Moodle release 4.2.7

Fixes the current behavior where the last row in the grader report is
always 'pinned', ensuring it is pinned only when necessary.

.eslintrc

@@ -1,8 +1,12 @@
 {
   'plugins': [
-    'babel',
+    '@babel',
     'promise',
-    'jsdoc',
+    'jsdoc'
+  ],
+  'extends': [
+    'eslint:recommended',
+    'plugin:promise/recommended'
   ],
   'env': {
     'browser': true,
@@ -16,42 +20,19 @@
     'M': true,
     'Y': true
   },
+  // Warn about unused eslint-disable statements.
+  'reportUnusedDisableDirectives': true,
   'rules': {
     // See http://eslint.org/docs/rules/ for all rules and explanations of all
     // rules.
 
     // === Possible Errors ===
     'comma-dangle': 'off',
-    'no-compare-neg-zero': 'error',
-    'no-cond-assign': 'error',
     'no-console': 'error',
-    'no-constant-condition': 'error',
-    'no-control-regex': 'error',
-    'no-debugger': 'error',
-    'no-dupe-args': 'error',
-    'no-dupe-keys': 'error',
-    'no-duplicate-case': 'error',
     'no-empty': 'warn',
-    'no-empty-character-class': 'error',
-    'no-ex-assign': 'error',
-    'no-extra-boolean-cast': 'error',
     'no-extra-parens': 'off',
-    'no-extra-semi': 'error',
-    'no-func-assign': 'error',
-    'no-inner-declarations': 'error',
-    'no-invalid-regexp': 'error',
-    'no-irregular-whitespace': 'error',
-    'no-obj-calls': 'error',
     'no-prototype-builtins': 'off',
-    'no-regex-spaces': 'error',
-    'no-sparse-arrays': 'error',
-    'no-unexpected-multiline': 'error',
     'no-unreachable': 'warn',
-    'no-unsafe-finally': 'error',
-    'no-unsafe-negation': 'error',
-    'use-isnan': 'error',
-    'valid-jsdoc': ['warn', { 'requireReturn': false, 'requireParamDescription': false, 'requireReturnDescription': false }],
-    'valid-typeof': 'error',
 
     // === Best Practices ===
     // (these mostly match our jshint config)
@@ -63,15 +44,12 @@
     'dot-notation': 'warn',
     'no-alert': 'warn',
     'no-caller': 'error',
-    'no-case-declarations': 'error',
     'no-div-regex': 'error',
-    'no-empty-pattern': 'error',
     'no-empty-function': 'warn',
     'no-eq-null': 'error',
     'no-eval': 'error',
     'no-extend-native': 'error',
     'no-extra-bind': 'warn',
-    'no-fallthrough': 'error',
     'no-floating-decimal': 'warn',
     'no-global-assign': 'warn',
     'no-implied-eval': 'error',
@@ -83,28 +61,22 @@
     'no-multi-str': 'error',
     'no-new-func': 'error',
     'no-new-wrappers': 'error',
-    'no-octal': 'error',
     'no-octal-escape': 'error',
     'no-proto': 'error',
     'no-redeclare': 'warn',
     'no-restricted-globals': ['error', { 'name': 'Notification' }],
     'no-return-assign': 'error',
     'no-script-url': 'error',
-    'no-self-assign': 'error',
     'no-self-compare': 'error',
     'no-sequences': 'warn',
     'no-throw-literal': 'warn',
     'no-unmodified-loop-condition': 'error',
     'no-unused-expressions': 'error',
-    'no-unused-labels': 'error',
     'no-useless-call': 'warn',
     'no-useless-escape': 'warn',
-    'no-with': 'error',
     'wrap-iife': ['error', 'any'],
 
     // === Variables ===
-    'no-delete-var': 'error',
-    'no-undef': 'error',
     'no-undef-init': 'error',
     'no-unused-vars': ['error', { 'caughtErrors': 'none' }],
 
@@ -137,8 +109,6 @@
     'max-statements-per-line': ['warn', { max: 2 }],
     'new-cap': ['warn', { 'properties': false }],
     'new-parens': 'warn',
-    'newline-after-var': 'off',
-    'newline-before-return': 'off',
     'newline-per-chained-call': 'off',
     'no-array-constructor': 'off',
     'no-bitwise': 'error',
@@ -146,7 +116,6 @@
     'no-inline-comments': 'off',
     'no-lonely-if': 'off',
     'no-mixed-operators': 'off',
-    'no-mixed-spaces-and-tabs': 'error',
     'no-multiple-empty-lines': 'warn',
     'no-negated-condition': 'off',
     'no-nested-ternary': 'warn',
@@ -168,7 +137,6 @@
     'padded-blocks': 'off',
     'quote-props': ['warn', 'as-needed', {'unnecessary': false, 'keywords': true, 'numbers': true}],
     'quotes': 'off',
-    'require-jsdoc': 'warn',
     'semi': 'error',
     'semi-spacing': ['warn', {'before': false, 'after': true}],
     'sort-vars': 'off',
@@ -181,21 +149,19 @@
     'unicode-bom': 'error',
     'wrap-regex': 'off',
 
-    // === Promises ===
+    // === Promises (override plugin:promise/recommended) ===
     'promise/always-return': 'warn',
     'promise/no-return-wrap': 'warn',
     'promise/param-names': 'warn',
     'promise/catch-or-return': ['warn', {terminationMethod: ['catch', 'fail']}],
     'promise/no-native': 'warn',
-    'promise/no-promise-in-callback': 'warn',
-    'promise/no-callback-in-promise': 'warn',
     'promise/avoid-new': 'warn',
 
     // === Deprecations ===
     "no-restricted-properties": ['warn', {
         'object': 'M',
         'property': 'str',
-        'message': 'Use AMD module "core/str" or M.util.get_string()'
+        'message': 'Use "core/str" module or M.util.get_string()'
     }],
   },
   overrides: [
@@ -235,7 +201,6 @@
       parser: '@babel/eslint-parser',
       // Check AMD with some slightly stricter rules.
       rules: {
-        'no-unused-vars': 'error',
         'no-implicit-globals': 'error',
         // Disable all of the rules that have babel versions.
         'new-cap': 'off',
@@ -247,65 +212,37 @@
         'semi': 'off',
         'no-unused-expressions': 'off',
         // Enable all of the babel version of these rules.
-        'babel/new-cap': ['warn', { 'properties': false }],
+        '@babel/new-cap': ['warn', { 'properties': false }],
         // Not using this rule for the time being because it isn't
         // compatible with jQuery and ES6.
-        'babel/no-invalid-this': 'off',
-        'babel/object-curly-spacing': 'warn',
-        // This is off in the original style int.
-        'babel/quotes': 'off',
-        'babel/semi': 'error',
-        'babel/no-unused-expressions': 'error',
+        '@babel/no-invalid-this': 'off',
+        '@babel/object-curly-spacing': 'warn',
+        '@babel/semi': 'error',
+        '@babel/no-unused-expressions': 'error',
         // === Promises ===
         // We have Promise now that we're using ES6.
         'promise/no-native': 'off',
         'promise/avoid-new': 'off',
 
         // === JSDocs ===
-        "jsdoc/check-access": [
-          'error',
-        ],
-        "jsdoc/check-alignment": 1, // Recommended.
-        "jsdoc/check-param-names": [
-          'error',
-        ],
-        "jsdoc/check-property-names": [
-          'error',
-        ],
-        "jsdoc/empty-tags": [
-          'error',
-        ],
-        "jsdoc/implements-on-classes": [
-          'error',
-        ],
-        "jsdoc/multiline-blocks": [
-          'error',
-        ],
-        "jsdoc/require-jsdoc": [
-          'error',
-        ],
-        "jsdoc/require-param": [
-          'error',
-        ],
-        "jsdoc/require-param-name": [
-          'error',
-        ],
-        "jsdoc/require-param-type": [
-          'error',
-        ],
-        "jsdoc/require-property": [
-          'error',
-        ],
-        "jsdoc/require-property-name": [
-          'error',
-        ],
-        "jsdoc/require-property-type": [
-          'error',
-        ],
+        'jsdoc/check-access': 'error',
+        'jsdoc/check-alignment': 1, // Recommended.
+        'jsdoc/check-param-names': 'error',
+        'jsdoc/check-property-names': 'error',
+        'jsdoc/empty-tags': 'error',
+        'jsdoc/implements-on-classes': 'error',
+        'jsdoc/multiline-blocks': 'error',
+        'jsdoc/require-jsdoc': 'error',
+        'jsdoc/require-param': 'error',
+        'jsdoc/require-param-name': 'error',
+        'jsdoc/require-param-type': 'error',
+        'jsdoc/require-property': 'error',
+        'jsdoc/require-property-name': 'error',
+        'jsdoc/require-property-type': 'error'
       },
       parserOptions: {
         'sourceType': 'module',
-        'requireConfigFile': false,
+        'requireConfigFile': false
       }
     }
   ]

.github/workflows/push.yml

@@ -7,6 +7,12 @@ on:
       - MOODLE_[0-9]+_STABLE
     tags-ignore:
       - v[0-9]+.[0-9]+.[0-9]+*
+  workflow_dispatch:
+    inputs:
+      phpunit_extra_options:
+        description: Additional options to apply to PHPUnit
+        required: false
+        default: ''
 
 env:
   php: 8.2
@@ -17,10 +23,10 @@ jobs:
 
     steps:
       - name: Checking out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Configuring node & npm
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
 
@@ -99,7 +105,7 @@ jobs:
           coverage: none
 
       - name: Checking out code from ${{ env.GITHUB_REF_SLUG }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setting up PHPUnit
         env:
@@ -115,4 +121,4 @@ jobs:
         env:
           dbtype: ${{ matrix.db }}
           phpunit_options: ${{ secrets.phpunit_options }}
-        run: vendor/bin/phpunit $phpunit_options
+        run: vendor/bin/phpunit $phpunit_options ${{ inputs.phpunit_extra_options }}

.github/workflows/windows.yml

@@ -1,7 +1,12 @@
 name: Windows Testing
 
 on:
-  workflow_dispatch
+  workflow_dispatch:
+    inputs:
+      phpunit_extra_options:
+        description: Additional options to apply to PHPUnit
+        required: false
+        default: ''
 env:
   php: 8.2
 
@@ -16,10 +21,10 @@ jobs:
           git config --global core.eol lf
 
       - name: Checking out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Configuring node & npm
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
 
@@ -112,7 +117,7 @@ jobs:
           git config --global core.eol lf
 
       - name: Checking out code from ${{ env.GITHUB_REF_SLUG }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       # Needs to be done after php is available, git configured and Moodle checkout has happened.
       - name: Setting up moodle-exttests service
@@ -141,4 +146,4 @@ jobs:
         env:
           dbtype: ${{ matrix.db }}
           phpunit_options: ${{ secrets.phpunit_options }}
-        run: vendor/bin/phpunit $phpunit_options
+        run: vendor/bin/phpunit $phpunit_options ${{ inputs.phpunit_extra_options }}

.grunt/tasks/javascript.js

@@ -21,7 +21,7 @@
  */
 
 /**
- * Function to generate the destination for the uglify task
+ * Function to generate the destination for the minification task
  * (e.g. build/file.min.js). This function will be passed to
  * the rename property of files array when building dynamically:
  * http://gruntjs.com/configuring-tasks#building-the-files-object-dynamically
@@ -60,7 +60,6 @@ module.exports = grunt => {
     grunt.registerTask('js', ['amd', 'yui']);
 
     // Register NPM tasks.
-    grunt.loadNpmTasks('grunt-contrib-uglify');
     grunt.loadNpmTasks('grunt-contrib-watch');
     grunt.loadNpmTasks('grunt-rollup');
 
@@ -104,6 +103,7 @@ module.exports = grunt => {
         // The queue runner will run the next `size` items in the queue.
         const runQueue = (size = 1) => {
             queue.splice(0, size).forEach(resolve => {
+                grunt.log.debug(`Item resolved. Kicking off next one.`);
                 resolve();
             });
         };
@@ -113,15 +113,17 @@ module.exports = grunt => {
 
             // The options hook is run in parallel.
             // We can return an unresolved Promise which is queued for later resolution.
-            options: async() => {
+            options: async(options) => {
                 return new Promise(resolve => {
                     queue.push(resolve);
                     startQueue();
+                    return options;
                 });
             },
 
             // When an item in the queue completes, start the next item in the queue.
-            buildEnd: () => {
+            generateBundle: (options, bundle) => {
+                grunt.log.debug(`Finished output phase for ${Object.keys(bundle).join(', ')}`);
                 runQueue();
             },
         };
@@ -151,24 +153,10 @@ module.exports = grunt => {
                             //
                             // It also adds the Moodle plugin name to the AMD module definition
                             // so that it can be imported as expected in other modules.
-                            path.resolve('.grunt/babel-plugin-add-module-to-define.js'),
-                            '@babel/plugin-syntax-dynamic-import',
-                            '@babel/plugin-syntax-import-meta',
-                            ['@babel/plugin-proposal-class-properties', {'loose': false}],
-                            '@babel/plugin-proposal-json-strings'
+                            path.resolve('.grunt/babel-plugin-add-module-to-define.js')
                         ],
                         presets: [
                             ['@babel/preset-env', {
-                                targets: {
-                                    browsers: [
-                                        ">0.3%",
-                                        "last 2 versions",
-                                        "not ie >= 0",
-                                        "not op_mini all",
-                                        "not Opera > 0",
-                                        "not dead"
-                                    ]
-                                },
                                 modules: false,
                                 useBuiltIns: false
                             }]

.grunt/tasks/jsdoc.js

@@ -20,17 +20,33 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 
-module.exports = grunt => {
-    // Project configuration.
-    grunt.config.merge({
-        jsdoc: {
-            dist: {
-                options: {
-                    configure: ".grunt/jsdoc/jsdoc.conf.js",
-                },
-            },
-        },
-    });
+module.exports = (grunt) => {
+    const path = require('path');
 
-    grunt.loadNpmTasks('grunt-jsdoc');
+    grunt.registerTask('jsdoc', 'Generate JavaScript documentation using jsdoc', function() {
+        const done = this.async();
+        const configuration = path.resolve('.grunt/jsdoc/jsdoc.conf.js');
+
+        grunt.util.spawn({
+            cmd: 'jsdoc',
+            args: [
+                '--configure',
+                configuration,
+            ]
+        }, function(error, result, code) {
+            if (result.stdout) {
+                grunt.log.write(result.stdout);
+            }
+
+            if (result.stderr) {
+                grunt.log.error(result.stderr);
+            }
+            if (error) {
+                grunt.fail.fatal(`JSDoc failed with error code ${code}`);
+            } else {
+                grunt.log.write('JSDoc completed successfully'.green);
+            }
+            done();
+        });
+    });
 };

.grunt/tasks/stylelint.js

@@ -29,6 +29,7 @@ module.exports = grunt => {
                     // Use a fully-qualified path.
                     src: files,
                     options: {
+                        quietDeprecationWarnings: true,
                         configOverrides: {
                             rules: {
                                 // These rules have to be disabled in .stylelintrc for scss compat.
@@ -45,7 +46,10 @@ module.exports = grunt => {
         return {
             stylelint: {
                 scss: {
-                    options: {syntax: 'scss'},
+                    options: {
+                        quietDeprecationWarnings: true,
+                        customSyntax: 'postcss-scss',
+                    },
                     src: files,
                 },
             },

.nvmrc

@@ -1 +1 @@
-lts/gallium
+lts/iron

.stylelintrc

@@ -1,9 +1,14 @@
 {
+    "customSyntax": "postcss-scss",
     "plugins": [
         "stylelint-csstree-validator"
     ],
     "rules": {
-        "csstree/validator": true,
+        "csstree/validator": {
+          "syntaxExtensions": [
+            "sass"
+          ]
+        },
         "at-rule-empty-line-before": [ "always",
           {"except": [ "blockless-after-blockless"], ignore: ["after-comment", "inside-block"]}
         ],
@@ -45,7 +50,7 @@
         "function-name-case": "lower",
         "function-parentheses-newline-inside": "always-multi-line",
         "function-parentheses-space-inside": "never-single-line",
-        "function-url-scheme-blacklist": ["data"],
+        "function-url-scheme-disallowed-list": ["data"],
         "function-whitespace-after": "always",
         "indentation": 4,
         "keyframe-declaration-no-important": true,
@@ -84,12 +89,19 @@
         "selector-type-no-unknown": true,
         "string-no-newline": true,
         "time-min-milliseconds": 100,
-        "unit-blacklist": ["pt"],
+        "unit-disallowed-list": ["pt"],
         "unit-case": "lower",
         "unit-no-unknown": true,
         "value-keyword-case": ["lower", {"ignoreKeywords": ["/(@|$)/"]}],
         "value-list-comma-newline-after": "always-multi-line",
         "value-list-comma-space-after": "always-single-line",
         "value-list-comma-space-before": "never",
-  }
+  },
+  "overrides": [
+    {
+      "files": ["**/yui/**/*.css"],
+      "rules": {
+      }
+    }
+  ]
 }

admin/classes/table/tool_plugin_management_table.php

@@ -19,7 +19,7 @@ namespace core_admin\table;
 use moodle_url;
 
 /**
- * Tiny admin settings.
+ * Admin tool settings.
  *
  * @package core_admin
  * @copyright 2023 Andrew Lyons <andrew@nicols.co.uk>
@@ -30,12 +30,6 @@ class tool_plugin_management_table extends \core_admin\table\plugin_management_t
         return 'tool';
     }
 
-    public function guess_base_url(): void {
-        $this->define_baseurl(
-            new moodle_url('/admin/tools.php')
-        );
-    }
-
     protected function get_column_list(): array {
         $columns = parent::get_column_list();
 
@@ -45,6 +39,6 @@ class tool_plugin_management_table extends \core_admin\table\plugin_management_t
     }
 
     protected function get_action_url(array $params = []): moodle_url {
-        return new moodle_url('/admin/tool.php', $params);
+        return new moodle_url('/admin/settings.php', array_merge(['section' => 'toolsmanagement'], $params));
     }
 }

admin/cli/restore_backup.php

@@ -80,8 +80,8 @@ if (!$category = $DB->get_record('course_categories', ['id' => $options['categor
     throw new \moodle_exception('invalidcategoryid');
 }
 
-$backupdir = "restore_" . uniqid();
-$path = $CFG->tempdir . DIRECTORY_SEPARATOR . "backup" . DIRECTORY_SEPARATOR . $backupdir;
+$backupdir = restore_controller::get_tempdir_name(SITEID, $USER->id);
+$path = make_backup_temp_directory($backupdir);
 
 cli_heading(get_string('extractingbackupfileto', 'backup', $path));
 $fp = get_file_packer('application/vnd.moodle.backup');

admin/environment.xml

@@ -3923,6 +3923,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.2" requires="3.11.8">
@@ -3939,6 +3941,7 @@
       <VENDOR name="oracle" version="19" />
     </DATABASE>
     <PHP version="8.0.0" level="required">
+      <RESTRICT function="restrict_php_version_83" message="unsupportedphpversion83" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -4112,6 +4115,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.3" requires="3.11.8">
@@ -4128,6 +4133,7 @@
       <VENDOR name="oracle" version="19" />
     </DATABASE>
     <PHP version="8.0.0" level="required">
+      <RESTRICT function="restrict_php_version_83" message="unsupportedphpversion83" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -4303,6 +4309,201 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="4.4" requires="4.1.2">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="10.6.7" />
+      <VENDOR name="mysql" version="8.0" />
+      <VENDOR name="postgres" version="13" />
+      <VENDOR name="mssql" version="14.0" />
+      <VENDOR name="oracle" version="19" />
+    </DATABASE>
+    <PHP version="8.1.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="mbstringrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+      <PHP_EXTENSION name="sodium" level="required"/>
+      <PHP_EXTENSION name="exif" level="optional"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_sixtyfour_bits" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="sixtyfourbitsrequired" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_max_input_vars" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_admin_dir_usage" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iscustomadminwarnings" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/presets/classes/manager.php

@@ -761,8 +761,8 @@ class manager {
     public function delete_preset(int $presetid): void {
         global $DB;
 
-        // Check the preset exists.
-        $preset = $DB->get_record('adminpresets', ['id' => $presetid]);
+        // Check the preset exists (cannot delete the pre-installed core "Starter" and "Full" presets).
+        $preset = $DB->get_record('adminpresets', ['id' => $presetid, 'iscore' => self::NONCORE_PRESET]);
         if (!$preset) {
             throw new moodle_exception('errordeleting', 'core_adminpresets');
         }

admin/presets/tests/manager_test.php

@@ -16,6 +16,7 @@
 
 namespace core_adminpresets;
 
+use moodle_exception;
 use stdClass;
 
 /**
@@ -599,10 +600,28 @@ class manager_test extends \advanced_testcase {
 
         $manager = new manager();
 
-        $this->expectException(\moodle_exception::class);
+        $this->expectException(moodle_exception::class);
+        $this->expectExceptionMessage('Error deleting from database');
         $manager->delete_preset($unexistingid);
     }
 
+    /**
+     * Test trying to delete the core/pre-defined presets
+     *
+     * @covers ::delete_preset
+     */
+    public function test_delete_preset_core(): void {
+        global $DB;
+
+        $this->resetAfterTest();
+
+        $starterpreset = $DB->get_record('adminpresets', ['iscore' => manager::STARTER_PRESET]);
+
+        $this->expectException(moodle_exception::class);
+        $this->expectExceptionMessage('Error deleting from database');
+        (new manager())->delete_preset($starterpreset->id);
+    }
+
     /**
      * Test the behaviour of delete_preset() method.
      *

admin/repository.php

@@ -49,26 +49,11 @@ if ($action == 'newon') {
 
 admin_externalpage_setup($pagename);
 
-$sesskeyurl = $CFG->wwwroot.'/'.$CFG->admin.'/repository.php?sesskey=' . sesskey();
-$baseurl    = $CFG->wwwroot.'/'.$CFG->admin.'/repository.php';
-
-$configstr  = get_string('manage', 'repository');
+// The URL used for redirection, and that all edit related URLs will be based off.
+$baseurl = new moodle_url('/admin/repository.php');
 
 $return = true;
 
-if (!empty($action)) {
-    require_sesskey();
-}
-
-/**
- * Helper function that generates a moodle_url object
- * relevant to the repository
- */
-function repository_action_url($repository) {
-    global $baseurl;
-    return new moodle_url($baseurl, array('sesskey'=>sesskey(), 'repos'=>$repository));
-}
-
 if (($action == 'edit') || ($action == 'new')) {
     $pluginname = '';
     if ($action == 'edit') {
@@ -182,16 +167,12 @@ if (($action == 'edit') || ($action == 'new')) {
         }
     }
 } else if ($action == 'show') {
-    if (!confirm_sesskey()) {
-        throw new \moodle_exception('confirmsesskeybad', '', $baseurl);
-    }
+    require_sesskey();
     $class = \core_plugin_manager::resolve_plugininfo_class('repository');
     $class::enable_plugin($repository, 1);
     $return = true;
 } else if ($action == 'hide') {
-    if (!confirm_sesskey()) {
-        throw new \moodle_exception('confirmsesskeybad', '', $baseurl);
-    }
+    require_sesskey();
     $class = \core_plugin_manager::resolve_plugininfo_class('repository');
     $class::enable_plugin($repository, 0);
     $return = true;
@@ -199,9 +180,7 @@ if (($action == 'edit') || ($action == 'new')) {
     $repositorytype = repository::get_type_by_typename($repository);
     if ($sure) {
         $PAGE->set_pagetype('admin-repository-' . $repository);
-        if (!confirm_sesskey()) {
-            throw new \moodle_exception('confirmsesskeybad', '', $baseurl);
-        }
+        require_sesskey();
 
         if ($repositorytype->delete($downloadcontents)) {
             // Include this information into config changes table.
@@ -220,20 +199,15 @@ if (($action == 'edit') || ($action == 'new')) {
         $output = $OUTPUT->box_start('generalbox', 'notice');
         $output .= html_writer::tag('p', $message);
 
-        $removeurl = new moodle_url($sesskeyurl);
-        $removeurl->params(array(
+        $removeurl = new moodle_url($baseurl, [
             'action' =>'delete',
             'repos' => $repository,
             'sure' => 'yes',
-        ));
+        ]);
 
-        $removeanddownloadurl = new moodle_url($sesskeyurl);
-        $removeanddownloadurl->params(array(
-            'action' =>'delete',
-            'repos'=> $repository,
-            'sure' => 'yes',
+        $removeanddownloadurl = new moodle_url($removeurl, [
             'downloadcontents' => 1,
-        ));
+        ]);
 
         $output .= $OUTPUT->single_button($removeurl, get_string('continueuninstall', 'repository'));
         $output .= $OUTPUT->single_button($removeanddownloadurl, get_string('continueuninstallanddownload', 'repository'));
@@ -245,9 +219,11 @@ if (($action == 'edit') || ($action == 'new')) {
         $return = false;
     }
 } else if ($action == 'moveup') {
+    require_sesskey();
     $repositorytype = repository::get_type_by_typename($repository);
     $repositorytype->move_order('up');
 } else if ($action == 'movedown') {
+    require_sesskey();
     $repositorytype = repository::get_type_by_typename($repository);
     $repositorytype->move_order('down');
 } else {
@@ -339,8 +315,7 @@ if (($action == 'edit') || ($action == 'new')) {
                     $userinstancenumbertext = "";
                 }
 
-                $settings .= '<a href="' . $sesskeyurl . '&amp;action=edit&amp;repos=' . $typename . '">' . $settingsstr .'</a>';
-
+                $settings = html_writer::link(new moodle_url($baseurl, ['action' => 'edit', 'repos' => $typename]), $settingsstr);
                 $settings .= $OUTPUT->container_start('mdl-left');
                 $settings .= '<br/>';
                 $settings .= $admininstancenumbertext;
@@ -357,22 +332,34 @@ if (($action == 'edit') || ($action == 'new')) {
                 $currentaction = 'hide';
             }
 
-            $select = new single_select(repository_action_url($typename, 'repos'), 'action', $actionchoicesforexisting, $currentaction, null, 'applyto' . basename($typename));
+            // Active toggle.
+            $selectaction = new moodle_url($baseurl, ['sesskey' => sesskey(), 'repos' => $typename]);
+            $select = new single_select($selectaction, 'action', $actionchoicesforexisting, $currentaction, null,
+                'applyto' . basename($typename));
             $select->set_label(get_string('action'), array('class' => 'accesshide'));
+
             // Display up/down link
             $updown = '';
             $spacer = $OUTPUT->spacer(array('height'=>15, 'width'=>15)); // should be done with CSS instead
 
             if ($updowncount > 1) {
-                $updown .= "<a href=\"$sesskeyurl&amp;action=moveup&amp;repos=".$typename."\">";
-                $updown .= $OUTPUT->pix_icon('t/up', get_string('moveup')) . "</a>&nbsp;";
+                $moveupaction = new moodle_url($baseurl, [
+                    'sesskey' => sesskey(),
+                    'action' => 'moveup',
+                    'repos' => $typename,
+                ]);
+                $updown .= html_writer::link($moveupaction, $OUTPUT->pix_icon('t/up', get_string('moveup'))) . '&nbsp;';
             }
             else {
                 $updown .= $spacer;
             }
             if ($updowncount < $totalrepositorytypes) {
-                $updown .= "<a href=\"$sesskeyurl&amp;action=movedown&amp;repos=".$typename."\">";
-                $updown .= $OUTPUT->pix_icon('t/down', get_string('movedown')) . "</a>&nbsp;";
+                $movedownaction = new moodle_url($baseurl, [
+                    'sesskey' => sesskey(),
+                    'action' => 'movedown',
+                    'repos' => $typename,
+                ]);
+                $updown .= html_writer::link($movedownaction, $OUTPUT->pix_icon('t/down', get_string('movedown'))) . '&nbsp;';
             }
             else {
                 $updown .= $spacer;
@@ -400,7 +387,9 @@ if (($action == 'edit') || ($action == 'new')) {
         foreach ($plugins as $plugin => $dir) {
             // Check that it has not already been listed
             if (!in_array($plugin, $alreadyplugins)) {
-                $select = new single_select(repository_action_url($plugin, 'repos'), 'action', $actionchoicesfornew, 'delete', null, 'applyto' . basename($plugin));
+                $selectaction = new moodle_url($baseurl, ['sesskey' => sesskey(), 'repos' => $plugin]);
+                $select = new single_select($selectaction, 'action', $actionchoicesfornew, 'delete', null,
+                    'applyto' . basename($plugin));
                 $select->set_label(get_string('action'), array('class' => 'accesshide'));
                 $uninstall = '';
                 if ($uninstallurl = core_plugin_manager::instance()->get_uninstall_url('repository_' . $plugin, 'manage')) {

admin/repositoryinstance.php

@@ -18,8 +18,6 @@ require_once(__DIR__ . '/../config.php');
 require_once($CFG->dirroot . '/repository/lib.php');
 require_once($CFG->libdir . '/adminlib.php');
 
-require_sesskey();
-
 // id of repository
 $edit    = optional_param('edit', 0, PARAM_INT);
 $new     = optional_param('new', '', PARAM_PLUGIN);
@@ -43,12 +41,8 @@ if ($edit){
 
 admin_externalpage_setup($pagename, '', null, new moodle_url('/admin/repositoryinstance.php'));
 
-$baseurl = new moodle_url("/$CFG->admin/repositoryinstance.php", array('sesskey'=>sesskey()));
-
-$parenturl = new moodle_url("/$CFG->admin/repository.php", array(
-    'sesskey'=>sesskey(),
-    'action'=>'edit',
-));
+// The URL used for redirection, and that all edit related URLs will be based off.
+$parenturl = new moodle_url('/admin/repository.php', ['action' => 'edit']);
 
 if ($new) {
     $parenturl->param('repos', $new);
@@ -116,6 +110,7 @@ if (!empty($edit) || !empty($new)) {
         $return = false;
     }
 } else if (!empty($hide)) {
+    require_sesskey();
     $instance = repository::get_type_by_typename($hide);
     $instance->hide();
     core_plugin_manager::reset_caches();
@@ -129,6 +124,7 @@ if (!empty($edit) || !empty($new)) {
         throw new repository_exception('nopermissiontoaccess', 'repository');
     }
     if ($sure) {
+        require_sesskey();
         if ($instance->delete($downloadcontents)) {
             $deletedstr = get_string('instancedeleted', 'repository');
             core_plugin_manager::reset_caches();
@@ -141,14 +137,17 @@ if (!empty($edit) || !empty($new)) {
 
     echo $OUTPUT->header();
     echo $OUTPUT->box_start('generalbox', 'notice');
-    $continueurl = new moodle_url($baseurl, array(
+
+    $continueurl = new moodle_url($PAGE->url, [
         'type' => $type,
         'delete' => $delete,
         'sure' => 'yes',
-    ));
+    ]);
+
     $continueanddownloadurl = new moodle_url($continueurl, array(
         'downloadcontents' => 1
     ));
+
     $message = get_string('confirmdelete', 'repository', $instance->name);
     echo html_writer::tag('p', $message);
 

admin/roles/admins.php

@@ -38,6 +38,22 @@ if (!is_siteadmin()) {
 }
 
 $admisselector = new core_role_admins_existing_selector();
+
+if (array_key_exists('siteadmins', $CFG->config_php_settings)) {
+    echo $OUTPUT->header();
+    echo $OUTPUT->heading(get_string('manageadmins', 'core_role'), 3);
+    echo $OUTPUT->notification(get_string('siteadministratorsconfigphp', 'core_role'), \core\output\notification::NOTIFY_INFO);
+    echo $OUTPUT->box_start();
+    echo html_writer::tag(
+        'p',
+        get_string('existingadmins', 'core_role'),
+    );
+    $admisselector->display();
+    echo $OUTPUT->box_end();
+    echo $OUTPUT->footer();
+    die();
+}
+
 $potentialadmisselector = new core_role_admins_potential_selector();
 
 if ($addusersaction) {

admin/roles/manage.php

@@ -76,7 +76,7 @@ switch ($action) {
             $optionsyes = array('action'=>'delete', 'roleid'=>$roleid, 'sesskey'=>sesskey(), 'confirm'=>1);
             $a = new stdClass();
             $a->id = $roleid;
-            $a->name = $roles[$roleid]->name;
+            $a->name = $roles[$roleid]->localname;
             $a->shortname = $roles[$roleid]->shortname;
             $a->count = $DB->count_records_select('role_assignments',
                 'roleid = ?', array($roleid), 'COUNT(DISTINCT userid)');

admin/settings/h5p.php

@@ -41,4 +41,18 @@ if (!empty($defaulth5plib)) {
 
     $settings->add(new admin_settings_h5plib_handler_select('h5plibraryhandler', new lang_string('h5plibraryhandler', 'core_h5p'),
         new lang_string('h5plibraryhandler_help', 'core_h5p'), $defaulth5plib));
+
+    $setting = new admin_setting_configtextarea(
+        'core_h5p/h5pcustomcss',
+        new lang_string('h5pcustomcss', 'core_h5p'),
+        new lang_string('h5pcustomcss_help', 'core_h5p'),
+        '',
+        PARAM_NOTAGS
+    );
+    $setting->set_updatedcallback(function () {
+        // Enables use of file_storage constants.
+        \core_h5p\local\library\autoloader::register();
+        \core_h5p\file_storage::generate_custom_styles();
+    });
+    $settings->add($setting);
 }

admin/templates/setting_configmulticheckbox.mustache

@@ -23,12 +23,15 @@
     * name - form element name
     * hasoptions - there are some options
     * options - list of options containing name, key, id, checked, label
+    * readonly - bool
 
     Example context (json):
     {
         "name": "test",
         "hasoptions": true,
-        "options": [ { "name": "Option", "key": "k1", "id": "id0", "checked": true, "label": "Option label"} ]
+        "options": [ { "name": "Option", "key": "k1", "id": "id0", "checked": true, "label": "Option label"} ],
+        "readonly": false
+
     }
 }}
 <div class="form-multicheckbox">
@@ -37,7 +40,7 @@
         <ul>
             {{#options}}
                 <li>
-                    <input type="checkbox" name="{{name}}[{{key}}]" value="1" id="{{id}}_{{key}}" {{#checked}}checked{{/checked}}>
+                    <input type="checkbox" name="{{name}}[{{key}}]" value="1" id="{{id}}_{{key}}" {{#readonly}}disabled{{/readonly}} {{#checked}}checked{{/checked}}>
                     <label for="{{id}}_{{key}}">{{{label}}}</label>
                 </li>
             {{/options}}

admin/tool/admin_presets/classes/local/action/delete.php

@@ -16,6 +16,7 @@
 
 namespace tool_admin_presets\local\action;
 
+use core_adminpresets\manager;
 use moodle_exception;
 
 /**
@@ -34,8 +35,8 @@ class delete extends base {
     public function show(): void {
         global $DB, $OUTPUT;
 
-        // Getting the preset name.
-        $presetdata = $DB->get_record('adminpresets', ['id' => $this->id], 'name');
+        // Check the preset exists (cannot delete the pre-installed core "Starter" and "Full" presets).
+        $presetdata = $DB->get_record('adminpresets', ['id' => $this->id, 'iscore' => manager::NONCORE_PRESET], 'name');
 
         if ($presetdata) {
             $deletetext = get_string('deletepreset', 'tool_admin_presets', $presetdata->name);
@@ -64,7 +65,7 @@ class delete extends base {
      * Delete the DB preset
      */
     public function execute(): void {
-        confirm_sesskey();
+        require_sesskey();
 
         $this->manager->delete_preset($this->id);
 

admin/tool/admin_presets/classes/local/action/export.php

@@ -52,8 +52,6 @@ class export extends base {
      * Stores a preset into the DB.
      */
     public function execute(): void {
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'export', 'mode' => 'execute']);
         $this->moodleform = new export_form($url);
 
@@ -87,7 +85,7 @@ class export extends base {
      * @throws xml_writer_exception
      */
     public function download_xml(): void {
-        confirm_sesskey();
+        require_sesskey();
 
         list($xmlstr, $filename) = $this->manager->download_preset($this->id);
 

admin/tool/admin_presets/classes/local/action/import.php

@@ -40,8 +40,6 @@ class import extends base {
      * Imports the xmlfile into DB
      */
     public function execute(): void {
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'import', 'mode' => 'execute']);
         $this->moodleform = new import_form($url);
 

admin/tool/admin_presets/classes/local/action/load.php

@@ -38,8 +38,6 @@ class load extends base {
     public function execute(): void {
         global $OUTPUT;
 
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'load', 'mode' => 'execute']);
         $this->moodleform = new load_form($url);
 

admin/tool/admin_presets/classes/local/action/rollback.php

@@ -73,7 +73,7 @@ class rollback extends base {
     public function execute(): void {
         global $OUTPUT;
 
-        confirm_sesskey();
+        require_sesskey();
 
         list($presetapp, $rollback, $failures) = $this->manager->revert_preset($this->id);
 

admin/tool/analytics/model.php

@@ -97,28 +97,28 @@ if ($onlycli === false) {
 switch ($action) {
 
     case 'enable':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->enable();
         redirect($returnurl);
         break;
 
     case 'disable':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->update(0, false, false);
         redirect($returnurl);
         break;
 
     case 'delete':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->delete();
         redirect($returnurl);
         break;
 
     case 'edit':
-        confirm_sesskey();
+        require_sesskey();
 
         $invalidcurrenttimesplitting = $model->invalid_timesplitting_selected();
         $potentialtimesplittings = $model->get_potential_timesplittings();
@@ -183,7 +183,7 @@ switch ($action) {
         break;
 
     case 'evaluate':
-        confirm_sesskey();
+        require_sesskey();
 
         if ($model->is_static()) {
             throw new moodle_exception('errornostaticevaluate', 'tool_analytics');
@@ -226,7 +226,7 @@ switch ($action) {
         break;
 
     case 'scheduledanalysis':
-        confirm_sesskey();
+        require_sesskey();
 
         if ($onlycli) {
             throw new moodle_exception('erroronlycli', 'tool_analytics');
@@ -292,7 +292,7 @@ switch ($action) {
         break;
 
     case 'clear':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->clear();
         redirect($returnurl);

admin/tool/behat/tests/behat/tabs.feature

@@ -0,0 +1,34 @@
+@tool_behat
+Feature: Confirm that we can open multiple browser tabs
+  In order to use multiple browser tabs
+  As a test writer
+  I need the relevant Behat steps to work
+
+  @javascript @_switch_window
+  Scenario: Open multiple browser tabs
+    Given the following "courses" exist:
+      | fullname | shortname |
+      | Course 1 | C1        |
+      | Course 2 | C2        |
+      | Course 3 | C3        |
+    And I am on the "C1" "Course" page logged in as "admin"
+
+    # Open a new tab on the same page.
+    When I open a tab named "CourseViewer1" on the current page
+    And I should see "Course 1" in the "h1" "css_element"
+    And I am on the "C2" "Course" page
+
+    # Open new tab for specified page with identifier.
+    And I open a tab named "CourseViewer2" on the "C3" "Course" page
+
+    # And for a specified page without identifier.
+    And I open a tab named "CourseViewer4" on the "My courses" page
+
+    # Switch between all the tabs and confirm their different contents.
+    Then I should see "You're not enrolled in any course"
+    And I switch to "CourseViewer2" tab
+    And "Course 3" "heading" should exist
+    And I switch to "CourseViewer1" tab
+    And "Course 2" "heading" should exist
+    And I switch to the main tab
+    And "Course 1" "heading" should exist

admin/tool/brickfield/classes/local/htmlchecker/common/brickfield_accessibility_color_test.php

@@ -170,6 +170,19 @@ class brickfield_accessibility_color_test extends brickfield_accessibility_test
         'yellowgreen' => '9acd32'
     ];
 
+    /** @var string[] Define estimated relative font-size codes to pt values. */
+    public $fontsizenames = [
+        'xx-small' => 9,
+        'x-small' => 10,
+        'small' => 11,
+        'smaller' => 11,
+        'medium' => 12,
+        'large' => 14,
+        'larger' => 14,
+        'x-large' => 18,
+        'xx-large' => 24,
+    ];
+
     /**
      * Helper method that finds the luminosity between the provided
      * foreground and background parameters.
@@ -227,7 +240,8 @@ class brickfield_accessibility_color_test extends brickfield_accessibility_test
             $l2 = (.2126 * $r4 + 0.7152 * $g4 + 0.0722 * $b4);
         }
 
-        $luminosity = round(($l1 + 0.05) / ($l2 + 0.05), 2);
+        // Increase round to 4 to avoid a 4.49 contrast being round up to a false pass of 4.5.
+        $luminosity = round(($l1 + 0.05) / ($l2 + 0.05), 4);
         return $luminosity;
     }
 
@@ -362,4 +376,35 @@ class brickfield_accessibility_color_test extends brickfield_accessibility_test
             : $backrgb['b'] - $forergb['b'];
         return ['red' => $reddiff, 'green' => $greendiff, 'blue' => $bluediff];
     }
+
+    /**
+     * Helper method that finds the estimated font-size for the provided
+     * string font-size parameter.
+     * @param string $fontsize The css font-size, in various formats
+     * @return int The estimated font-size
+     */
+    public function get_fontsize(string $fontsize): int {
+        $newfontsize = 12; // Default value, in pt, equivalent to 16px.
+
+        // Search for rem, em, and px initially, typical font-size values.
+        $pos1 = stripos($fontsize, 'rem');
+        $pos2 = stripos($fontsize, 'em');
+        $pos3 = stripos($fontsize, 'px');
+        if ($pos1 !== false) {
+            $rem = substr($fontsize, 0, -3);
+            $newfontsize = $newfontsize * $rem;
+        } else if ($pos2 !== false) {
+            $em = substr($fontsize, 0, -2);
+            $newfontsize = $newfontsize * $em;
+        } else if ($pos3 !== false) {
+            $px = substr($fontsize, 0, -2);
+            $newfontsize = 0.75 * $px;
+        } else if (in_array($fontsize, array_keys($this->fontsizenames))) {
+            $newfontsize = $this->fontsizenames[$fontsize];
+        } else {
+            preg_match_all('!\d+!', $fontsize, $matches);
+            $newfontsize = $matches[0][0] ?? $newfontsize;
+        }
+        return (int) $newfontsize;
+    }
 }

admin/tool/brickfield/classes/local/htmlchecker/common/checks/css_text_has_contrast.php

@@ -92,8 +92,7 @@ class css_text_has_contrast extends brickfield_accessibility_color_test {
                     $italic = false;
 
                     if (isset($style['font-size'])) {
-                        preg_match_all('!\d+!', $style['font-size'], $matches);
-                        $fontsize = $matches[0][0];
+                        $fontsize = $this->get_fontsize($style['font-size']);
                     }
 
                     if (isset($style['font-weight'])) {

admin/tool/brickfield/tests/local/htmlchecker/common/checks/css_text_has_contrast_test.php

@@ -178,6 +178,54 @@ EOD;
     </html>
 EOD;
 
+    /** @var string HTML with px18 fail colour values. */
+    private $px18 = <<<EOD
+    <body><p style="color:#EF0000; background-color:white; font-size: 18px">
+    This is not contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with px19bold pass colour values. */
+    private $px19bold = <<<EOD
+    <body><p style="color:#EF0000; background-color:white; font-size: 19px; font-weight: bold;">
+    This is contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with px18 pass colour values. */
+    private $px18pass = <<<EOD
+    <body><p style="color:#E60000; background-color:white; font-size: 18px">
+    This is contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with medium size colour values. */
+    private $mediumfail = <<<EOD
+    <body><p style="color:#EF0000; background-color:white; font-size: medium">
+    This is not contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with px18 colour values. */
+    private $mediumpass = <<<EOD
+    <body><p style="color:#E60000; background-color:white; font-size: medium">
+    This is contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with larger fail colour values. */
+    private $largerfail = <<<EOD
+    <body><p style="color:#FF6161; background-color:white; font-size: larger">
+    This is not contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with px18 colour values. */
+    private $largerpass = <<<EOD
+    <body><p style="color:#FF5C5C; background-color:white; font-size: larger;">
+    This is contrasty enough.</p></body>
+EOD;
+
+    /** @var string HTML with px18 colour values. */
+    private $largerboldpass = <<<EOD
+    <body><p style="color:#FF5C5C; background-color:white; font-size: larger; font-weight: bold;">
+    This is contrasty enough.</p></body>
+EOD;
+
     /**
      * Test for the area assign intro
      */
@@ -235,4 +283,68 @@ EOD;
         $results = $this->get_checker_results($this->emptyvalue);
         $this->assertEmpty($results);
     }
+
+    /**
+     * Test for text px18 with insufficient contrast of 4.49.
+     */
+    public function test_check_for_px18_fail() {
+        $results = $this->get_checker_results($this->px18);
+        $this->assertTrue($results[0]->element->tagName == 'p');
+    }
+
+    /**
+     * Test for text px19 bold with sufficient contrast of 4.49.
+     */
+    public function test_check_for_px19bold_pass() {
+        $results = $this->get_checker_results($this->px19bold);
+        $this->assertEmpty($results);
+    }
+
+    /**
+     * Test for text px18 with sufficient contrast of 4.81.
+     */
+    public function test_check_for_px18_pass() {
+        $results = $this->get_checker_results($this->px18pass);
+        $this->assertEmpty($results);
+    }
+
+    /**
+     * Test for medium (12pt) text with insufficient contrast of 4.49.
+     */
+    public function test_check_for_medium_fail() {
+        $results = $this->get_checker_results($this->mediumfail);
+        $this->assertTrue($results[0]->element->tagName == 'p');
+    }
+
+    /**
+     * Test for medium (12pt) text with sufficient contrast of 4.81.
+     */
+    public function test_check_for_medium_pass() {
+        $results = $this->get_checker_results($this->mediumpass);
+        $this->assertEmpty($results);
+    }
+
+    /**
+     * Test for larger (14pt) text with insufficient contrast of 2.94.
+     */
+    public function test_check_for_larger_fail() {
+        $results = $this->get_checker_results($this->largerfail);
+        $this->assertTrue($results[0]->element->tagName == 'p');
+    }
+
+    /**
+     * Test for larger (14pt) text with insufficient contrast of 3.02.
+     */
+    public function test_check_for_larger_pass() {
+        $results = $this->get_checker_results($this->largerpass);
+        $this->assertTrue($results[0]->element->tagName == 'p');
+    }
+
+    /**
+     * Test for larger (14pt) bold text with sufficient contrast of 3.02.
+     */
+    public function test_check_for_largerbold_pass() {
+        $results = $this->get_checker_results($this->largerboldpass);
+        $this->assertEmpty($results);
+    }
 }

admin/tool/componentlibrary/content/moodle/javascript/confirm.md

@@ -24,7 +24,7 @@ The confirmation AMD module is loaded automatically, so the only thing you need
 to the target element:
 {{< highlight html >}}
 <button type="button" class="btn btn-primary" data-confirmation="modal" data-confirmation-title-str='["delete", "core"]'
-data-confirmation-question-str='["areyousure"]' data-confirmation-yes-button-str='["delete", "core"]'>Show confirmation modal</button>
+data-confirmation-content-str='["areyousure"]' data-confirmation-yes-button-str='["delete", "core"]'>Show confirmation modal</button>
 {{< /highlight >}}
 
 You can also use it on PHP, you just need to set the attributes parameter to any moodle output component that takes attributes:
@@ -32,7 +32,7 @@ You can also use it on PHP, you just need to set the attributes parameter to any
 echo $OUTPUT->single_button('#', get_string('delete'), 'get', [
     'data-confirmation' => 'modal',
     'data-confirmation-title-str' => json_encode(['delete', 'core']),
-    'data-confirmation-question-str' => json_encode(['areyousure']),
+    'data-confirmation-content-str' => json_encode(['areyousure']),
     'data-confirmation-yes-button-str' => json_encode(['delete', 'core'])
 ]);
 {{< / php >}}
@@ -56,8 +56,8 @@ echo $OUTPUT->single_button('#', get_string('delete'), 'get', [
       <td>The modal title language string identifier, must be provided in JSON encoded format.</td>
     </tr>
     <tr>
-      <td>data-confirmation-question-str</td>
-      <td>The confirmation question language string identifier, must be provided in JSON encoded format.</td>
+      <td>data-confirmation-content-str</td>
+      <td>The modal main content language string identifier, must be provided in JSON encoded format.</td>
     </tr>
     <tr>
       <td>data-confirmation-yes-button-str</td>
@@ -86,14 +86,14 @@ echo $OUTPUT->single_button('#', get_string('delete'), 'get', [
 
 {{< example >}}
 <button type="button" class="btn btn-primary" data-confirmation="modal" data-confirmation-title-str='["ok", "core"]'
-data-confirmation-question-str='["areyousure"]' data-confirmation-yes-button-str='["ok", "core"]'>Show confirmation modal</button>
+data-confirmation-content-str='["areyousure"]' data-confirmation-yes-button-str='["ok", "core"]'>Show confirmation modal</button>
 {{< /example >}}
 
 #### Delete Modal
 
 {{< example >}}
 <button type="button" class="btn btn-primary" data-confirmation="modal" data-confirmation-type="delete" data-confirmation-title-str='["delete", "core"]'
-data-confirmation-question-str='["areyousure"]' data-confirmation-yes-button-str='["delete", "core"]'>Show delete modal</button>
+data-confirmation-content-str='["areyousure"]' data-confirmation-yes-button-str='["delete", "core"]'>Show delete modal</button>
 {{< /example >}}
 
 
@@ -101,7 +101,7 @@ data-confirmation-question-str='["areyousure"]' data-confirmation-yes-button-str
 
 {{< example >}}
 <button type="button" class="btn btn-primary" data-confirmation="modal" data-confirmation-title-str='["save", "core"]'
-data-confirmation-question-str='["areyousure"]' data-confirmation-yes-button-str='["save", "core"]' data-confirmation-toast="true"
+data-confirmation-content-str='["areyousure"]' data-confirmation-yes-button-str='["save", "core"]' data-confirmation-toast="true"
 data-confirmation-toast-confirmation-str='["saved", "core_question", "My question"]'>Show confirmation modal</button>
 {{< /example >}}
 
@@ -109,6 +109,6 @@ data-confirmation-toast-confirmation-str='["saved", "core_question", "My questio
 
 {{< example >}}
 <button type="button" class="btn btn-primary" data-confirmation="modal" data-confirmation-title-str='["save", "core"]'
-data-confirmation-question-str='["areyousure"]' data-confirmation-yes-button-str='["save", "core"]'
+data-confirmation-content-str='["areyousure"]' data-confirmation-yes-button-str='["save", "core"]'
 data-confirmation-destination="http://moodle.com">Show confirmation modal</button>
 {{< /example >}}

admin/tool/customlang/tests/behat/customisation_create.feature

@@ -22,12 +22,12 @@ Feature: Within a moodle instance, an administrator should be able to modify lan
   Scenario: Edit an string but don't save it to lang pack.
     When I press "Apply changes and continue editing"
     Then I should not see "moodle documents" in the "page-footer" "region"
-    And I should see "Help and documentation" in the "page-footer" "region"
+    And I should see "Documentation for this page" in the "page-footer" "region"
 
   @javascript
   Scenario: Customize an string as admin and save it to lang pack.
     Given I press "Save changes to the language pack"
     And I should see "There are 1 modified strings."
     When I click on "Continue" "button"
-    Then I should not see "Help and documentation" in the "page-footer" "region"
+    Then I should not see "Documentation for this page" in the "page-footer" "region"
     And I should see "moodle documents" in the "page-footer" "region"

admin/tool/dataprivacy/lang/en/tool_dataprivacy.php

@@ -45,7 +45,7 @@ $string['cachedef_purpose'] = 'Data purposes';
 $string['cachedef_purpose_overrides'] = 'Purpose overrides in the Data privacy tool';
 $string['cachedef_contextlevel'] = 'Context levels purpose and category';
 $string['cancelrequest'] = 'Cancel request';
-$string['cancelrequestconfirmation'] = 'Do you really want cancel this data request?';
+$string['cancelrequestconfirmation'] = 'Do you want to cancel this data request?';
 $string['cannotreset'] = 'Unable to reset this request. Only rejected requests can be reset.';
 $string['categories'] = 'Categories';
 $string['category'] = 'Category';

admin/tool/dataprivacy/tests/task/task_test.php

@@ -16,6 +16,7 @@
 
 namespace tool_dataprivacy\task;
 
+use core\task\task_trait;
 use tool_dataprivacy\api;
 
 defined('MOODLE_INTERNAL') || die();
@@ -30,6 +31,8 @@ require_once(__DIR__ . '/../data_privacy_testcase.php');
  */
 class task_test extends \data_privacy_testcase {
 
+    use task_trait;
+
     /**
      * Test tearDown.
      */
@@ -215,17 +218,4 @@ class task_test extends \data_privacy_testcase {
         $this->assertCount(1, \tool_dataprivacy\api::get_data_requests($user->id,
                 [api::DATAREQUEST_STATUS_CANCELLED], [api::DATAREQUEST_TYPE_DELETE]));
     }
-
-    /**
-     * Helper to execute a particular task.
-     *
-     * @param string $task The task.
-     */
-    private function execute_task($task) {
-        // Run the scheduled task.
-        ob_start();
-        $task = \core\task\manager::get_scheduled_task($task);
-        $task->execute();
-        ob_end_clean();
-    }
 }

admin/tool/filetypes/tests/behat/add_filetypes.feature

@@ -120,8 +120,7 @@ Feature: Add customised file types
       | Custom description | Froggy file                               |
     And I press "Save changes"
     # Create a resource activity and add it to a course
-    And I am on "Course 1" course homepage with editing mode on
-    When I add a "File" to section "1"
+    When I add a resource activity to course "Course 1" section "1"
     And I set the following fields to these values:
       | Name        | An example of customised file type |
       | Description | File description                   |

admin/tool/generator/classes/course_backend.php

@@ -216,7 +216,7 @@ class tool_generator_course_backend extends tool_generator_backend {
      * @return int Course id
      */
     public function make() {
-        global $DB, $CFG;
+        global $DB, $CFG, $USER;
         require_once($CFG->dirroot . '/lib/phpunit/classes/util.php');
 
         raise_memory_limit(MEMORY_EXTRA);
@@ -252,6 +252,12 @@ class tool_generator_course_backend extends tool_generator_backend {
             }
         }
 
+        // We are checking 'enroladminnewcourse' setting to decide to enrol admins or not.
+        if (!empty($CFG->creatornewroleid) && !empty($CFG->enroladminnewcourse) && is_siteadmin($USER->id)) {
+            // Deal with course creators - enrol them internally with default role.
+            enrol_try_internal_enrol($this->course->id, $USER->id, $CFG->creatornewroleid);
+        }
+
         // Log total time.
         $this->log('coursecompleted', round(microtime(true) - $entirestart, 1));
 

admin/tool/generator/tests/behat/make_test_course.feature

@@ -0,0 +1,33 @@
+@core @core_course @tool_generator
+Feature: Admins can create test courses
+  In order to create testing information
+  As an admin
+  I need to create testing courses quickly
+
+  @javascript
+  Scenario: 'Auto-enrol admin in new courses' setting when creating a test course as admin
+    Given I log in as "admin"
+    And the following config values are set as admin:
+      | enroladminnewcourse | 0 |
+    And I navigate to "Development > Make test course" in site administration
+    And I set the following fields to these values:
+      | Size of course    | XS                      |
+      | Course full name  | Fake course for testing |
+      | Course short name | fake                    |
+    And I press "Create course"
+    And I click on "Continue" "link"
+    And I navigate to course participants
+    Then I should not see "Teacher"
+    And I should not see "Nothing to display"
+    And the following config values are set as admin:
+      | enroladminnewcourse | 1 |
+    And I navigate to "Courses > Add a new course" in site administration
+    And I navigate to "Development > Make test course" in site administration
+    And I set the following fields to these values:
+      | Size of course    | XS                          |
+      | Course full name  | New fake course for testing |
+      | Course short name | newfake                     |
+    And I press "Create course"
+    And I click on "Continue" "link"
+    And I navigate to course participants
+    And I should see "Teacher"

admin/tool/generator/tests/maketestcourse_test.php

@@ -68,9 +68,14 @@ class maketestcourse_test extends \advanced_testcase {
         $this->assertEquals(2, count($modinfo->get_section_info_all()));
 
         // Check user is enrolled.
+        // enroladminnewcourse is enabled by default, so admin is also enrolled as teacher.
         $users = get_enrolled_users($context);
-        $this->assertEquals(1, count($users));
-        $this->assertEquals('tool_generator_000001', reset($users)->username);
+        $this->assertEquals(2, count($users));
+        $usernames = array_map(function($user) {
+            return $user->username;
+        }, $users);
+        $this->assertTrue(in_array('admin', $usernames));
+        $this->assertTrue(in_array('tool_generator_000001', $usernames));
 
         // Check there's a page on the course.
         $pages = $modinfo->get_instances_of('page');

admin/tool/langimport/index.php

@@ -114,7 +114,7 @@ if ($mode == DELETION_OF_SELECTED_LANG and (!empty($uninstalllang) or !empty($co
     }
 }
 
-if ($mode == UPDATE_ALL_LANG) {
+if ($mode == UPDATE_ALL_LANG && confirm_sesskey()) {
     core_php_time_limit::raise();
     $controller->update_all_installed_languages();
 }

admin/tool/langimport/templates/langimport.mustache

@@ -87,6 +87,7 @@
                 <div>
                     <form id="updateform" action="{{updateurl}}" method="post">
                         <fieldset>
+                            <input type="hidden" name="sesskey" value="{{sesskey}}">
                             <input type="submit" value="{{#str}}updatelangs, tool_langimport{{/str}}" class="btn btn-secondary">
                             {{#hasmanyinstalledlanguages}}
                                 <p class="mt-2 small">{{#str}} updatelangsnote, tool_langimport, {"taskname": {{#quote}}{{updatelangstaskname}}{{/quote}} }{{/str}}</p>

admin/tool/log/classes/helper/reader.php

@@ -82,7 +82,7 @@ trait reader {
      */
     public static function decode_other(?string $other) {
         if ($other === 'N;' || preg_match('~^.:~', $other ?? '')) {
-            return unserialize($other);
+            return unserialize($other, ['allowed_classes' => [stdClass::class]]);
         } else {
             return json_decode($other ?? '', true);
         }

admin/tool/lp/amd/src/competency_rule.js

@@ -71,14 +71,12 @@ define(['jquery'], function($) {
         return null;
     };
 
-    // eslint-disable-line valid-jsdoc
     /**
      * Return the type of the module.
      *
      * @return {String}
      * @method getType
      */
-    // eslint-enable-line valid-jsdoc
     Rule.prototype.getType = function() {
         throw new Error('Not implemented');
     };

admin/tool/lp/classes/output/manage_competency_frameworks_page.php

@@ -75,7 +75,7 @@ class manage_competency_frameworks_page implements renderable, templatable {
             );
             $this->navigation[] = $addpage;
             $competenciesrepository = new single_button(
-                new moodle_url('https://archive.moodle.net/competencies'),
+                new moodle_url('https://moodle.net/search', ['q' => 'competency frameworks']),
                 get_string('competencyframeworksrepository', 'tool_lp'),
                 'get'
             );

admin/tool/lp/templates/course_competencies_page.mustache

@@ -102,7 +102,7 @@
         <strong>{{#str}}activities{{/str}}</strong>
         <ul class="inline list-inline p-2">
         {{#coursemodules}}
-            <li class="list-inline-item"><a href="{{url}}"><img src="{{iconurl}}"> {{name}} </a></li>
+            <li class="list-inline-item"><a href="{{url}}"><img class="icon" src="{{iconurl}}"> {{name}} </a></li>
         {{/coursemodules}}
         {{^coursemodules}}
             <li class="list-inline-item">{{#str}}noactivities, tool_lp{{/str}}</li>

admin/tool/lp/templates/form-user-selector-suggestion.mustache

@@ -49,7 +49,7 @@
     }
 }}
 <span>
-    <img height="12" src="{{profileimageurlsmall}}" alt="" role="presentation">
+    <img height="12" src="{{profileimageurlsmall}}" alt="">
     <span>{{fullname}}</span>
     {{#hasidentity}}
     <span><small>{{identity}}</small></span>

admin/tool/lp/templates/user_competency_summary_in_course.mustache

@@ -49,7 +49,7 @@
         <p>
         <ul class="inline list-inline">
         {{#coursemodules}}
-            <li class="list-inline-item"><a href="{{url}}"><img src="{{iconurl}}"> {{name}} </a></li>
+            <li class="list-inline-item"><a href="{{url}}"><img class="icon" src="{{iconurl}}" alt=""> {{name}} </a></li>
         {{/coursemodules}}
         {{^coursemodules}}
             <li class="list-inline-item"><span class="alert">{{#str}}noactivities, tool_lp{{/str}}</span></li>

admin/tool/lp/templates/user_summary.mustache

@@ -50,7 +50,7 @@
 }}
 <span>
     <a href="{{profileurl}}" title="{{#str}}viewprofile{{/str}}">
-    <img height="18" src="{{profileimageurlsmall}}" alt="" role="presentation">
+    <img height="18" src="{{profileimageurlsmall}}" alt="">
     <span>{{fullname}}</span>
     {{#hasidentity}}
     <span><small>{{identity}}</small></span>

admin/tool/mobile/classes/api.php

@@ -369,6 +369,14 @@ class api {
             $settings->forcetimezone = $CFG->forcetimezone;
         }
 
+        if (empty($section) || $section === 'h5psettings') {
+            \core_h5p\local\library\autoloader::register();
+            $customcss = \core_h5p\file_storage::get_custom_styles();
+            if (!empty($customcss)) {
+                $settings->h5pcustomcssurl = $customcss['cssurl']->out() . '?ver=' . $customcss['cssversion'];
+            }
+        }
+
         return $settings;
     }
 

admin/tool/mobile/classes/event_handler.php

@@ -0,0 +1,45 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_mobile;
+
+use core\session\utility\cookie_helper;
+use core\event\user_loggedin;
+
+/**
+ * Event handler for tool_mobile.
+ *
+ * @package    tool_mobile
+ * @copyright  2024 Juan Leyva
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class event_handler {
+
+    /**
+     * Allows the plugin to augment Set-Cookie headers when the user_loggedin event is fired as part of complete_user_login() calls.
+     *
+     * @param user_loggedin $event the event
+     * @return void
+     */
+    public static function handle_user_loggedin(user_loggedin $event): void {
+        global $CFG;
+
+        // Set Partitioned and Secure attributes to the MoodleSession cookie if the user is using the Moodle app.
+        if (\core_useragent::is_moodle_app()) {
+            cookie_helper::add_attributes_to_cookie_response_header('MoodleSession'.$CFG->sessioncookie, ['Secure', 'Partitioned']);
+        }
+    }
+}

admin/tool/mobile/db/events.php

@@ -0,0 +1,33 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * tool_mobile plugin event handler definition.
+ *
+ * @package tool_mobile
+ * @category event
+ * @copyright 2024 Juan Leyva
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$observers = [
+    [
+        'eventname' => '\core\event\user_loggedin',
+        'callback' => '\tool_mobile\event_handler::handle_user_loggedin',
+    ],
+];

admin/tool/mobile/launch.php

@@ -56,8 +56,9 @@ if (!empty($oauthsso) && is_enabled_auth('oauth2')) {
 
 // Check if the plugin is properly configured.
 $typeoflogin = get_config('tool_mobile', 'typeoflogin');
-if (empty($SESSION->justloggedin) and
-        $typeoflogin != tool_mobile\api::LOGIN_VIA_BROWSER and
+if (empty($SESSION->justloggedin) &&
+        !is_enabled_auth('oauth2') &&
+        $typeoflogin != tool_mobile\api::LOGIN_VIA_BROWSER &&
         $typeoflogin != tool_mobile\api::LOGIN_VIA_EMBEDDED_BROWSER) {
     throw new moodle_exception('pluginnotenabledorconfigured', 'tool_mobile');
 }

admin/tool/mobile/lib.php

@@ -265,3 +265,16 @@ function tool_mobile_pre_processor_message_send($procname, $data) {
         $data->fullmessagehtml .= html_writer::tag('p', get_string('readingthisemailgettheapp', 'tool_mobile', $url->out()));
     }
 }
+
+/**
+ * Callback to add headers before the HTTP headers are sent.
+ *
+ */
+function tool_mobile_before_http_headers() {
+    global $CFG;
+
+    // Set Partitioned and Secure attributes to the MoodleSession cookie if the user is using the Moodle app.
+    if (\core_useragent::is_moodle_app()) {
+        \core\session\utility\cookie_helper::add_attributes_to_cookie_response_header('MoodleSession'.$CFG->sessioncookie, ['Secure', 'Partitioned']);
+    }
+}

admin/tool/mobile/tests/externallib_test.php

@@ -260,6 +260,18 @@ class externallib_test extends externallib_advanced_testcase {
         $this->assertCount(0, $result['warnings']);
         $this->assertEquals($expected, $result['settings']);
 
+        // H5P custom CSS.
+        set_config('h5pcustomcss', '.debug { color: #fab; }', 'core_h5p');
+        \core_h5p\local\library\autoloader::register();
+        \core_h5p\file_storage::generate_custom_styles();
+        $result = external::get_config();
+        $result = external_api::clean_returnvalue(external::get_config_returns(), $result);
+
+        $customcss = \core_h5p\file_storage::get_custom_styles();
+        $expected[] = ['name' => 'h5pcustomcssurl', 'value' => $customcss['cssurl']->out() . '?ver=' . $customcss['cssversion']];
+        $this->assertCount(0, $result['warnings']);
+        $this->assertEquals($expected, $result['settings']);
+
         // Change a value and retrieve filtering by section.
         set_config('commentsperpage', 1);
         $expected[10]['value'] = 1;

admin/tool/mobile/version.php

@@ -23,7 +23,7 @@
  */
 
 defined('MOODLE_INTERNAL') || die();
-$plugin->version   = 2023042400; // The current plugin version (Date: YYYYMMDDXX).
+$plugin->version   = 2023042401; // The current plugin version (Date: YYYYMMDDXX).
 $plugin->requires  = 2023041800; // Requires this Moodle version.
 $plugin->component = 'tool_mobile'; // Full name of the plugin (used for diagnostics).
 $plugin->dependencies = array(

admin/tool/moodlenet/amd/src/instance_form.js

@@ -121,7 +121,6 @@ define(['tool_moodlenet/validator',
         });
         // Trigger the transition between 'pages'.
         carousel.carousel(2);
-        // eslint-disable-next-line max-len
         modal.setFooter(Templates.render('tool_moodlenet/chooser_footer_close_mnet', {}));
     };
 

admin/tool/phpunit/cli/util.php

@@ -50,12 +50,10 @@ list($options, $unrecognized) = cli_get_params(
     )
 );
 
-if (file_exists(__DIR__.'/../../../../vendor/phpunit/phpunit/composer.json')) {
-    // Composer packages present.
-    require_once(__DIR__.'/../../../../vendor/autoload.php');
-
-} else {
-    // Note: installation via PEAR is not supported any more.
+// Basic check to see if phpunit is installed.
+if (!file_exists(__DIR__.'/../../../../vendor/phpunit/phpunit/composer.json') ||
+        !file_exists(__DIR__.'/../../../../vendor/bin/phpunit') ||
+        !file_exists(__DIR__.'/../../../../vendor/autoload.php')) {
     phpunit_bootstrap_error(PHPUNIT_EXITCODE_PHPUNITMISSING);
 }
 
@@ -74,12 +72,13 @@ if ($options['run']) {
         }
     }
     $_SERVER['argv'] = array_values($_SERVER['argv']);
-    PHPUnit\TextUI\Command::main();
+    require(__DIR__ . '/../../../../vendor/bin/phpunit');
     exit(0);
 }
 
 define('PHPUNIT_UTIL', true);
 
+require(__DIR__.'/../../../../vendor/autoload.php');
 require(__DIR__ . '/../../../../lib/phpunit/bootstrap.php');
 
 // from now on this is a regular moodle CLI_SCRIPT

admin/tool/task/adhoctasks.php

@@ -35,7 +35,7 @@ $renderer = $PAGE->get_renderer('tool_task');
 if ($classname) {
     $pageurl = new moodle_url('/admin/tool/task/adhoctasks.php');
     $PAGE->navbar->add(get_string('adhoctasks', 'tool_task'), $pageurl);
-    $PAGE->navbar->add($classname, $PAGE->url);
+    $PAGE->navbar->add(s($classname), $PAGE->url);
 
     $tasks = core\task\manager::get_adhoc_tasks($classname, $failedonly);
 

admin/tool/task/lang/en/tool_task.php

@@ -80,6 +80,9 @@ $string['runnow'] = 'Run now';
 $string['runagain'] = 'Run again';
 $string['runadhoc_confirm'] = 'Tasks will run on the web server and may take some time to complete.';
 $string['runadhoc'] = 'Run ad hoc tasks now?';
+$string['runadhoctask'] = 'Run \'{$a->task}\' task ID {$a->taskid}';
+$string['runadhoctasks'] = 'Run all \'{$a}\' tasks';
+$string['runadhoctasksfailed'] = 'Run failed \'{$a}\' tasks';
 $string['runnow_confirm'] = 'Are you sure you want to run this task \'{$a}\' now? The task will run on the web server and may take some time to complete.';
 $string['runclassname'] = 'Run all';
 $string['runclassnamefailedonly'] = 'Run all failed';

admin/tool/task/lib.php

@@ -45,5 +45,6 @@ function tool_task_status_checks() : array {
  * @param string $eol End of line character
  */
 function tool_task_mtrace_wrapper(string $message, string $eol): void {
-    echo s($message . $eol);
+    $message = s($message);
+    echo $message . $eol;
 }

admin/tool/task/renderer.php

@@ -82,7 +82,7 @@ class tool_task_renderer extends plugin_renderer_base {
                 );
                 $classcell = new html_table_cell($classcontent);
                 $classcell->header = true;
-                $classcell->class = "task-class-summary text-ltr";
+                $classcell->attributes['class'] = "task-class-summary text-ltr";
 
                 $duecontent = $stats['due'];
                 if ($canruntasks && ($stats['due'] > 0 || $stats['failed'] > 0)) {
@@ -166,7 +166,7 @@ class tool_task_renderer extends plugin_renderer_base {
         // Main tasks table.
         $table = $this->generate_adhoc_tasks_simple_table($tasks, $canruntasks);
 
-        $table->caption = "$classname "
+        $table->caption = s($classname) . " "
             . get_string($failedonly ? 'adhoctasksfailed' : 'adhoctasks', 'tool_task');
         $table->head[3] .= " $failedorall"; // Spice up faildelay heading.
 

admin/tool/task/run_adhoctasks.php

@@ -54,13 +54,19 @@ if ($taskid) {
         throw new \moodle_exception('invalidtaskid');
     }
     $classname = $record->classname;
-    $heading = "Run $classname task Id $taskid";
+    $heading = get_string('runadhoctask', 'tool_task', ['task' => $classname, 'taskid' => $taskid]);
     $tasks = [core\task\manager::adhoc_task_from_record($record)];
 } else {
     if (!$classname) {
         throw new \moodle_exception('noclassname', 'tool_task');
     }
-    $heading = "Run $classname " . ($failedonly ? "failed" : "all")." tasks";
+
+    $heading = get_string(
+        $failedonly ? 'runadhoctasksfailed' : 'runadhoctasks',
+        'tool_task',
+        s($classname),
+    );
+
     $now = time();
     $tasks = array_filter(
         core\task\manager::get_adhoc_tasks($classname, $failedonly, true),
@@ -111,6 +117,7 @@ require_sesskey();
 \core\session\manager::write_close();
 
 // Prepare to handle output via mtrace.
+require_once("{$CFG->dirroot}/{$CFG->admin}/tool/task/lib.php");
 $CFG->mtrace_wrapper = 'tool_task_mtrace_wrapper';
 
 // Run the specified tasks.

admin/tool/task/schedule_task.php

@@ -85,6 +85,8 @@ require_sesskey();
 
 // Prepare to handle output via mtrace.
 echo html_writer::start_tag('pre');
+
+require_once("{$CFG->dirroot}/{$CFG->admin}/tool/task/lib.php");
 $CFG->mtrace_wrapper = 'tool_task_mtrace_wrapper';
 
 // Run the specified task (this will output an error if it doesn't exist).

admin/tool/task/tests/form_test.php

@@ -236,6 +236,8 @@ class form_test extends \advanced_testcase {
         $checker->set_day_of_week('6');
         $this->assertTrue($checker->is_valid($checker::FIELD_DAYOFWEEK));
         $checker->set_day_of_week('7');
+        $this->assertTrue($checker->is_valid($checker::FIELD_DAYOFWEEK));
+        $checker->set_day_of_week('8');
         $this->assertFalse($checker->is_valid($checker::FIELD_DAYOFWEEK));
         $checker->set_day_of_week('20');
         $this->assertFalse($checker->is_valid($checker::FIELD_DAYOFWEEK));
@@ -247,7 +249,7 @@ class form_test extends \advanced_testcase {
         $checker->set_day_of_week('*/6');
         $this->assertTrue($checker->is_valid($checker::FIELD_DAYOFWEEK));
         $checker->set_day_of_week('*/7');
-        $this->assertFalse($checker->is_valid($checker::FIELD_DAYOFWEEK));
+        $this->assertTrue($checker->is_valid($checker::FIELD_DAYOFWEEK));
         $checker->set_day_of_week('*/13');
         $this->assertFalse($checker->is_valid($checker::FIELD_DAYOFWEEK));
         $checker->set_day_of_week('*/35');
@@ -271,6 +273,8 @@ class form_test extends \advanced_testcase {
         $checker->set_day_of_week('65-2');
         $this->assertFalse($checker->is_valid($checker::FIELD_DAYOFWEEK));
         $checker->set_day_of_week('3-7');
+        $this->assertTrue($checker->is_valid($checker::FIELD_DAYOFWEEK));
+        $checker->set_day_of_week('3-8');
         $this->assertFalse($checker->is_valid($checker::FIELD_DAYOFWEEK));
     }
 }

admin/tool/uploaduser/classes/cli_helper.php

@@ -367,6 +367,11 @@ class cli_helper {
                     $firstoption = reset($selectoptions);
                     $default = $firstoption['attr']['value'];
                 }
+
+                // The menu profile field type allows for an empty default value, handle that here.
+                if (preg_match('/^profile_field_/', $name) && $default === '') {
+                    $possiblevalues[] = $default;
+                }
             }
 
             if ($element instanceof \HTML_QuickForm_checkbox) {

admin/tool/uploaduser/classes/process.php

@@ -461,9 +461,22 @@ class process {
             return;
         }
 
-        $matchparam = $this->get_match_on_email() ? ['email' => $user->email] : ['username' => $user->username];
-        if ($existinguser = $DB->get_records('user', $matchparam + ['mnethostid' => $user->mnethostid])) {
-            if (is_array($existinguser) && count($existinguser) !== 1) {
+        if ($this->get_match_on_email()) {
+            // Case-insensitive query for the given email address.
+            $userselect = $DB->sql_equal('email', ':email', false);
+            $userparams = ['email' => $user->email];
+        } else {
+            $userselect = 'username = :username';
+            $userparams = ['username' => $user->username];
+        }
+
+        // Match the user, also accounting for multiple records by email.
+        $existinguser = $DB->get_records_select('user', "{$userselect} AND mnethostid = :mnethostid",
+            $userparams + ['mnethostid' => $user->mnethostid]);
+        $existingusercount = count($existinguser);
+
+        if ($existingusercount > 0) {
+            if ($existingusercount !== 1) {
                 $this->upt->track('status', get_string('duplicateemail', 'tool_uploaduser', $user->email), 'warning');
                 $this->userserrors++;
                 return;
@@ -675,6 +688,17 @@ class process {
                 break;
 
             case UU_USER_ADD_UPDATE:
+                if ($this->get_match_on_email()) {
+                    if ($usersbyname = $DB->get_records('user', ['username' => $user->username])) {
+                        foreach ($usersbyname as $userbyname) {
+                            if (strtolower($userbyname->email) != strtolower($user->email)) {
+                                $this->usersskipped++;
+                                $this->upt->track('status', get_string('usernotaddedusernameexists', 'error'), 'warning');
+                                $skip = true;
+                            }
+                        }
+                    }
+                }
                 break;
 
             case UU_USER_UPDATE:
@@ -1371,8 +1395,14 @@ class process {
                 }
             }
         }
+
+        // Warn user about invalid data values.
         if (($invalid = \core_user::validate($user)) !== true) {
-            $this->upt->track('status', get_string('invaliduserdata', 'tool_uploaduser', s($user->username)), 'warning');
+            $listseparator = get_string('listsep', 'langconfig') . ' ';
+            $this->upt->track('status', get_string('invaliduserdatavalues', 'tool_uploaduser', [
+                'username' => s($user->username),
+                'values' => implode($listseparator, array_keys($invalid)),
+            ]), 'warning');
         }
     }
 

admin/tool/uploaduser/lang/en/tool_uploaduser.php

@@ -50,6 +50,7 @@ The example text file may also be used for testing, as you are able to preview u
 $string['infoprefix'] = 'Info:';
 $string['invalidupdatetype'] = 'This option cannot be selected with the chosen upload type.';
 $string['invaliduserdata'] = 'Invalid data detected for user {$a} and it has been automatically cleaned.';
+$string['invaliduserdatavalues'] = 'Incorrect data ({$a->values}) found for user {$a->username}. This data has been corrected or deleted.';
 $string['invalidtheme'] = 'Theme "{$a}" is not installed and will be ignored.';
 $string['linex'] = 'Line {$a}';
 $string['matchemail'] = 'Match on email address';

admin/tool/uploaduser/tests/behat/upload_users.feature

@@ -296,3 +296,25 @@ Feature: Upload users
     And I navigate to "Users > Accounts > Browse list of users" in site administration
     And I should see "Bilbo Baggins"
     And I should not see "Frodo Baggins"
+
+  @javascript
+  Scenario: Create a new user when matching them on email where where the username already exists
+    Given the following "users" exist:
+      | username | firstname | lastname | email               |
+      | bilbob   | Samwise   | Gamgee   | samwise@example.com |
+      | frodob   | Frodeo    | Baspins  | frodo@example.com   |
+    And I log in as "admin"
+    And I navigate to "Users > Accounts > Upload users" in site administration
+    When I upload "lib/tests/fixtures/upload_users_email_matching.csv" file to "File" filemanager
+    And I press "Upload users"
+    Then I should see "Upload users preview"
+    And I set the following fields to these values:
+      | Upload type            | Add new and update existing users |
+      | Existing user details  | Override with file                |
+      | Match on email address | Yes                               |
+    And I press "Upload users"
+    And I should see "User not added - username already exists under a different email"
+    And I press "Continue"
+    And I navigate to "Users > Accounts > Browse list of users" in site administration
+    And I should see "Samwise Gamgee"
+    And I should see "Frodo Baggins"

admin/tool/uploaduser/tests/upload_users_test.php

@@ -186,6 +186,26 @@ EOF;
         $this->assertEquals('student1', reset($usersasdefaultrole)->username);
     }
 
+    /**
+     * Test that invalid data contained in uploaded CSV triggers appropriate warnings
+     */
+    public function test_user_upload_user_validate(): void {
+        $this->resetAfterTest();
+        $this->setAdminUser();
+
+        $csv = <<<EOF
+username,firstname,lastname,email,country
+student1,Student,One,s1@example.com,Wales
+EOF;
+
+        $output = $this->process_csv_upload($csv, ['--uutype=' . UU_USER_ADDNEW]);
+
+        // We should get the debugging from the user class itself, as well as warning in the output regarding the same.
+        $this->assertDebuggingCalled('The property \'country\' has invalid data and has been cleaned.');
+        $this->assertStringContainsString('Incorrect data (country) found for user student1. ' .
+            'This data has been corrected or deleted.', $output);
+    }
+
     /**
      * Generate cli_helper and mock $_SERVER['argv']
      *

admin/tool/uploaduser/user_form.php

@@ -97,9 +97,6 @@ class admin_uploaduser_form2 extends moodleform {
         $columns = $this->_customdata['columns'];
         $data    = $this->_customdata['data'];
 
-        // I am the template user, why should it be the administrator? we have roles now, other ppl may use this script ;-)
-        $templateuser = $USER;
-
         // upload settings and file
         $mform->addElement('header', 'settingsheader', get_string('settings'));
 
@@ -276,30 +273,19 @@ class admin_uploaduser_form2 extends moodleform {
         $mform->setDefault('autosubscribe', core_user::get_property_default('autosubscribe'));
 
         $mform->addElement('text', 'city', get_string('city'), 'maxlength="120" size="25"');
-        $mform->setType('city', PARAM_TEXT);
-        if (empty($CFG->defaultcity)) {
-            $mform->setDefault('city', $templateuser->city);
-        } else {
-            $mform->setDefault('city', core_user::get_property_default('city'));
-        }
+        $mform->setType('city', core_user::get_property_type('city'));
+        $mform->setDefault('city', core_user::get_property_default('city'));
 
-        $choices = get_string_manager()->get_list_of_countries();
-        $choices = array(''=>get_string('selectacountry').'...') + $choices;
-        $mform->addElement('select', 'country', get_string('selectacountry'), $choices);
-        if (empty($CFG->country)) {
-            $mform->setDefault('country', $templateuser->country);
-        } else {
-            $mform->setDefault('country', core_user::get_property_default('country'));
-        }
+        $mform->addElement('select', 'country', get_string('selectacountry'), core_user::get_property_choices('country'));
+        $mform->setDefault('country', core_user::get_property_default('country') ?: '');
         $mform->setAdvanced('country');
 
-        $choices = core_date::get_list_of_timezones($templateuser->timezone, true);
-        $mform->addElement('select', 'timezone', get_string('timezone'), $choices);
-        $mform->setDefault('timezone', $templateuser->timezone);
+        $mform->addElement('select', 'timezone', get_string('timezone'), core_date::get_list_of_timezones(null, true));
+        $mform->setDefault('timezone', core_user::get_property_default('timezone'));
         $mform->setAdvanced('timezone');
 
-        $mform->addElement('select', 'lang', get_string('preferredlanguage'), get_string_manager()->get_list_of_translations());
-        $mform->setDefault('lang', $templateuser->lang);
+        $mform->addElement('select', 'lang', get_string('preferredlanguage'), core_user::get_property_choices('lang'));
+        $mform->setDefault('lang', core_user::get_property_default('lang'));
         $mform->setAdvanced('lang');
 
         $editoroptions = array('maxfiles'=>0, 'maxbytes'=>0, 'trusttext'=>false, 'forcehttps'=>false);
@@ -313,25 +299,23 @@ class admin_uploaduser_form2 extends moodleform {
         $mform->setForceLtr('idnumber');
 
         $mform->addElement('text', 'institution', get_string('institution'), 'maxlength="255" size="25"');
-        $mform->setType('institution', PARAM_TEXT);
-        $mform->setDefault('institution', $templateuser->institution);
+        $mform->setType('institution', core_user::get_property_type('institution'));
 
         $mform->addElement('text', 'department', get_string('department'), 'maxlength="255" size="25"');
-        $mform->setType('department', PARAM_TEXT);
-        $mform->setDefault('department', $templateuser->department);
+        $mform->setType('department', core_user::get_property_type('department'));
 
         $mform->addElement('text', 'phone1', get_string('phone1'), 'maxlength="20" size="25"');
-        $mform->setType('phone1', PARAM_NOTAGS);
+        $mform->setType('phone1', core_user::get_property_type('phone1'));
         $mform->setAdvanced('phone1');
         $mform->setForceLtr('phone1');
 
         $mform->addElement('text', 'phone2', get_string('phone2'), 'maxlength="20" size="25"');
-        $mform->setType('phone2', PARAM_NOTAGS);
+        $mform->setType('phone2', core_user::get_property_type('phone2'));
         $mform->setAdvanced('phone2');
         $mform->setForceLtr('phone2');
 
         $mform->addElement('text', 'address', get_string('address'), 'maxlength="255" size="25"');
-        $mform->setType('address', PARAM_TEXT);
+        $mform->setType('address', core_user::get_property_type('address'));
         $mform->setAdvanced('address');
 
         // Next the profile defaults

admin/tool/usertours/classes/local/target/block.php

@@ -102,7 +102,7 @@ class block extends base {
      */
     public static function add_disabled_constraints_to_form(\MoodleQuickForm $mform) {
         $mform->hideIf('targetvalue_block', 'targettype', 'noteq',
-                \tool_usertours\target::get_target_constant_for_class(get_class()));
+                \tool_usertours\target::get_target_constant_for_class(self::class));
     }
 
     /**

admin/tool/usertours/classes/local/target/selector.php

@@ -92,7 +92,7 @@ class selector extends base {
      */
     public static function add_disabled_constraints_to_form(\MoodleQuickForm $mform) {
         $mform->hideIf('targetvalue_selector', 'targettype', 'noteq',
-                \tool_usertours\target::get_target_constant_for_class(get_class()));
+                \tool_usertours\target::get_target_constant_for_class(self::class));
     }
 
     /**

admin/tool/usertours/classes/local/target/unattached.php

@@ -81,7 +81,7 @@ class unattached extends base {
      * @param   MoodleQuickForm $mform      The form to add configuration to.
      */
     public static function add_disabled_constraints_to_form(\MoodleQuickForm $mform) {
-        $myvalue = \tool_usertours\target::get_target_constant_for_class(get_class());
+        $myvalue = \tool_usertours\target::get_target_constant_for_class(self::class);
 
         foreach (array_keys(self::$forcedsettings) as $settingname) {
             $mform->hideIf($settingname, 'targettype', 'eq', $myvalue);

admin/tool/usertours/classes/manager.php

@@ -283,7 +283,7 @@ class manager {
                 'title' => get_string('importtour', 'tool_usertours'),
             ],
             (object) [
-                'link'  => new \moodle_url('https://archive.moodle.net/tours'),
+                'link'  => new \moodle_url('https://moodle.net/search', ['q' => 'user tours']),
                 'linkproperties' => [
                         'target' => '_blank',
                     ],

admin/tool/xmldb/actions/edit_field_save/edit_field_save.class.php

@@ -91,12 +91,12 @@ class edit_field_save extends XMLDBAction {
         $comment = trim($comment);
 
         $type       = required_param('type', PARAM_INT);
-        $length     = strtolower(optional_param('length', NULL, PARAM_ALPHANUM));
+        $length     = optional_param('length', null, PARAM_INT);
         $decimals   = optional_param('decimals', NULL, PARAM_INT);
         $notnull    = optional_param('notnull', false, PARAM_BOOL);
         $sequence   = optional_param('sequence', false, PARAM_BOOL);
         $default    = optional_param('default', NULL, PARAM_PATH);
-        $default    = trim($default);
+        $default    = is_null($default) ? $default : trim($default);
 
         $editeddir = $XMLDB->editeddirs[$dirpath];
         $structure = $editeddir->xml_file->getStructure();

admin/webservice/service_user_settings.php

@@ -33,18 +33,17 @@ $userid = required_param('userid', PARAM_INT);
 admin_externalpage_setup('externalserviceusersettings');
 
 //define nav bar
-$PAGE->set_url('/' . $CFG->admin . '/webservice/service_user_settings.php',
-        array('id' => $serviceid, 'userid'  => $userid));
+$PAGE->set_url('/admin/webservice/service_user_settings.php', ['serviceid' => $serviceid, 'userid'  => $userid]);
 $node = $PAGE->settingsnav->find('externalservices', navigation_node::TYPE_SETTING);
 if ($node) {
     $node->make_active();
 }
-$PAGE->navbar->add(get_string('serviceusers', 'webservice'),
-        new moodle_url('/' . $CFG->admin . '/webservice/service_users.php', array('id' => $serviceid)));
+
+$returnurl = new moodle_url('/admin/webservice/service_users.php', ['id' => $serviceid]);
+$PAGE->navbar->add(get_string('serviceusers', 'webservice'), $returnurl);
 $PAGE->navbar->add(get_string('serviceusersettings', 'webservice'));
 
 $formaction = new moodle_url('', array('id' => $serviceid, 'userid' => $userid));
-$returnurl = new moodle_url('/' . $CFG->admin . '/webservice/service_users.php', array('id' => $serviceid));
 
 $webservicemanager = new webservice();
 $serviceuser = $webservicemanager->get_ws_authorised_user($serviceid, $userid);

auth/classes/output/login.php

@@ -86,7 +86,7 @@ class login implements renderable, templatable {
         $languagedata = new \core\output\language_menu($PAGE);
 
         $this->languagemenu = $languagedata->export_for_action_menu($OUTPUT);
-        $this->canloginasguest = $CFG->guestloginbutton and !isguestuser();
+        $this->canloginasguest = $CFG->guestloginbutton && !isguestuser();
         $this->canloginbyemail = !empty($CFG->authloginviaemail);
         $this->cansignup = $CFG->registerauth == 'email' || !empty($CFG->registerauth);
         if ($CFG->rememberusername == 0) {

auth/lti/auth.php

@@ -110,22 +110,23 @@ class auth_plugin_lti extends \auth_plugin_base {
 
         // The platform user is already linked with a user account.
         if ($this->get_user_binding($launchdata['iss'], $launchdata['sub'])) {
-            // Always sync the PII, regardless of whether we're already authenticated as this user or not.
-            $user = $this->find_or_create_user_from_launch($launchdata, true);
+            $user = $this->find_or_create_user_from_launch($launchdata);
 
             if (isloggedin()) {
                 // If a different user is currently logged in, authenticate the linked user instead.
                 global $USER;
-                if ((int) $USER->id !== $user->id) {
+                if ($USER->id !== $user->id) {
                     complete_user_login($user);
                 }
                 // If the linked user is already logged in, skip the call to complete_user_login() because this affects deep linking
                 // workflows on sites publishing and consuming resources on the same site, due to the regenerated sesskey.
-                return;
             } else {
                 complete_user_login($user);
-                return;
+
             }
+            // Always sync the PII, regardless of whether we're already authenticated as this user or not.
+            $this->update_user_account($user, $launchdata, $launchdata['iss']);
+            return;
         }
 
         // The platform user is not bound to a user account, check provisioning mode now.
@@ -136,7 +137,9 @@ class auth_plugin_lti extends \auth_plugin_base {
         switch ($provisioningmode) {
             case self::PROVISIONING_MODE_AUTO_ONLY:
                 // Automatic provisioning - this will create/migrate a user account and log the user in.
-                complete_user_login($this->find_or_create_user_from_launch($launchdata, true, $legacyconsumersecrets));
+                $user = $this->find_or_create_user_from_launch($launchdata, $legacyconsumersecrets);
+                complete_user_login($user);
+                $this->update_user_account($user, $launchdata, $launchdata['iss']);
                 break;
             case self::PROVISIONING_MODE_PROMPT_NEW_EXISTING:
             case self::PROVISIONING_MODE_PROMPT_EXISTING_ONLY:
@@ -211,21 +214,13 @@ class auth_plugin_lti extends \auth_plugin_base {
      * itself and pass relevant data in - as auth_plugin_lti::complete_login() does.
      *
      * @param array $launchdata all data in the decoded JWT including iss and sub.
-     * @param bool $syncpicture whether to sync the user's picture with the picture sent in the launch.
      * @param array $legacyconsumersecrets all secrets found for the legacy consumer, facilitating user migration.
      * @return stdClass the Moodle user who is mapped to the platform user identified in the JWT data.
      */
-    public function find_or_create_user_from_launch(array $launchdata, bool $syncpicture = false,
-            array $legacyconsumersecrets = []): stdClass {
-
-        if (!$syncpicture) {
-            unset($launchdata['picture']);
-        }
+    public function find_or_create_user_from_launch(array $launchdata, array $legacyconsumersecrets = []): stdClass {
 
         if ($binduser = $this->get_user_binding($launchdata['iss'], $launchdata['sub'])) {
-            $user = \core_user::get_user((int) $binduser);
-            $this->update_user_account($user, $launchdata, $launchdata['iss']);
-            return \core_user::get_user($user->id);
+            return \core_user::get_user($binduser);
         } else {
             // Is the intent to migrate a user account used in legacy launches?
             if (!empty($legacyconsumersecrets)) {
@@ -234,11 +229,10 @@ class auth_plugin_lti extends \auth_plugin_base {
                     $usermigrationclaim = new user_migration_claim($launchdata, $legacyconsumersecrets);
                     $username = 'enrol_lti' .
                         sha1($usermigrationclaim->get_consumer_key() . '::' .
-                        $usermigrationclaim->get_consumer_key() .':' .$usermigrationclaim->get_user_id());
-                    if ($user = \core_user::get_user_by_username($username)) {
+                            $usermigrationclaim->get_consumer_key() . ':' . $usermigrationclaim->get_user_id());
+                    if ($user = core_user::get_user_by_username($username)) {
                         $this->create_user_binding($launchdata['iss'], $launchdata['sub'], $user->id);
-                        $this->update_user_account($user, $launchdata, $launchdata['iss']);
-                        return \core_user::get_user($user->id);
+                        return core_user::get_user($user->id);
                     }
                 } catch (Exception $e) {
                     // There was an issue validating the user migration claim. We don't want to fail auth entirely though.
@@ -247,9 +241,12 @@ class auth_plugin_lti extends \auth_plugin_base {
                         "'{$launchdata['iss']}'. The migration claim could not be validated. A new account will be created.");
                 }
             }
+            // At the point of the creation, to ensure the user_created event correctly reflects the creating user of '0' (the user
+            // performing the action), ensure any active session is terminated and an empty session initialised.
+            $this->empty_session();
+
             $user = $this->create_new_account($launchdata, $launchdata['iss']);
-            $this->update_user_account($user, $launchdata, $launchdata['iss']);
-            return \core_user::get_user($user->id);
+            return core_user::get_user($user->id);
         }
     }
 
@@ -301,6 +298,17 @@ class auth_plugin_lti extends \auth_plugin_base {
         return $binduser;
     }
 
+    /**
+     * If there's an existing session, inits an empty session.
+     *
+     * @return void
+     */
+    protected function empty_session(): void {
+        if (isloggedin()) {
+            \core\session\manager::init_empty_session();
+        }
+    }
+
     /**
      * Check whether a provisioning mode is valid or not.
      *
@@ -361,7 +369,7 @@ class auth_plugin_lti extends \auth_plugin_base {
      * @param array $userdata the user data coming from either a launch or membership service call.
      * @param string $iss the issuer to which the user belongs.
      */
-    protected function update_user_account(stdClass $user, array $userdata, string $iss): void {
+    public function update_user_account(stdClass $user, array $userdata, string $iss): void {
         global $CFG;
         require_once($CFG->dirroot.'/user/lib.php');
         if ($user->auth !== 'lti') {

auth/lti/classes/local/ltiadvantage/event/event_handler.php

@@ -0,0 +1,48 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\local\ltiadvantage\event;
+
+use auth_lti\local\ltiadvantage\utility\cookie_helper;
+use core\event\user_loggedin;
+
+/**
+ * Event handler for auth_lti.
+ *
+ * @package    auth_lti
+ * @copyright  2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class event_handler {
+
+    /**
+     * Allows the plugin to augment Set-Cookie headers when the user_loggedin event is fired as part of complete_user_login() calls.
+     *
+     * @param user_loggedin $event the event
+     * @return void
+     */
+    public static function handle_user_loggedin(user_loggedin $event): void {
+        // The event data isn't important here. The intent of this listener is to ensure that the MoodleSession cookie is set up
+        // properly during LTI launches + login. This means two things:
+        // i) it's set with SameSite=None; Secure; where possible (since OIDC needs HTTPS this will almost always be possible).
+        // ii) it set with the 'Partitioned' attribute, when required.
+        // The former ensures cross-site cookies are sent for embedded launches. The latter is an opt-in flag needed to use Chrome's
+        // partitioning mechanism, CHIPS.
+        if (cookie_helper::cookies_supported()) {
+            cookie_helper::setup_session_cookie();
+        }
+    }
+}

auth/lti/classes/local/ltiadvantage/utility/cookie_helper.php

@@ -0,0 +1,173 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\local\ltiadvantage\utility;
+use core\session\utility\cookie_helper as core_cookie_helper;
+
+/**
+ * Helper class providing utils dealing with cookies in LTI, particularly 3rd party cookies.
+ *
+ * @package    auth_lti
+ * @copyright  2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+final class cookie_helper {
+
+    /** @var int Cookies are not supported. */
+    public const COOKIE_METHOD_NOT_SUPPORTED = 0;
+
+    /** @var int Cookies are supported without explicit partitioning. */
+    public const COOKIE_METHOD_NO_PARTITIONING = 1;
+
+    /** @var int Cookies are supported via explicit partitioning. */
+    public const COOKIE_METHOD_EXPLICIT_PARTITIONING = 2;
+
+    /**
+     * Check whether cookies can be used with the current user agent and, if so, via what method they are set.
+     *
+     * Currently, this tries 2 modes of setting a test cookie:
+     * 1. Setting a SameSite=None, Secure cookie. This will work in any first party context, and in 3rd party contexts for
+     * any browsers supporting automatic partitioning of 3rd party cookies (E.g. Firefox, Brave).
+     * 2. If 1 fails, setting a cookie with the Chrome 'Partitioned' attribute included, opting that cookie into CHIPS. This will
+     * work for Chrome.
+     *
+     * Upon completion of the cookie check, the check sets a SESSION flag indicating the method used to set the cookie, and upgrades
+     * the session cookie ('MoodleSession') using the respective method. This ensure the session cookie will continue to be sent.
+     *
+     * Then, the following methods can be used by client code to query whether the UA supports cookies, and how:
+     * @see self::cookies_supported() - whether it could be set at all.
+     * @see self::get_cookies_supported_mode() - if a cookie could be set, what mode was used to set it.
+     *
+     * This permits client code to make sure it's setting its cookies appropriately (via the advertised method), and allows it to
+     * present notices - such as in the case where a given UA is found to be lacking the requisite cookie support.
+     * E.g.
+     * cookie_helper::do_cookie_check($mypageurl);
+     * if (!cookie_helper::cookies_supported()) {
+     *     // Print a notice stating that cookie support is required.
+     * }
+     * // Elsewhere in other client code...
+     * if (cookie_helper::get_cookies_supported_mode() === cookie_helper::COOKIE_METHOD_EXPLICIT_PARTITIONING) {
+     *     // Set a cookie, making sure to use the helper to also opt-in to partitioning.
+     *     setcookie('myauthcookie', 'myauthcookievalue', ['samesite' => 'None', 'secure' => true]);
+     *     cookie_helper::add_partitioning_to_cookie('myauthcookie');
+     * }
+     *
+     * @param \moodle_url $pageurl the URL of the page making the check, used to redirect back to after setting test cookies.
+     * @return void
+     */
+    public static function do_cookie_check(\moodle_url $pageurl): void {
+        global $_COOKIE, $SESSION, $CFG;
+        $cookiecheck1 = optional_param('cookiecheck1', null, PARAM_INT);
+        $cookiecheck2 = optional_param('cookiecheck2', null, PARAM_INT);
+
+        if (empty($cookiecheck1)) {
+            // Start the cookie check. Set two test cookies - one samesite none, and one partitioned - and redirect.
+            // Set cookiecheck to show the check has started.
+            self::set_test_cookie('cookiecheck1', self::COOKIE_METHOD_NO_PARTITIONING);
+            self::set_test_cookie('cookiecheck2', self::COOKIE_METHOD_EXPLICIT_PARTITIONING, true);
+            $pageurl->params([
+                'cookiecheck1' => self::COOKIE_METHOD_NO_PARTITIONING,
+                'cookiecheck2' => self::COOKIE_METHOD_EXPLICIT_PARTITIONING,
+            ]);
+
+            // LTI needs to guarantee the 'SameSite=None', 'Secure' (and sometimes 'Partitioned') attributes are set on the
+            // MoodleSession cookie. This is done via manipulation of the outgoing headers after the cookie check redirect. To
+            // guarantee these outgoing Set-Cookie headers will be created after the redirect, expire the current cookie.
+            core_cookie_helper::expire_moodlesession();
+
+            redirect($pageurl);
+        } else {
+            // Have already started a cookie check, so check the result.
+            $cookie1received = isset($_COOKIE['cookiecheck1']) && $_COOKIE['cookiecheck1'] == $cookiecheck1;
+            $cookie2received = isset($_COOKIE['cookiecheck2']) && $_COOKIE['cookiecheck2'] == $cookiecheck2;
+
+            if ($cookie1received || $cookie2received) {
+                // The test cookie could be set and received.
+                // Set a session flag storing the method used to set it, and make sure the session cookie uses this method.
+                $cookiemethod = $cookie1received ? self::COOKIE_METHOD_NO_PARTITIONING : self::COOKIE_METHOD_EXPLICIT_PARTITIONING;
+                $SESSION->auth_lti_cookie_method = $cookiemethod;
+
+                self::setup_session_cookie();
+            }
+        }
+    }
+
+    /**
+     * If a cookie check has been made, returns whether cookies could be set or not.
+     *
+     * @return bool whether cookies are supported or not.
+     */
+    public static function cookies_supported(): bool {
+        return self::get_cookies_supported_method() !== self::COOKIE_METHOD_NOT_SUPPORTED;
+    }
+
+    /**
+     * If a cookie check has been made, gets the method used to set a cookie, or self::COOKIE_METHOD_NOT_SUPPORTED if not supported.
+     *
+     * For cookie methods:
+     * @see self::COOKIE_METHOD_NOT_SUPPORTED
+     * @see self::COOKIE_METHOD_NO_PARTITIONING
+     * @see self::COOKIE_METHOD_EXPLICIT_PARTITIONING
+     *
+     * @return int the constant representing the method by which the cookie was set, or not.
+     */
+    public static function get_cookies_supported_method(): int {
+        global $SESSION;
+        return $SESSION->auth_lti_cookie_method ?? self::COOKIE_METHOD_NOT_SUPPORTED;
+    }
+
+    /**
+     * Sets up the session cookie according to the method used in the cookie check, and with SameSite=None; Secure attributes.
+     *
+     * @return void
+     */
+    public static function setup_session_cookie(): void {
+        global $CFG;
+        require_once($CFG->libdir . '/sessionlib.php');
+
+        if (is_moodle_cookie_secure()) {
+            $atts = ['SameSite=None', 'Secure'];
+            if (self::get_cookies_supported_method() == self::COOKIE_METHOD_EXPLICIT_PARTITIONING) {
+                $atts[] = 'Partitioned';
+            }
+            core_cookie_helper::add_attributes_to_cookie_response_header('MoodleSession' . $CFG->sessioncookie, $atts);
+        }
+    }
+
+    /**
+     * Set a test cookie, using SameSite=None; Secure; attributes if possible, and with or without partitioning opt-in.
+     *
+     * @param string $name cookie name
+     * @param string $value cookie value
+     * @param bool $partitioned whether to try to add partitioning opt-in, which requires secure cookies (https sites).
+     * @return void
+     */
+    private static function set_test_cookie(string $name, string $value, bool $partitioned = false): void {
+        global $CFG;
+        require_once($CFG->libdir . '/sessionlib.php');
+
+        $atts = ['expires' => time() + 30];
+        if (is_moodle_cookie_secure()) {
+            $atts['samesite'] = 'none';
+            $atts['secure'] = true;
+        }
+        setcookie($name, $value, $atts);
+
+        if (is_moodle_cookie_secure() && $partitioned) {
+            core_cookie_helper::add_attributes_to_cookie_response_header($name, ['Partitioned']);
+        }
+    }
+}

auth/lti/classes/output/renderer.php

@@ -33,33 +33,32 @@ class renderer extends \plugin_renderer_base {
      * @return string the html.
      */
     public function render_account_binding_options_page(int $provisioningmode): string {
+
         $formaction = new \moodle_url('/auth/lti/login.php');
         $notification = new notification(get_string('firstlaunchnotice', 'auth_lti'), \core\notification::INFO, false);
-        $noauthnotice = new notification(get_string('firstlaunchnoauthnotice', 'auth_lti', get_docs_url('Publish_as_LTI_tool')),
-            \core\notification::WARNING, false);
         $cancreateaccounts = !get_config('moodle', 'authpreventaccountcreation');
         if ($provisioningmode == \auth_plugin_lti::PROVISIONING_MODE_PROMPT_EXISTING_ONLY) {
             $cancreateaccounts = false;
         }
 
-        $accountinfo = ['isloggedin' => isloggedin()];
+        $accountinfo = [];
         if (isloggedin()) {
             global $USER;
-            $accountinfo = array_merge($accountinfo, [
+            $accountinfo = [
                 'firstname' => $USER->firstname,
                 'lastname' => $USER->lastname,
                 'email' => $USER->email,
                 'picturehtml' => $this->output->user_picture($USER,  ['size' => 35, 'class' => 'round']),
-            ]);
+            ];
         }
 
         $context = [
+            'isloggedin' => isloggedin(),
             'info' => $notification->export_for_template($this),
             'formaction' => $formaction->out(),
             'sesskey' => sesskey(),
             'accountinfo' => $accountinfo,
             'cancreateaccounts' => $cancreateaccounts,
-            'noauthnotice' => $noauthnotice->export_for_template($this)
         ];
         return parent::render_from_template('auth_lti/local/ltiadvantage/login', $context);
     }

auth/lti/db/events.php

@@ -0,0 +1,33 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * LTI Auth plugin event handler definition.
+ *
+ * @package auth_lti
+ * @category event
+ * @copyright 2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$observers = [
+    [
+        'eventname' => '\core\event\user_loggedin',
+        'callback' => '\auth_lti\local\ltiadvantage\event\event_handler::handle_user_loggedin',
+    ],
+];

auth/lti/lang/en/auth_lti.php

@@ -35,7 +35,7 @@ $string['firstlaunchnoauthnotice'] = 'To link your existing account you must be
 $string['getstartedwithnewaccount'] = 'Get started with a new account';
 $string['haveexistingaccount'] = 'I have an existing account';
 $string['linkthisaccount'] = 'Link this account';
-$string['mustbeloggedin'] = 'You need to be logged in to your existing account';
+$string['mustbeloggedin'] = 'Log in to link your existing account.';
 $string['pluginname'] = 'LTI';
 $string['privacy:metadata:auth_lti'] = 'LTI authentication';
 $string['privacy:metadata:auth_lti:authsubsystem'] = 'This plugin is connected to the authentication subsystem.';

auth/lti/login.php

@@ -72,8 +72,9 @@ if ($newaccount) {
     } else {
         // Create a new account and link it, logging the user in.
         $auth = get_auth_plugin('lti');
-        $newuser = $auth->find_or_create_user_from_launch($launchdata, true);
+        $newuser = $auth->find_or_create_user_from_launch($launchdata);
         complete_user_login($newuser);
+        $auth->update_user_account($newuser, $launchdata, $launchdata['iss']);
 
         $PAGE->set_context(context_system::instance());
         $PAGE->set_url(new moodle_url('/auth/lti/login.php'));

auth/lti/templates/local/ltiadvantage/login.mustache

@@ -32,7 +32,6 @@
     * info - a notification describing the first launch options
     * cancreateaccounts - whether or not the user is allowed to create auth_lti accounts
     * accountinfo - information about the user, importantly whether they are logged in or not.
-    * noauthnotice - a notification telling the user they must be authenticated to link accounts. Only relevant when not logged in.
 
     Example context (json):
     {
@@ -46,19 +45,12 @@
             "issuccess": true
         },
         "cancreateaccounts": true,
+        "isloggedin": true,
         "accountinfo": {
-            "isloggedin": true,
             "firstname": "John",
             "lastname": "Smith",
             "email": "john@example.com",
             "picturehtml": "<img src=\"http://site.example.com/pluginfile.php/5/user/icon/boost/f2?rev=99\" class=\"round\" alt=\"\" width=\"35\" height=\"35\">"
-        },
-        "noauthnotice": {
-            "message": "To link your existing account you must be logged in to the site...",
-            "extraclasses": "",
-            "announce": false,
-            "closebutton": false,
-            "iswarning": true
         }
     }
 }}
@@ -79,8 +71,8 @@
                         <div class="card-body text-center d-flex flex-column">
                             <i class="fa fa-user-circle-o fa-2x link"></i>
                             <h4 class="card-title">{{#str}} useexistingaccount, auth_lti {{/str}}</h4>
-                            {{#accountinfo}}
                                 {{#isloggedin}}
+                                    {{#accountinfo}}
                                     <p class="card-text mt-2">
                                         <span class="text-muted">
                                             {{#str}} currentlyloggedinas, auth_lti {{/str}}
@@ -90,14 +82,12 @@
                                         {{firstname}} {{lastname}} ({{email}})
                                     </p>
                                     <input type="submit" class="btn btn-primary mt-auto" name="existing_account" value="{{#str}} linkthisaccount, auth_lti {{/str}}">
+                                    {{/accountinfo}}
                                 {{/isloggedin}}
                                 {{^isloggedin}}
                                     <p class="card-text text-muted">{{#str}} mustbeloggedin, auth_lti {{/str}}</p>
-                                    {{#noauthnotice}}
-                                        {{> core/notification}}
-                                    {{/noauthnotice}}
+                                    <input type="submit" class="btn btn-primary mt-auto" name="existing_account" value="{{#str}} login, moodle {{/str}}">
                                 {{/isloggedin}}
-                            {{/accountinfo}}
                         </div>
                     </div>
                 </div>

auth/lti/tests/auth_test.php

@@ -214,7 +214,7 @@ class auth_test extends \advanced_testcase {
      * @param array $expected the test case expectations.
      * @covers ::find_or_create_user_from_launch
      */
-    public function test_find_or_create_user_from_launch(?array $legacydata, array $launchdata, array $expected) {
+    public function test_find_or_create_user_from_launch(?array $legacydata, array $launchdata, array $expected = []) {
         $this->resetAfterTest();
         global $DB;
         $auth = get_auth_plugin('lti');
@@ -251,7 +251,7 @@ class auth_test extends \advanced_testcase {
         // Authenticate the platform user.
         $sink = $this->redirectEvents();
         $countusersbefore = $DB->count_records('user');
-        $user = $auth->find_or_create_user_from_launch($mockjwtdata, true, $legacysecrets);
+        $user = $auth->find_or_create_user_from_launch($mockjwtdata, $legacysecrets);
         if (!empty($expected['migration_debugging'])) {
             $this->assertDebuggingCalled();
         }
@@ -266,47 +266,15 @@ class auth_test extends \advanced_testcase {
             0 : $numnewusers;
         $this->assertEquals($numnewusers, $countusersafter - $countusersbefore);
 
-        // Verify PII is updated appropriately.
-        switch ($expected['PII']) {
-            case self::PII_ALL:
-                $this->assertEquals($launchdata['user']['given_name'], $user->firstname);
-                $this->assertEquals($launchdata['user']['family_name'], $user->lastname);
-                $this->assertEquals($launchdata['user']['email'], $user->email);
-                break;
-            case self::PII_NAMES_ONLY:
-                $this->assertEquals($launchdata['user']['given_name'], $user->firstname);
-                $this->assertEquals($launchdata['user']['family_name'], $user->lastname);
-                $email = 'enrol_lti_13_' . sha1($mockjwtdata['iss'] . '_' . $mockjwtdata['sub']) . "@example.com";
-                $this->assertEquals($email, $user->email);
-                break;
-            case self::PII_EMAILS_ONLY:
-                $this->assertEquals($mockjwtdata['iss'], $user->lastname);
-                $this->assertEquals($mockjwtdata['sub'], $user->firstname);
-                $this->assertEquals($launchdata['user']['email'], $user->email);
-                break;
-            default:
-            case self::PII_NONE:
-                $this->assertEquals($mockjwtdata['iss'], $user->lastname);
-                $this->assertEquals($mockjwtdata['sub'], $user->firstname);
-                $email = 'enrol_lti_13_' . sha1($mockjwtdata['iss'] . '_' . $mockjwtdata['sub']) . "@example.com";
-                $this->assertEquals($email, $user->email);
-                break;
-        }
-
-        // Verify picture sync occurs, if expected.
-        if (!empty($expected['syncpicture']) && $expected['syncpicture']) {
-            $this->verify_user_profile_image_updated($user->id);
-        }
-
         if (!empty($expected['migrated']) && $expected['migrated']) {
             // If migrated, verify the user account is reusing the legacy user account.
             $legacyuserids = array_column($legacyusers, 'id');
             $this->assertContains($user->id, $legacyuserids);
-            $this->assertInstanceOf(\core\event\user_updated::class, $events[0]);
+            $this->assertEmpty($events); // No updates as part of this method.
         } else if (isset($firstauthuser)) {
             // If the user is authenticating a second time, confirm the same account is being returned.
             $this->assertEquals($firstauthuser->id, $user->id);
-            $this->assertEmpty($events); // The user authenticated with the same data once before, so we don't expect an update.
+            $this->assertEmpty($events); // No updates as part of this method.
         } else {
             // The user wasn't migrated and hasn't launched before, so we expect a user_created event.
             $this->assertInstanceOf(\core\event\user_created::class, $events[0]);
@@ -329,9 +297,6 @@ class auth_test extends \advanced_testcase {
                     )[0],
                     'migration_claim' => null
                 ],
-                'expected' => [
-                    'PII' => self::PII_ALL,
-                ]
             ],
             'New (unlinked) platform learner excluding names, no legacy user, no migration claim' => [
                 'legacy_data' => null,
@@ -343,9 +308,6 @@ class auth_test extends \advanced_testcase {
                     )[0],
                     'migration_claim' => null
                 ],
-                'expected' => [
-                    'PII' => self::PII_EMAILS_ONLY,
-                ]
             ],
             'New (unlinked) platform learner excluding emails, no legacy user, no migration claim' => [
                 'legacy_data' => null,
@@ -358,9 +320,6 @@ class auth_test extends \advanced_testcase {
                     )[0],
                     'migration_claim' => null
                 ],
-                'expected' => [
-                    'PII' => self::PII_NAMES_ONLY,
-                ]
             ],
             'New (unlinked) platform learner excluding all PII, no legacy user, no migration claim' => [
                 'legacy_data' => null,
@@ -373,9 +332,6 @@ class auth_test extends \advanced_testcase {
                     )[0],
                     'migration_claim' => null
                 ],
-                'expected' => [
-                    'PII' => self::PII_NONE,
-                ]
             ],
             'New (unlinked) platform learner including PII, existing legacy user, valid migration claim' => [
                 'legacy_data' => [
@@ -403,7 +359,6 @@ class auth_test extends \advanced_testcase {
                     ]
                 ],
                 'expected' => [
-                    'PII' => self::PII_ALL,
                     'migrated' => true
                 ]
             ],
@@ -426,7 +381,6 @@ class auth_test extends \advanced_testcase {
                     'migration_claim' => null,
                 ],
                 'expected' => [
-                    'PII' => self::PII_ALL,
                     'migrated' => false,
                 ]
             ],
@@ -455,7 +409,6 @@ class auth_test extends \advanced_testcase {
                     ]
                 ],
                 'expected' => [
-                    'PII' => self::PII_ALL,
                     'migrated' => false,
                     'migration_debugging' => true,
                 ]
@@ -486,7 +439,6 @@ class auth_test extends \advanced_testcase {
                     ]
                 ],
                 'expected' => [
-                    'PII' => self::PII_ALL,
                     'migrated' => false,
                 ]
             ],
@@ -516,7 +468,6 @@ class auth_test extends \advanced_testcase {
                     ]
                 ],
                 'expected' => [
-                    'PII' => self::PII_ALL,
                     'migrated' => false
                 ]
             ],
@@ -546,7 +497,6 @@ class auth_test extends \advanced_testcase {
                     ]
                 ],
                 'expected' => [
-                    'PII' => self::PII_ALL,
                     'migrated' => true
                 ]
             ],
@@ -576,7 +526,6 @@ class auth_test extends \advanced_testcase {
                     ]
                 ],
                 'expected' => [
-                    'PII' => self::PII_ALL,
                     'migrated' => false,
                     'migration_debugging' => true,
                 ]
@@ -605,7 +554,6 @@ class auth_test extends \advanced_testcase {
                     ]
                 ],
                 'expected' => [
-                    'PII' => self::PII_ALL,
                     'migrated' => false
                 ]
             ],
@@ -637,7 +585,6 @@ class auth_test extends \advanced_testcase {
                     ]
                 ],
                 'expected' => [
-                    'PII' => self::PII_NONE,
                     'migrated' => true
                 ]
             ],
@@ -650,9 +597,6 @@ class auth_test extends \advanced_testcase {
                     )[0],
                     'migration_claim' => null
                 ],
-                'expected' => [
-                    'PII' => self::PII_ALL,
-                ]
             ],
             'New (unlinked) platform instructor excluding PII, no legacy user, no migration claim' => [
                 'legacy_data' => null,
@@ -665,9 +609,6 @@ class auth_test extends \advanced_testcase {
                     )[0],
                     'migration_claim' => null
                 ],
-                'expected' => [
-                    'PII' => self::PII_NONE,
-                ]
             ],
             'New (unlinked) platform instructor including PII, existing legacy user, valid migration claim' => [
                 'legacy_data' => [
@@ -695,7 +636,6 @@ class auth_test extends \advanced_testcase {
                     ]
                 ],
                 'expected' => [
-                    'PII' => self::PII_ALL,
                     'migrated' => true
                 ]
             ],
@@ -709,9 +649,6 @@ class auth_test extends \advanced_testcase {
                     )[0],
                     'migration_claim' => null
                 ],
-                'expected' => [
-                    'PII' => self::PII_ALL,
-                ]
             ],
             'Existing (linked) platform learner excluding PII, no legacy user, no migration claim' => [
                 'legacy_data' => null,
@@ -725,9 +662,6 @@ class auth_test extends \advanced_testcase {
                     )[0],
                     'migration_claim' => null
                 ],
-                'expected' => [
-                    'PII' => self::PII_NONE,
-                ]
             ],
             'Existing (linked) platform instructor including PII, no legacy user, no migration claim' => [
                 'legacy_data' => null,
@@ -739,9 +673,6 @@ class auth_test extends \advanced_testcase {
                     )[0],
                     'migration_claim' => null
                 ],
-                'expected' => [
-                    'PII' => self::PII_ALL,
-                ]
             ],
             'Existing (linked) platform instructor excluding PII, no legacy user, no migration claim' => [
                 'legacy_data' => null,
@@ -755,9 +686,6 @@ class auth_test extends \advanced_testcase {
                     )[0],
                     'migration_claim' => null
                 ],
-                'expected' => [
-                    'PII' => self::PII_NONE,
-                ]
             ],
             'New (unlinked) platform instructor excluding PII, picture included' => [
                 'legacy_data' => null,
@@ -772,10 +700,6 @@ class auth_test extends \advanced_testcase {
                     )[0],
                     'migration_claim' => null
                 ],
-                'expected' => [
-                    'PII' => self::PII_NONE,
-                    'syncpicture' => true
-                ]
             ]
         ];
     }
@@ -1154,4 +1078,226 @@ class auth_test extends \advanced_testcase {
         // Assert idempotency of the bind call.
         $this->assertNull($auth->create_user_binding($mockiss, $mocksub, $user->id));
     }
+
+    /**
+     * Test updating a user account based on a given set of launchdata.
+     *
+     * @param array $firstlaunchdata the data from the first launch the user made.
+     * @param array $launchdata the current launch data, which will dictate what data is updated.
+     * @param array $expected array of test expectations
+     * @dataProvider update_user_account_provider
+     * @covers ::update_user_account
+     */
+    public function test_update_user_account(array $firstlaunchdata, array $launchdata, array $expected): void {
+        $this->resetAfterTest();
+        $auth = get_auth_plugin('lti');
+
+        // Mock the first authentication of the user.
+        $firstmockjwtdata = $this->get_mock_launchdata_for_user($firstlaunchdata['user']);
+        $user = $auth->find_or_create_user_from_launch($firstmockjwtdata);
+
+        // Now, mock the recent authentication, confirming updates.
+        $mockjwtdata = $this->get_mock_launchdata_for_user($launchdata['user']);
+        $sink = $this->redirectEvents();
+        $auth->update_user_account($user, $mockjwtdata, $mockjwtdata['iss']);
+        $user = \core_user::get_user($user->id);
+        $events = $sink->get_events();
+        $sink->close();
+
+        if (!empty($expected['user_updated'])) {
+            $this->assertInstanceOf(\core\event\user_updated::class, $events[0]);
+        } else {
+            $this->assertEmpty($events);
+        }
+
+        // Verify PII is updated appropriately.
+        switch ($expected['PII']) {
+            case self::PII_ALL:
+                $this->assertEquals($launchdata['user']['given_name'], $user->firstname);
+                $this->assertEquals($launchdata['user']['family_name'], $user->lastname);
+                $this->assertEquals($launchdata['user']['email'], $user->email);
+                break;
+            case self::PII_NAMES_ONLY:
+                $this->assertEquals($launchdata['user']['given_name'], $user->firstname);
+                $this->assertEquals($launchdata['user']['family_name'], $user->lastname);
+                $email = 'enrol_lti_13_' . sha1($mockjwtdata['iss'] . '_' . $mockjwtdata['sub']) . "@example.com";
+                $this->assertEquals($email, $user->email);
+                break;
+            case self::PII_EMAILS_ONLY:
+                $this->assertEquals($mockjwtdata['iss'], $user->lastname);
+                $this->assertEquals($mockjwtdata['sub'], $user->firstname);
+                $this->assertEquals($launchdata['user']['email'], $user->email);
+                break;
+            default:
+            case self::PII_NONE:
+                $this->assertEquals($mockjwtdata['iss'], $user->lastname);
+                $this->assertEquals($mockjwtdata['sub'], $user->firstname);
+                $email = 'enrol_lti_13_' . sha1($mockjwtdata['iss'] . '_' . $mockjwtdata['sub']) . "@example.com";
+                $this->assertEquals($email, $user->email);
+                break;
+        }
+
+        // Verify picture sync occurs, if expected.
+        if (!empty($expected['picture_updated'])) {
+            $this->verify_user_profile_image_updated($user->id);
+        }
+    }
+
+    /**
+     * Data provider for testing user user_update_account.
+     *
+     * @return array the test case data.
+     */
+    public function update_user_account_provider(): array {
+        return [
+            'Full PII included in both auths, no picture in either' => [
+                'first_launch_data' => [
+                     'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner'
+                    )[0]
+                ],
+                'launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner'
+                    )[0],
+                ],
+                'expected' => [
+                    'PII' => self::PII_ALL,
+                    'user_updated' => false,
+                    'picture_updated' => false
+                ]
+            ],
+            'No PII included in both auths, no picture in either' => [
+                'first_launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner',
+                        false,
+                        false
+                    )[0]
+                ],
+                'launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner',
+                        false,
+                        false
+                    )[0],
+                ],
+                'expected' => [
+                    'PII' => self::PII_NONE,
+                    'user_updated' => false,
+                    'picture_updated' => false
+                ]
+            ],
+            'First auth no PII, second auth including PII, no picture in either' => [
+                'first_launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner',
+                        false,
+                        false
+                    )[0]
+                ],
+                'launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner'
+                    )[0],
+                ],
+                'expected' => [
+                    'PII' => self::PII_ALL,
+                    'user_updated' => true,
+                    'picture_updated' => false
+                ]
+            ],
+            'First auth full PII, second auth no PII, no picture in either' => [
+                'first_launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner',
+                    )[0]
+                ],
+                'launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner',
+                        false,
+                        false
+                    )[0],
+                ],
+                'expected' => [
+                    'PII' => self::PII_NONE,
+                    'user_updated' => true,
+                    'picture_updated' => false
+                ]
+            ],
+            'First auth full PII, second auth emails only, no picture in either' => [
+                'first_launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner',
+                    )[0]
+                ],
+                'launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner',
+                        false
+                    )[0],
+                ],
+                'expected' => [
+                    'PII' => self::PII_EMAILS_ONLY,
+                    'user_updated' => true,
+                    'picture_updated' => false
+                ]
+            ],
+            'First auth full PII, second auth names only, no picture in either' => [
+                'first_launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner',
+                    )[0]
+                ],
+                'launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner',
+                        true,
+                        false
+                    )[0],
+                ],
+                'expected' => [
+                    'PII' => self::PII_NAMES_ONLY,
+                    'user_updated' => true,
+                    'picture_updated' => false
+                ]
+            ],
+            'Full PII included in both auths, picture included in the second auth' => [
+                'first_launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner'
+                    )[0]
+                ],
+                'launch_data' => [
+                    'user' => $this->get_mock_users_with_ids(
+                        ['1'],
+                        'http://purl.imsglobal.org/vocab/lis/v2/membership#Learner',
+                        true,
+                        true,
+                        true
+                    )[0],
+                ],
+                'expected' => [
+                    'PII' => self::PII_ALL,
+                    'user_updated' => false,
+                    'picture_updated' => false
+                ]
+            ],
+        ];
+    }
+
 }

auth/lti/version.php

@@ -24,6 +24,6 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version = 2023042400; // The current plugin version (Date: YYYYMMDDXX).
+$plugin->version = 2023042401; // The current plugin version (Date: YYYYMMDDXX).
 $plugin->requires = 2023041800; // Requires this Moodle version.
 $plugin->component = 'auth_lti'; // Full name of the plugin (used for diagnostics).

availability/classes/info.php

@@ -49,6 +49,9 @@ abstract class info {
     /** @var tree Availability configuration, decoded from JSON; null if unset */
     protected $availabilitytree;
 
+    /** @var array The groups the current user belongs to. */
+    protected $groups;
+
     /** @var array|null Array of information about current restore if any */
     protected static $restoreinfo = null;
 
@@ -65,6 +68,7 @@ abstract class info {
         $this->course = $course;
         $this->visible = (bool)$visible;
         $this->availability = $availability;
+        $this->groups = null;
     }
 
     /**
@@ -298,6 +302,7 @@ abstract class info {
             // So instead use the numbers (cmid) from the tag.
             $htmlname = preg_replace('~[^0-9]~', '', $name);
         }
+        $htmlname = html_to_text($htmlname, 75, false);
         $info = 'Error processing availability data for ‘' . $htmlname
                  . '’: ' . s($e->a);
         debugging($info, DEBUG_DEVELOPER);
@@ -740,11 +745,14 @@ abstract class info {
         $info = preg_replace_callback('~<AVAILABILITY_CMNAME_([0-9]+)/>~',
                 function($matches) use($modinfo, $context) {
                     $cm = $modinfo->get_cm($matches[1]);
-                    if ($cm->has_view() and $cm->get_user_visible()) {
+                    $modulename = format_string($cm->get_name(), true, ['context' => $context]);
+                    // We make sure that we add a data attribute to the name so we can change it later if the
+                    // original module name changes.
+                    if ($cm->has_view() && $cm->get_user_visible()) {
                         // Help student by providing a link to the module which is preventing availability.
-                        return \html_writer::link($cm->get_url(), format_string($cm->get_name(), true, ['context' => $context]));
+                        return \html_writer::link($cm->get_url(), $modulename, ['data-cm-name-for' => $cm->id]);
                     } else {
-                        return format_string($cm->get_name(), true, ['context' => $context]);
+                        return \html_writer::span($modulename, '', ['data-cm-name-for' => $cm->id]);
                     }
                 }, $info);
         $info = preg_replace_callback('~<AVAILABILITY_FORMAT_STRING>(.*?)</AVAILABILITY_FORMAT_STRING>~s',
@@ -796,4 +804,28 @@ abstract class info {
         }
         return false;
     }
+
+    /**
+     * Returns groups that the current user belongs to on the course. Note: If not already
+     * available, this may make a database query.
+     *
+     * This will include groups the user is not allowed to see themselves, so check visibility
+     * before displaying groups to the user.
+     *
+     * @param int $groupingid Grouping ID or 0 (default) for all groups
+     * @return int[] Array of int (group id) => int (same group id again); empty array if none
+     */
+    public function get_groups(int $groupingid = 0): array {
+        global $USER;
+        if (is_null($this->groups)) {
+            $allgroups = groups_get_user_groups($this->course->id, $USER->id, true);
+            $this->groups = $allgroups;
+        } else {
+            $allgroups = $this->groups;
+        }
+        if (!isset($allgroups[$groupingid])) {
+            return [];
+        }
+        return $allgroups[$groupingid];
+    }
 }

availability/condition/completion/classes/condition.php

@@ -149,15 +149,23 @@ class condition extends \core_availability\condition {
 
             $allow = true;
             if ($this->expectedcompletion == COMPLETION_COMPLETE) {
-                // Complete also allows the pass, fail states.
+                // Complete also allows the pass state.
                 switch ($completiondata->completionstate) {
                     case COMPLETION_COMPLETE:
-                    case COMPLETION_COMPLETE_FAIL:
                     case COMPLETION_COMPLETE_PASS:
                         break;
                     default:
                         $allow = false;
                 }
+            } else if ($this->expectedcompletion == COMPLETION_INCOMPLETE) {
+                // Incomplete also allows the fail state.
+                switch ($completiondata->completionstate) {
+                    case COMPLETION_INCOMPLETE:
+                    case COMPLETION_COMPLETE_FAIL:
+                        break;
+                    default:
+                        $allow = false;
+                }
             } else {
                 // Other values require exact match.
                 if ($completiondata->completionstate != $this->expectedcompletion) {

availability/condition/completion/tests/behat/availability_completion.feature

@@ -20,6 +20,8 @@ Feature: availability_completion
       | activity | course | name   | completion |
       | page     | C1     | Page 1 | 1          |
       | page     | C1     | Page 2 |            |
+      | page     | C1     | Page 3 | 1          |
+      | page     | C1     | Page 4 |            |
 
   @javascript
   Scenario: Test condition
@@ -74,3 +76,70 @@ Feature: availability_completion
     And I click on "forum 1" "link" in the "region-main" "region"
     And I am on "Course 1" course homepage
     And I should see "Page 2" in the "region-main" "region"
+
+  @javascript
+  Scenario Outline: Restrict access for activity completion should display correctly
+    Given the following "question categories" exist:
+      | contextlevel | reference | name           |
+      | Course       | C1        | Test questions |
+    And the following "questions" exist:
+      | questioncategory | qtype     | name           | questiontext              |
+      | Test questions   | truefalse | First question | Answer the first question |
+    And the following "activities" exist:
+      | activity   | name           | course | idnumber | gradepass | completion | completionpassgrade | completionusegrade |
+      | quiz       | Test quiz name | C1     | quiz1    | 5.00      | 2          | 1                   | 1                  |
+    And quiz "Test quiz name" contains the following questions:
+      | question       | page |
+      | First question | 1    |
+    And I am on the "Page 2" "page activity editing" page logged in as "teacher1"
+    And I expand all fieldsets
+    And I press "Add restriction..."
+    And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
+    And I click on ".availability-item .availability-eye img" "css_element"
+    And I set the following fields to these values:
+      | Required completion status | <condition>   |
+      | cm                         | quiz          |
+    And I press "Save and return to course"
+    And I am on the "Course 1" "course" page logged in as "student1"
+    And I <shouldornot> see "Page 2" in the "region-main" "region"
+    # Failed grade for quiz.
+    When user "student1" has attempted "Test quiz name" with responses:
+      | slot | response   |
+      | 1    | <answer1>  |
+    And I reload the page
+    And I <shouldornotanswer1> see "Page 2" in the "region-main" "region"
+    # Passing grade for quiz.
+    But user "student1" has attempted "Test quiz name" with responses:
+      | slot | response    |
+      | 1    | <answer2>   |
+    And I reload the page
+    And I <shouldornotanswer2> see "Page 2" in the "region-main" "region"
+
+    Examples:
+      | condition                        | answer1 | answer2 | shouldornot | shouldornotanswer1 | shouldornotanswer2 |
+      | must be marked complete          | False   | True    | should not  | should not         | should             |
+      | must not be marked complete      | False   | True    | should      | should             | should not         |
+      | must be complete with pass grade | False   | True    | should not  | should not         | should             |
+      | must be complete with fail grade | False   | True    | should not  | should             | should not         |
+
+  @javascript
+  Scenario: Edit dependent activity name should also change the access restriction message
+    Given I am on the "Page 2" "page activity editing" page logged in as "teacher1"
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
+    And I click on ".availability-item .availability-eye img" "css_element"
+    And I set the field "Activity or resource" to "Page 1"
+    And I press "Save and return to course"
+    And I am on the "Page 4" "page activity editing" page
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
+    And I click on ".availability-item .availability-eye img" "css_element"
+    And I set the field "Activity or resource" to "Page 3"
+    And I press "Save and return to course"
+    And I switch editing mode on
+    And I set the field "Edit title" in the "Page 1" "activity" to "Page X"
+    And I wait until the page is ready
+    Then I should see "Not available unless: The activity Page X is marked complete" in the "Page 2" "activity"
+    Then I should see "Not available unless: The activity Page 3 is marked complete" in the "Page 4" "activity"

availability/condition/completion/tests/condition_test.php

@@ -301,14 +301,14 @@ class condition_test extends \advanced_testcase {
         $cond = new condition((object)[
             'cm' => (int)$assigncm->id, 'e' => COMPLETION_INCOMPLETE
         ]);
-        $this->assertFalse($cond->is_available(false, $info, true, $user->id));
-        $this->assertTrue($cond->is_available(true, $info, true, $user->id));
+        $this->assertTrue($cond->is_available(false, $info, true, $user->id));
+        $this->assertFalse($cond->is_available(true, $info, true, $user->id));
 
         $cond = new condition((object)[
             'cm' => (int)$assigncm->id, 'e' => COMPLETION_COMPLETE
         ]);
-        $this->assertTrue($cond->is_available(false, $info, true, $user->id));
-        $this->assertFalse($cond->is_available(true, $info, true, $user->id));
+        $this->assertFalse($cond->is_available(false, $info, true, $user->id));
+        $this->assertTrue($cond->is_available(true, $info, true, $user->id));
 
         $cond = new condition((object)[
             'cm' => (int)$assigncm->id, 'e' => COMPLETION_COMPLETE_PASS
@@ -531,10 +531,10 @@ class condition_test extends \advanced_testcase {
             ],
             // Depending on assign with grade.
             'Previous complete condition with previous fail grade' => [
-                40, COMPLETION_COMPLETE, '', 'page3', true, false, '~Assign!.*is marked complete~'
+                40, COMPLETION_COMPLETE, '', 'page3', false, true, '~Assign!.*is marked complete~',
             ],
             'Previous incomplete condition with previous fail grade' => [
-                40, COMPLETION_INCOMPLETE, '', 'page3', false, true, '~Assign!.*is incomplete~'
+                40, COMPLETION_INCOMPLETE, '', 'page3', true, false, '~Assign!.*is incomplete~',
             ],
             'Previous complete pass condition with previous fail grade' => [
                 40, COMPLETION_COMPLETE_PASS, '', 'page3', false, true, '~Assign!.*is complete and passed~'

availability/condition/group/classes/condition.php

@@ -71,7 +71,7 @@ class condition extends \core_availability\condition {
         $allow = true;
         if (!has_capability('moodle/site:accessallgroups', $context, $userid)) {
             // Get all groups the user belongs to.
-            $groups = $info->get_modinfo()->get_groups();
+            $groups = $info->get_groups();
             if ($this->groupid) {
                 $allow = in_array($this->groupid, $groups);
             } else {

availability/condition/group/tests/behat/availability_group.feature

@@ -108,3 +108,49 @@ Feature: availability_group
     When I am on the "C1" "Course" page logged in as "student1"
     Then I should see "Not available unless: You belong to G-One"
     And I should not see "G-Un"
+
+  @javascript
+  Scenario: Condition using a hidden group
+    Given the following "groups" exist:
+      | name         | course | idnumber | visibility |
+      | Hidden Group | C1     | GA       | 3          |
+    And I log in as "teacher1"
+    And I add a page activity to course "Course 1" section "1"
+    And I expand all fieldsets
+
+    # Page P1 any group.
+    And I am on the "P1" "page activity editing" page
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And "Group" "button" should exist in the "Add restriction..." "dialogue"
+    And I click on "Group" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Group" to "(Any group)"
+    And I click on ".availability-item .availability-eye img" "css_element"
+    And I click on "Save and return to course" "button"
+
+    # Page P2 with hidden group.
+    And I am on the "P2" "page activity editing" page
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And I click on "Group" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Group" to "Hidden Group"
+    And I click on "Save and return to course" "button"
+
+    # Log back in as student.
+    When I am on the "Course 1" "course" page logged in as "student1"
+
+    # No pages should appear yet.
+    Then I should not see "P1" in the "region-main" "region"
+    And I should not see "P2" in the "region-main" "region"
+    And I should not see "Hidden Group"
+
+    # Add to groups and log out/in again.
+    And the following "group members" exist:
+      | user     | group |
+      | student1 | GA    |
+    And I am on "Course 1" course homepage
+
+    # P1 (any groups) and P2 should show. The user should not see the hidden group mentioned anywhere.
+    And I should see "P1" in the "region-main" "region"
+    And I should see "P2" in the "region-main" "region"
+    And I should not see "Hidden Group"

availability/condition/group/tests/condition_test.php

@@ -49,6 +49,7 @@ class condition_test extends \advanced_testcase {
         $course = $generator->create_course();
         $user = $generator->create_user();
         $generator->enrol_user($user->id, $course->id);
+        $this->setUser($user);
         $info = new \core_availability\mock_info($course, $user->id);
 
         // Make 2 test groups, one in a grouping and one not.
@@ -70,7 +71,7 @@ class condition_test extends \advanced_testcase {
         // Add user to groups and refresh cache.
         groups_add_member($group1, $user);
         groups_add_member($group2, $user);
-        get_fast_modinfo($course->id, 0, true);
+        $info = new \core_availability\mock_info($course, $user->id);
 
         // Recheck.
         $this->assertTrue($cond->is_available(false, $info, true, $user->id));

availability/tests/behat/private_ruleset.feature

@@ -21,8 +21,7 @@ Feature: Private rule sets
       | Group A | C1     | GA       | 0          |
       | Group B | C1     | GB       | 1          |
     And I log in as "teacher1"
-    And I am on "Course 1" course homepage with editing mode on
-    And I add a "Page" to section "1"
+    And I add a page activity to course "Course 1" section "1"
     And I expand all fieldsets
 
   Scenario: Add restriction with visible condition (must match), display option should be active

backup/moodle2/backup_course_task.class.php

@@ -168,6 +168,7 @@ class backup_course_task extends backup_task {
         $content = self::encode_links_helper($content, 'BADGESVIEWBYID',       '/badges/view.php?type=2&id=');
         $content = self::encode_links_helper($content, 'USERINDEXVIEWBYID',    '/user/index.php?id=');
         $content = self::encode_links_helper($content, 'PLUGINFILEBYCONTEXT',  '/pluginfile.php/');
+        $content = self::encode_links_helper($content, 'PLUGINFILEBYCONTEXTURLENCODED', '/pluginfile.php/', true);
 
         return $content;
     }
@@ -178,17 +179,26 @@ class backup_course_task extends backup_task {
      * @param string $name the name of this type of encoded link.
      * @param string $path the path that identifies this type of link, up
      *      to the ?paramname= bit.
+     * @param bool $urlencoded whether to use urlencode() before replacing the path.
      * @return string content with one type of link encoded.
      */
-    static private function encode_links_helper($content, $name, $path) {
+    private static function encode_links_helper(string $content, string $name, string $path, bool $urlencoded = false) {
         global $CFG;
         // We want to convert both http and https links.
         $root = $CFG->wwwroot;
         $httpsroot = str_replace('http://', 'https://', $root);
         $httproot = str_replace('https://', 'http://', $root);
 
-        $httpsbase = preg_quote($httpsroot . $path, '/');
-        $httpbase = preg_quote($httproot . $path, '/');
+        $httpsbase = $httpsroot . $path;
+        $httpbase = $httproot . $path;
+
+        if ($urlencoded) {
+            $httpsbase = urlencode($httpsbase);
+            $httpbase = urlencode($httpbase);
+        }
+
+        $httpsbase = preg_quote($httpsbase, '/');
+        $httpbase = preg_quote($httpbase, '/');
 
         $return = preg_replace('/(' . $httpsbase . ')([0-9]+)/', '$@' . $name . '*$2@$', $content);
         $return = preg_replace('/(' . $httpbase . ')([0-9]+)/', '$@' . $name . '*$2@$', $return);

backup/moodle2/backup_stepslib.php

@@ -1602,7 +1602,13 @@ class backup_block_instance_structure_step extends backup_structure_step {
         // Transform configdata information if needed (process links and friends)
         $blockrec = $DB->get_record('block_instances', array('id' => $this->task->get_blockid()));
         if ($attrstotransform = $this->task->get_configdata_encoded_attributes()) {
-            $configdata = (array)unserialize(base64_decode($blockrec->configdata));
+            $configdata = array_filter(
+                (array) unserialize_object(base64_decode($blockrec->configdata)),
+                static function($value): bool {
+                    return !($value instanceof __PHP_Incomplete_Class);
+                }
+            );
+
             foreach ($configdata as $attribute => $value) {
                 if (in_array($attribute, $attrstotransform)) {
                     $configdata[$attribute] = $this->contenttransformer->process($value);

backup/moodle2/restore_course_task.class.php

@@ -167,6 +167,7 @@ class restore_course_task extends restore_task {
         $rules[] = new restore_decode_rule('BADGESVIEWBYID',       '/badges/view.php?type=2&id=$1', 'course');
         $rules[] = new restore_decode_rule('USERINDEXVIEWBYID',    '/user/index.php?id=$1',         'course');
         $rules[] = new restore_decode_rule('PLUGINFILEBYCONTEXT',  '/pluginfile.php/$1',            'context');
+        $rules[] = new restore_decode_rule('PLUGINFILEBYCONTEXTURLENCODED', '/pluginfile.php/$1', 'context', true);
 
         return $rules;
     }

backup/moodle2/restore_stepslib.php

@@ -3749,7 +3749,7 @@ class restore_activity_competencies_structure_step extends restore_structure_ste
             // Sortorder is ignored by precaution, anyway we should walk through the records in the right order.
             $record = (object) $params;
             $record->ruleoutcome = $data->ruleoutcome;
-            $record->overridegrade = $data->overridegrade;
+            $record->overridegrade = $data->overridegrade ?? 0;
             $coursemodulecompetency = new \core_competency\course_module_competency(0, $record);
             $coursemodulecompetency->create();
         }
@@ -4398,7 +4398,13 @@ class restore_block_instance_structure_step extends restore_structure_step {
         // Let's look for anything within configdata neededing processing
         // (nulls and uses of legacy file.php)
         if ($attrstotransform = $this->task->get_configdata_encoded_attributes()) {
-            $configdata = (array) unserialize_object(base64_decode($data->configdata));
+            $configdata = array_filter(
+                (array) unserialize_object(base64_decode($data->configdata)),
+                static function($value): bool {
+                    return !($value instanceof __PHP_Incomplete_Class);
+                }
+            );
+
             foreach ($configdata as $attribute => $value) {
                 if (in_array($attribute, $attrstotransform)) {
                     $configdata[$attribute] = $this->contentprocessor->process_cdata($value);
@@ -5384,6 +5390,25 @@ class restore_move_module_questions_categories extends restore_execution_step {
                     ];
                     $params += $categoryidparams;
                     $DB->execute($sqlupdate, $params);
+
+                    // As explained in {@see restore_quiz_activity_structure_step::process_quiz_question_legacy_instance()}
+                    // question_set_references relating to random questions restored from old backups,
+                    // which pick from context_module question_categores, will have been restored with the wrong questioncontextid.
+                    // So, now, we need to find those, and updated the questioncontextid.
+                    // We can only find them by picking apart the filter conditions, and seeign which categories they refer to.
+
+                    // We need to check all the question_set_references belonging to this context_module.
+                    $references = $DB->get_records('question_set_references', ['usingcontextid' => $newcontext->newitemid]);
+                    foreach ($references as $reference) {
+                        $filtercondition = json_decode($reference->filtercondition);
+                        if (!empty($filtercondition->questioncategoryid) &&
+                                in_array($filtercondition->questioncategoryid, $categoryids)) {
+                            // This is one of ours, update the questionscontextid.
+                            $DB->set_field('question_set_references',
+                                'questionscontextid', $newcontext->newitemid,
+                                ['id' => $reference->id]);
+                        }
+                    }
                 }
 
                 // Now set the parent id for the question categories that were in the top category in the course context
@@ -6181,6 +6206,11 @@ trait restore_question_set_reference_data_trait {
         $data->filtercondition = json_encode($filtercondition);
         if ($context = $this->get_mappingid('context', $data->questionscontextid)) {
             $data->questionscontextid = $context;
+        } else {
+            $this->log('question_set_reference with old id ' . $data->id .
+                ' referenced question context ' . $data->questionscontextid .
+                ' which was not included in the backup. Therefore, this has been ' .
+                ' restored with the old questionscontextid.', backup::LOG_WARNING);
         }
 
         $DB->insert_record('question_set_references', $data);

backup/restorefile.php

@@ -160,12 +160,16 @@ if ($context->contextlevel == CONTEXT_MODULE) {
     $renderer = $PAGE->get_renderer('core', 'backup');
     echo $renderer->backup_files_viewer($treeview_options);
     echo $OUTPUT->container_end();
+    // Update the course context with the proper value, because $context contains the module context.
+    $coursecontext = \context_course::instance($course->id);
+} else {
+    $coursecontext = $context;
 }
 
 echo $OUTPUT->heading_with_help(get_string('choosefilefromcoursebackup', 'backup'), 'choosefilefromcoursebackup', 'backup');
 echo $OUTPUT->container_start();
 $treeview_options = array();
-$treeview_options['filecontext'] = $context;
+$treeview_options['filecontext'] = $coursecontext;
 $treeview_options['currentcontext'] = $context;
 $treeview_options['component']   = 'backup';
 $treeview_options['context']     = $context;