Moodle release 4.2.11

We are encountering Behat failures on MacOS and possibly Windows.

This reverts commit 3202109780.

.eslintrc

@@ -1,8 +1,12 @@
 {
   'plugins': [
-    'babel',
+    '@babel',
     'promise',
-    'jsdoc',
+    'jsdoc'
+  ],
+  'extends': [
+    'eslint:recommended',
+    'plugin:promise/recommended'
   ],
   'env': {
     'browser': true,
@@ -16,42 +20,19 @@
     'M': true,
     'Y': true
   },
+  // Warn about unused eslint-disable statements.
+  'reportUnusedDisableDirectives': true,
   'rules': {
     // See http://eslint.org/docs/rules/ for all rules and explanations of all
     // rules.
 
     // === Possible Errors ===
     'comma-dangle': 'off',
-    'no-compare-neg-zero': 'error',
-    'no-cond-assign': 'error',
     'no-console': 'error',
-    'no-constant-condition': 'error',
-    'no-control-regex': 'error',
-    'no-debugger': 'error',
-    'no-dupe-args': 'error',
-    'no-dupe-keys': 'error',
-    'no-duplicate-case': 'error',
     'no-empty': 'warn',
-    'no-empty-character-class': 'error',
-    'no-ex-assign': 'error',
-    'no-extra-boolean-cast': 'error',
     'no-extra-parens': 'off',
-    'no-extra-semi': 'error',
-    'no-func-assign': 'error',
-    'no-inner-declarations': 'error',
-    'no-invalid-regexp': 'error',
-    'no-irregular-whitespace': 'error',
-    'no-obj-calls': 'error',
     'no-prototype-builtins': 'off',
-    'no-regex-spaces': 'error',
-    'no-sparse-arrays': 'error',
-    'no-unexpected-multiline': 'error',
     'no-unreachable': 'warn',
-    'no-unsafe-finally': 'error',
-    'no-unsafe-negation': 'error',
-    'use-isnan': 'error',
-    'valid-jsdoc': ['warn', { 'requireReturn': false, 'requireParamDescription': false, 'requireReturnDescription': false }],
-    'valid-typeof': 'error',
 
     // === Best Practices ===
     // (these mostly match our jshint config)
@@ -63,15 +44,12 @@
     'dot-notation': 'warn',
     'no-alert': 'warn',
     'no-caller': 'error',
-    'no-case-declarations': 'error',
     'no-div-regex': 'error',
-    'no-empty-pattern': 'error',
     'no-empty-function': 'warn',
     'no-eq-null': 'error',
     'no-eval': 'error',
     'no-extend-native': 'error',
     'no-extra-bind': 'warn',
-    'no-fallthrough': 'error',
     'no-floating-decimal': 'warn',
     'no-global-assign': 'warn',
     'no-implied-eval': 'error',
@@ -83,28 +61,22 @@
     'no-multi-str': 'error',
     'no-new-func': 'error',
     'no-new-wrappers': 'error',
-    'no-octal': 'error',
     'no-octal-escape': 'error',
     'no-proto': 'error',
     'no-redeclare': 'warn',
     'no-restricted-globals': ['error', { 'name': 'Notification' }],
     'no-return-assign': 'error',
     'no-script-url': 'error',
-    'no-self-assign': 'error',
     'no-self-compare': 'error',
     'no-sequences': 'warn',
     'no-throw-literal': 'warn',
     'no-unmodified-loop-condition': 'error',
     'no-unused-expressions': 'error',
-    'no-unused-labels': 'error',
     'no-useless-call': 'warn',
     'no-useless-escape': 'warn',
-    'no-with': 'error',
     'wrap-iife': ['error', 'any'],
 
     // === Variables ===
-    'no-delete-var': 'error',
-    'no-undef': 'error',
     'no-undef-init': 'error',
     'no-unused-vars': ['error', { 'caughtErrors': 'none' }],
 
@@ -137,8 +109,6 @@
     'max-statements-per-line': ['warn', { max: 2 }],
     'new-cap': ['warn', { 'properties': false }],
     'new-parens': 'warn',
-    'newline-after-var': 'off',
-    'newline-before-return': 'off',
     'newline-per-chained-call': 'off',
     'no-array-constructor': 'off',
     'no-bitwise': 'error',
@@ -146,7 +116,6 @@
     'no-inline-comments': 'off',
     'no-lonely-if': 'off',
     'no-mixed-operators': 'off',
-    'no-mixed-spaces-and-tabs': 'error',
     'no-multiple-empty-lines': 'warn',
     'no-negated-condition': 'off',
     'no-nested-ternary': 'warn',
@@ -168,7 +137,6 @@
     'padded-blocks': 'off',
     'quote-props': ['warn', 'as-needed', {'unnecessary': false, 'keywords': true, 'numbers': true}],
     'quotes': 'off',
-    'require-jsdoc': 'warn',
     'semi': 'error',
     'semi-spacing': ['warn', {'before': false, 'after': true}],
     'sort-vars': 'off',
@@ -181,21 +149,19 @@
     'unicode-bom': 'error',
     'wrap-regex': 'off',
 
-    // === Promises ===
+    // === Promises (override plugin:promise/recommended) ===
     'promise/always-return': 'warn',
     'promise/no-return-wrap': 'warn',
     'promise/param-names': 'warn',
     'promise/catch-or-return': ['warn', {terminationMethod: ['catch', 'fail']}],
     'promise/no-native': 'warn',
-    'promise/no-promise-in-callback': 'warn',
-    'promise/no-callback-in-promise': 'warn',
     'promise/avoid-new': 'warn',
 
     // === Deprecations ===
     "no-restricted-properties": ['warn', {
         'object': 'M',
         'property': 'str',
-        'message': 'Use AMD module "core/str" or M.util.get_string()'
+        'message': 'Use "core/str" module or M.util.get_string()'
     }],
   },
   overrides: [
@@ -235,7 +201,6 @@
       parser: '@babel/eslint-parser',
       // Check AMD with some slightly stricter rules.
       rules: {
-        'no-unused-vars': 'error',
         'no-implicit-globals': 'error',
         // Disable all of the rules that have babel versions.
         'new-cap': 'off',
@@ -247,65 +212,37 @@
         'semi': 'off',
         'no-unused-expressions': 'off',
         // Enable all of the babel version of these rules.
-        'babel/new-cap': ['warn', { 'properties': false }],
+        '@babel/new-cap': ['warn', { 'properties': false }],
         // Not using this rule for the time being because it isn't
         // compatible with jQuery and ES6.
-        'babel/no-invalid-this': 'off',
-        'babel/object-curly-spacing': 'warn',
-        // This is off in the original style int.
-        'babel/quotes': 'off',
-        'babel/semi': 'error',
-        'babel/no-unused-expressions': 'error',
+        '@babel/no-invalid-this': 'off',
+        '@babel/object-curly-spacing': 'warn',
+        '@babel/semi': 'error',
+        '@babel/no-unused-expressions': 'error',
         // === Promises ===
         // We have Promise now that we're using ES6.
         'promise/no-native': 'off',
         'promise/avoid-new': 'off',
 
         // === JSDocs ===
-        "jsdoc/check-access": [
-          'error',
-        ],
-        "jsdoc/check-alignment": 1, // Recommended.
-        "jsdoc/check-param-names": [
-          'error',
-        ],
-        "jsdoc/check-property-names": [
-          'error',
-        ],
-        "jsdoc/empty-tags": [
-          'error',
-        ],
-        "jsdoc/implements-on-classes": [
-          'error',
-        ],
-        "jsdoc/multiline-blocks": [
-          'error',
-        ],
-        "jsdoc/require-jsdoc": [
-          'error',
-        ],
-        "jsdoc/require-param": [
-          'error',
-        ],
-        "jsdoc/require-param-name": [
-          'error',
-        ],
-        "jsdoc/require-param-type": [
-          'error',
-        ],
-        "jsdoc/require-property": [
-          'error',
-        ],
-        "jsdoc/require-property-name": [
-          'error',
-        ],
-        "jsdoc/require-property-type": [
-          'error',
-        ],
+        'jsdoc/check-access': 'error',
+        'jsdoc/check-alignment': 1, // Recommended.
+        'jsdoc/check-param-names': 'error',
+        'jsdoc/check-property-names': 'error',
+        'jsdoc/empty-tags': 'error',
+        'jsdoc/implements-on-classes': 'error',
+        'jsdoc/multiline-blocks': 'error',
+        'jsdoc/require-jsdoc': 'error',
+        'jsdoc/require-param': 'error',
+        'jsdoc/require-param-name': 'error',
+        'jsdoc/require-param-type': 'error',
+        'jsdoc/require-property': 'error',
+        'jsdoc/require-property-name': 'error',
+        'jsdoc/require-property-type': 'error'
       },
       parserOptions: {
         'sourceType': 'module',
-        'requireConfigFile': false,
+        'requireConfigFile': false
       }
     }
   ]

.github/workflows/push.yml

@@ -3,7 +3,7 @@ name: Core
 on:
   push:
     branches-ignore:
-      - master
+      - main
       - MOODLE_[0-9]+_STABLE
     tags-ignore:
       - v[0-9]+.[0-9]+.[0-9]+*

.grunt/tasks/javascript.js

@@ -21,7 +21,7 @@
  */
 
 /**
- * Function to generate the destination for the uglify task
+ * Function to generate the destination for the minification task
  * (e.g. build/file.min.js). This function will be passed to
  * the rename property of files array when building dynamically:
  * http://gruntjs.com/configuring-tasks#building-the-files-object-dynamically
@@ -60,7 +60,6 @@ module.exports = grunt => {
     grunt.registerTask('js', ['amd', 'yui']);
 
     // Register NPM tasks.
-    grunt.loadNpmTasks('grunt-contrib-uglify');
     grunt.loadNpmTasks('grunt-contrib-watch');
     grunt.loadNpmTasks('grunt-rollup');
 
@@ -104,6 +103,7 @@ module.exports = grunt => {
         // The queue runner will run the next `size` items in the queue.
         const runQueue = (size = 1) => {
             queue.splice(0, size).forEach(resolve => {
+                grunt.log.debug(`Item resolved. Kicking off next one.`);
                 resolve();
             });
         };
@@ -113,15 +113,17 @@ module.exports = grunt => {
 
             // The options hook is run in parallel.
             // We can return an unresolved Promise which is queued for later resolution.
-            options: async() => {
+            options: async(options) => {
                 return new Promise(resolve => {
                     queue.push(resolve);
                     startQueue();
+                    return options;
                 });
             },
 
             // When an item in the queue completes, start the next item in the queue.
-            buildEnd: () => {
+            generateBundle: (options, bundle) => {
+                grunt.log.debug(`Finished output phase for ${Object.keys(bundle).join(', ')}`);
                 runQueue();
             },
         };
@@ -151,24 +153,10 @@ module.exports = grunt => {
                             //
                             // It also adds the Moodle plugin name to the AMD module definition
                             // so that it can be imported as expected in other modules.
-                            path.resolve('.grunt/babel-plugin-add-module-to-define.js'),
-                            '@babel/plugin-syntax-dynamic-import',
-                            '@babel/plugin-syntax-import-meta',
-                            ['@babel/plugin-proposal-class-properties', {'loose': false}],
-                            '@babel/plugin-proposal-json-strings'
+                            path.resolve('.grunt/babel-plugin-add-module-to-define.js')
                         ],
                         presets: [
                             ['@babel/preset-env', {
-                                targets: {
-                                    browsers: [
-                                        ">0.3%",
-                                        "last 2 versions",
-                                        "not ie >= 0",
-                                        "not op_mini all",
-                                        "not Opera > 0",
-                                        "not dead"
-                                    ]
-                                },
                                 modules: false,
                                 useBuiltIns: false
                             }]

.grunt/tasks/jsdoc.js

@@ -20,17 +20,33 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 
-module.exports = grunt => {
-    // Project configuration.
-    grunt.config.merge({
-        jsdoc: {
-            dist: {
-                options: {
-                    configure: ".grunt/jsdoc/jsdoc.conf.js",
-                },
-            },
-        },
-    });
+module.exports = (grunt) => {
+    const path = require('path');
 
-    grunt.loadNpmTasks('grunt-jsdoc');
+    grunt.registerTask('jsdoc', 'Generate JavaScript documentation using jsdoc', function() {
+        const done = this.async();
+        const configuration = path.resolve('.grunt/jsdoc/jsdoc.conf.js');
+
+        grunt.util.spawn({
+            cmd: 'jsdoc',
+            args: [
+                '--configure',
+                configuration,
+            ]
+        }, function(error, result, code) {
+            if (result.stdout) {
+                grunt.log.write(result.stdout);
+            }
+
+            if (result.stderr) {
+                grunt.log.error(result.stderr);
+            }
+            if (error) {
+                grunt.fail.fatal(`JSDoc failed with error code ${code}`);
+            } else {
+                grunt.log.write('JSDoc completed successfully'.green);
+            }
+            done();
+        });
+    });
 };

.grunt/tasks/stylelint.js

@@ -29,6 +29,7 @@ module.exports = grunt => {
                     // Use a fully-qualified path.
                     src: files,
                     options: {
+                        quietDeprecationWarnings: true,
                         configOverrides: {
                             rules: {
                                 // These rules have to be disabled in .stylelintrc for scss compat.
@@ -45,7 +46,10 @@ module.exports = grunt => {
         return {
             stylelint: {
                 scss: {
-                    options: {syntax: 'scss'},
+                    options: {
+                        quietDeprecationWarnings: true,
+                        customSyntax: 'postcss-scss',
+                    },
                     src: files,
                 },
             },

.nvmrc

@@ -1 +1 @@
-lts/gallium
+lts/iron

.stylelintrc

@@ -1,9 +1,14 @@
 {
+    "customSyntax": "postcss-scss",
     "plugins": [
         "stylelint-csstree-validator"
     ],
     "rules": {
-        "csstree/validator": true,
+        "csstree/validator": {
+          "syntaxExtensions": [
+            "sass"
+          ]
+        },
         "at-rule-empty-line-before": [ "always",
           {"except": [ "blockless-after-blockless"], ignore: ["after-comment", "inside-block"]}
         ],
@@ -45,7 +50,7 @@
         "function-name-case": "lower",
         "function-parentheses-newline-inside": "always-multi-line",
         "function-parentheses-space-inside": "never-single-line",
-        "function-url-scheme-blacklist": ["data"],
+        "function-url-scheme-disallowed-list": ["data"],
         "function-whitespace-after": "always",
         "indentation": 4,
         "keyframe-declaration-no-important": true,
@@ -84,12 +89,19 @@
         "selector-type-no-unknown": true,
         "string-no-newline": true,
         "time-min-milliseconds": 100,
-        "unit-blacklist": ["pt"],
+        "unit-disallowed-list": ["pt"],
         "unit-case": "lower",
         "unit-no-unknown": true,
         "value-keyword-case": ["lower", {"ignoreKeywords": ["/(@|$)/"]}],
         "value-list-comma-newline-after": "always-multi-line",
         "value-list-comma-space-after": "always-single-line",
         "value-list-comma-space-before": "never",
-  }
+  },
+  "overrides": [
+    {
+      "files": ["**/yui/**/*.css"],
+      "rules": {
+      }
+    }
+  ]
 }

admin/classes/table/plugin_management_table.php

@@ -500,4 +500,15 @@ abstract class plugin_management_table extends flexible_table implements dynamic
     protected function supports_ordering(): bool {
         return $this->plugininfoclass::plugintype_supports_ordering();
     }
+
+    /**
+     * Check if the user has the capability to access this table.
+     *
+     * Default implementation for plugin management tables is to require 'moodle/site:config' capability
+     *
+     * @return bool Return true if capability check passed.
+     */
+    public function has_capability(): bool {
+        return has_capability('moodle/site:config', $this->get_context());
+    }
 }

admin/environment.xml

@@ -3923,6 +3923,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.2" requires="3.11.8">
@@ -3939,6 +3941,7 @@
       <VENDOR name="oracle" version="19" />
     </DATABASE>
     <PHP version="8.0.0" level="required">
+      <RESTRICT function="restrict_php_version_83" message="unsupportedphpversion83" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -4112,6 +4115,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.3" requires="3.11.8">
@@ -4128,6 +4133,7 @@
       <VENDOR name="oracle" version="19" />
     </DATABASE>
     <PHP version="8.0.0" level="required">
+      <RESTRICT function="restrict_php_version_83" message="unsupportedphpversion83" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -4303,6 +4309,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.4" requires="4.1.2">
@@ -4494,6 +4502,205 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_async_backup" level="recommended">
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="4.5" requires="4.1.2">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="10.6.7" />
+      <VENDOR name="mysql" version="8.0" />
+      <VENDOR name="postgres" version="13" />
+      <VENDOR name="mssql" version="14.0" />
+      <VENDOR name="oracle" version="19" />
+    </DATABASE>
+    <PHP version="8.1.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="mbstringrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+      <PHP_EXTENSION name="sodium" level="required"/>
+      <PHP_EXTENSION name="exif" level="optional"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_sixtyfour_bits" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="sixtyfourbitsrequired" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_max_input_vars" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_admin_dir_usage" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iscustomadminwarnings" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_async_backup" level="recommended">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/renderer.php

@@ -2051,8 +2051,10 @@ class core_admin_renderer extends plugin_renderer_base {
                         // We are checking installed & enabled things
                         if ($environment_result->getLevel() == 'required') {
                             $stringtouse = 'environmentrequirecustomcheck';
-                        } else {
+                        } else if ($environment_result->getLevel() == 'optional') {
                             $stringtouse = 'environmentrecommendcustomcheck';
+                        } else {
+                            $stringtouse = 'environmentshouldfixcustomcheck';
                         }
 
                     } else if ($environment_result->getPart() == 'php_setting') {
@@ -2083,7 +2085,8 @@ class core_admin_renderer extends plugin_renderer_base {
                         if ($status) {                                          //Handle ok result (ok)
                             $status = get_string('statusok');
                         } else {
-                            if ($environment_result->getLevel() == 'optional') {//Handle check result (warning)
+                            // Handle check result (warning).
+                            if (in_array($environment_result->getLevel(), ['optional', 'recommended'])) {
                                 $status = get_string('check');
                                 $warningline = true;
                             } else {                                            //Handle error result (error)

admin/roles/admins.php

@@ -38,6 +38,22 @@ if (!is_siteadmin()) {
 }
 
 $admisselector = new core_role_admins_existing_selector();
+
+if (array_key_exists('siteadmins', $CFG->config_php_settings)) {
+    echo $OUTPUT->header();
+    echo $OUTPUT->heading(get_string('manageadmins', 'core_role'), 3);
+    echo $OUTPUT->notification(get_string('siteadministratorsconfigphp', 'core_role'), \core\output\notification::NOTIFY_INFO);
+    echo $OUTPUT->box_start();
+    echo html_writer::tag(
+        'p',
+        get_string('existingadmins', 'core_role'),
+    );
+    $admisselector->display();
+    echo $OUTPUT->box_end();
+    echo $OUTPUT->footer();
+    die();
+}
+
 $potentialadmisselector = new core_role_admins_potential_selector();
 
 if ($addusersaction) {

admin/settings/h5p.php

@@ -41,4 +41,18 @@ if (!empty($defaulth5plib)) {
 
     $settings->add(new admin_settings_h5plib_handler_select('h5plibraryhandler', new lang_string('h5plibraryhandler', 'core_h5p'),
         new lang_string('h5plibraryhandler_help', 'core_h5p'), $defaulth5plib));
+
+    $setting = new admin_setting_configtextarea(
+        'core_h5p/h5pcustomcss',
+        new lang_string('h5pcustomcss', 'core_h5p'),
+        new lang_string('h5pcustomcss_help', 'core_h5p'),
+        '',
+        PARAM_NOTAGS
+    );
+    $setting->set_updatedcallback(function () {
+        // Enables use of file_storage constants.
+        \core_h5p\local\library\autoloader::register();
+        \core_h5p\file_storage::generate_custom_styles();
+    });
+    $settings->add($setting);
 }

admin/settings/security.php

@@ -152,7 +152,8 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
     $sensiblesettingsdefault .= 'server_password@@search_solr, ssl_keypassword@@search_solr, ';
     $sensiblesettingsdefault .= 'alternateserver_password@@search_solr, alternatessl_keypassword@@search_solr, ';
     $sensiblesettingsdefault .= 'test_password@@cachestore_redis, password@@mlbackend_python, ';
-    $sensiblesettingsdefault .= 'badges_badgesalt@@none, calendar_exportsalt@@none';
+    $sensiblesettingsdefault .= 'badges_badgesalt@@none, calendar_exportsalt@@none, ';
+    $sensiblesettingsdefault .= 'bigbluebuttonbn_shared_secret@@none';
     $temp->add(new admin_setting_configtextarea('adminpresets/sensiblesettings',
             get_string('sensiblesettings', 'core_adminpresets'),
             get_string('sensiblesettingstext', 'core_adminpresets'),

admin/tests/behat/browse_users.feature

@@ -18,7 +18,7 @@ Feature: An administrator can browse user accounts
     When I navigate to "Users > Accounts > Browse list of users" in site administration
     # Name field always present, email field is default for showidentity.
     Then the following should exist in the "users" table:
-      | First name / Last name | Email address   |
+      | First name           | Email address   |
       | User One             | one@example.com |
       | User Two             | two@example.com |
     # Should not see other identity fields or non-default name fields.
@@ -34,7 +34,7 @@ Feature: An administrator can browse user accounts
       | alternativefullnameformat | firstnamephonetic lastname |
     When I navigate to "Users > Accounts > Browse list of users" in site administration
     Then the following should exist in the "users" table:
-      | First name - phonetic / Last name | Email address   |
+      | First name - phonetic           | Email address   |
       | Yewzer One                      | one@example.com |
       | Yoozare Two                     | two@example.com |
 
@@ -43,7 +43,7 @@ Feature: An administrator can browse user accounts
       | showuseridentity | department,profile_field_frog |
     When I navigate to "Users > Accounts > Browse list of users" in site administration
     Then the following should exist in the "users" table:
-      | First name / Last name | Favourite frog  | Department |
+      | First name           | Favourite frog  | Department |
       | User One             | Kermit          | Attack     |
       | User Two             | Tree            | Defence    |
     And I should not see "Email address" in the "table" "css_element"

admin/tests/behat/task_logs.feature

@@ -48,25 +48,3 @@ Feature: View task logs report and use its filters
       | operator     | shouldornotsee |
       | Less than    | should not see |
       | Greater than | should see     |
-
-  @javascript
-  Scenario: Reset task log filters
-    Given I log in as "admin"
-    And I change window size to "large"
-    And I navigate to "Server > Tasks > Task logs" in site administration
-    When I click on "Filters" "button"
-    And I set the following fields in the "Result" "core_reportbuilder > Filter" to these values:
-      | Result operator | Is equal to |
-      | Result value    | Fail        |
-    And I click on "Apply" "button" in the "[data-region='report-filters']" "css_element"
-    Then I should see "Filters applied"
-    And I should see "Filters (1)" in the "#dropdownFiltersButton" "css_element"
-    And I should see "Nothing to display"
-    And I click on "Reset all" "button" in the "[data-region='report-filters']" "css_element"
-    And I should see "Filters reset"
-    And I should not see "Filters (1)" in the "#dropdownFiltersButton" "css_element"
-    And I should see "Filters" in the "#dropdownFiltersButton" "css_element"
-    And "[data-region='report-filters']" "css_element" should be visible
-    And the following fields in the "Result" "core_reportbuilder > Filter" match these values:
-      | Result operator | Is any value |
-    And I should not see "Nothing to display"

admin/tool/admin_presets/classes/local/action/delete.php

@@ -65,7 +65,7 @@ class delete extends base {
      * Delete the DB preset
      */
     public function execute(): void {
-        confirm_sesskey();
+        require_sesskey();
 
         $this->manager->delete_preset($this->id);
 

admin/tool/admin_presets/classes/local/action/export.php

@@ -52,8 +52,6 @@ class export extends base {
      * Stores a preset into the DB.
      */
     public function execute(): void {
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'export', 'mode' => 'execute']);
         $this->moodleform = new export_form($url);
 
@@ -87,7 +85,7 @@ class export extends base {
      * @throws xml_writer_exception
      */
     public function download_xml(): void {
-        confirm_sesskey();
+        require_sesskey();
 
         list($xmlstr, $filename) = $this->manager->download_preset($this->id);
 

admin/tool/admin_presets/classes/local/action/import.php

@@ -40,8 +40,6 @@ class import extends base {
      * Imports the xmlfile into DB
      */
     public function execute(): void {
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'import', 'mode' => 'execute']);
         $this->moodleform = new import_form($url);
 

admin/tool/admin_presets/classes/local/action/load.php

@@ -38,8 +38,6 @@ class load extends base {
     public function execute(): void {
         global $OUTPUT;
 
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'load', 'mode' => 'execute']);
         $this->moodleform = new load_form($url);
 

admin/tool/admin_presets/classes/local/action/rollback.php

@@ -73,7 +73,7 @@ class rollback extends base {
     public function execute(): void {
         global $OUTPUT;
 
-        confirm_sesskey();
+        require_sesskey();
 
         list($presetapp, $rollback, $failures) = $this->manager->revert_preset($this->id);
 

admin/tool/admin_presets/tests/behat/download.feature

@@ -5,16 +5,18 @@ Feature: I can download a preset
       | name       |
       | Custom preset |
 
-  @javascript
   Scenario: Custom preset settings can be downloaded
     Given I log in as "admin"
     And I navigate to "Site admin presets" in site administration
     When I open the action menu in "Custom preset" "table_row"
-    Then following "Download" "link" in the "Custom preset" "table_row" should download between "0" and "5000" bytes
+    Then following "Download" in the "Custom preset" "table_row" should download a file that:
+      | Has mimetype                 | text/xml      |
+      | Contains text in xml element | Custom preset |
 
-  @javascript
   Scenario: Core preset settings can be downloaded
     Given I log in as "admin"
     And I navigate to "Site admin presets" in site administration
     When I open the action menu in "Starter" "table_row"
-    Then following "Download" "link" in the "Starter" "table_row" should download between "0" and "5000" bytes
+    Then following "Download" in the "Starter" "table_row" should download a file that:
+      | Has mimetype                 | text/xml |
+      | Contains text in xml element | Starter  |

admin/tool/analytics/model.php

@@ -97,28 +97,28 @@ if ($onlycli === false) {
 switch ($action) {
 
     case 'enable':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->enable();
         redirect($returnurl);
         break;
 
     case 'disable':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->update(0, false, false);
         redirect($returnurl);
         break;
 
     case 'delete':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->delete();
         redirect($returnurl);
         break;
 
     case 'edit':
-        confirm_sesskey();
+        require_sesskey();
 
         $invalidcurrenttimesplitting = $model->invalid_timesplitting_selected();
         $potentialtimesplittings = $model->get_potential_timesplittings();
@@ -183,7 +183,7 @@ switch ($action) {
         break;
 
     case 'evaluate':
-        confirm_sesskey();
+        require_sesskey();
 
         if ($model->is_static()) {
             throw new moodle_exception('errornostaticevaluate', 'tool_analytics');
@@ -226,7 +226,7 @@ switch ($action) {
         break;
 
     case 'scheduledanalysis':
-        confirm_sesskey();
+        require_sesskey();
 
         if ($onlycli) {
             throw new moodle_exception('erroronlycli', 'tool_analytics');
@@ -292,7 +292,7 @@ switch ($action) {
         break;
 
     case 'clear':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->clear();
         redirect($returnurl);

admin/tool/dataprivacy/classes/data_request.php

@@ -155,9 +155,9 @@ class data_request extends persistent {
                 case api::DATAREQUEST_STATUS_EXPIRED:
                     $result = true;
                     break;
-                // Complete requests are expired if the expiry time has elapsed.
+                // Complete requests are expired if the expiry time is a positive value, and has elapsed.
                 case api::DATAREQUEST_STATUS_DOWNLOAD_READY:
-                    $expiryseconds = get_config('tool_dataprivacy', 'privacyrequestexpiry');
+                    $expiryseconds = (int) get_config('tool_dataprivacy', 'privacyrequestexpiry');
                     if ($expiryseconds > 0 && time() >= ($request->get('timemodified') + $expiryseconds)) {
                         $result = true;
                     }
@@ -178,7 +178,12 @@ class data_request extends persistent {
     public static function get_expired_requests($userid = 0) {
         global $DB;
 
-        $expiryseconds = get_config('tool_dataprivacy', 'privacyrequestexpiry');
+        // Complete requests are expired if the expiry time is a positive value, and has elapsed.
+        $expiryseconds = (int) get_config('tool_dataprivacy', 'privacyrequestexpiry');
+        if ($expiryseconds <= 0) {
+            return [];
+        }
+
         $expirytime = strtotime("-{$expiryseconds} second");
         $table = self::TABLE;
         $sqlwhere = 'type = :export_type AND status = :completestatus AND timemodified <= :expirytime';

admin/tool/dataprivacy/lang/en/tool_dataprivacy.php

@@ -45,7 +45,7 @@ $string['cachedef_purpose'] = 'Data purposes';
 $string['cachedef_purpose_overrides'] = 'Purpose overrides in the Data privacy tool';
 $string['cachedef_contextlevel'] = 'Context levels purpose and category';
 $string['cancelrequest'] = 'Cancel request';
-$string['cancelrequestconfirmation'] = 'Do you really want cancel this data request?';
+$string['cancelrequestconfirmation'] = 'Do you want to cancel this data request?';
 $string['cannotreset'] = 'Unable to reset this request. Only rejected requests can be reset.';
 $string['categories'] = 'Categories';
 $string['category'] = 'Category';

admin/tool/dataprivacy/tests/behat/datadelete.feature

@@ -54,6 +54,7 @@ Feature: Data delete from the privacy API
     And I should see "Awaiting approval" in the "Victim User 1" "table_row"
     And I open the action menu in "Victim User 1" "table_row"
     And I follow "Approve request"
+    And I wait until "Approve request" "button" exists
     And I press "Approve request"
     And I should see "Approved" in the "Victim User 1" "table_row"
     And I run all adhoc tasks
@@ -80,6 +81,7 @@ Feature: Data delete from the privacy API
     And I navigate to "Users > Privacy and policies > Data requests" in site administration
     And I open the action menu in "Victim User 1" "table_row"
     And I follow "Approve request"
+    And I wait until "Approve request" "button" exists
     And I press "Approve request"
 
     And I log out
@@ -115,6 +117,7 @@ Feature: Data delete from the privacy API
     And I navigate to "Users > Privacy and policies > Data requests" in site administration
     And I open the action menu in "Victim User 1" "table_row"
     And I follow "Approve request"
+    And I wait until "Approve request" "button" exists
     And I press "Approve request"
 
     And I log out

admin/tool/dataprivacy/tests/behat/dataexport.feature

@@ -48,13 +48,15 @@ Feature: Data export from the privacy API
     And I should see "Awaiting approval" in the "Victim User 1" "table_row"
     And I open the action menu in "Victim User 1" "table_row"
     And I follow "Approve request"
+    And I wait until "Approve request" "button" exists
     And I press "Approve request"
     And I should see "Approved" in the "Victim User 1" "table_row"
     And I run all adhoc tasks
     And I reload the page
     And I should see "Download ready" in the "Victim User 1" "table_row"
     And I open the action menu in "Victim User 1" "table_row"
-    And following "Download" should download between "1" and "200000" bytes
+    And following "Download" should download a file that:
+      | Contains file in zip | index.html |
     And the following config values are set as admin:
       | privacyrequestexpiry | 1 | tool_dataprivacy |
     And I wait "1" seconds
@@ -89,7 +91,8 @@ Feature: Data export from the privacy API
     And I reload the page
     And I should see "Download ready" in the "Export all of my personal data" "table_row"
     And I open the action menu in "Victim User 1" "table_row"
-    And following "Download" should download between "1" and "200000" bytes
+    And following "Download" should download a file that:
+      | Contains file in zip | index.html |
 
     And the following config values are set as admin:
       | privacyrequestexpiry | 1 | tool_dataprivacy |
@@ -115,6 +118,7 @@ Feature: Data export from the privacy API
     And I navigate to "Users > Privacy and policies > Data requests" in site administration
     And I open the action menu in "Victim User 1" "table_row"
     And I follow "Approve request"
+    And I wait until "Approve request" "button" exists
     And I press "Approve request"
 
     And I log out
@@ -126,7 +130,8 @@ Feature: Data export from the privacy API
     And I reload the page
     And I should see "Download ready" in the "Victim User 1" "table_row"
     And I open the action menu in "Victim User 1" "table_row"
-    And following "Download" should download between "1" and "200000" bytes
+    And following "Download" should download a file that:
+      | Contains file in zip | index.html |
 
     And the following config values are set as admin:
       | privacyrequestexpiry | 1 | tool_dataprivacy |

admin/tool/dataprivacy/tests/expired_data_requests_test.php

@@ -26,10 +26,11 @@ require_once('data_privacy_testcase.php');
  * Expired data requests tests.
  *
  * @package    tool_dataprivacy
+ * @covers     \tool_dataprivacy\data_request
  * @copyright  2018 Michael Hawkins
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
-class expired_data_requests_test extends data_privacy_testcase {
+final class expired_data_requests_test extends data_privacy_testcase {
 
     /**
      * Test tearDown.
@@ -107,6 +108,52 @@ class expired_data_requests_test extends data_privacy_testcase {
         $this->assertEquals(0, $DB->count_records('files', $fileconditions));
     }
 
+    /**
+     * Test that data requests are not expired when expiration is disabled (set to zero)
+     */
+    public function test_data_request_expiry_never(): void {
+        global $DB;
+
+        $this->resetAfterTest();
+
+        \core_privacy\local\request\writer::setup_real_writer_instance();
+
+        // Disable request expiry.
+        set_config('privacyrequestexpiry', 0, 'tool_dataprivacy');
+
+        // Create and approve data request.
+        $user = $this->getDataGenerator()->create_user();
+        $usercontext = \context_user::instance($user->id);
+
+        $this->setUser($user->id);
+        $datarequest = api::create_data_request($user->id, api::DATAREQUEST_TYPE_EXPORT);
+        $requestid = $datarequest->get('id');
+
+        $this->setAdminUser();
+        api::approve_data_request($requestid);
+
+        ob_start();
+        $this->runAdhocTasks('\tool_dataprivacy\task\process_data_request_task');
+        ob_end_clean();
+
+        // Run expiry deletion - should not affect test export.
+        $expiredrequests = data_request::get_expired_requests();
+        $this->assertEmpty($expiredrequests);
+        data_request::expire($expiredrequests);
+
+        // Confirm approved and exported.
+        $request = new data_request($requestid);
+        $this->assertEquals(api::DATAREQUEST_STATUS_DOWNLOAD_READY, $request->get('status'));
+        $fileconditions = [
+            'userid' => $user->id,
+            'component' => 'tool_dataprivacy',
+            'filearea' => 'export',
+            'itemid' => $requestid,
+            'contextid' => $usercontext->id,
+        ];
+        $this->assertEquals(2, $DB->count_records('files', $fileconditions));
+    }
+
     /**
      * Test for \tool_dataprivacy\data_request::is_expired()
      * Tests for the expected request status to protect from false positive/negative,

admin/tool/licensemanager/tests/behat/delete_license.feature

@@ -37,8 +37,8 @@ Feature: Delete custom licenses
       | Licence version | ##1 March 2019##                    |
     And I press "Save changes"
     And I follow "Private files" in the user menu
-    And I upload "lib/editor/atto/tests/fixtures/moodle-logo.png" file to "Files" filemanager
-    And I click on "moodle-logo.png" "link"
+    And I upload "lib/tests/fixtures/gd-logo.png" file to "Files" filemanager
+    And I click on "gd-logo.png" "link"
     And I set the field "Choose licence" to "Test licence"
     And I press "Update"
     And I press "Save changes"

admin/tool/log/tests/behat/logstore_store_visibility_change.feature

@@ -14,6 +14,6 @@ Feature: In a report, admin can see logstore visibility changes
     And I click on "Enable" "icon" in the "External database log" "table_row"
     And I navigate to "Reports > Config changes" in site administration
     Then the following should exist in the "reportbuilder-table" table:
-      | User       | Plugin               | Setting                  | New value | Original value |
+      | First name | Plugin               | Setting                  | New value | Original value |
       | Admin User | logstore_standard    | tool_logstore_visibility | 0         | 1              |
       | Admin User | logstore_database    | tool_logstore_visibility | 1         | 0              |

admin/tool/lp/amd/src/competency_rule.js

@@ -71,14 +71,12 @@ define(['jquery'], function($) {
         return null;
     };
 
-    // eslint-disable-line valid-jsdoc
     /**
      * Return the type of the module.
      *
      * @return {String}
      * @method getType
      */
-    // eslint-enable-line valid-jsdoc
     Rule.prototype.getType = function() {
         throw new Error('Not implemented');
     };

admin/tool/lp/classes/output/manage_competency_frameworks_page.php

@@ -75,7 +75,7 @@ class manage_competency_frameworks_page implements renderable, templatable {
             );
             $this->navigation[] = $addpage;
             $competenciesrepository = new single_button(
-                new moodle_url('https://archive.moodle.net/competencies'),
+                new moodle_url('https://moodle.net/search', ['q' => 'competency frameworks']),
                 get_string('competencyframeworksrepository', 'tool_lp'),
                 'get'
             );

admin/tool/lp/templates/form-user-selector-suggestion.mustache

@@ -49,7 +49,7 @@
     }
 }}
 <span>
-    <img height="12" src="{{profileimageurlsmall}}" alt="" role="presentation">
+    <img height="12" src="{{profileimageurlsmall}}" alt="">
     <span>{{fullname}}</span>
     {{#hasidentity}}
     <span><small>{{identity}}</small></span>

admin/tool/lp/templates/user_competency_summary_in_course.mustache

@@ -49,7 +49,7 @@
         <p>
         <ul class="inline list-inline">
         {{#coursemodules}}
-            <li class="list-inline-item"><a href="{{url}}"><img class="icon" src="{{iconurl}}"> {{name}} </a></li>
+            <li class="list-inline-item"><a href="{{url}}"><img class="icon" src="{{iconurl}}" alt=""> {{name}} </a></li>
         {{/coursemodules}}
         {{^coursemodules}}
             <li class="list-inline-item"><span class="alert">{{#str}}noactivities, tool_lp{{/str}}</span></li>

admin/tool/lp/templates/user_summary.mustache

@@ -50,7 +50,7 @@
 }}
 <span>
     <a href="{{profileurl}}" title="{{#str}}viewprofile{{/str}}">
-    <img height="18" src="{{profileimageurlsmall}}" alt="" role="presentation">
+    <img height="18" src="{{profileimageurlsmall}}" alt="">
     <span>{{fullname}}</span>
     {{#hasidentity}}
     <span><small>{{identity}}</small></span>

admin/tool/mobile/classes/api.php

@@ -369,6 +369,14 @@ class api {
             $settings->forcetimezone = $CFG->forcetimezone;
         }
 
+        if (empty($section) || $section === 'h5psettings') {
+            \core_h5p\local\library\autoloader::register();
+            $customcss = \core_h5p\file_storage::get_custom_styles();
+            if (!empty($customcss)) {
+                $settings->h5pcustomcssurl = $customcss['cssurl']->out() . '?ver=' . $customcss['cssversion'];
+            }
+        }
+
         return $settings;
     }
 
@@ -424,13 +432,13 @@ class api {
     public static function get_qrlogin_key(stdClass $mobilesettings) {
         global $USER;
         // Delete previous keys.
-        delete_user_key('tool_mobile', $USER->id);
+        delete_user_key('tool_mobile/qrlogin', $USER->id);
 
         // Create a new key.
         $iprestriction = !empty($mobilesettings->qrsameipcheck) ? getremoteaddr(null) : null;
         $qrkeyttl = !empty($mobilesettings->qrkeyttl) ? $mobilesettings->qrkeyttl : self::LOGIN_QR_KEY_TTL;
         $validuntil = time() + $qrkeyttl;
-        return create_user_key('tool_mobile', $USER->id, null, $iprestriction, $validuntil);
+        return create_user_key('tool_mobile/qrlogin', $USER->id, null, $iprestriction, $validuntil);
     }
 
     /**

admin/tool/mobile/classes/event_handler.php

@@ -0,0 +1,45 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_mobile;
+
+use core\session\utility\cookie_helper;
+use core\event\user_loggedin;
+
+/**
+ * Event handler for tool_mobile.
+ *
+ * @package    tool_mobile
+ * @copyright  2024 Juan Leyva
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class event_handler {
+
+    /**
+     * Allows the plugin to augment Set-Cookie headers when the user_loggedin event is fired as part of complete_user_login() calls.
+     *
+     * @param user_loggedin $event the event
+     * @return void
+     */
+    public static function handle_user_loggedin(user_loggedin $event): void {
+        global $CFG;
+
+        // Set Partitioned and Secure attributes to the MoodleSession cookie if the user is using the Moodle app.
+        if (\core_useragent::is_moodle_app()) {
+            cookie_helper::add_attributes_to_cookie_response_header('MoodleSession'.$CFG->sessioncookie, ['Secure', 'Partitioned']);
+        }
+    }
+}

admin/tool/mobile/classes/external.php

@@ -648,8 +648,8 @@ class external extends external_api {
         api::check_autologin_prerequisites($params['userid']);  // Checks https, avoid site admins using this...
 
         // Validate and delete the key.
-        $key = validate_user_key($params['qrloginkey'], 'tool_mobile', null);
-        delete_user_key('tool_mobile', $params['userid']);
+        $key = validate_user_key($params['qrloginkey'], 'tool_mobile/qrlogin', null);
+        delete_user_key('tool_mobile/qrlogin', $params['userid']);
 
         // Double check key belong to user.
         if ($key->userid != $params['userid']) {

admin/tool/mobile/classes/privacy/provider.php

@@ -66,7 +66,7 @@ class provider implements
                   FROM {user_private_key} k
                   JOIN {user} u ON k.userid = u.id
                   JOIN {context} ctx ON ctx.instanceid = u.id AND ctx.contextlevel = :contextlevel
-                 WHERE k.userid = :userid AND k.script = 'tool_mobile'";
+                 WHERE k.userid = :userid AND (k.script = 'tool_mobile' OR k.script = 'tool_mobile/qrlogin')";
         $params = ['userid' => $userid, 'contextlevel' => CONTEXT_USER];
         $contextlist = new contextlist();
         $contextlist->add_from_sql($sql, $params);
@@ -88,6 +88,7 @@ class provider implements
 
         // Add users based on userkey.
         \core_userkey\privacy\provider::get_user_contexts_with_script($userlist, $context, 'tool_mobile');
+        \core_userkey\privacy\provider::get_user_contexts_with_script($userlist, $context, 'tool_mobile/qrlogin');
     }
 
     /**
@@ -108,6 +109,7 @@ class provider implements
         }
         // Export associated userkeys.
         \core_userkey\privacy\provider::export_userkeys($context, [], 'tool_mobile');
+        \core_userkey\privacy\provider::export_userkeys($context, [], 'tool_mobile/qrlogin');
     }
     /**
      * Export all user preferences for the plugin.
@@ -138,6 +140,7 @@ class provider implements
         $userid = $context->instanceid;
         // Delete all the userkeys.
         \core_userkey\privacy\provider::delete_userkeys('tool_mobile', $userid);
+        \core_userkey\privacy\provider::delete_userkeys('tool_mobile/qrlogin', $userid);
     }
     /**
      * Delete all user data for the specified user, in the specified contexts.
@@ -158,6 +161,7 @@ class provider implements
         $userid = $context->instanceid;
         // Delete all the userkeys.
         \core_userkey\privacy\provider::delete_userkeys('tool_mobile', $userid);
+        \core_userkey\privacy\provider::delete_userkeys('tool_mobile/qrlogin', $userid);
     }
 
     /**
@@ -178,5 +182,6 @@ class provider implements
 
         // Delete all the userkeys.
         \core_userkey\privacy\provider::delete_userkeys('tool_mobile', $userid);
+        \core_userkey\privacy\provider::delete_userkeys('tool_mobile/qrlogin', $userid);
     }
 }

admin/tool/mobile/db/events.php

@@ -0,0 +1,33 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * tool_mobile plugin event handler definition.
+ *
+ * @package tool_mobile
+ * @category event
+ * @copyright 2024 Juan Leyva
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$observers = [
+    [
+        'eventname' => '\core\event\user_loggedin',
+        'callback' => '\tool_mobile\event_handler::handle_user_loggedin',
+    ],
+];

admin/tool/mobile/launch.php

@@ -69,6 +69,14 @@ if (empty($service)) {
     throw new moodle_exception('servicenotavailable', 'webservice');
 }
 
+// If the user is using the inapp (embedded) browser, we need to set the Secure and Partitioned attributes to the session cookie.
+if (\core_useragent::is_moodle_app()) {
+    \core\session\utility\cookie_helper::add_attributes_to_cookie_response_header(
+        cookiename: "MoodleSession{$CFG->sessioncookie}",
+        attributes: ['Secure', 'Partitioned'],
+    );
+}
+
 require_login(0, false);
 
 // Require an active user: not guest, not suspended.

admin/tool/mobile/lib.php

@@ -265,3 +265,16 @@ function tool_mobile_pre_processor_message_send($procname, $data) {
         $data->fullmessagehtml .= html_writer::tag('p', get_string('readingthisemailgettheapp', 'tool_mobile', $url->out()));
     }
 }
+
+/**
+ * Callback to add headers before the HTTP headers are sent.
+ *
+ */
+function tool_mobile_before_http_headers() {
+    global $CFG;
+
+    // Set Partitioned and Secure attributes to the MoodleSession cookie if the user is using the Moodle app.
+    if (\core_useragent::is_moodle_app()) {
+        \core\session\utility\cookie_helper::add_attributes_to_cookie_response_header('MoodleSession'.$CFG->sessioncookie, ['Secure', 'Partitioned']);
+    }
+}

admin/tool/mobile/tests/externallib_test.php

@@ -260,6 +260,18 @@ class externallib_test extends externallib_advanced_testcase {
         $this->assertCount(0, $result['warnings']);
         $this->assertEquals($expected, $result['settings']);
 
+        // H5P custom CSS.
+        set_config('h5pcustomcss', '.debug { color: #fab; }', 'core_h5p');
+        \core_h5p\local\library\autoloader::register();
+        \core_h5p\file_storage::generate_custom_styles();
+        $result = external::get_config();
+        $result = external_api::clean_returnvalue(external::get_config_returns(), $result);
+
+        $customcss = \core_h5p\file_storage::get_custom_styles();
+        $expected[] = ['name' => 'h5pcustomcssurl', 'value' => $customcss['cssurl']->out() . '?ver=' . $customcss['cssversion']];
+        $this->assertCount(0, $result['warnings']);
+        $this->assertEquals($expected, $result['settings']);
+
         // Change a value and retrieve filtering by section.
         set_config('commentsperpage', 1);
         $expected[10]['value'] = 1;

admin/tool/mobile/tests/privacy/provider_test.php

@@ -87,7 +87,8 @@ class provider_test extends \core_privacy\tests\provider_testcase {
         $context1 = \context_user::instance($user1->id);
         $context2 = \context_user::instance($user2->id);
         $key1 = get_user_key('tool_mobile', $user1->id);
-        $key2 = get_user_key('tool_mobile', $user2->id);
+        $key2 = get_user_key('tool_mobile/qrlogin', $user1->id);
+        $key3 = get_user_key('tool_mobile', $user2->id);
 
         // Ensure only user1 is found in context1.
         $userlist = new \core_privacy\local\request\userlist($context1, $component);
@@ -175,12 +176,15 @@ class provider_test extends \core_privacy\tests\provider_testcase {
         $context1 = \context_user::instance($user1->id);
         $context2 = \context_user::instance($user2->id);
         $keyvalue1 = get_user_key('tool_mobile', $user1->id);
-        $keyvalue2 = get_user_key('tool_mobile', $user2->id);
+        $keyvalue2 = get_user_key('tool_mobile/qrlogin', $user1->id);
+        $keyvalue3 = get_user_key('tool_mobile', $user2->id);
         $key1 = $DB->get_record('user_private_key', ['value' => $keyvalue1]);
 
-        // Before deletion, we should have 2 user_private_keys.
+        // Before deletion, we should have 2 user_private_keys for tool_mobile and one for tool_mobile/qrlogin.
         $count = $DB->count_records('user_private_key', ['script' => 'tool_mobile']);
         $this->assertEquals(2, $count);
+        $count = $DB->count_records('user_private_key', ['script' => 'tool_mobile/qrlogin']);
+        $this->assertEquals(1, $count);
 
         // Ensure deleting wrong user in the user context does nothing.
         $approveduserids = [$user2->id];
@@ -198,6 +202,8 @@ class provider_test extends \core_privacy\tests\provider_testcase {
         // Ensure only user1's data is deleted, user2's remains.
         $count = $DB->count_records('user_private_key', ['script' => 'tool_mobile']);
         $this->assertEquals(1, $count);
+        $count = $DB->count_records('user_private_key', ['script' => 'tool_mobile/qrlogin']);
+        $this->assertEquals(0, $count);
 
         $params = ['script' => $component];
         $userid = $DB->get_field_select('user_private_key', 'userid', 'script = :script', $params);

admin/tool/mobile/version.php

@@ -23,7 +23,7 @@
  */
 
 defined('MOODLE_INTERNAL') || die();
-$plugin->version   = 2023042400; // The current plugin version (Date: YYYYMMDDXX).
+$plugin->version   = 2023042401; // The current plugin version (Date: YYYYMMDDXX).
 $plugin->requires  = 2023041800; // Requires this Moodle version.
 $plugin->component = 'tool_mobile'; // Full name of the plugin (used for diagnostics).
 $plugin->dependencies = array(

admin/tool/moodlenet/amd/src/instance_form.js

@@ -121,7 +121,6 @@ define(['tool_moodlenet/validator',
         });
         // Trigger the transition between 'pages'.
         carousel.carousel(2);
-        // eslint-disable-next-line max-len
         modal.setFooter(Templates.render('tool_moodlenet/chooser_footer_close_mnet', {}));
     };
 

admin/tool/moodlenet/index.php

@@ -63,7 +63,7 @@ if ($cancel) {
     }
     redirect($url);
 } else if ($continue) {
-    confirm_sesskey();
+    require_sesskey();
 
     // Handle backups.
     if (strtolower($importinfo->get_resource()->get_extension()) == 'mbz') {

admin/tool/moodlenet/options.php

@@ -81,7 +81,7 @@ switch ($config->type) {
 }
 
 if ($import && $module) {
-    confirm_sesskey();
+    require_sesskey();
 
     $handlerinfo = $handlerregistry->get_resource_handler_for_mod_and_strategy($importinfo->get_resource(), $module, $strategy);
     if (is_null($handlerinfo)) {

admin/tool/policy/tests/behat/acceptances.feature

@@ -170,6 +170,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "Actions" "link_or_button" in the "This privacy policy" "table_row"
     And I click on "Set status to \"Active\"" "link" in the "This privacy policy" "table_row"
+    And I wait until "Activate" "button" exists
     And I press "Activate"
     And I log out
     When I log in as "manager"
@@ -260,6 +261,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "Actions" "link_or_button" in the "This privacy policy" "table_row"
     And I click on "Set status to \"Active\"" "link" in the "This privacy policy" "table_row"
+    And I wait until "Activate" "button" exists
     And I press "Activate"
     And I log out
     When I log in as "manager"

admin/tool/task/tests/behat/manage_tasks.feature

@@ -62,8 +62,8 @@ Feature: Manage scheduled tasks
     And I press "Save changes"
     Then I should see "Changes saved"
     And the following should not exist in the "admintable" table:
-      | Name               | Component    | Minute | Hour | Day | Day of week | Month |
-      | Log table cleanup  | Standard log | */5    | 1    | 2   | 4           | 3     |
+      | Name               | Minute | Hour | Day | Day of week | Month |
+      | Log table cleanup  | */5    | 1    | 2   | 4           | 3     |
     And I should see "Log table cleanup" in the "tr.table-primary" "css_element"
 
   Scenario: Disabled plugin's tasks are labelled as disabled too

admin/tool/uploaduser/classes/process.php

@@ -688,6 +688,17 @@ class process {
                 break;
 
             case UU_USER_ADD_UPDATE:
+                if ($this->get_match_on_email()) {
+                    if ($usersbyname = $DB->get_records('user', ['username' => $user->username])) {
+                        foreach ($usersbyname as $userbyname) {
+                            if (strtolower($userbyname->email) != strtolower($user->email)) {
+                                $this->usersskipped++;
+                                $this->upt->track('status', get_string('usernotaddedusernameexists', 'error'), 'warning');
+                                $skip = true;
+                            }
+                        }
+                    }
+                }
                 break;
 
             case UU_USER_UPDATE:

admin/tool/uploaduser/lang/en/tool_uploaduser.php

@@ -50,7 +50,7 @@ The example text file may also be used for testing, as you are able to preview u
 $string['infoprefix'] = 'Info:';
 $string['invalidupdatetype'] = 'This option cannot be selected with the chosen upload type.';
 $string['invaliduserdata'] = 'Invalid data detected for user {$a} and it has been automatically cleaned.';
-$string['invaliduserdatavalues'] = 'Invalid data detected for user \'{$a->username}\' ({$a->values}), which has been automatically cleaned.';
+$string['invaliduserdatavalues'] = 'Incorrect data ({$a->values}) found for user {$a->username}. This data has been corrected or deleted.';
 $string['invalidtheme'] = 'Theme "{$a}" is not installed and will be ignored.';
 $string['linex'] = 'Line {$a}';
 $string['matchemail'] = 'Match on email address';

admin/tool/uploaduser/tests/behat/upload_users.feature

@@ -296,3 +296,25 @@ Feature: Upload users
     And I navigate to "Users > Accounts > Browse list of users" in site administration
     And I should see "Bilbo Baggins"
     And I should not see "Frodo Baggins"
+
+  @javascript
+  Scenario: Create a new user when matching them on email where where the username already exists
+    Given the following "users" exist:
+      | username | firstname | lastname | email               |
+      | bilbob   | Samwise   | Gamgee   | samwise@example.com |
+      | frodob   | Frodeo    | Baspins  | frodo@example.com   |
+    And I log in as "admin"
+    And I navigate to "Users > Accounts > Upload users" in site administration
+    When I upload "lib/tests/fixtures/upload_users_email_matching.csv" file to "File" filemanager
+    And I press "Upload users"
+    Then I should see "Upload users preview"
+    And I set the following fields to these values:
+      | Upload type            | Add new and update existing users |
+      | Existing user details  | Override with file                |
+      | Match on email address | Yes                               |
+    And I press "Upload users"
+    And I should see "User not added - username already exists under a different email"
+    And I press "Continue"
+    And I navigate to "Users > Accounts > Browse list of users" in site administration
+    And I should see "Samwise Gamgee"
+    And I should see "Frodo Baggins"

admin/tool/uploaduser/tests/upload_users_test.php

@@ -202,8 +202,8 @@ EOF;
 
         // We should get the debugging from the user class itself, as well as warning in the output regarding the same.
         $this->assertDebuggingCalled('The property \'country\' has invalid data and has been cleaned.');
-        $this->assertStringContainsString('Invalid data detected for user \'student1\' (country), ' .
-            'which has been automatically cleaned.', $output);
+        $this->assertStringContainsString('Incorrect data (country) found for user student1. ' .
+            'This data has been corrected or deleted.', $output);
     }
 
     /**

admin/tool/usertours/amd/src/tour.js

@@ -36,6 +36,7 @@ import {dispatchEvent} from 'core/event_dispatcher';
 import {eventTypes} from './events';
 import {get_string as getString} from 'core/str';
 import {prefetchStrings} from 'core/prefetch';
+import PendingPromise from 'core/pending';
 
 /**
  * The minimum spacing for tour step to display.
@@ -485,14 +486,22 @@ const Tour = class {
             return this.endTour();
         }
 
+        const pendingPromise = new PendingPromise(`tool_usertours/tour:_gotoStep-${stepConfig.stepNumber}`);
+
         if (typeof stepConfig.delay !== 'undefined' && stepConfig.delay && !stepConfig.delayed) {
             stepConfig.delayed = true;
-            window.setTimeout(this._gotoStep.bind(this), stepConfig.delay, stepConfig, direction);
+            window.setTimeout(function(stepConfig, direction) {
+                this._gotoStep(stepConfig, direction);
+                pendingPromise.resolve();
+            }, stepConfig.delay, stepConfig, direction);
 
             return this;
         } else if (!stepConfig.orphan && !this.isStepActuallyVisible(stepConfig)) {
-            let fn = direction == -1 ? 'getPreviousStepNumber' : 'getNextStepNumber';
-            return this.gotoStep(this[fn](stepConfig.stepNumber), direction);
+            const fn = direction == -1 ? 'getPreviousStepNumber' : 'getNextStepNumber';
+            this.gotoStep(this[fn](stepConfig.stepNumber), direction);
+
+            pendingPromise.resolve();
+            return this;
         }
 
         this.hide();
@@ -503,6 +512,7 @@ const Tour = class {
             this.dispatchEvent(eventTypes.stepRendered, {stepConfig});
         }
 
+        pendingPromise.resolve();
         return this;
     }
 
@@ -820,12 +830,14 @@ const Tour = class {
                 left: 0,
             });
 
+            const pendingPromise = new PendingPromise(`tool_usertours/tour:addStepToPage-${stepConfig.stepNumber}`);
             animationTarget
                 .animate({
                     scrollTop: this.calculateScrollTop(stepConfig),
                 }).promise().then(function() {
                         this.positionStep(stepConfig);
                         this.revealStep(stepConfig);
+                        pendingPromise.resolve();
                         return;
                     }.bind(this))
                     .catch(function() {
@@ -897,6 +909,7 @@ const Tour = class {
      */
     revealStep(stepConfig) {
         // Fade the step in.
+        const pendingPromise = new PendingPromise(`tool_usertours/tour:revealStep-${stepConfig.stepNumber}`);
         this.currentStepNode.fadeIn('', $.proxy(function() {
                 // Announce via ARIA.
                 this.announceStep(stepConfig);
@@ -910,6 +923,7 @@ const Tour = class {
                     if (this.currentStepNode) {
                         this.currentStepNode.focus();
                     }
+                    pendingPromise.resolve();
                 }, this), 100);
 
             }, this));
@@ -1157,6 +1171,7 @@ const Tour = class {
             return this;
         }
 
+        const pendingPromise = new PendingPromise('tool_usertours/tour:hide');
         if (this.currentStepNode && this.currentStepNode.length) {
             this.currentStepNode.hide();
             if (this.currentStepPopper) {
@@ -1191,17 +1206,22 @@ const Tour = class {
             this.currentStepConfig = null;
         }
 
-        let fadeTime = 0;
-        if (transition) {
-            fadeTime = 400;
-        }
-
         // Remove the backdrop features.
         $('[data-flexitour="step-background"]').remove();
         $('[data-flexitour="step-backdrop"]').removeAttr('data-flexitour');
-        $('[data-flexitour="backdrop"]').fadeOut(fadeTime, function() {
-            $(this).remove();
-        });
+
+        const backdrop = $('[data-flexitour="backdrop"]');
+        if (backdrop.length) {
+            if (transition) {
+                const backdropRemovalPromise = new PendingPromise('tool_usertours/tour:hide:backdrop');
+                backdrop.fadeOut(400, function() {
+                    $(this).remove();
+                    backdropRemovalPromise.resolve();
+                });
+            } else {
+                backdrop.remove();
+            }
+        }
 
         // Remove aria-describedby and tabindex attributes.
         if (this.currentStepNode && this.currentStepNode.length) {
@@ -1222,6 +1242,8 @@ const Tour = class {
 
         this.currentStepNode = null;
         this.currentStepPopper = null;
+
+        pendingPromise.resolve();
         return this;
     }
 

admin/tool/usertours/classes/manager.php

@@ -283,7 +283,7 @@ class manager {
                 'title' => get_string('importtour', 'tool_usertours'),
             ],
             (object) [
-                'link'  => new \moodle_url('https://archive.moodle.net/tours'),
+                'link'  => new \moodle_url('https://moodle.net/search', ['q' => 'user tours']),
                 'linkproperties' => [
                         'target' => '_blank',
                     ],

admin/tool/usertours/tests/behat/tour_content_type.feature

@@ -25,6 +25,7 @@ Feature: Apply content type to a tour
     Then "Content type" "select" should exist
     And the "Content type" select box should contain "Language string ID"
     And the "Content type" select box should contain "Manual"
+    And I change window size to "large"
     And I select "Language string ID" from the "Content type" singleselect
     And I should see " Language string ID"
     And "#fgroup_id_contenthtmlgrp" "css_element" should not be visible
@@ -38,6 +39,7 @@ Feature: Apply content type to a tour
     And I click on "View" "link" in the "My first tour" "table_row"
     And I click on "New step" "link"
     And I set the field "Title" to "tour_activityinfo_course_teacher_title,tool_usertours"
+    And I change window size to "large"
     And I select "Language string ID" from the "Content type" singleselect
     And I set the field "Language string ID" to "tour_activityinfo_course_teacher_content_abc,tool_usertours"
     When I press "Save changes"

admin/tool/xmldb/actions/edit_field_save/edit_field_save.class.php

@@ -91,12 +91,12 @@ class edit_field_save extends XMLDBAction {
         $comment = trim($comment);
 
         $type       = required_param('type', PARAM_INT);
-        $length     = strtolower(optional_param('length', NULL, PARAM_ALPHANUM));
+        $length     = optional_param('length', null, PARAM_INT);
         $decimals   = optional_param('decimals', NULL, PARAM_INT);
         $notnull    = optional_param('notnull', false, PARAM_BOOL);
         $sequence   = optional_param('sequence', false, PARAM_BOOL);
         $default    = optional_param('default', NULL, PARAM_PATH);
-        $default    = trim($default);
+        $default    = is_null($default) ? $default : trim($default);
 
         $editeddir = $XMLDB->editeddirs[$dirpath];
         $structure = $editeddir->xml_file->getStructure();

admin/tool/xmldb/actions/new_table_from_mysql/new_table_from_mysql.class.php

@@ -36,6 +36,11 @@ class new_table_from_mysql extends XMLDBAction {
     function init() {
         parent::init();
 
+        global $DB;
+        if ($DB->get_dbfamily() !== 'mysql') {
+            throw new moodle_exception('DB family not supported');
+        }
+
         // Set own custom attributes
 
         // Get needed strings
@@ -55,8 +60,6 @@ class new_table_from_mysql extends XMLDBAction {
     function invoke() {
         parent::invoke();
 
-        $result = true;
-
         // Set own core attributes
         $this->does_generate = ACTION_GENERATE_HTML;
 
@@ -125,11 +128,15 @@ class new_table_from_mysql extends XMLDBAction {
         // If table, retrofit information and, if everything works,
         // go to the table edit action
         } else {
-            // Get some params (table is mandatory here)
-            $tableparam = required_param('table', PARAM_CLEAN);
-            $afterparam = required_param('after', PARAM_CLEAN);
+            // Get some params (table is mandatory here).
+            $tableparam = required_param('table', PARAM_ALPHANUMEXT);
+            $afterparam = required_param('after', PARAM_ALPHANUMEXT);
 
-            // Create one new xmldb_table
+            if (empty($tableparam) || empty($afterparam)) {
+                throw new moodle_exception('Invalid param value detected.');
+            }
+
+            // Create one new xmldb_table.
             $table = new xmldb_table(strtolower(trim($tableparam)));
             $table->setComment($table->getName() . ' table retrofitted from MySQL');
             // Get fields info from ADODb
@@ -147,7 +154,6 @@ class new_table_from_mysql extends XMLDBAction {
             // Get PK, UK and indexes info from ADODb
             $dbindexes = $DB->get_indexes($tableparam);
             if ($dbindexes) {
-                $lastkey = NULL; //To temp store the last key processed
                 foreach ($dbindexes as $indexname => $dbindex) {
                     // Add the indexname to the array
                     $dbindex['name'] = $indexname;
@@ -156,9 +162,6 @@ class new_table_from_mysql extends XMLDBAction {
                         $key = new xmldb_key(strtolower($dbindex['name']));
                         // Set key with info retrofitted
                         $key->setFromADOKey($dbindex);
-                        // Set default comment to PKs
-                        if ($key->getType() == XMLDB_KEY_PRIMARY) {
-                        }
                         // Add key to the table
                         $table->addKey($key);
 
@@ -172,18 +175,17 @@ class new_table_from_mysql extends XMLDBAction {
                     }
                 }
             }
-            // Finally, add the whole retroffited table to the structure
-            // in the place specified
+            // Finally, add the whole retrofitted table to the structure in the place specified.
             $structure->addTable($table, $afterparam);
         }
 
         // Launch postaction if exists (leave this here!)
-        if ($this->getPostAction() && $result) {
+        if ($this->getPostAction()) {
             return $this->launch($this->getPostAction());
         }
 
         // Return ok if arrived here
-        return $result;
+        return true;
     }
 }
 

analytics/tests/behat/manage_models.feature

@@ -114,6 +114,7 @@ Feature: Manage analytics models
     And I should see "Read actions amount"
     And I click on "Select Student 6 for bulk action" "checkbox" in the "Student 6" "table_row"
     And I click on "Accept" "button"
+    And I wait until "Confirm" "button" exists
     And I click on "Confirm" "button" in the "Accept" "dialogue"
     And I click on "View prediction details" "icon" in the "Student 5" "table_row"
     And I click on "Select Student 5 for bulk action" "checkbox" in the "Student 5" "table_row"
@@ -145,7 +146,8 @@ Feature: Manage analytics models
     When I open the action menu in "Students at risk of not meeting the course completion conditions" "table_row"
     And I choose "Export" in the open action menu
     And I click on "Actions" "link" in the "Students at risk of not meeting the course completion conditions" "table_row"
-    And following "Export" should download between "100" and "500" bytes
+    And following "Export" should download a file that:
+       | Contains file in zip | model-config.json |
 
   Scenario: Check invalid site elements
     When I open the action menu in "Students at risk of not meeting the course completion conditions" "table_row"

analytics/tests/community_of_inquiry_activities_completed_by_test.php

@@ -14,31 +14,29 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
-/**
- * Unit tests for activities completed by classification.
- *
- * @package   core_analytics
- * @copyright 2017 David Monllaó {@link http://www.davidmonllao.com}
- * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
- */
+namespace core_analytics;
 
-defined('MOODLE_INTERNAL') || die();
+use advanced_testcase;
+use ReflectionClass;
+use ReflectionMethod;
+use stdClass;
 
 /**
  * Unit tests for activities completed by classification.
  *
  * @package   core_analytics
+ * @covers    \core_analytics\local\indicator\community_of_inquiry_activity
  * @copyright 2017 David Monllaó {@link http://www.davidmonllao.com}
  * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
-class community_of_inquiry_activities_completed_by_testcase extends advanced_testcase {
+final class community_of_inquiry_activities_completed_by_test extends advanced_testcase {
 
     /**
      * availability_levels
      *
      * @return array
      */
-    public function availability_levels() {
+    public static function availability_levels(): array {
         return array(
             'activity' => array('activity'),
             'section' => array('section'),
@@ -148,7 +146,7 @@ class community_of_inquiry_activities_completed_by_testcase extends advanced_tes
         $second = $startdate + WEEKSECS;
         $third = $startdate + (WEEKSECS * 2);
         $forth = $startdate + (WEEKSECS * 3);
-        $this->assertCount(1, $method->invoke($indicator, $first, $first + WEEKSECS, $stu1));
+        $this->assertCount(2, $method->invoke($indicator, $first, $first + WEEKSECS, $stu1));
         $this->assertCount(1, $method->invoke($indicator, $second, $second + WEEKSECS, $stu1));
         $this->assertCount(0, $method->invoke($indicator, $third, $third + WEEKSECS, $stu1));
         $this->assertCount(2, $method->invoke($indicator, $forth, $forth + WEEKSECS, $stu1));

auth/lti/auth.php

@@ -115,7 +115,7 @@ class auth_plugin_lti extends \auth_plugin_base {
             if (isloggedin()) {
                 // If a different user is currently logged in, authenticate the linked user instead.
                 global $USER;
-                if ((int) $USER->id !== $user->id) {
+                if ($USER->id !== $user->id) {
                     complete_user_login($user);
                 }
                 // If the linked user is already logged in, skip the call to complete_user_login() because this affects deep linking

auth/lti/classes/local/ltiadvantage/event/event_handler.php

@@ -0,0 +1,48 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\local\ltiadvantage\event;
+
+use auth_lti\local\ltiadvantage\utility\cookie_helper;
+use core\event\user_loggedin;
+
+/**
+ * Event handler for auth_lti.
+ *
+ * @package    auth_lti
+ * @copyright  2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class event_handler {
+
+    /**
+     * Allows the plugin to augment Set-Cookie headers when the user_loggedin event is fired as part of complete_user_login() calls.
+     *
+     * @param user_loggedin $event the event
+     * @return void
+     */
+    public static function handle_user_loggedin(user_loggedin $event): void {
+        // The event data isn't important here. The intent of this listener is to ensure that the MoodleSession cookie is set up
+        // properly during LTI launches + login. This means two things:
+        // i) it's set with SameSite=None; Secure; where possible (since OIDC needs HTTPS this will almost always be possible).
+        // ii) it set with the 'Partitioned' attribute, when required.
+        // The former ensures cross-site cookies are sent for embedded launches. The latter is an opt-in flag needed to use Chrome's
+        // partitioning mechanism, CHIPS.
+        if (cookie_helper::cookies_supported()) {
+            cookie_helper::setup_session_cookie();
+        }
+    }
+}

auth/lti/classes/local/ltiadvantage/utility/cookie_helper.php

@@ -0,0 +1,173 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\local\ltiadvantage\utility;
+use core\session\utility\cookie_helper as core_cookie_helper;
+
+/**
+ * Helper class providing utils dealing with cookies in LTI, particularly 3rd party cookies.
+ *
+ * @package    auth_lti
+ * @copyright  2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+final class cookie_helper {
+
+    /** @var int Cookies are not supported. */
+    public const COOKIE_METHOD_NOT_SUPPORTED = 0;
+
+    /** @var int Cookies are supported without explicit partitioning. */
+    public const COOKIE_METHOD_NO_PARTITIONING = 1;
+
+    /** @var int Cookies are supported via explicit partitioning. */
+    public const COOKIE_METHOD_EXPLICIT_PARTITIONING = 2;
+
+    /**
+     * Check whether cookies can be used with the current user agent and, if so, via what method they are set.
+     *
+     * Currently, this tries 2 modes of setting a test cookie:
+     * 1. Setting a SameSite=None, Secure cookie. This will work in any first party context, and in 3rd party contexts for
+     * any browsers supporting automatic partitioning of 3rd party cookies (E.g. Firefox, Brave).
+     * 2. If 1 fails, setting a cookie with the Chrome 'Partitioned' attribute included, opting that cookie into CHIPS. This will
+     * work for Chrome.
+     *
+     * Upon completion of the cookie check, the check sets a SESSION flag indicating the method used to set the cookie, and upgrades
+     * the session cookie ('MoodleSession') using the respective method. This ensure the session cookie will continue to be sent.
+     *
+     * Then, the following methods can be used by client code to query whether the UA supports cookies, and how:
+     * @see self::cookies_supported() - whether it could be set at all.
+     * @see self::get_cookies_supported_mode() - if a cookie could be set, what mode was used to set it.
+     *
+     * This permits client code to make sure it's setting its cookies appropriately (via the advertised method), and allows it to
+     * present notices - such as in the case where a given UA is found to be lacking the requisite cookie support.
+     * E.g.
+     * cookie_helper::do_cookie_check($mypageurl);
+     * if (!cookie_helper::cookies_supported()) {
+     *     // Print a notice stating that cookie support is required.
+     * }
+     * // Elsewhere in other client code...
+     * if (cookie_helper::get_cookies_supported_mode() === cookie_helper::COOKIE_METHOD_EXPLICIT_PARTITIONING) {
+     *     // Set a cookie, making sure to use the helper to also opt-in to partitioning.
+     *     setcookie('myauthcookie', 'myauthcookievalue', ['samesite' => 'None', 'secure' => true]);
+     *     cookie_helper::add_partitioning_to_cookie('myauthcookie');
+     * }
+     *
+     * @param \moodle_url $pageurl the URL of the page making the check, used to redirect back to after setting test cookies.
+     * @return void
+     */
+    public static function do_cookie_check(\moodle_url $pageurl): void {
+        global $_COOKIE, $SESSION, $CFG;
+        $cookiecheck1 = optional_param('cookiecheck1', null, PARAM_INT);
+        $cookiecheck2 = optional_param('cookiecheck2', null, PARAM_INT);
+
+        if (empty($cookiecheck1)) {
+            // Start the cookie check. Set two test cookies - one samesite none, and one partitioned - and redirect.
+            // Set cookiecheck to show the check has started.
+            self::set_test_cookie('cookiecheck1', self::COOKIE_METHOD_NO_PARTITIONING);
+            self::set_test_cookie('cookiecheck2', self::COOKIE_METHOD_EXPLICIT_PARTITIONING, true);
+            $pageurl->params([
+                'cookiecheck1' => self::COOKIE_METHOD_NO_PARTITIONING,
+                'cookiecheck2' => self::COOKIE_METHOD_EXPLICIT_PARTITIONING,
+            ]);
+
+            // LTI needs to guarantee the 'SameSite=None', 'Secure' (and sometimes 'Partitioned') attributes are set on the
+            // MoodleSession cookie. This is done via manipulation of the outgoing headers after the cookie check redirect. To
+            // guarantee these outgoing Set-Cookie headers will be created after the redirect, expire the current cookie.
+            core_cookie_helper::expire_moodlesession();
+
+            redirect($pageurl);
+        } else {
+            // Have already started a cookie check, so check the result.
+            $cookie1received = isset($_COOKIE['cookiecheck1']) && $_COOKIE['cookiecheck1'] == $cookiecheck1;
+            $cookie2received = isset($_COOKIE['cookiecheck2']) && $_COOKIE['cookiecheck2'] == $cookiecheck2;
+
+            if ($cookie1received || $cookie2received) {
+                // The test cookie could be set and received.
+                // Set a session flag storing the method used to set it, and make sure the session cookie uses this method.
+                $cookiemethod = $cookie1received ? self::COOKIE_METHOD_NO_PARTITIONING : self::COOKIE_METHOD_EXPLICIT_PARTITIONING;
+                $SESSION->auth_lti_cookie_method = $cookiemethod;
+
+                self::setup_session_cookie();
+            }
+        }
+    }
+
+    /**
+     * If a cookie check has been made, returns whether cookies could be set or not.
+     *
+     * @return bool whether cookies are supported or not.
+     */
+    public static function cookies_supported(): bool {
+        return self::get_cookies_supported_method() !== self::COOKIE_METHOD_NOT_SUPPORTED;
+    }
+
+    /**
+     * If a cookie check has been made, gets the method used to set a cookie, or self::COOKIE_METHOD_NOT_SUPPORTED if not supported.
+     *
+     * For cookie methods:
+     * @see self::COOKIE_METHOD_NOT_SUPPORTED
+     * @see self::COOKIE_METHOD_NO_PARTITIONING
+     * @see self::COOKIE_METHOD_EXPLICIT_PARTITIONING
+     *
+     * @return int the constant representing the method by which the cookie was set, or not.
+     */
+    public static function get_cookies_supported_method(): int {
+        global $SESSION;
+        return $SESSION->auth_lti_cookie_method ?? self::COOKIE_METHOD_NOT_SUPPORTED;
+    }
+
+    /**
+     * Sets up the session cookie according to the method used in the cookie check, and with SameSite=None; Secure attributes.
+     *
+     * @return void
+     */
+    public static function setup_session_cookie(): void {
+        global $CFG;
+        require_once($CFG->libdir . '/sessionlib.php');
+
+        if (is_moodle_cookie_secure()) {
+            $atts = ['SameSite=None', 'Secure'];
+            if (self::get_cookies_supported_method() == self::COOKIE_METHOD_EXPLICIT_PARTITIONING) {
+                $atts[] = 'Partitioned';
+            }
+            core_cookie_helper::add_attributes_to_cookie_response_header('MoodleSession' . $CFG->sessioncookie, $atts);
+        }
+    }
+
+    /**
+     * Set a test cookie, using SameSite=None; Secure; attributes if possible, and with or without partitioning opt-in.
+     *
+     * @param string $name cookie name
+     * @param string $value cookie value
+     * @param bool $partitioned whether to try to add partitioning opt-in, which requires secure cookies (https sites).
+     * @return void
+     */
+    private static function set_test_cookie(string $name, string $value, bool $partitioned = false): void {
+        global $CFG;
+        require_once($CFG->libdir . '/sessionlib.php');
+
+        $atts = ['expires' => time() + 30];
+        if (is_moodle_cookie_secure()) {
+            $atts['samesite'] = 'none';
+            $atts['secure'] = true;
+        }
+        setcookie($name, $value, $atts);
+
+        if (is_moodle_cookie_secure() && $partitioned) {
+            core_cookie_helper::add_attributes_to_cookie_response_header($name, ['Partitioned']);
+        }
+    }
+}

auth/lti/classes/output/renderer.php

@@ -33,33 +33,32 @@ class renderer extends \plugin_renderer_base {
      * @return string the html.
      */
     public function render_account_binding_options_page(int $provisioningmode): string {
+
         $formaction = new \moodle_url('/auth/lti/login.php');
         $notification = new notification(get_string('firstlaunchnotice', 'auth_lti'), \core\notification::INFO, false);
-        $noauthnotice = new notification(get_string('firstlaunchnoauthnotice', 'auth_lti', get_docs_url('Publish_as_LTI_tool')),
-            \core\notification::WARNING, false);
         $cancreateaccounts = !get_config('moodle', 'authpreventaccountcreation');
         if ($provisioningmode == \auth_plugin_lti::PROVISIONING_MODE_PROMPT_EXISTING_ONLY) {
             $cancreateaccounts = false;
         }
 
-        $accountinfo = ['isloggedin' => isloggedin()];
+        $accountinfo = [];
         if (isloggedin()) {
             global $USER;
-            $accountinfo = array_merge($accountinfo, [
+            $accountinfo = [
                 'firstname' => $USER->firstname,
                 'lastname' => $USER->lastname,
                 'email' => $USER->email,
                 'picturehtml' => $this->output->user_picture($USER,  ['size' => 35, 'class' => 'round']),
-            ]);
+            ];
         }
 
         $context = [
+            'isloggedin' => isloggedin(),
             'info' => $notification->export_for_template($this),
             'formaction' => $formaction->out(),
             'sesskey' => sesskey(),
             'accountinfo' => $accountinfo,
             'cancreateaccounts' => $cancreateaccounts,
-            'noauthnotice' => $noauthnotice->export_for_template($this)
         ];
         return parent::render_from_template('auth_lti/local/ltiadvantage/login', $context);
     }

auth/lti/db/events.php

@@ -0,0 +1,33 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * LTI Auth plugin event handler definition.
+ *
+ * @package auth_lti
+ * @category event
+ * @copyright 2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$observers = [
+    [
+        'eventname' => '\core\event\user_loggedin',
+        'callback' => '\auth_lti\local\ltiadvantage\event\event_handler::handle_user_loggedin',
+    ],
+];

auth/lti/lang/en/auth_lti.php

@@ -35,7 +35,7 @@ $string['firstlaunchnoauthnotice'] = 'To link your existing account you must be
 $string['getstartedwithnewaccount'] = 'Get started with a new account';
 $string['haveexistingaccount'] = 'I have an existing account';
 $string['linkthisaccount'] = 'Link this account';
-$string['mustbeloggedin'] = 'You need to be logged in to your existing account';
+$string['mustbeloggedin'] = 'Log in to link your existing account.';
 $string['pluginname'] = 'LTI';
 $string['privacy:metadata:auth_lti'] = 'LTI authentication';
 $string['privacy:metadata:auth_lti:authsubsystem'] = 'This plugin is connected to the authentication subsystem.';

auth/lti/templates/local/ltiadvantage/login.mustache

@@ -32,7 +32,6 @@
     * info - a notification describing the first launch options
     * cancreateaccounts - whether or not the user is allowed to create auth_lti accounts
     * accountinfo - information about the user, importantly whether they are logged in or not.
-    * noauthnotice - a notification telling the user they must be authenticated to link accounts. Only relevant when not logged in.
 
     Example context (json):
     {
@@ -46,19 +45,12 @@
             "issuccess": true
         },
         "cancreateaccounts": true,
+        "isloggedin": true,
         "accountinfo": {
-            "isloggedin": true,
             "firstname": "John",
             "lastname": "Smith",
             "email": "john@example.com",
             "picturehtml": "<img src=\"http://site.example.com/pluginfile.php/5/user/icon/boost/f2?rev=99\" class=\"round\" alt=\"\" width=\"35\" height=\"35\">"
-        },
-        "noauthnotice": {
-            "message": "To link your existing account you must be logged in to the site...",
-            "extraclasses": "",
-            "announce": false,
-            "closebutton": false,
-            "iswarning": true
         }
     }
 }}
@@ -79,8 +71,8 @@
                         <div class="card-body text-center d-flex flex-column">
                             <i class="fa fa-user-circle-o fa-2x link"></i>
                             <h4 class="card-title">{{#str}} useexistingaccount, auth_lti {{/str}}</h4>
-                            {{#accountinfo}}
                                 {{#isloggedin}}
+                                    {{#accountinfo}}
                                     <p class="card-text mt-2">
                                         <span class="text-muted">
                                             {{#str}} currentlyloggedinas, auth_lti {{/str}}
@@ -90,14 +82,12 @@
                                         {{firstname}} {{lastname}} ({{email}})
                                     </p>
                                     <input type="submit" class="btn btn-primary mt-auto" name="existing_account" value="{{#str}} linkthisaccount, auth_lti {{/str}}">
+                                    {{/accountinfo}}
                                 {{/isloggedin}}
                                 {{^isloggedin}}
                                     <p class="card-text text-muted">{{#str}} mustbeloggedin, auth_lti {{/str}}</p>
-                                    {{#noauthnotice}}
-                                        {{> core/notification}}
-                                    {{/noauthnotice}}
+                                    <input type="submit" class="btn btn-primary mt-auto" name="existing_account" value="{{#str}} login, moodle {{/str}}">
                                 {{/isloggedin}}
-                            {{/accountinfo}}
                         </div>
                     </div>
                 </div>

auth/lti/version.php

@@ -24,6 +24,6 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version = 2023042400; // The current plugin version (Date: YYYYMMDDXX).
+$plugin->version = 2023042401; // The current plugin version (Date: YYYYMMDDXX).
 $plugin->requires = 2023041800; // Requires this Moodle version.
 $plugin->component = 'auth_lti'; // Full name of the plugin (used for diagnostics).

auth/oauth2/classes/api.php

@@ -345,7 +345,7 @@ class api {
     }
 
     /**
-     * Delete linked login
+     * Delete a users own linked login
      *
      * Requires auth/oauth2:managelinkedlogins capability at the user context.
      *
@@ -353,14 +353,19 @@ class api {
      * @return boolean
      */
     public static function delete_linked_login($linkedloginid) {
-        $login = new linked_login($linkedloginid);
-        $userid = $login->get('userid');
+        global $USER;
 
         if (\core\session\manager::is_loggedinas()) {
             throw new moodle_exception('notwhileloggedinas', 'auth_oauth2');
         }
 
-        $context = context_user::instance($userid);
+        $login = linked_login::get_record([
+            'id' => $linkedloginid,
+            'userid' => $USER->id,
+            'confirmtoken' => '',
+        ], MUST_EXIST);
+
+        $context = context_user::instance($login->get('userid'));
         require_capability('auth/oauth2:managelinkedlogins', $context);
 
         $login->delete();

auth/oauth2/tests/api_test.php

@@ -137,6 +137,7 @@ class api_test extends \advanced_testcase {
         $issuer = \core\oauth2\api::create_standard_issuer('google');
 
         $user = $this->getDataGenerator()->create_user();
+        $this->setUser($user);
 
         $info = [];
         $info['username'] = 'banana';
@@ -169,6 +170,30 @@ class api_test extends \advanced_testcase {
         $this->assertEquals($newuser->id, $match->get('userid'));
     }
 
+    /**
+     * Test that we cannot deleted a linked login for another user
+     */
+    public function test_delete_linked_login_other_user(): void {
+        $this->resetAfterTest();
+
+        $this->setAdminUser();
+        $issuer = \core\oauth2\api::create_standard_issuer('google');
+
+        $user = $this->getDataGenerator()->create_user();
+
+        api::link_login([
+            'username' => 'banana',
+            'email' => 'banana@example.com',
+        ], $issuer, $user->id);
+
+        /** @var linked_login $linkedlogin */
+        $linkedlogin = api::get_linked_logins($user->id)[0];
+
+        // We are logged in as a different user, so cannot delete this.
+        $this->expectException(\dml_missing_record_exception::class);
+        api::delete_linked_login($linkedlogin->get('id'));
+    }
+
     /**
      * Test that is_enabled correctly identifies when the plugin is enabled.
      */

availability/classes/info.php

@@ -49,6 +49,9 @@ abstract class info {
     /** @var tree Availability configuration, decoded from JSON; null if unset */
     protected $availabilitytree;
 
+    /** @var array The groups the current user belongs to. */
+    protected $groups;
+
     /** @var array|null Array of information about current restore if any */
     protected static $restoreinfo = null;
 
@@ -65,6 +68,7 @@ abstract class info {
         $this->course = $course;
         $this->visible = (bool)$visible;
         $this->availability = $availability;
+        $this->groups = null;
     }
 
     /**
@@ -800,4 +804,28 @@ abstract class info {
         }
         return false;
     }
+
+    /**
+     * Returns groups that the current user belongs to on the course. Note: If not already
+     * available, this may make a database query.
+     *
+     * This will include groups the user is not allowed to see themselves, so check visibility
+     * before displaying groups to the user.
+     *
+     * @param int $groupingid Grouping ID or 0 (default) for all groups
+     * @return int[] Array of int (group id) => int (same group id again); empty array if none
+     */
+    public function get_groups(int $groupingid = 0): array {
+        global $USER;
+        if (is_null($this->groups)) {
+            $allgroups = groups_get_user_groups($this->course->id, $USER->id, true);
+            $this->groups = $allgroups;
+        } else {
+            $allgroups = $this->groups;
+        }
+        if (!isset($allgroups[$groupingid])) {
+            return [];
+        }
+        return $allgroups[$groupingid];
+    }
 }

availability/condition/group/classes/condition.php

@@ -71,7 +71,7 @@ class condition extends \core_availability\condition {
         $allow = true;
         if (!has_capability('moodle/site:accessallgroups', $context, $userid)) {
             // Get all groups the user belongs to.
-            $groups = $info->get_modinfo()->get_groups();
+            $groups = $info->get_groups();
             if ($this->groupid) {
                 $allow = in_array($this->groupid, $groups);
             } else {

availability/condition/group/tests/behat/availability_group.feature

@@ -108,3 +108,49 @@ Feature: availability_group
     When I am on the "C1" "Course" page logged in as "student1"
     Then I should see "Not available unless: You belong to G-One"
     And I should not see "G-Un"
+
+  @javascript
+  Scenario: Condition using a hidden group
+    Given the following "groups" exist:
+      | name         | course | idnumber | visibility |
+      | Hidden Group | C1     | GA       | 3          |
+    And I log in as "teacher1"
+    And I add a page activity to course "Course 1" section "1"
+    And I expand all fieldsets
+
+    # Page P1 any group.
+    And I am on the "P1" "page activity editing" page
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And "Group" "button" should exist in the "Add restriction..." "dialogue"
+    And I click on "Group" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Group" to "(Any group)"
+    And I click on ".availability-item .availability-eye img" "css_element"
+    And I click on "Save and return to course" "button"
+
+    # Page P2 with hidden group.
+    And I am on the "P2" "page activity editing" page
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And I click on "Group" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Group" to "Hidden Group"
+    And I click on "Save and return to course" "button"
+
+    # Log back in as student.
+    When I am on the "Course 1" "course" page logged in as "student1"
+
+    # No pages should appear yet.
+    Then I should not see "P1" in the "region-main" "region"
+    And I should not see "P2" in the "region-main" "region"
+    And I should not see "Hidden Group"
+
+    # Add to groups and log out/in again.
+    And the following "group members" exist:
+      | user     | group |
+      | student1 | GA    |
+    And I am on "Course 1" course homepage
+
+    # P1 (any groups) and P2 should show. The user should not see the hidden group mentioned anywhere.
+    And I should see "P1" in the "region-main" "region"
+    And I should see "P2" in the "region-main" "region"
+    And I should not see "Hidden Group"

availability/condition/group/tests/condition_test.php

@@ -49,6 +49,7 @@ class condition_test extends \advanced_testcase {
         $course = $generator->create_course();
         $user = $generator->create_user();
         $generator->enrol_user($user->id, $course->id);
+        $this->setUser($user);
         $info = new \core_availability\mock_info($course, $user->id);
 
         // Make 2 test groups, one in a grouping and one not.
@@ -70,7 +71,7 @@ class condition_test extends \advanced_testcase {
         // Add user to groups and refresh cache.
         groups_add_member($group1, $user);
         groups_add_member($group2, $user);
-        get_fast_modinfo($course->id, 0, true);
+        $info = new \core_availability\mock_info($course, $user->id);
 
         // Recheck.
         $this->assertTrue($cond->is_available(false, $info, true, $user->id));

backup/moodle2/backup_block_task.class.php

@@ -52,7 +52,7 @@ abstract class backup_block_task extends backup_task {
         }
 
         $this->blockid    = $blockid;
-        $this->blockname  = $block->blockname;
+        $this->blockname  = clean_param($block->blockname, PARAM_PLUGIN);
         $this->contextid  = context_block::instance($this->blockid)->id;
         $this->moduleid   = $moduleid;
         $this->modulename = null;

backup/moodle2/backup_course_task.class.php

@@ -168,6 +168,7 @@ class backup_course_task extends backup_task {
         $content = self::encode_links_helper($content, 'BADGESVIEWBYID',       '/badges/view.php?type=2&id=');
         $content = self::encode_links_helper($content, 'USERINDEXVIEWBYID',    '/user/index.php?id=');
         $content = self::encode_links_helper($content, 'PLUGINFILEBYCONTEXT',  '/pluginfile.php/');
+        $content = self::encode_links_helper($content, 'PLUGINFILEBYCONTEXTURLENCODED', '/pluginfile.php/', true);
 
         return $content;
     }
@@ -178,17 +179,26 @@ class backup_course_task extends backup_task {
      * @param string $name the name of this type of encoded link.
      * @param string $path the path that identifies this type of link, up
      *      to the ?paramname= bit.
+     * @param bool $urlencoded whether to use urlencode() before replacing the path.
      * @return string content with one type of link encoded.
      */
-    static private function encode_links_helper($content, $name, $path) {
+    private static function encode_links_helper(string $content, string $name, string $path, bool $urlencoded = false) {
         global $CFG;
         // We want to convert both http and https links.
         $root = $CFG->wwwroot;
         $httpsroot = str_replace('http://', 'https://', $root);
         $httproot = str_replace('https://', 'http://', $root);
 
-        $httpsbase = preg_quote($httpsroot . $path, '/');
-        $httpbase = preg_quote($httproot . $path, '/');
+        $httpsbase = $httpsroot . $path;
+        $httpbase = $httproot . $path;
+
+        if ($urlencoded) {
+            $httpsbase = urlencode($httpsbase);
+            $httpbase = urlencode($httpbase);
+        }
+
+        $httpsbase = preg_quote($httpsbase, '/');
+        $httpbase = preg_quote($httpbase, '/');
 
         $return = preg_replace('/(' . $httpsbase . ')([0-9]+)/', '$@' . $name . '*$2@$', $content);
         $return = preg_replace('/(' . $httpbase . ')([0-9]+)/', '$@' . $name . '*$2@$', $return);

backup/moodle2/restore_course_task.class.php

@@ -167,6 +167,7 @@ class restore_course_task extends restore_task {
         $rules[] = new restore_decode_rule('BADGESVIEWBYID',       '/badges/view.php?type=2&id=$1', 'course');
         $rules[] = new restore_decode_rule('USERINDEXVIEWBYID',    '/user/index.php?id=$1',         'course');
         $rules[] = new restore_decode_rule('PLUGINFILEBYCONTEXT',  '/pluginfile.php/$1',            'context');
+        $rules[] = new restore_decode_rule('PLUGINFILEBYCONTEXTURLENCODED', '/pluginfile.php/$1', 'context', true);
 
         return $rules;
     }

backup/moodle2/restore_stepslib.php

@@ -3749,7 +3749,7 @@ class restore_activity_competencies_structure_step extends restore_structure_ste
             // Sortorder is ignored by precaution, anyway we should walk through the records in the right order.
             $record = (object) $params;
             $record->ruleoutcome = $data->ruleoutcome;
-            $record->overridegrade = $data->overridegrade;
+            $record->overridegrade = $data->overridegrade ?? 0;
             $coursemodulecompetency = new \core_competency\course_module_competency(0, $record);
             $coursemodulecompetency->create();
         }
@@ -5390,6 +5390,25 @@ class restore_move_module_questions_categories extends restore_execution_step {
                     ];
                     $params += $categoryidparams;
                     $DB->execute($sqlupdate, $params);
+
+                    // As explained in {@see restore_quiz_activity_structure_step::process_quiz_question_legacy_instance()}
+                    // question_set_references relating to random questions restored from old backups,
+                    // which pick from context_module question_categores, will have been restored with the wrong questioncontextid.
+                    // So, now, we need to find those, and updated the questioncontextid.
+                    // We can only find them by picking apart the filter conditions, and seeign which categories they refer to.
+
+                    // We need to check all the question_set_references belonging to this context_module.
+                    $references = $DB->get_records('question_set_references', ['usingcontextid' => $newcontext->newitemid]);
+                    foreach ($references as $reference) {
+                        $filtercondition = json_decode($reference->filtercondition);
+                        if (!empty($filtercondition->questioncategoryid) &&
+                                in_array($filtercondition->questioncategoryid, $categoryids)) {
+                            // This is one of ours, update the questionscontextid.
+                            $DB->set_field('question_set_references',
+                                'questionscontextid', $newcontext->newitemid,
+                                ['id' => $reference->id]);
+                        }
+                    }
                 }
 
                 // Now set the parent id for the question categories that were in the top category in the course context
@@ -6187,6 +6206,11 @@ trait restore_question_set_reference_data_trait {
         $data->filtercondition = json_encode($filtercondition);
         if ($context = $this->get_mappingid('context', $data->questionscontextid)) {
             $data->questionscontextid = $context;
+        } else {
+            $this->log('question_set_reference with old id ' . $data->id .
+                ' referenced question context ' . $data->questionscontextid .
+                ' which was not included in the backup. Therefore, this has been ' .
+                ' restored with the old questionscontextid.', backup::LOG_WARNING);
         }
 
         $DB->insert_record('question_set_references', $data);

backup/moodle2/tests/moodle2_test.php

@@ -36,7 +36,7 @@ require_once($CFG->libdir . '/completionlib.php');
  * @copyright 2014 The Open University
  * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
-class moodle2_test extends \advanced_testcase {
+final class moodle2_test extends \advanced_testcase {
 
     /**
      * Tests the availability field on modules and sections is correctly
@@ -1146,7 +1146,6 @@ class moodle2_test extends \advanced_testcase {
             'filearea' => 'package',
             'itemid' => 0,
             'filepath' => '/',
-            'filepath' => '/',
             'filename' => 'dummy.h5p',
             'addxapistate' => true,
         ];

backup/util/helper/restore_decode_rule.class.php

@@ -44,7 +44,18 @@ class restore_decode_rule {
 
     protected $cregexp;     // Calculated regular expresion we'll be looking for matches
 
-    public function __construct($linkname, $urltemplate, $mappings) {
+    /** @var bool $urlencoded Whether to use urlencode() on the final URL. */
+    protected bool $urlencoded;
+
+    /**
+     * Constructor
+     *
+     * @param string $linkname How the link has been encoded in backup (CHOICEVIEWBYID, COURSEVIEWBYID...)
+     * @param string $urltemplate How the original URL looks like, with dollar placeholders
+     * @param array|string $mappings Which backup_ids mappings do we need to apply for replacing the placeholders
+     * @param bool $urlencoded Whether to use urlencode() on the final URL (defaults to false)
+     */
+    public function __construct(string $linkname, string $urltemplate, $mappings, bool $urlencoded = false) {
         // Validate all the params are ok
         $this->mappings = $this->validate_params($linkname, $urltemplate, $mappings);
         $this->linkname = $linkname;
@@ -52,6 +63,7 @@ class restore_decode_rule {
         $this->restoreid = 0;
         $this->sourcewwwroot = '';
         $this->targetwwwroot = ''; // yes, uses to be $CFG->wwwroot, and? ;-)
+        $this->urlencoded = $urlencoded;
         $this->cregexp = $this->get_calculated_regexp();
     }
 
@@ -96,6 +108,9 @@ class restore_decode_rule {
             } else {            // All mappings found, apply target values to the template
                 $toreplace = str_replace($placeholdersarr, $mappingstargetarr, $toreplace);
             }
+            if ($this->urlencoded) {
+                $toreplace = urlencode($toreplace);
+            }
             // Finally, perform the replacement in original content
             $content = str_replace($tosearch, $toreplace, $content);
         }

backup/util/helper/tests/backup_encode_content_test.php

@@ -50,14 +50,18 @@ class backup_encode_content_test extends \basic_testcase {
         // HTTPS root and links of both types in content.
         $CFG->wwwroot = $httpsroot;
         $encoded = backup_course_task::encode_content_links(
-                $httproot . '/course/view.php?id=123, ' .
-                $httpsroot . '/course/view.php?id=123, ' .
-                $httpsroot . '/grade/index.php?id=123, ' .
-                $httpsroot . '/grade/report/index.php?id=123, ' .
-                $httpsroot . '/badges/view.php?type=2&id=123 and ' .
-                $httpsroot . '/user/index.php?id=123.');
+            $httproot . '/course/view.php?id=123, ' .
+            $httpsroot . '/course/view.php?id=123, ' .
+            $httpsroot . '/grade/index.php?id=123, ' .
+            $httpsroot . '/grade/report/index.php?id=123, ' .
+            $httpsroot . '/badges/view.php?type=2&id=123, ' .
+            $httpsroot . '/user/index.php?id=123, ' .
+            $httpsroot . '/pluginfile.php/123 and ' .
+            urlencode($httpsroot . '/pluginfile.php/123') . '.'
+        );
         $this->assertEquals('$@COURSEVIEWBYID*123@$, $@COURSEVIEWBYID*123@$, $@GRADEINDEXBYID*123@$, ' .
-                '$@GRADEREPORTINDEXBYID*123@$, $@BADGESVIEWBYID*123@$ and $@USERINDEXVIEWBYID*123@$.', $encoded);
+                '$@GRADEREPORTINDEXBYID*123@$, $@BADGESVIEWBYID*123@$, $@USERINDEXVIEWBYID*123@$, ' .
+                '$@PLUGINFILEBYCONTEXT*123@$ and $@PLUGINFILEBYCONTEXTURLENCODED*123@$.', $encoded);
 
         // HTTP root and links of both types in content.
         $CFG->wwwroot = $httproot;
@@ -66,10 +70,14 @@ class backup_encode_content_test extends \basic_testcase {
             $httpsroot . '/course/view.php?id=123, ' .
             $httproot . '/grade/index.php?id=123, ' .
             $httproot . '/grade/report/index.php?id=123, ' .
-            $httproot . '/badges/view.php?type=2&id=123 and ' .
-            $httproot . '/user/index.php?id=123.');
+            $httproot . '/badges/view.php?type=2&id=123, ' .
+            $httproot . '/user/index.php?id=123, ' .
+            $httproot . '/pluginfile.php/123 and ' .
+            urlencode($httproot . '/pluginfile.php/123') . '.'
+        );
         $this->assertEquals('$@COURSEVIEWBYID*123@$, $@COURSEVIEWBYID*123@$, $@GRADEINDEXBYID*123@$, ' .
-            '$@GRADEREPORTINDEXBYID*123@$, $@BADGESVIEWBYID*123@$ and $@USERINDEXVIEWBYID*123@$.', $encoded);
+                '$@GRADEREPORTINDEXBYID*123@$, $@BADGESVIEWBYID*123@$, $@USERINDEXVIEWBYID*123@$, ' .
+                '$@PLUGINFILEBYCONTEXT*123@$ and $@PLUGINFILEBYCONTEXTURLENCODED*123@$.', $encoded);
         $CFG->wwwroot = $oldroot;
     }
 }

backup/util/ui/renderer.php

@@ -134,14 +134,14 @@ class core_backup_renderer extends plugin_renderer_base {
         $html .= $this->backup_detail_pair(get_string('backupmode', 'backup'), get_string('backupmode'.$details->mode, 'backup'));
         $html .= $this->backup_detail_pair(get_string('backupdate', 'backup'), userdate($details->backup_date));
         $html .= $this->backup_detail_pair(get_string('moodleversion', 'backup'),
-                html_writer::tag('span', $details->moodle_release, array('class' => 'moodle_release')).
-                html_writer::tag('span', '['.$details->moodle_version.']', array('class' => 'moodle_version sub-detail')));
+                html_writer::tag('span', s($details->moodle_release), array('class' => 'moodle_release')).
+                html_writer::tag('span', '[' . s($details->moodle_version) .']', array('class' => 'moodle_version sub-detail')));
         $html .= $this->backup_detail_pair(get_string('backupversion', 'backup'),
-                html_writer::tag('span', $details->backup_release, array('class' => 'moodle_release')).
-                html_writer::tag('span', '['.$details->backup_version.']', array('class' => 'moodle_version sub-detail')));
+                html_writer::tag('span', s($details->backup_release), array('class' => 'moodle_release')).
+                html_writer::tag('span', '[' . s($details->backup_version) . ']', array('class' => 'moodle_version sub-detail')));
         $html .= $this->backup_detail_pair(get_string('originalwwwroot', 'backup'),
-                html_writer::tag('span', $details->original_wwwroot, array('class' => 'originalwwwroot')).
-                html_writer::tag('span', '['.$details->original_site_identifier_hash.']', array('class' => 'sitehash sub-detail')));
+                html_writer::tag('span', s($details->original_wwwroot), array('class' => 'originalwwwroot')).
+                html_writer::tag('span', '[' . s($details->original_site_identifier_hash) . ']', array('class' => 'sitehash sub-detail')));
         if (!empty($details->include_file_references_to_external_content)) {
             $message = '';
             if (backup_general_helper::backup_is_samesite($details)) {
@@ -169,8 +169,8 @@ class core_backup_renderer extends plugin_renderer_base {
             $html .= html_writer::start_tag('div', ['class' => 'backup-section',
                     'role' => 'table', 'aria-labelledby' => 'backupcoursedetailsheader']);
             $html .= $this->output->heading(get_string('backupcoursedetails', 'backup'), 2, 'header', 'backupcoursedetailsheader');
-            $html .= $this->backup_detail_pair(get_string('coursetitle', 'backup'), $details->course->title);
-            $html .= $this->backup_detail_pair(get_string('courseid', 'backup'), $details->course->courseid);
+            $html .= $this->backup_detail_pair(get_string('coursetitle', 'backup'), format_string($details->course->title));
+            $html .= $this->backup_detail_pair(get_string('courseid', 'backup'), clean_param($details->course->courseid, PARAM_INT));
 
             // Warning users about front page backups.
             if ($details->original_course_format === 'site') {
@@ -188,7 +188,7 @@ class core_backup_renderer extends plugin_renderer_base {
                 } else {
                     continue;
                 }
-                $html .= $this->backup_detail_pair(get_string('backupcoursesection', 'backup', $section->title), $value);
+                $html .= $this->backup_detail_pair(get_string('backupcoursesection', 'backup', format_string($section->title)), $value);
                 $table = null;
                 foreach ($details->activities as $activitykey => $activity) {
                     if ($activity->sectionid != $section->sectionid) {
@@ -206,7 +206,7 @@ class core_backup_renderer extends plugin_renderer_base {
                     $icon = new image_icon('monologo', '', $activity->modulename, ['class' => 'iconlarge icon-pre']);
                     $table->data[] = array(
                         $this->output->render($icon).$name,
-                        $activity->title,
+                        format_string($activity->title),
                         ($activity->settings[$activitykey.'_userinfo']) ? $yestick : $notick,
                     );
                 }

badges/index.php

@@ -107,9 +107,10 @@ if (!has_any_capability(array(
 $PAGE->set_title($hdr);
 $output = $PAGE->get_renderer('core', 'badges');
 
-if (($delete || $archive) && has_capability('moodle/badges:deletebadge', $PAGE->context)) {
+if ($delete || $archive) {
     $badgeid = ($archive != 0) ? $archive : $delete;
     $badge = new badge($badgeid);
+    require_capability('moodle/badges:deletebadge', $badge->get_context());
     if (!$confirm) {
         echo $output->header();
         // Archive this badge?

badges/tests/behat/award_badge_groups.feature

@@ -119,3 +119,97 @@ Feature: Award badges with separate groups
     And I press "Award badge"
     # Teacher 2 shouldn't be able to go further
     Then I should see "Sorry, but you need to be part of a group to see this page."
+
+  @javascript
+  Scenario: Editing teacher can award badge to members of separate groups
+    Given I am on the "Course 1" course page logged in as teacher1
+    And I navigate to "Badges > Manage badges" in current page administration
+    And I follow "Course Badge"
+    And I press "Award badge"
+    When I set the field "role" to "Teacher"
+    # Confirm that editing teacher sees a separate groups dropdown menu.
+    Then "Separate groups" "select" should exist
+    And I should see "All participants" in the "Separate groups" "select"
+    # Confirm that all participants are displayed when All participants is selected.
+    And I should see "Student 1" in the "potentialrecipients[]" "select"
+    And I should see "Student 2" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 1" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 2" in the "potentialrecipients[]" "select"
+    And I set the field "Separate groups" to "Class A"
+    # Confirm that only members of selected group are displayed
+    And I should not see "Student 1" in the "potentialrecipients[]" "select"
+    And I should not see "Teacher 1" in the "potentialrecipients[]" "select"
+    And I should see "Student 2" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 2" in the "potentialrecipients[]" "select"
+    And I set the field "Separate groups" to "Class B"
+    And I should not see "Student 2" in the "potentialrecipients[]" "select"
+    And I should not see "Teacher 2" in the "potentialrecipients[]" "select"
+    And I should see "Student 1" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 1" in the "potentialrecipients[]" "select"
+
+  @javascript
+  Scenario Outline: Teacher can award badge to members of visible groups
+    Given I am on the "Course 1" "course editing" page logged in as teacher1
+    And I expand all fieldsets
+    # Set the group mode to visible groups.
+    And I set the field "Group mode" to "Visible groups"
+    And I press "Save and display"
+    When I am on the "Course 1" course page logged in as <loggedinuser>
+    And I navigate to "Badges > Manage badges" in current page administration
+    And I follow "Course Badge"
+    And I press "Award badge"
+    And I set the field "role" to "<awarder>"
+    # Confirm that teachers see a visible groups dropdown menu.
+    Then "Visible groups" "select" should exist
+    # Confirm that My groups option group exists.
+    And "optgroup[label='My groups']" "css_element" should exist in the "select[name='group']" "css_element"
+    # Confirm that Other groups option group exists.
+    And "optgroup[label='Other groups']" "css_element" should exist in the "select[name='group']" "css_element"
+    # Confirm that all participants are displayed when All participants is selected.
+    And I set the field "Visible groups" to "All participants"
+    And I should see "Student 1" in the "potentialrecipients[]" "select"
+    And I should see "Student 2" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 1" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 2" in the "potentialrecipients[]" "select"
+    # Confirm that only members of selected group are displayed.
+    And I set the field "Visible groups" to "Class A"
+    And I should not see "Student 1" in the "potentialrecipients[]" "select"
+    And I should not see "Teacher 1" in the "potentialrecipients[]" "select"
+    And I should see "Student 2" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 2" in the "potentialrecipients[]" "select"
+    And I set the field "Visible groups" to "Class B"
+    And I should not see "Student 2" in the "potentialrecipients[]" "select"
+    And I should not see "Teacher 2" in the "potentialrecipients[]" "select"
+    And I should see "Student 1" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 1" in the "potentialrecipients[]" "select"
+
+    Examples:
+      | loggedinuser | awarder             |
+      | teacher1     | Teacher             |
+      | teacher2     | Non-editing teacher |
+
+  @javascript
+  Scenario Outline: Teacher can award badge to members when group mode is set to no groups
+    Given I am on the "Course 1" "course editing" page logged in as teacher1
+    And I expand all fieldsets
+    # Set the group mode to no groups.
+    And I set the field "Group mode" to "No groups"
+    And I press "Save and display"
+    When I am on the "Course 1" course page logged in as <loggedinuser>
+    And I navigate to "Badges > Manage badges" in current page administration
+    And I follow "Course Badge"
+    And I press "Award badge"
+    And I set the field "role" to "<awarder>"
+    # Confirm that no group dropdowns don't exist.
+    Then "Separate groups" "select" should not exist
+    And "Visible groups" "select" should not exist
+    # Confirm all participants are displayed.
+    And I should see "Student 1" in the "potentialrecipients[]" "select"
+    And I should see "Student 2" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 1" in the "potentialrecipients[]" "select"
+    And I should see "Teacher 2" in the "potentialrecipients[]" "select"
+
+    Examples:
+      | loggedinuser | awarder             |
+      | teacher1     | Teacher             |
+      | teacher2     | Non-editing teacher |

blocks/calendar_month/tests/behat/block_calendar_month_dashboard.feature

@@ -10,8 +10,8 @@ Feature: View a site event on the dashboard
       | student1 | Student | 1 | student1@example.com | S1 |
     And I log in as "admin"
     And I create a calendar event with form data:
-      | id_eventtype | Site |
-      | id_name | Site Event |
+      | id_eventtype    | Site |
+      | id_name         | Site Event |
     And I log out
 
   @javascript
@@ -29,5 +29,5 @@ Feature: View a site event on the dashboard
     # We need to give the browser a couple seconds to re-render the page after the screen has been resized.
     And I wait "1" seconds
     And I should not see "Site Event"
-    And I hover over today in the mini-calendar block
+    When I hover over today in the mini-calendar block responsive view
     And I should see "Site Event"

blocks/myoverview/amd/src/view.js

@@ -551,7 +551,11 @@ const itemsPerPageFunc = (pagingLimit, root) => {
     // Filter out all pagination options which are too large for the amount of courses user is enrolled in.
     const totalCourseCount = parseInt(root.find(SELECTORS.courseView.region).attr('data-totalcoursecount'), 10);
     return itemsPerPage.filter(pagingOption => {
-        return pagingOption.value < totalCourseCount || pagingOption.value === 0;
+        if (pagingOption.value === 0 && totalCourseCount > 100) {
+            // To minimise performance issues, do not show the "All" option if the user is enrolled in more than 100 courses.
+            return false;
+        }
+        return pagingOption.value < totalCourseCount;
     });
 };
 

blocks/myoverview/classes/output/main.php

@@ -363,7 +363,14 @@ class main implements renderable, templatable {
         if (!$this->displaygroupingcustomfield) {
             return [];
         }
-        $fieldid = $DB->get_field('customfield_field', 'id', ['shortname' => $this->customfiltergrouping]);
+
+        // Get the relevant customfield ID within the core_course/course component/area.
+        $fieldid = $DB->get_field_sql("
+            SELECT f.id
+              FROM {customfield_field} f
+              JOIN {customfield_category} c ON c.id = f.categoryid
+             WHERE f.shortname = :shortname AND c.component = 'core_course' AND c.area = 'course'
+        ", ['shortname' => $this->customfiltergrouping]);
         if (!$fieldid) {
             return [];
         }

blocks/myoverview/templates/zero-state.mustache

@@ -51,8 +51,7 @@
         <div class="text-xs-center text-center mt-3" data-region="empty-message">
             <img class="empty-placeholder-image-lg mt-1"
                     src="{{nocoursesimg}}"
-                    alt="{{{ title }}}"
-                    role="presentation"
+                    alt=""
             >
             <h5 class="h5 mt-3 mb-0">{{{ title }}}</h5>
             <p class="mt-3 mb-0">{{{ intro }}}</p>

blocks/myoverview/tests/behat/block_myoverview_zerostate.feature

@@ -70,3 +70,8 @@ Feature: Zero state on my overview block
     And "Create course" "button" should exist
     And I click on "Create course" "button"
     And I should see "Add a new course"
+
+  @accessibility
+  Scenario: Evaluate the accessibility of the My courses (zero state)
+    When I am on the "My courses" page logged in as "manager"
+    Then the page should meet accessibility standards

blocks/recentlyaccesseditems/classes/helper.php

@@ -58,7 +58,7 @@ class helper {
                   FROM {block_recentlyaccesseditems} rai
                   JOIN {course} c ON c.id = rai.courseid
                  WHERE userid = :userid
-                 ORDER BY rai.timeaccess DESC";
+              ORDER BY rai.timeaccess DESC, rai.id DESC";
         $records = $DB->get_records_sql($sql, $paramsql);
         $order = 0;
 

blocks/recentlyaccesseditems/templates/no-items.mustache

@@ -27,9 +27,8 @@
 <div class="text-xs-center text-center mt-4" data-region="empty-message">
     <img
         src="{{noitemsimgurl}}"
-        alt="{{#str}} noitems, block_recentlyaccesseditems {{/str}}"
-        role="presentation"
+        alt=""
         style="height: 70px; width: 70px;"
     >
     <p class="text-muted mt-3 mb-0">{{#str}} noitems, block_recentlyaccesseditems {{/str}}</p>
-</div>
+</div>

blocks/recentlyaccesseditems/templates/view-cards.mustache

@@ -42,19 +42,21 @@
 
 <div class="card-deck dashboard-card-deck one-row" data-region="items-list" role="list">
     {{#items}}
-        <a class="card dashboard-card mb-1" href="{{{viewurl}}}" title="{{{name}}}" role="listitem">
-            <div class="card-body p-2 m-1">
-                <div class="d-flex text-truncate">
-                    <div class="d-flex align-self-center activityiconcontainer {{purpose}}">
-                        {{{icon}}}
-                    </div>
-                    <div class="w-100 line-height-3 text-truncate ml-2">
-                        <h6 class="mb-0 text-truncate"><span class="clickable">{{{name}}}</span></h6>
-                        <small class="text-truncate mb-0">{{{coursename}}}</small>
+        <div class="card dashboard-card" role="listitem">
+            <a class="mb-1" href="{{{viewurl}}}" title="{{{name}}}">
+                <div class="card-body p-2 m-1">
+                    <div class="d-flex text-truncate">
+                        <div class="d-flex align-self-center activityiconcontainer {{purpose}}">
+                            {{{icon}}}
+                        </div>
+                        <div class="w-100 line-height-3 text-truncate ml-2">
+                            <h6 class="mb-0 text-truncate"><span class="clickable">{{{name}}}</span></h6>
+                            <small class="text-truncate mb-0">{{{coursename}}}</small>
+                        </div>
                     </div>
                 </div>
-            </div>
-        </a>
+            </a>
+        </div>
     {{/items}}
 </div>
 {{#hasmoreitems}}

blocks/recentlyaccesseditems/tests/behat/block_recentlyaccesseditems_dashboard.feature

@@ -23,15 +23,19 @@ Feature: The recently accessed items block allows users to easily access their m
       | name     | Test forum name |
     And I log in as "student1"
 
+  @accessibility
   Scenario: User has not accessed any item
     Then I should see "No recent items" in the "Recently accessed items" "block"
+    And the page should meet accessibility standards
 
+  @accessibility
   Scenario: User has accessed some items
     Given I change window size to "large"
     When I am on the "Test forum name" "forum activity" page
     And I follow "Dashboard"
     Then I should see "Test forum name" in the "Recently accessed items" "block"
     And I should not see "Show more items" in the "Recently accessed items" "block"
+    And the page should meet accessibility standards
 
   Scenario: User has accessed more than 3 items
     Given the following "activities" exist:

blocks/rss_client/editfeed.php

@@ -180,7 +180,18 @@ $PAGE->set_pagelayout('admin');
 
 if ($rssid) {
     $isadding = false;
-    $rssrecord = $DB->get_record('block_rss_client', array('id' => $rssid), '*', MUST_EXIST);
+
+    if ($managesharedfeeds) {
+        $select = 'id = :id AND (userid = :userid OR shared = 1)';
+    } else {
+        $select = 'id = :id AND userid = :userid';
+    }
+
+    $rssrecord = $DB->get_record_select('block_rss_client', $select, [
+        'id' => $rssid,
+        'userid' => $USER->id,
+    ], '*', MUST_EXIST);
+
 } else {
     $isadding = true;
     $rssrecord = new stdClass;