length == 0) {
+            throw Error(errors.dndunkownfile);
+        }
+        let fileHandler = null;
+        if (fileHandlers.length == 1) {
+            fileHandler = fileHandlers[0];
+        } else {
+            fileHandler = await this.askHandlerToUser(fileHandlers, fileInfo);
+        }
+        return fileHandler;
+    }
+
+    /**
+     * Ask the user to select a specific handler.
+     *
+     * @param {Handler[]} fileHandlers
+     * @param {File} fileInfo the file info
+     * @return {Promise<Handler>} the selected handler
+     */
+    async askHandlerToUser(fileHandlers, fileInfo) {
+        const extension = this.getFileExtension(fileInfo);
+        // Build the modal parameters from the event data.
+        const modalParams = {
+            title: getString('addresourceoractivity', 'moodle'),
+            body: Templates.render(
+                'core_courseformat/fileuploader',
+                this.getModalData(
+                    fileHandlers,
+                    fileInfo,
+                    this.lastHandlers[extension] ?? null
+                )
+            ),
+            type: ModalFactory.types.SAVE_CANCEL,
+            saveButtonText: getString('upload', 'moodle'),
+        };
+        // Create the modal.
+        const modal = await this.modalBodyRenderedPromise(modalParams);
+        const selectedHandler = await this.modalUserAnswerPromise(modal, fileHandlers);
+        // Cancel action.
+        if (selectedHandler === null) {
+            return null;
+        }
+        // Save last selected handler.
+        this.lastHandlers[extension] = selectedHandler.module;
+        return selectedHandler;
+    }
+
+    /**
+     * Generated the modal template data.
+     *
+     * @param {Handler[]} fileHandlers
+     * @param {File} fileInfo the file info
+     * @param {String|null} defaultModule the default module if any
+     * @return {Object} the modal template data.
+     */
+    getModalData(fileHandlers, fileInfo, defaultModule) {
+        const data = {
+            filename: fileInfo.name,
+            uploadid: ++this.lastUploadId,
+            handlers: [],
+        };
+        let hasDefault = false;
+        fileHandlers.forEach((handler, index) => {
+            const isDefault = (defaultModule == handler.module);
+            data.handlers.push({
+                ...handler,
+                selected: isDefault,
+                labelid: `fileuploader_${data.uploadid}`,
+                value: index,
+            });
+            hasDefault = hasDefault || isDefault;
+        });
+        if (!hasDefault && data.handlers.length > 0) {
+            const lastHandler = data.handlers.pop();
+            lastHandler.selected = true;
+            data.handlers.push(lastHandler);
+        }
+        return data;
+    }
+
+    /**
+     * Get the user handler choice.
+     *
+     * Wait for the user answer in the modal and resolve with the selected index.
+     *
+     * @param {Modal} modal the modal instance
+     * @param {Handler[]} fileHandlers the availabvle file handlers
+     * @return {Promise} with the option selected by the user.
+     */
+    modalUserAnswerPromise(modal, fileHandlers) {
+        const modalBody = getFirst(modal.getBody());
+        return new Promise((resolve, reject) => {
+            modal.getRoot().on(
+                ModalEvents.save,
+                event => {
+                    // Get the selected option.
+                    const index = modalBody.querySelector('input:checked').value;
+                    event.preventDefault();
+                    modal.destroy();
+                    if (!fileHandlers[index]) {
+                        reject('Invalid handler selected');
+                    }
+                    resolve(fileHandlers[index]);
+
+                }
+            );
+            modal.getRoot().on(
+                ModalEvents.cancel,
+                () => {
+                    resolve(null);
+                }
+            );
+        });
+    }
+
+    /**
+     * Create a new modal and return a Promise to the body rendered.
+     *
+     * @param {Object} modalParams the modal params
+     * @returns {Promise} the modal body rendered promise
+     */
+    modalBodyRenderedPromise(modalParams) {
+        return new Promise((resolve, reject) => {
+            ModalFactory.create(modalParams).then((modal) => {
+                modal.setRemoveOnClose(true);
+                // Handle body loading event.
+                modal.getRoot().on(ModalEvents.bodyRendered, () => {
+                    resolve(modal);
+                });
+                // Configure some extra modal params.
+                if (modalParams.saveButtonText !== undefined) {
+                    modal.setSaveButtonText(modalParams.saveButtonText);
+                }
+                modal.show();
+                return;
+            }).catch(() => {
+                reject(`Cannot load modal content`);
+            });
+        });
+    }
+}
+
+/**
+ * Add a section to refresh.
+ *
+ * @param {number} courseId the course id
+ * @param {number} sectionId the seciton id
+ */
+function addRefreshSection(courseId, sectionId) {
+    let refresh = courseUpdates.get(courseId);
+    if (!refresh) {
+        refresh = new Set();
+    }
+    refresh.add(sectionId);
+    courseUpdates.set(courseId, refresh);
+    refreshCourseEditors();
+}
+
+/**
+ * Debounced processing all pending course refreshes.
+ * @private
+ */
+const refreshCourseEditors = debounce(
+    () => {
+        const refreshes = courseUpdates;
+        courseUpdates = new Map();
+        refreshes.forEach((sectionIds, courseId) => {
+            const courseEditor = getCourseEditor(courseId);
+            if (!courseEditor) {
+                return;
+            }
+            courseEditor.dispatch('sectionState', [...sectionIds]);
+        });
+    },
+    DEBOUNCETIMER
+);
+
+/**
+ * Load and return the course handler manager instance.
+ *
+ * @param {Number} courseId the course Id to load
+ * @returns {Promise<HandlerManager>} promise of the the loaded handleManager
+ */
+async function loadCourseHandlerManager(courseId) {
+    if (handlerManagers[courseId] !== undefined) {
+        return handlerManagers[courseId];
+    }
+    const handlerManager = new HandlerManager(courseId);
+    await handlerManager.loadHandlers();
+    handlerManagers[courseId] = handlerManager;
+    return handlerManagers[courseId];
+}
+
+/**
+ * Load all the erros messages at once in the module "errors" variable.
+ * @param {Number} courseId the course id
+ */
+async function loadErrorStrings(courseId) {
+    if (errors !== null) {
+        return;
+    }
+    const courseEditor = getCourseEditor(courseId);
+    const maxbytestext = courseEditor.get('course')?.maxbytestext ?? '0';
+
+    errors = {};
+    const allStrings = [
+        {key: 'dndmaxbytes', component: 'core_error', param: {size: maxbytestext}},
+        {key: 'dndread', component: 'core_error'},
+        {key: 'dndupload', component: 'core_error'},
+        {key: 'dndunkownfile', component: 'core_error'},
+    ];
+    window.console.log(allStrings);
+    const loadedStrings = await getStrings(allStrings);
+    allStrings.forEach(({key}, index) => {
+        errors[key] = loadedStrings[index];
+    });
+}
+
+/**
+ * Start a batch file uploading into the course.
+ *
+ * @private
+ * @param {number} courseId the course id.
+ * @param {number} sectionId the section id.
+ * @param {number} sectionNum the section number.
+ * @param {File} fileInfo the file information object
+ * @param {HandlerManager} handlerManager the course handler manager
+ */
+const queueFileUpload = async function(courseId, sectionId, sectionNum, fileInfo, handlerManager) {
+    let handler;
+    uploadQueue = await processMonitor.createProcessQueue();
+    try {
+        handlerManager.validateFile(fileInfo);
+        handler = await handlerManager.getFileHandler(fileInfo);
+    } catch (error) {
+        uploadQueue.addError(fileInfo.name, error.message);
+        return;
+    }
+    // If we don't have a handler means the user cancel the upload.
+    if (!handler) {
+        return;
+    }
+    const fileProcessor = new FileUploader(courseId, sectionId, sectionNum, fileInfo, handler);
+    uploadQueue.addPending(fileInfo.name, fileProcessor.getExecutionFunction());
+};
+
+/**
+ * Upload a file to the course.
+ *
+ * This method will show any necesary modal to handle the request.
+ *
+ * @param {number} courseId the course id
+ * @param {number} sectionId the section id
+ * @param {number} sectionNum the section number
+ * @param {Array} files and array of files
+ */
+export const uploadFilesToCourse = async function(courseId, sectionId, sectionNum, files) {
+    // Get the course handlers.
+    const handlerManager = await loadCourseHandlerManager(courseId);
+    await loadErrorStrings(courseId);
+    for (let index = 0; index < files.length; index++) {
+        const fileInfo = files[index];
+        await queueFileUpload(courseId, sectionId, sectionNum, fileInfo, handlerManager);
+    }
+};

course/format/amd/src/local/courseeditor/mutations.js

@@ -473,12 +473,16 @@ export default class {
      * @param {boolean} collapsed the new collapsed value
      */
     async sectionIndexCollapsed(stateManager, sectionIds, collapsed) {
-        const collapsedIds = this._updateStateSectionPreference(stateManager, 'indexcollapsed', sectionIds, collapsed);
-        if (!collapsedIds) {
+        const affectedSections = this._updateStateSectionPreference(stateManager, 'indexcollapsed', sectionIds, collapsed);
+        if (!affectedSections) {
             return;
         }
         const course = stateManager.get('course');
-        await this._callEditWebservice('section_index_collapsed', course.id, collapsedIds);
+        let actionName = 'section_index_collapsed';
+        if (!collapsed) {
+            actionName = 'section_index_expanded';
+        }
+        await this._callEditWebservice(actionName, course.id, affectedSections);
     }
 
     /**
@@ -489,12 +493,16 @@ export default class {
      * @param {boolean} collapsed the new collapsed value
      */
     async sectionContentCollapsed(stateManager, sectionIds, collapsed) {
-        const collapsedIds = this._updateStateSectionPreference(stateManager, 'contentcollapsed', sectionIds, collapsed);
-        if (!collapsedIds) {
+        const affectedSections = this._updateStateSectionPreference(stateManager, 'contentcollapsed', sectionIds, collapsed);
+        if (!affectedSections) {
             return;
         }
         const course = stateManager.get('course');
-        await this._callEditWebservice('section_content_collapsed', course.id, collapsedIds);
+        let actionName = 'section_content_collapsed';
+        if (!collapsed) {
+            actionName = 'section_content_expanded';
+        }
+        await this._callEditWebservice(actionName, course.id, affectedSections);
     }
 
     /**
@@ -508,32 +516,22 @@ export default class {
      */
     _updateStateSectionPreference(stateManager, preferenceName, sectionIds, preferenceValue) {
         stateManager.setReadOnly(false);
-        const affectedSections = new Set();
+        const affectedSections = [];
         // Check if we need to update preferences.
         sectionIds.forEach(sectionId => {
             const section = stateManager.get('section', sectionId);
             if (section === undefined) {
+                stateManager.setReadOnly(true);
                 return null;
             }
             const newValue = preferenceValue ?? section[preferenceName];
             if (section[preferenceName] != newValue) {
                 section[preferenceName] = newValue;
-                affectedSections.add(section.id);
+                affectedSections.push(section.id);
             }
         });
         stateManager.setReadOnly(true);
-        if (affectedSections.size == 0) {
-            return null;
-        }
-        // Get all collapsed section ids.
-        const collapsedSectionIds = [];
-        const state = stateManager.state;
-        state.section.forEach(section => {
-            if (section[preferenceName]) {
-                collapsedSectionIds.push(section.id);
-            }
-        });
-        return collapsedSectionIds;
+        return affectedSections;
     }
 
     /**

course/format/amd/src/local/courseindex/cm.js

@@ -180,12 +180,8 @@ export default class Component extends DndCmItem {
         const exporter = this.reactive.getExporter();
         const data = exporter.cmCompletion(state, element);
 
-        try {
-            const {html, js} = await Templates.renderForPromise(completionTemplate, data);
-            Templates.replaceNode(completionElement, html, js);
-        } catch (error) {
-            throw error;
-        }
+        const {html, js} = await Templates.renderForPromise(completionTemplate, data);
+        Templates.replaceNode(completionElement, html, js);
     }
 
     /**

course/format/amd/src/local/courseindex/courseindex.js

@@ -131,9 +131,16 @@ export default class Component extends BaseComponent {
             const toggler = section.querySelector(this.selectors.COLLAPSE);
             const isCollapsed = toggler?.classList.contains(this.classes.COLLAPSED) ?? false;
 
-            if (isChevron || isCollapsed) {
-                // Update the state.
-                const sectionId = section.getAttribute('data-id');
+            // Update the state.
+            const sectionId = section.getAttribute('data-id');
+            if ((!sectionlink)) {
+                this.reactive.dispatch(
+                    'sectionIndexCollapsed',
+                    [sectionId],
+                    !isCollapsed
+                );
+            } else if (isCollapsed) {
+                // Always expand the section when clicking on section name.
                 this.reactive.dispatch(
                     'sectionIndexCollapsed',
                     [sectionId],

course/format/classes/base.php

@@ -617,8 +617,9 @@ abstract class base {
         global $USER;
         $course = $this->get_course();
         try {
-            $sectionpreferences = (array) json_decode(
-                get_user_preferences("coursesectionspreferences_{$course->id}", '', $USER->id)
+            $sectionpreferences = json_decode(
+                get_user_preferences("coursesectionspreferences_{$course->id}", '', $USER->id),
+                true
             );
             if (empty($sectionpreferences)) {
                 $sectionpreferences = [];
@@ -637,10 +638,65 @@ abstract class base {
      *
      */
     public function set_sections_preference(string $preferencename, array $sectionids) {
-        global $USER;
-        $course = $this->get_course();
         $sectionpreferences = $this->get_sections_preferences_by_preference();
         $sectionpreferences[$preferencename] = $sectionids;
+        $this->persist_to_user_preference($sectionpreferences);
+    }
+
+    /**
+     * Add section preference ids.
+     *
+     * @param string $preferencename preference name
+     * @param array $sectionids affected section ids
+     */
+    public function add_section_preference_ids(
+        string $preferencename,
+        array $sectionids
+    ): void {
+        $sectionpreferences = $this->get_sections_preferences_by_preference();
+        if (!isset($sectionpreferences[$preferencename])) {
+            $sectionpreferences[$preferencename] = [];
+        }
+        foreach ($sectionids as $sectionid) {
+            if (!in_array($sectionid, $sectionpreferences[$preferencename])) {
+                $sectionpreferences[$preferencename][] = $sectionid;
+            }
+        }
+        $this->persist_to_user_preference($sectionpreferences);
+    }
+
+    /**
+     * Remove section preference ids.
+     *
+     * @param string $preferencename preference name
+     * @param array $sectionids affected section ids
+     */
+    public function remove_section_preference_ids(
+        string $preferencename,
+        array $sectionids
+    ): void {
+        $sectionpreferences = $this->get_sections_preferences_by_preference();
+        if (!isset($sectionpreferences[$preferencename])) {
+            $sectionpreferences[$preferencename] = [];
+        }
+        foreach ($sectionids as $sectionid) {
+            if (($key = array_search($sectionid, $sectionpreferences[$preferencename])) !== false) {
+                unset($sectionpreferences[$preferencename][$key]);
+            }
+        }
+        $this->persist_to_user_preference($sectionpreferences);
+    }
+
+    /**
+     * Persist the section preferences to the user preferences.
+     *
+     * @param array $sectionpreferences the section preferences
+     */
+    private function persist_to_user_preference(
+        array $sectionpreferences
+    ): void {
+        global $USER;
+        $course = $this->get_course();
         set_user_preference('coursesectionspreferences_' . $course->id, json_encode($sectionpreferences), $USER->id);
         // Invalidate section preferences cache.
         $coursesectionscache = cache::make('core', 'coursesectionspreferences');

course/format/classes/stateactions.php

@@ -531,7 +531,7 @@ class stateactions {
     }
 
     /**
-     * Update the course content section collapsed value.
+     * Update the course content section state to collapse.
      *
      * @param stateupdates $updates the affected course elements track
      * @param stdClass $course the course object
@@ -550,11 +550,34 @@ class stateactions {
             $this->validate_sections($course, $ids, __FUNCTION__);
         }
         $format = course_get_format($course->id);
-        $format->set_sections_preference('contentcollapsed', $ids);
+        $format->add_section_preference_ids('contentcollapsed', $ids);
     }
 
     /**
-     * Update the course index section collapsed value.
+     * Update the course content section state to expand.
+     *
+     * @param stateupdates $updates the affected course elements track
+     * @param stdClass $course the course object
+     * @param int[] $ids the collapsed section ids
+     * @param int|null $targetsectionid not used
+     * @param int|null $targetcmid not used
+     */
+    public function section_content_expanded(
+        stateupdates $updates,
+        stdClass $course,
+        array $ids = [],
+        ?int $targetsectionid = null,
+        ?int $targetcmid = null
+    ): void {
+        if (!empty($ids)) {
+            $this->validate_sections($course, $ids, __FUNCTION__);
+        }
+        $format = course_get_format($course->id);
+        $format->remove_section_preference_ids('contentcollapsed', $ids);
+    }
+
+    /**
+     * Update the course index section state to collapse.
      *
      * @param stateupdates $updates the affected course elements track
      * @param stdClass $course the course object
@@ -573,7 +596,30 @@ class stateactions {
             $this->validate_sections($course, $ids, __FUNCTION__);
         }
         $format = course_get_format($course->id);
-        $format->set_sections_preference('indexcollapsed', $ids);
+        $format->add_section_preference_ids('indexcollapsed', $ids);
+    }
+
+    /**
+     * Update the course index section state to expand.
+     *
+     * @param stateupdates $updates the affected course elements track
+     * @param stdClass $course the course object
+     * @param int[] $ids the collapsed section ids
+     * @param int $targetsectionid not used
+     * @param int $targetcmid not used
+     */
+    public function section_index_expanded(
+        stateupdates $updates,
+        stdClass $course,
+        array $ids = [],
+        ?int $targetsectionid = null,
+        ?int $targetcmid = null
+    ): void {
+        if (!empty($ids)) {
+            $this->validate_sections($course, $ids, __FUNCTION__);
+        }
+        $format = course_get_format($course->id);
+        $format->remove_section_preference_ids('indexcollapsed', $ids);
     }
 
     /**

course/format/tests/base_test.php

@@ -347,6 +347,73 @@ class base_test extends advanced_testcase {
         );
     }
 
+    /**
+     * Test add_section_preference_ids() method.
+     *
+     * @covers \core_courseformat\base::persist_to_user_preference
+     */
+    public function test_add_section_preference_ids(): void {
+        $this->resetAfterTest();
+        // Create initial data.
+        $generator = $this->getDataGenerator();
+        $course = $generator->create_course();
+        $user = $generator->create_and_enrol($course);
+        // Get the course format.
+        $format = course_get_format($course);
+        // Login as the user.
+        $this->setUser($user);
+
+        // Add section preference ids.
+        $format->add_section_preference_ids('pref1', [1, 2]);
+        $format->add_section_preference_ids('pref1', [3]);
+        $format->add_section_preference_ids('pref2', [1]);
+
+        // Get section preferences.
+        $sectionpreferences = $format->get_sections_preferences_by_preference();
+        $this->assertCount(3, $sectionpreferences['pref1']);
+        $this->assertContains(1, $sectionpreferences['pref1']);
+        $this->assertContains(2, $sectionpreferences['pref1']);
+        $this->assertContains(3, $sectionpreferences['pref1']);
+        $this->assertCount(1, $sectionpreferences['pref2']);
+        $this->assertContains(1, $sectionpreferences['pref1']);
+    }
+
+    /**
+     * Test remove_section_preference_ids() method.
+     *
+     * @covers \core_courseformat\base::persist_to_user_preference
+     */
+    public function test_remove_section_preference_ids(): void {
+        $this->resetAfterTest();
+        // Create initial data.
+        $generator = $this->getDataGenerator();
+        $course = $generator->create_course();
+        $user = $generator->create_and_enrol($course);
+        // Get the course format.
+        $format = course_get_format($course);
+        // Login as the user.
+        $this->setUser($user);
+        // Set initial preferences.
+        $format->set_sections_preference('pref1', [1, 2, 3]);
+        $format->set_sections_preference('pref2', [1]);
+
+        // Remove section with id = 3 out of the pref1.
+        $format->remove_section_preference_ids('pref1', [3]);
+        // Get section preferences.
+        $sectionpreferences = $format->get_sections_preferences_by_preference();
+        $this->assertCount(2, $sectionpreferences['pref1']);
+        $this->assertCount(1, $sectionpreferences['pref2']);
+
+        // Remove section with id = 2 out of the pref1.
+        $format->remove_section_preference_ids('pref1', [2]);
+        // Remove section with id = 1 out of the pref2.
+        $format->remove_section_preference_ids('pref2', [1]);
+        // Get section preferences.
+        $sectionpreferences = $format->get_sections_preferences_by_preference();
+        $this->assertCount(1, $sectionpreferences['pref1']);
+        $this->assertEmpty($sectionpreferences['pref2']);
+    }
+
     /**
      * Test that retrieving last section number for a course
      *

course/format/upgrade.txt

@@ -2,6 +2,10 @@ This files describes API changes for course formats
 
 Overview of this plugin type at https://moodledev.io/docs/apis/plugintypes/format
 
+=== 4.1.10 ===
+* New core_courseformat\base::add_section_preference_ids() to add the section ids to course format preferences.
+* New core_courseformat\base::remove_section_preference_ids() to remove the section ids out of course format preferences.
+
 === 4.1 ===
 * New \core_courseformat\stateupdates methods add_section_remove() and add_cm_remove() have been added to replace
   the deprecated methods add_section_delete() and add_cm_delete().

course/tests/behat/add_activities.feature

@@ -11,9 +11,8 @@ Feature: Add activities to courses
 
   @javascript
   Scenario: Add an activity to a course
-    Given I am on the "Course 1" Course page logged in as admin
-    And I am on "Course 1" course homepage with editing mode on
-    When I add a "Database" to section "3" and I fill the form with:
+    Given I log in as "admin"
+    When I add a data activity to course "Course 1" section "3" and I fill the form with:
       | Name                      | Test name                 |
       | Description               | Test database description |
       | ID number                 | TESTNAME                  |
@@ -32,9 +31,8 @@ Feature: Add activities to courses
 
   @javascript
   Scenario: Add an activity supplying only the name
-    Given I am on the "Course 1" Course page logged in as admin
-    And I am on "Course 1" course homepage with editing mode on
-    When I add a "Database" to section "3" and I fill the form with:
+    Given I log in as "admin"
+    When I add a data activity to course "Course 1" section "3" and I fill the form with:
       | Name | Test name |
     Then I should see "Test name"
 
@@ -42,9 +40,8 @@ Feature: Add activities to courses
   Scenario: Set activity description to required then add an activity supplying only the name
     Given the following config values are set as admin:
       | requiremodintro | 1 |
-    And I am on the "Course 1" Course page logged in as admin
-    And I am on "Course 1" course homepage with editing mode on
-    And I add a "Database" to section "3" and I fill the form with:
+    And I log in as "admin"
+    And I add a data activity to course "Course 1" section "3" and I fill the form with:
       | Name | Test name |
     Then I should see "Required"
 
@@ -53,9 +50,8 @@ Feature: Add activities to courses
     Given the following "user preferences" exist:
       | user   | preference   | value    |
       | admin  | htmleditor   | textarea |
-    And I am logged in as admin
-    And I am on "Course 1" course homepage with editing mode on
-    When I add a "Database" to section "3"
+    And I log in as "admin"
+    When I add a data activity to course "Course 1" section "3"
     Then the field "Description format" matches value "0"
 
   @javascript

course/tests/behat/behat_course.php

@@ -202,7 +202,7 @@ class behat_course extends behat_base {
             if ($section) {
                 // Section 1 represents the contents on the frontpage.
                 $sectionxpath = "//body[@id='page-site-index']" .
-                        "/descendant::div[contains(concat(' ',normalize-space(@class),' '),' sitetopic ')]";
+                    "/descendant::div[contains(concat(' ',normalize-space(@class),' '),' sitetopic ')]";
             } else {
                 // Section 0 represents "Site main menu" block.
                 $sectionxpath = "//*[contains(concat(' ',normalize-space(@class),' '),' block_site_main_menu ')]";
@@ -224,10 +224,116 @@ class behat_course extends behat_base {
         // Clicks the selected activity if it exists.
         $activityliteral = behat_context_helper::escape(ucfirst($activity));
         $activityxpath = "//div[contains(concat(' ', normalize-space(@class), ' '), ' modchooser ')]" .
-                "/descendant::div[contains(concat(' ', normalize-space(@class), ' '), ' optioninfo ')]" .
-                "/descendant::div[contains(concat(' ', normalize-space(@class), ' '), ' optionname ')]" .
-                "[normalize-space(.)=$activityliteral]" .
-                "/parent::a";
+            "/descendant::div[contains(concat(' ', normalize-space(@class), ' '), ' optioninfo ')]" .
+            "/descendant::div[contains(concat(' ', normalize-space(@class), ' '), ' optionname ')]" .
+            "[normalize-space(.)=$activityliteral]" .
+            "/parent::a";
+
+        $this->execute('behat_general::i_click_on', [$activityxpath, 'xpath']);
+    }
+
+    /**
+     * Adds the selected activity/resource filling the form data with the specified field/value pairs.
+     *
+     * Sections 0 and 1 are also allowed on frontpage.
+     *
+     * @Given I add a :activity activity to course :coursefullname section :sectionnum and I fill the form with:
+     * @Given I add an :activity activity to course :coursefullname section :sectionnum and I fill the form with:
+     * @param string $activity The activity name
+     * @param string $coursefullname The course full name of the course.
+     * @param int $section The section number
+     * @param TableNode $data The activity field/value data
+     */
+    public function i_add_to_course_section_and_i_fill_the_form_with($activity, $coursefullname, $section, TableNode $data) {
+
+        // Add activity to section.
+        $this->execute(
+            "behat_course::i_add_to_course_section",
+            [$this->escape($activity), $this->escape($coursefullname), $this->escape($section)]
+        );
+
+        // Wait to be redirected.
+        $this->execute('behat_general::wait_until_the_page_is_ready');
+
+        // Set form fields.
+        $this->execute("behat_forms::i_set_the_following_fields_to_these_values", $data);
+
+        // Save course settings.
+        $this->execute("behat_forms::press_button", get_string('savechangesandreturntocourse'));
+    }
+
+    /**
+     * Open a add activity form page.
+     *
+     * @Given I add a :activity activity to course :coursefullname section :sectionnum
+     * @Given I add an :activity activity to course :coursefullname section :sectionnum
+     * @throws coding_exception
+     * @param string $activity The activity name.
+     * @param string $coursefullname The course full name of the course.
+     * @param string $sectionnum The section number.
+     */
+    public function i_add_to_course_section(string $activity, string $coursefullname, string $sectionnum): void {
+        $addurl = new moodle_url('/course/modedit.php', [
+            'add' => $activity,
+            'course' => $this->get_course_id($coursefullname),
+            'section' => intval($sectionnum),
+        ]);
+        $this->execute('behat_general::i_visit', [$addurl]);
+    }
+
+    /**
+     * Opens the activity chooser and opens the activity/resource link form page.
+     *
+     * Sections 0 and 1 are also allowed on frontpage.
+     *
+     * This step require javascript enabled and it is used mainly to click activities or resources by name,
+     * not by plugin name. Use the standard behat_course::i_add_to_course_section step instead unless the
+     * plugin create extra entries into the activity chooser (like LTI).
+     *
+     * @Given I add a :activityname to section :sectionnum using the activity chooser
+     * @Given I add an :activityname to section :sectionnum using the activity chooser
+     * @throws ElementNotFoundException Thrown by behat_base::find
+     * @param string $activityname
+     * @param int $sectionnum
+     */
+    public function i_add_to_section_using_the_activity_chooser($activityname, $sectionnum) {
+
+        $this->require_javascript('Please use the \'the following "activity" exists:\' data generator instead.');
+
+        if ($this->getSession()->getPage()->find('css', 'body#page-site-index') && (int) $sectionnum <= 1) {
+            // We are on the frontpage.
+            if ($sectionnum) {
+                // Section 1 represents the contents on the frontpage.
+                $sectionxpath = "//body[@id='page-site-index']" .
+                    "/descendant::div[contains(concat(' ',normalize-space(@class),' '),' sitetopic ')]";
+            } else {
+                // Section 0 represents "Site main menu" block.
+                $sectionxpath = "//*[contains(concat(' ',normalize-space(@class),' '),' block_site_main_menu ')]";
+            }
+        } else {
+            // We are inside the course.
+            $sectionxpath = "//li[@id='section-" . $sectionnum . "']";
+        }
+
+        // Clicks add activity or resource section link.
+        $sectionnode = $this->find('xpath', $sectionxpath);
+        $this->execute(
+            'behat_general::i_click_on_in_the',
+            [
+                "//button[@data-action='open-chooser' and not(@data-beforemod)]",
+                'xpath',
+                $sectionnode,
+                'NodeElement',
+            ]
+        );
+
+        // Clicks the selected activity if it exists.
+        $activityliteral = behat_context_helper::escape(ucfirst($activityname));
+        $activityxpath = "//div[contains(concat(' ', normalize-space(@class), ' '), ' modchooser ')]" .
+            "/descendant::div[contains(concat(' ', normalize-space(@class), ' '), ' optioninfo ')]" .
+            "/descendant::div[contains(concat(' ', normalize-space(@class), ' '), ' optionname ')]" .
+            "[normalize-space(.)=$activityliteral]" .
+            "/parent::a";
 
         $this->execute('behat_general::i_click_on', [$activityxpath, 'xpath']);
     }

course/tests/behat/course_force_language.feature

@@ -0,0 +1,38 @@
+@core_course
+Feature: Force course language
+  To be able to force a language for the course
+  As a teacher
+  I need to be able to set force language setting for the course
+
+  Background:
+    Given remote langimport tests are enabled
+    And the following "courses" exist:
+      | fullname | shortname |
+      | Course 1 | C1        |
+    And the following "users" exist:
+      | username | firstname | lastname | email                |
+      | teacher1 | Teacher   | One      | teacher1@example.com |
+    And the following "course enrolments" exist:
+      | user     | course | role           |
+      | teacher1 | C1     | editingteacher |
+    And the following "language pack" exists:
+      | language | fr | es |
+
+  Scenario: A teacher can set a course language
+    Given I am on the "Course 1" course page logged in as "teacher1"
+    # Site default language is English.
+    And I should see "Settings"
+    And I follow "Preferences" in the user menu
+    And I follow "Preferred language"
+    # Change preferred language to French.
+    And I set the field "Preferred language" to "fr"
+    And I press "Save changes"
+    And I am on "Course 1" course homepage
+    And I should see "Paramètres"
+    # Change course language to Spanish.
+    And I navigate to "Paramètres" in current page administration
+    When I set the following fields to these values:
+      | id_lang | es |
+    And I press "Enregistrer et afficher"
+    # Course language is now Spanish.
+    Then I should see "Configuración"

course/tests/behat/section_visibility.feature

@@ -10,8 +10,8 @@ Feature: Show/hide course sections
       | teacher1 | Teacher | 1 | teacher1@example.com |
       | student1 | Student | 1 | student1@example.com |
     And the following "courses" exist:
-      | fullname | shortname | format | hiddensections |
-      | Course 1 | C1 | topics | 0                     |
+      | fullname | shortname | format | hiddensections | enablecompletion | coursedisplay |
+      | Course 1 | C1        | topics | 0              | 1                | 1             |
     And the following "course enrolments" exist:
       | user | course | role |
       | teacher1 | C1 | editingteacher |
@@ -76,12 +76,7 @@ Feature: Show/hide course sections
 
   @javascript
   Scenario: Students can not navigate to restricted sections
-    Given I navigate to "Settings" in current page administration
-    And I set the following fields to these values:
-      | Course layout | Show one section per page |
-      | Enable completion tracking | Yes |
-    And I press "Save and display"
-    And the following "activities" exist:
+    Given the following "activities" exist:
       | activity | course | section | name       | completion |
       | label    | C1     | 1       | Test label | 1          |
     And I edit the section "2"

course/upgrade.txt

@@ -2,6 +2,10 @@ This files describes API changes in /course/*,
 information provided here is intended especially for developers.
 
 === 4.1.7 ===
+* New behat steps backported to stable versions:
+  - I add a :activityname to section :sectionnum using the activity chooser
+  - I add a :activitypluginname activity to course :coursefullname section :sectionnum
+  - I add a :activitypluginname activity to course :coursefullname section :sectionnum and I fill the form with:
 * set_coursemodule_visible() has a new $rebuildcache parameter. If this is being called multiple times in the same request,
   consider passing `false` for this parameter and rebuilding the cache once after all the course modules have been updated.
   See course_update_section() for an example.

enrol/externallib.php

@@ -619,6 +619,7 @@ class core_enrol_external extends external_api {
                 'searchanywhere' => new external_value(PARAM_BOOL, 'find a match anywhere, or only at the beginning'),
                 'page' => new external_value(PARAM_INT, 'Page number'),
                 'perpage' => new external_value(PARAM_INT, 'Number per page'),
+                'contextid' => new external_value(PARAM_INT, 'Context ID', VALUE_DEFAULT, null),
             ]
         );
     }
@@ -631,11 +632,12 @@ class core_enrol_external extends external_api {
      * @param bool $searchanywhere Match anywhere in the string
      * @param int $page Page number
      * @param int $perpage Max per page
+     * @param ?int $contextid Context ID we are in - we might use search on activity level and its group mode can be different from course group mode.
      * @return array An array of users
      * @throws moodle_exception
      */
-    public static function search_users(int $courseid, string $search, bool $searchanywhere, int $page, int $perpage): array {
-        global $PAGE, $DB, $CFG;
+    public static function search_users(int $courseid, string $search, bool $searchanywhere, int $page, int $perpage, ?int $contextid = null): array {
+        global $PAGE, $CFG;
 
         require_once($CFG->dirroot.'/enrol/locallib.php');
         require_once($CFG->dirroot.'/user/lib.php');
@@ -647,10 +649,15 @@ class core_enrol_external extends external_api {
                     'search'         => $search,
                     'searchanywhere' => $searchanywhere,
                     'page'           => $page,
-                    'perpage'        => $perpage
-                ]
+                    'perpage'        => $perpage,
+                    'contextid'      => $contextid,
+                ],
         );
-        $context = context_course::instance($params['courseid']);
+        if (isset($contextid)) {
+            $context = context::instance_by_id($params['contextid']);
+        } else {
+            $context = context_course::instance($params['courseid']);
+        }
         try {
             self::validate_context($context);
         } catch (Exception $e) {
@@ -664,10 +671,14 @@ class core_enrol_external extends external_api {
         $course = get_course($params['courseid']);
         $manager = new course_enrolment_manager($PAGE, $course);
 
-        $users = $manager->search_users($params['search'],
-                                        $params['searchanywhere'],
-                                        $params['page'],
-                                        $params['perpage']);
+        $users = $manager->search_users(
+            $params['search'],
+            $params['searchanywhere'],
+            $params['page'],
+            $params['perpage'],
+            false,
+            $params['contextid']
+        );
 
         $results = [];
         // Add also extra user fields.

enrol/locallib.php

@@ -563,26 +563,40 @@ class course_enrolment_manager {
      * @param int $page Starting at 0.
      * @param int $perpage Number of users returned per page.
      * @param bool $returnexactcount Return the exact total users using count_record or not.
+     * @param ?int $contextid Context ID we are in - we might use search on activity level and its group mode can be different from course group mode.
      * @return array with two or three elements:
      *      int totalusers Number users matching the search. (This element only exist if $returnexactcount was set to true)
      *      array users List of user objects returned by the query.
      *      boolean moreusers True if there are still more users, otherwise is False.
      */
     public function search_users(string $search = '', bool $searchanywhere = false, int $page = 0, int $perpage = 25,
-            bool $returnexactcount = false) {
+            bool $returnexactcount = false, ?int $contextid = null) {
         global $USER;
 
         [$ufields, $joins, $params, $wherecondition] = $this->get_basic_search_conditions($search, $searchanywhere);
 
-        $groupmode = groups_get_course_groupmode($this->course);
-        if ($groupmode == SEPARATEGROUPS && !has_capability('moodle/site:accessallgroups', $this->context)) {
+        if (isset($contextid)) {
+            // If contextid is set, we need to determine the group mode that should be used (module or course).
+            [$context, $course, $cm] = get_context_info_array($contextid);
+            // If cm instance is returned, then use the group mode from the module, otherwise get the course group mode.
+            $groupmode = $cm ? groups_get_activity_groupmode($cm, $course) : groups_get_course_groupmode($this->course);
+        } else {
+            // Otherwise, default to the group mode of the course.
+            $context = $this->context;
+            $groupmode = groups_get_course_groupmode($this->course);
+        }
+
+        if ($groupmode == SEPARATEGROUPS && !has_capability('moodle/site:accessallgroups', $context)) {
             $groups = groups_get_all_groups($this->course->id, $USER->id, 0, 'g.id');
             $groupids = array_column($groups, 'id');
+            if (!$groupids) {
+                return ['totalusers' => 0, 'users' => [], 'moreusers' => false];
+            }
         } else {
             $groupids = [];
         }
 
-        [$enrolledsql, $enrolledparams] = get_enrolled_sql($this->context, '', $groupids);
+        [$enrolledsql, $enrolledparams] = get_enrolled_sql($context, '', $groupids);
 
         $fields      = 'SELECT ' . $ufields;
         $countfields = 'SELECT COUNT(u.id)';

enrol/lti/classes/output/renderer.php

@@ -263,4 +263,19 @@ class renderer extends plugin_renderer_base {
         return parent::render_from_template('enrol_lti/local/ltiadvantage/registration_view',
             $tcontext);
     }
+
+    /**
+     * Render a warning, indicating to the user that cookies are require but couldn't be set.
+     *
+     * @return string the html.
+     */
+    public function render_cookies_required_notice(): string {
+        $notification = new notification(get_string('cookiesarerequiredinfo', 'enrol_lti'), notification::NOTIFY_WARNING, false);
+        $tcontext = [
+            'heading' => get_string('cookiesarerequired', 'enrol_lti'),
+            'notification' => $notification->export_for_template($this),
+        ];
+
+        return parent::render_from_template('enrol_lti/local/ltiadvantage/cookies_required_notice', $tcontext);
+    }
 }

enrol/lti/lang/en/enrol_lti.php

@@ -31,6 +31,10 @@ $string['addtocourse'] = 'Add to course';
 $string['addtogradebook'] = 'Add to gradebook';
 $string['allowframeembedding'] = 'Note: It is recommended that the site administration setting \'Allow frame embedding\' is enabled, so that tools are displayed within a frame rather than in a new window.';
 $string['authltimustbeenabled'] = 'Note: This plugin requires the LTI authentication plugin to be enabled too.';
+$string['cookiesarerequired'] = 'Cookies are blocked by your browser';
+$string['cookiesarerequiredinfo'] = 'This tool can\'t be launched because your browser seems to be blocking third-party cookies.
+<br><br>
+To use this tool, try changing your browser cookie settings or using a different browser.';
 $string['copiedtoclipboard'] = '{$a} copied to clipboard';
 $string['copytoclipboard'] = 'Copy to clipboard';
 $string['couldnotestablishproxy'] = 'Could not establish proxy with consumer.';

enrol/lti/login.php

@@ -26,6 +26,7 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 
+use auth_lti\local\ltiadvantage\utility\cookie_helper;
 use enrol_lti\local\ltiadvantage\lib\issuer_database;
 use enrol_lti\local\ltiadvantage\lib\launch_cache_session;
 use enrol_lti\local\ltiadvantage\repository\application_registration_repository;
@@ -39,7 +40,7 @@ require_once(__DIR__."/../../config.php");
 // See http://www.imsglobal.org/spec/security/v1p0/#step-1-third-party-initiated-login.
 // Validate these here, despite further validation in the LTI 1.3 library.
 $iss = required_param('iss', PARAM_URL); // Issuer URI of the calling platform.
-$loginhint = required_param('login_hint', PARAM_INT); // Platform ID for the person to login.
+$loginhint = required_param('login_hint', PARAM_RAW); // Platform ID for the person to login.
 $targetlinkuri = required_param('target_link_uri', PARAM_URL); // The took launch URL.
 
 // Optional lti_message_hint. See https://www.imsglobal.org/spec/lti/v1p3#additional-login-parameters-0.
@@ -76,6 +77,30 @@ if (empty($_REQUEST['client_id']) && !empty($_REQUEST['id'])) {
     $_REQUEST['client_id'] = $_REQUEST['id'];
 }
 
+// Before beginning the OIDC authentication, ensure the MoodleSession cookie can be used. Browser-specific steps may need to be
+// taken to set cookies in 3rd party contexts. Skip the check if the user is already auth'd. This means that either cookies aren't
+// an issue in the current browser/launch context.
+if (!isloggedin()) {
+    cookie_helper::do_cookie_check(new moodle_url('/enrol/lti/login.php', [
+        'iss' => $iss,
+        'login_hint' => $loginhint,
+        'target_link_uri' => $targetlinkuri,
+        'lti_message_hint' => $ltimessagehint,
+        'client_id' => $_REQUEST['client_id'],
+    ]));
+    if (!cookie_helper::cookies_supported()) {
+        global $OUTPUT, $PAGE;
+        $PAGE->set_context(context_system::instance());
+        $PAGE->set_url(new moodle_url('/enrol/lti/login.php'));
+        $PAGE->set_pagelayout('popup');
+        echo $OUTPUT->header();
+        $renderer = $PAGE->get_renderer('enrol_lti');
+        echo $renderer->render_cookies_required_notice();
+        echo $OUTPUT->footer();
+        die();
+    }
+}
+
 // Now, do the OIDC login.
 LtiOidcLogin::new(
     new issuer_database(new application_registration_repository(), new deployment_repository()),

enrol/lti/templates/local/ltiadvantage/cookies_required_notice.mustache

@@ -0,0 +1,50 @@
+{{!
+    This file is part of Moodle - http://moodle.org/
+
+    Moodle is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    Moodle is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+}}
+{{!
+    @template enrol_lti/local/ltiadvantage/cookies_required_notice
+
+    Displays a notice, reporting that cookies are required but couldn't be set.
+
+    Classes required for JS:
+    * none
+
+    Data attributes required for JS:
+    * none
+
+    Context variables required for this template:
+    * heading
+    * notification
+
+    Example context (json):
+    {
+        "heading": "Cookies are required",
+        "notification": {
+            "message": "You appear to be using an unsupported browser...",
+            "extraclasses": "",
+            "announce": true,
+            "closebutton": false,
+            "issuccess": false,
+            "isinfo": false,
+            "iswarning": true,
+            "iserror": false
+        }
+    }
+}}
+<h3>{{heading}}</h3>
+{{#notification}}
+    {{> core/notification}}
+{{/notification}}

enrol/tests/course_enrolment_manager_test.php

@@ -18,6 +18,7 @@ namespace core_enrol;
 
 use context_course;
 use course_enrolment_manager;
+use stdClass;
 
 /**
  * Test course_enrolment_manager parts.
@@ -557,11 +558,18 @@ class course_enrolment_manager_test extends \advanced_testcase {
 
         $this->resetAfterTest();
 
+        // Create the forum.
+        $record = new stdClass();
+        $record->introformat = FORMAT_HTML;
+        $record->course = $this->course->id;
+        $forum = self::getDataGenerator()->create_module('forum', $record, ['groupmode' => SEPARATEGROUPS]);
+        $contextid = $DB->get_field('context', 'id', ['instanceid' => $forum->cmid, 'contextlevel' => CONTEXT_MODULE]);
+
         $teacher = $this->getDataGenerator()->create_and_enrol($this->course, 'teacher');
         $this->getDataGenerator()->create_group_member(['groupid' => $this->groups['group1']->id, 'userid' => $teacher->id]);
         $this->setUser($teacher);
 
-        $users = (new course_enrolment_manager($PAGE, $this->course))->search_users('', false, 0, 25, true);
+        $courseusers = (new course_enrolment_manager($PAGE, $this->course))->search_users('', false, 0, 25, true);
         $this->assertEqualsCanonicalizing([
             $teacher->username,
             $this->users['user0']->username,
@@ -570,26 +578,49 @@ class course_enrolment_manager_test extends \advanced_testcase {
             $this->users['user22']->username,
             $this->users['userall']->username,
             $this->users['usertch']->username,
-        ], array_column($users['users'], 'username'));
-        $this->assertEquals(7, $users['totalusers']);
+        ], array_column($courseusers['users'], 'username'));
+        $this->assertEquals(7, $courseusers['totalusers']);
 
-        // Switch course to separate groups.
-        $this->course->groupmode = SEPARATEGROUPS;
-        update_course($this->course);
-
-        $users = (new course_enrolment_manager($PAGE, $this->course))->search_users('', false, 0, 25, true);
+        $forumusers = (new course_enrolment_manager($PAGE, $this->course))->search_users('', false, 0, 25, true, $contextid);
         $this->assertEqualsCanonicalizing([
             $teacher->username,
             $this->users['user1']->username,
             $this->users['userall']->username,
-        ], array_column($users['users'], 'username'));
-        $this->assertEquals(3, $users['totalusers']);
+        ], array_column($forumusers['users'], 'username'));
+        $this->assertEquals(3, $forumusers['totalusers']);
+
+        // Switch course to separate groups and forum to no group.
+        $this->course->groupmode = SEPARATEGROUPS;
+        update_course($this->course);
+        set_coursemodule_groupmode($forum->cmid, NOGROUPS);
+
+        $courseusers = (new course_enrolment_manager($PAGE, $this->course))->search_users('', false, 0, 25, true);
+        $this->assertEqualsCanonicalizing([
+            $teacher->username,
+            $this->users['user1']->username,
+            $this->users['userall']->username,
+        ], array_column($courseusers['users'], 'username'));
+        $this->assertEquals(3, $courseusers['totalusers']);
+
+        $forumusers = (new course_enrolment_manager($PAGE, $this->course))->search_users('', false, 0, 25, true, $contextid);
+        $this->assertEqualsCanonicalizing([
+            $teacher->username,
+            $this->users['user0']->username,
+            $this->users['user1']->username,
+            $this->users['user21']->username,
+            $this->users['user22']->username,
+            $this->users['userall']->username,
+            $this->users['usertch']->username,
+        ], array_column($forumusers['users'], 'username'));
+        $this->assertEquals(7, $forumusers['totalusers']);
+
+        set_coursemodule_groupmode($forum->cmid, SEPARATEGROUPS);
 
         // Allow teacher to access all groups.
         $roleid = $DB->get_field('role', 'id', ['shortname' => 'teacher']);
         assign_capability('moodle/site:accessallgroups', CAP_ALLOW, $roleid, context_course::instance($this->course->id)->id);
 
-        $users = (new course_enrolment_manager($PAGE, $this->course))->search_users('', false, 0, 25, true);
+        $courseusers = (new course_enrolment_manager($PAGE, $this->course))->search_users('', false, 0, 25, true);
         $this->assertEqualsCanonicalizing([
             $teacher->username,
             $this->users['user0']->username,
@@ -598,7 +629,19 @@ class course_enrolment_manager_test extends \advanced_testcase {
             $this->users['user22']->username,
             $this->users['userall']->username,
             $this->users['usertch']->username,
-        ], array_column($users['users'], 'username'));
-        $this->assertEquals(7, $users['totalusers']);
+        ], array_column($courseusers['users'], 'username'));
+        $this->assertEquals(7, $courseusers['totalusers']);
+
+        $forumusers = (new course_enrolment_manager($PAGE, $this->course))->search_users('', false, 0, 25, true, $contextid);
+        $this->assertEqualsCanonicalizing([
+            $teacher->username,
+            $this->users['user0']->username,
+            $this->users['user1']->username,
+            $this->users['user21']->username,
+            $this->users['user22']->username,
+            $this->users['userall']->username,
+            $this->users['usertch']->username,
+        ], array_column($forumusers['users'], 'username'));
+        $this->assertEquals(7, $forumusers['totalusers']);
     }
 }

enrol/tests/externallib_test.php

@@ -19,6 +19,7 @@ namespace core_enrol;
 use core_enrol_external;
 use enrol_user_enrolment_form;
 use externallib_advanced_testcase;
+use stdClass;
 
 defined('MOODLE_INTERNAL') || die();
 
@@ -1402,6 +1403,71 @@ class externallib_test extends externallib_advanced_testcase {
         $this->assertCount(0, $result);
     }
 
+    /**
+     * Test for core_enrol_external::search_users() when group mode is active.
+     * @covers ::search_users
+     */
+    public function test_search_users_groupmode() {
+        global $DB;
+
+        $this->resetAfterTest();
+        $datagen = $this->getDataGenerator();
+
+        $studentroleid = $DB->get_field('role', 'id', ['shortname' => 'student'], MUST_EXIST);
+        $teacherroleid = $DB->get_field('role', 'id', ['shortname' => 'teacher'], MUST_EXIST);
+
+        $course = $datagen->create_course();
+
+        $student1 = $datagen->create_and_enrol($course);
+        $student2 = $datagen->create_and_enrol($course);
+        $student3 = $datagen->create_and_enrol($course);
+        $teacher1 = $datagen->create_and_enrol($course, 'teacher');
+        $teacher2 = $datagen->create_and_enrol($course, 'teacher');
+        $teacher3 = $datagen->create_and_enrol($course, 'teacher');
+        $teacher4 = $datagen->create_and_enrol($course, 'editingteacher');
+
+        // Create 2 groups.
+        $group1 = $datagen->create_group(['courseid' => $course->id]);
+        $group2 = $datagen->create_group(['courseid' => $course->id]);
+
+        // Add the users to the groups.
+        $datagen->create_group_member(['groupid' => $group1->id, 'userid' => $student1->id]);
+        $datagen->create_group_member(['groupid' => $group2->id, 'userid' => $student2->id]);
+        $datagen->create_group_member(['groupid' => $group2->id, 'userid' => $student3->id]);
+        $datagen->create_group_member(['groupid' => $group1->id, 'userid' => $teacher1->id]);
+        $datagen->create_group_member(['groupid' => $group2->id, 'userid' => $teacher1->id]);
+        $datagen->create_group_member(['groupid' => $group1->id, 'userid' => $teacher2->id]);
+
+        // Create the forum.
+        $record = new stdClass();
+        $record->introformat = FORMAT_HTML;
+        $record->course = $course->id;
+        $forum = self::getDataGenerator()->create_module('forum', $record, ['groupmode' => SEPARATEGROUPS]);
+        $contextid = $DB->get_field('context', 'id', ['instanceid' => $forum->cmid, 'contextlevel' => CONTEXT_MODULE]);
+
+        $this->setUser($teacher1);
+        $result = core_enrol_external::search_users($course->id, 'user', true, 0, 30, $contextid);
+        $this->assertCount(5, $result);
+
+        $this->setUser($teacher2);
+        $result = core_enrol_external::search_users($course->id, 'user', true, 0, 30, $contextid);
+        $this->assertCount(3, $result);
+
+        $this->setUser($teacher3);
+        $result = core_enrol_external::search_users($course->id, 'user', true, 0, 30, $contextid);
+        $this->assertCount(0, $result);
+
+        $this->setUser($teacher4);
+        $result = core_enrol_external::search_users($course->id, 'user', true, 0, 30, $contextid);
+        $this->assertCount(7, $result);
+
+        // Now change the group mode to no groups.
+        set_coursemodule_groupmode($forum->cmid, NOGROUPS);
+        $this->setUser($teacher1);
+        $result = core_enrol_external::search_users($course->id, 'user', true, 0, 30, $contextid);
+        $this->assertCount(7, $result);
+    }
+
     /**
      * Tests the get_potential_users external function (not too much detail because the back-end
      * is covered in another test).

enrol/upgrade.txt

@@ -1,6 +1,11 @@
 This files describes API changes in /enrol/* - plugins,
 information provided here is intended especially for developers.
 
+=== 4.1.9 ===
+
+* Functions core_enrol_external::search_users and course_enrolment_manager::search_users now have extra optional parameter
+  contextid which allows to search users in a specific activity context. When omitted it searches in the whole course.
+
 === 4.1.1 ===
 
 * New is_self_enrol_available() function has been created. Similar to can_self_enrol but without checking user capabilities.

enrol/yui/otherusersmanager/assets/skins/sam/otherusersmanager.css

@@ -1,4 +1,4 @@
-/* stylelint-disable unit-blacklist */
+/* stylelint-disable unit-disallowed-list */
 /**************************************
 
 Structure of the other user role assignment panel

filter/mathjaxloader/filter.php

@@ -138,9 +138,13 @@ class filter_mathjaxloader extends moodle_text_filter {
 
         $hasdisplayorinline = false;
         if ($hasextra) {
+            // Convert the HTML tag wrapper inside the equation to entities.
+            $text = $this->escape_html_tag_wrapper($text);
             // If custom dilimeters are used, wrap whole text to prevent autolinking.
             $text = '<span class="nolink">' . $text . '</span>';
         } else if (preg_match('/\\\\[[(]/', $text) || preg_match('/\$\$/', $text)) {
+            // Convert the HTML tag wrapper inside the equation to entities.
+            $text = $this->escape_html_tag_wrapper($text);
             // Only parse the text if there are mathjax symbols in it. The recognized
             // math environments are \[ \] and $$ $$ for display mathematics and \( \)
             // for inline mathematics.
@@ -246,4 +250,20 @@ class filter_mathjaxloader extends moodle_text_filter {
                 $start,
                 $end - $start + 1);
     }
+
+    /**
+     * Escapes HTML tags within a string.
+     *
+     * This function replaces HTML tags enclosed in curly brackets with their respective HTML entities.
+     *
+     * @param string $text The input string containing HTML tags.
+     * @return string Returns the input string with HTML tags escaped.
+     */
+    private function escape_html_tag_wrapper(string $text): string {
+        return preg_replace_callback('/\{([^}]+)\}/', function(array $matches): string {
+            $search = ['<', '>'];
+            $replace = ['&lt;', '&gt;'];
+            return str_replace($search, $replace, $matches[0]);
+        }, $text);
+    }
 }

grade/grading/form/guide/tests/behat/assign_marking_guide.feature

@@ -0,0 +1,72 @@
+@gradingform @gradingform_guide @javascript
+Feature: Display marking guide information to students
+  In order for students to see the marking guide information
+  As a teacher
+  I should be able to change display settings for marking guide information
+
+  Background:
+    Given the following "courses" exist:
+      | fullname | shortname |
+      | Course 1 | C1        |
+    And the following "users" exist:
+      | username | firstname | lastname | email                |
+      | teacher1 | Teacher   | 1        | teacher1@example.com |
+      | student1 | Student   | 1        | student1@example.com |
+    And the following "course enrolments" exist:
+      | user     | course | role           |
+      | teacher1 | C1     | editingteacher |
+      | student1 | C1     | student        |
+    And the following "activities" exist:
+      | activity | course | name     | advancedgradingmethod_submissions |
+      | assign   | C1     | Assign 1 | guide                             |
+    And I am on the "Course 1" course page logged in as teacher1
+    And I go to "Assign 1" advanced grading definition page
+    And I set the following fields to these values:
+      | Name                                 | Assign 1 marking guide    |
+      | Description                          | Marking guide description |
+    And I define the following marking guide:
+      | Criterion name    | Description for students         | Description for markers         | Maximum score |
+      | Grade Criteria 1  | Grade 1 description for students | Grade 1 description for markers | 70            |
+      | Grade Criteria 2  | Grade 2 description for students | Grade 2 description for markers | 30            |
+    And I press "Save marking guide and make it ready"
+
+  Scenario: Confirm that marking guide information is not displayed after student is graded
+    # Update the existing marking guide to ensure that marks per criterion is displayed.
+    Given I click on "Edit the current form definition" "link"
+    And I set the field "Show marks per criterion to students" to "0"
+    And I press "Save"
+    And I am on the "Assign 1" "assign activity" page
+    And I go to "Student 1" "Assign 1" activity advanced grading page
+    And I grade by filling the marking guide with:
+      | Grade Criteria 1 | 50 | Excellent work! |
+      | Grade Criteria 2 | 20 | Try harder      |
+    And I press "Save changes"
+    When I am on the "Assign 1" "assign activity" page logged in as student1
+    # Confirm the marking guide information display after student is graded when marking per criterion display is disabled.
+    # Confirm that overall grade is displayed.
+    Then I should see "70.00 / 100.00"
+    And I should see the marking guide information displayed as:
+      | criteria         | description                      | remark          |
+      | Grade Criteria 1 | Grade 1 description for students | Excellent work! |
+      | Grade Criteria 2 | Grade 2 description for students | Try harder      |
+
+  Scenario: Confirm that marking guide information is displayed after student is graded
+    Given I am on the "Assign 1" "assign activity" page logged in as student1
+    And I should see "Grade 1 description for students" in the "Grade Criteria 1" "table_row"
+    And I should see "Grade 2 description for students" in the "Grade Criteria 2" "table_row"
+    # No grade to student1 yet.
+    And I should not see "70.00 / 100.00"
+    # No need to update marking guide as marking guide definition is already enabled by default
+    And I am on the "Assign 1" "assign activity" page logged in as teacher1
+    And I go to "Student 1" "Assign 1" activity advanced grading page
+    And I grade by filling the marking guide with:
+      | Grade Criteria 1 | 50 | Excellent work! |
+      | Grade Criteria 2 | 20 | Try harder      |
+    And I press "Save changes"
+    When I am on the "Assign 1" "assign activity" page logged in as student1
+    # Student1 grade is now displayed.
+    Then I should see "70.00 / 100.00"
+    And I should see the marking guide information displayed as:
+      | criteria         | description                      | remark          | maxscore | criteriascore |
+      | Grade Criteria 1 | Grade 1 description for students | Excellent work! | 70       | 50 / 70       |
+      | Grade Criteria 2 | Grade 2 description for students | Try harder      | 30       | 20 / 30       |

grade/lib.php

@@ -183,12 +183,7 @@ class graded_users_iterator {
             }
         }
 
-        $userfieldsapi = \core_user\fields::for_identity($coursecontext, false)->with_userpic();
-        $userfields = $userfieldsapi->get_sql('u', false, '', '', false)->selects;
-
-        // This need to be fixed - webservices in grade/report/user/classes/external/user.php don't check permission properly.
-        $userfields .= ', u.idnumber, u.institution, u.department';
-
+        $userfields = 'u.*';
         $customfieldssql = '';
         if ($this->allowusercustomfields && !empty($CFG->grade_export_customprofilefields)) {
             $customfieldscount = 0;
@@ -222,7 +217,8 @@ class graded_users_iterator {
         $this->users_rs = $DB->get_recordset_sql($users_sql, $params);
 
         if (!$this->onlyactive) {
-            $this->suspendedusers = get_suspended_userids($coursecontext);
+            $context = context_course::instance($this->course->id);
+            $this->suspendedusers = get_suspended_userids($context);
         } else {
             $this->suspendedusers = array();
         }

grade/report/user/tests/behat/user_report_navigation.feature

@@ -27,36 +27,36 @@ Feature: Teacher can navigate to the previous or next user report.
 
   Scenario: A teacher can navigate to the next user report
     Given I click on "Student 1" in the "user" search widget
-    And I should see "Student 1" in the ".user-heading" "css_element"
+    And "Student 1" "heading" should exist
     And ".previous" "css_element" should not exist in the ".user-navigation" "css_element"
     And ".next" "css_element" should exist in the ".user-navigation" "css_element"
     And I should see "Student 2" in the ".next" "css_element"
     When I click on "Student 2" "link" in the ".next" "css_element"
-    Then I should see "Student 2" in the ".user-heading" "css_element"
+    And "Student 2" "heading" should exist
     And ".previous" "css_element" should exist in the ".user-navigation" "css_element"
     And I should see "Student 1" in the ".previous" "css_element"
     And ".next" "css_element" should exist in the ".user-navigation" "css_element"
     And I should see "Student 3" in the ".next" "css_element"
     And I click on "Student 3" "link" in the ".next" "css_element"
-    And I should see "Student 3" in the ".user-heading" "css_element"
+    And "Student 3" "heading" should exist
     And ".previous" "css_element" should exist in the ".user-navigation" "css_element"
     And I should see "Student 2" in the ".previous" "css_element"
     And ".next" "css_element" should not exist in the ".user-navigation" "css_element"
 
   Scenario: A teacher can navigate to the previous user report
     Given I click on "Student 3" in the "user" search widget
-    And I should see "Student 3" in the ".user-heading" "css_element"
+    And "Student 3" "heading" should exist
     And ".previous" "css_element" should exist in the ".user-navigation" "css_element"
     And I should see "Student 2" in the ".previous" "css_element"
     And ".next" "css_element" should not exist in the ".user-navigation" "css_element"
     When I click on "Student 2" "link" in the ".previous" "css_element"
-    Then I should see "Student 2" in the ".user-heading" "css_element"
+    And "Student 2" "heading" should exist
     And ".previous" "css_element" should exist in the ".user-navigation" "css_element"
     And I should see "Student 1" in the ".previous" "css_element"
     And ".next" "css_element" should exist in the ".user-navigation" "css_element"
     And I should see "Student 3" in the ".next" "css_element"
     And I click on "Student 1" "link" in the ".previous" "css_element"
-    And I should see "Student 1" in the ".user-heading" "css_element"
+    And "Student 1" "heading" should exist
     And ".previous" "css_element" should not exist in the ".user-navigation" "css_element"
     And ".next" "css_element" should exist in the ".user-navigation" "css_element"
     And I should see "Student 2" in the ".next" "css_element"

grade/tests/behat/grade_recovery_settings.feature

@@ -0,0 +1,52 @@
+@core @core_grades @javascript
+Feature: Admin can set Recover grades default setting
+  In order to recover grades
+  As an admin
+  I need to enable "Recover grades default" from site administration
+
+  Background:
+    Given the following "courses" exist:
+      | fullname | shortname |
+      | Course 1 | C1        |
+    And the following "users" exist:
+      | username | firstname | lastname | email                |
+      | student1 | Student   | One      | student1@example.com |
+    And the following "course enrolments" exist:
+      | user     | course | role    |
+      | student1 | C1     | student |
+    And the following "activities" exist:
+      | activity | course | name     |
+      | assign   | C1     | Assign 1 |
+
+  Scenario Outline: Recover grades default setting can be changed
+    Given the following config values are set as admin:
+      | recovergradesdefault  | <recovergradesetting>  |
+    # Grade student 1 via quick grading
+    And I am on the "Assign 1" "assign activity" page logged in as admin
+    And I follow "View all submissions"
+    And I click on "Quick grading" "checkbox"
+    And I set the field "User grade" to "60.00"
+    And I press "Save all quick grading changes"
+    # Confirm that assigned grade was saved
+    And I am on the "Course 1" "grades > Grader report > View" page
+    And I should see "60.00" in the "Student One" "table_row"
+    And I navigate to course participants
+    And I click on "Unenrol" "icon" in the "Student One" "table_row"
+    And I click on "Unenrol" "button" in the "Unenrol" "dialogue"
+    # The button at the top is hidden by the un-enrolment confirmation dialogue so the button at the bottom is clicked instead.
+    And I click on "Enrol users" "button" in the "div.justify-content-end .enrolusersbutton" "css_element"
+    And I set the field "Select users" to "student1"
+    # Confirm the "Recover user's old grades if possible" checkbox state based on Recover grades default setting
+    When I click on "Show more..." "link"
+    Then the field "Recover user's old grades if possible" matches value "<oldgraderecover>"
+    # Confirm that "Recover user's old grades if possible" checkbox state can be changed manually
+    And I click on "Recover user's old grades if possible" "checkbox" in the "Enrol users" "dialogue"
+    And I click on "Enrol users" "button" in the "Enrol users" "dialogue"
+    # Confirm whether re-enrolled student's grade is recovered or not based on student enrolment settings
+    And I am on the "Course 1" "grades > Grader report > View" page
+    And I <gradevisibility> see "60.00" in the "Student One" "table_row"
+
+    Examples:
+      | recovergradesetting | oldgraderecover | gradevisibility |
+      | 0                   | 0               | should          |
+      | 1                   | 1               | should not      |