Moodle release 4.2.10

Co-authored-by: David Woloszyn <david.woloszyn@moodle.com>
Co-authored-by: Jun Pataleta <jun@moodle.com>

.github/workflows/push.yml

@@ -3,7 +3,7 @@ name: Core
 on:
   push:
     branches-ignore:
-      - master
+      - main
       - MOODLE_[0-9]+_STABLE
     tags-ignore:
       - v[0-9]+.[0-9]+.[0-9]+*

admin/classes/table/plugin_management_table.php

@@ -500,4 +500,15 @@ abstract class plugin_management_table extends flexible_table implements dynamic
     protected function supports_ordering(): bool {
         return $this->plugininfoclass::plugintype_supports_ordering();
     }
+
+    /**
+     * Check if the user has the capability to access this table.
+     *
+     * Default implementation for plugin management tables is to require 'moodle/site:config' capability
+     *
+     * @return bool Return true if capability check passed.
+     */
+    public function has_capability(): bool {
+        return has_capability('moodle/site:config', $this->get_context());
+    }
 }

admin/tests/behat/task_logs.feature

@@ -48,25 +48,3 @@ Feature: View task logs report and use its filters
       | operator     | shouldornotsee |
       | Less than    | should not see |
       | Greater than | should see     |
-
-  @javascript
-  Scenario: Reset task log filters
-    Given I log in as "admin"
-    And I change window size to "large"
-    And I navigate to "Server > Tasks > Task logs" in site administration
-    When I click on "Filters" "button"
-    And I set the following fields in the "Result" "core_reportbuilder > Filter" to these values:
-      | Result operator | Is equal to |
-      | Result value    | Fail        |
-    And I click on "Apply" "button" in the "[data-region='report-filters']" "css_element"
-    Then I should see "Filters applied"
-    And I should see "Filters (1)" in the "#dropdownFiltersButton" "css_element"
-    And I should see "Nothing to display"
-    And I click on "Reset all" "button" in the "[data-region='report-filters']" "css_element"
-    And I should see "Filters reset"
-    And I should not see "Filters (1)" in the "#dropdownFiltersButton" "css_element"
-    And I should see "Filters" in the "#dropdownFiltersButton" "css_element"
-    And "[data-region='report-filters']" "css_element" should be visible
-    And the following fields in the "Result" "core_reportbuilder > Filter" match these values:
-      | Result operator | Is any value |
-    And I should not see "Nothing to display"

admin/tool/dataprivacy/tests/behat/datadelete.feature

@@ -54,6 +54,7 @@ Feature: Data delete from the privacy API
     And I should see "Awaiting approval" in the "Victim User 1" "table_row"
     And I open the action menu in "Victim User 1" "table_row"
     And I follow "Approve request"
+    And I wait until "Approve request" "button" exists
     And I press "Approve request"
     And I should see "Approved" in the "Victim User 1" "table_row"
     And I run all adhoc tasks
@@ -80,6 +81,7 @@ Feature: Data delete from the privacy API
     And I navigate to "Users > Privacy and policies > Data requests" in site administration
     And I open the action menu in "Victim User 1" "table_row"
     And I follow "Approve request"
+    And I wait until "Approve request" "button" exists
     And I press "Approve request"
 
     And I log out
@@ -115,6 +117,7 @@ Feature: Data delete from the privacy API
     And I navigate to "Users > Privacy and policies > Data requests" in site administration
     And I open the action menu in "Victim User 1" "table_row"
     And I follow "Approve request"
+    And I wait until "Approve request" "button" exists
     And I press "Approve request"
 
     And I log out

admin/tool/dataprivacy/tests/behat/dataexport.feature

@@ -48,6 +48,7 @@ Feature: Data export from the privacy API
     And I should see "Awaiting approval" in the "Victim User 1" "table_row"
     And I open the action menu in "Victim User 1" "table_row"
     And I follow "Approve request"
+    And I wait until "Approve request" "button" exists
     And I press "Approve request"
     And I should see "Approved" in the "Victim User 1" "table_row"
     And I run all adhoc tasks
@@ -115,6 +116,7 @@ Feature: Data export from the privacy API
     And I navigate to "Users > Privacy and policies > Data requests" in site administration
     And I open the action menu in "Victim User 1" "table_row"
     And I follow "Approve request"
+    And I wait until "Approve request" "button" exists
     And I press "Approve request"
 
     And I log out

admin/tool/policy/tests/behat/acceptances.feature

@@ -170,6 +170,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "Actions" "link_or_button" in the "This privacy policy" "table_row"
     And I click on "Set status to \"Active\"" "link" in the "This privacy policy" "table_row"
+    And I wait until "Activate" "button" exists
     And I press "Activate"
     And I log out
     When I log in as "manager"
@@ -260,6 +261,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "Actions" "link_or_button" in the "This privacy policy" "table_row"
     And I click on "Set status to \"Active\"" "link" in the "This privacy policy" "table_row"
+    And I wait until "Activate" "button" exists
     And I press "Activate"
     And I log out
     When I log in as "manager"

admin/tool/usertours/tests/behat/tour_content_type.feature

@@ -25,6 +25,7 @@ Feature: Apply content type to a tour
     Then "Content type" "select" should exist
     And the "Content type" select box should contain "Language string ID"
     And the "Content type" select box should contain "Manual"
+    And I change window size to "large"
     And I select "Language string ID" from the "Content type" singleselect
     And I should see " Language string ID"
     And "#fgroup_id_contenthtmlgrp" "css_element" should not be visible
@@ -38,6 +39,7 @@ Feature: Apply content type to a tour
     And I click on "View" "link" in the "My first tour" "table_row"
     And I click on "New step" "link"
     And I set the field "Title" to "tour_activityinfo_course_teacher_title,tool_usertours"
+    And I change window size to "large"
     And I select "Language string ID" from the "Content type" singleselect
     And I set the field "Language string ID" to "tour_activityinfo_course_teacher_content_abc,tool_usertours"
     When I press "Save changes"

admin/tool/xmldb/actions/new_table_from_mysql/new_table_from_mysql.class.php

@@ -129,8 +129,8 @@ class new_table_from_mysql extends XMLDBAction {
         // go to the table edit action
         } else {
             // Get some params (table is mandatory here).
-            $tableparam = required_param('table', PARAM_ALPHAEXT);
-            $afterparam = required_param('after', PARAM_ALPHAEXT);
+            $tableparam = required_param('table', PARAM_ALPHANUMEXT);
+            $afterparam = required_param('after', PARAM_ALPHANUMEXT);
 
             if (empty($tableparam) || empty($afterparam)) {
                 throw new moodle_exception('Invalid param value detected.');

analytics/tests/behat/manage_models.feature

@@ -114,6 +114,7 @@ Feature: Manage analytics models
     And I should see "Read actions amount"
     And I click on "Select Student 6 for bulk action" "checkbox" in the "Student 6" "table_row"
     And I click on "Accept" "button"
+    And I wait until "Confirm" "button" exists
     And I click on "Confirm" "button" in the "Accept" "dialogue"
     And I click on "View prediction details" "icon" in the "Student 5" "table_row"
     And I click on "Select Student 5 for bulk action" "checkbox" in the "Student 5" "table_row"

auth/oauth2/classes/api.php

@@ -345,7 +345,7 @@ class api {
     }
 
     /**
-     * Delete linked login
+     * Delete a users own linked login
      *
      * Requires auth/oauth2:managelinkedlogins capability at the user context.
      *
@@ -353,14 +353,19 @@ class api {
      * @return boolean
      */
     public static function delete_linked_login($linkedloginid) {
-        $login = new linked_login($linkedloginid);
-        $userid = $login->get('userid');
+        global $USER;
 
         if (\core\session\manager::is_loggedinas()) {
             throw new moodle_exception('notwhileloggedinas', 'auth_oauth2');
         }
 
-        $context = context_user::instance($userid);
+        $login = linked_login::get_record([
+            'id' => $linkedloginid,
+            'userid' => $USER->id,
+            'confirmtoken' => '',
+        ], MUST_EXIST);
+
+        $context = context_user::instance($login->get('userid'));
         require_capability('auth/oauth2:managelinkedlogins', $context);
 
         $login->delete();

auth/oauth2/tests/api_test.php

@@ -137,6 +137,7 @@ class api_test extends \advanced_testcase {
         $issuer = \core\oauth2\api::create_standard_issuer('google');
 
         $user = $this->getDataGenerator()->create_user();
+        $this->setUser($user);
 
         $info = [];
         $info['username'] = 'banana';
@@ -169,6 +170,30 @@ class api_test extends \advanced_testcase {
         $this->assertEquals($newuser->id, $match->get('userid'));
     }
 
+    /**
+     * Test that we cannot deleted a linked login for another user
+     */
+    public function test_delete_linked_login_other_user(): void {
+        $this->resetAfterTest();
+
+        $this->setAdminUser();
+        $issuer = \core\oauth2\api::create_standard_issuer('google');
+
+        $user = $this->getDataGenerator()->create_user();
+
+        api::link_login([
+            'username' => 'banana',
+            'email' => 'banana@example.com',
+        ], $issuer, $user->id);
+
+        /** @var linked_login $linkedlogin */
+        $linkedlogin = api::get_linked_logins($user->id)[0];
+
+        // We are logged in as a different user, so cannot delete this.
+        $this->expectException(\dml_missing_record_exception::class);
+        api::delete_linked_login($linkedlogin->get('id'));
+    }
+
     /**
      * Test that is_enabled correctly identifies when the plugin is enabled.
      */

blocks/site_main_menu/tests/behat/edit_activities.feature

@@ -5,7 +5,7 @@ Feature: Edit activities in main menu block
   I need to add and edit activities there
 
   @javascript
-  Scenario: Edit name of acitivity in-place in site main menu block
+  Scenario: Edit name of activity in-place in site main menu block
     Given the following "activity" exists:
       | activity | forum                |
       | course   | Acceptance test site |
@@ -36,6 +36,7 @@ Feature: Edit activities in main menu block
       | forum    | Acceptance test site | 0       | Visible forum |
       | forum    | Acceptance test site | 0       | My forum name |
     And I log in as "admin"
+    And I change window size to "large"
     And I am on site homepage
     And I turn editing mode on
     And "My forum name" activity in site main menu block should have "Hide" editing icon

course/tests/behat/course_controls.feature

@@ -33,11 +33,6 @@ Feature: Course activity controls works as expected
     And I log in as "teacher1"
     And I am on "Course 1" course homepage with editing mode on
     When I click on <targetpage> "link" in the "region-main" "region"
-    And I add the "Recent activity" block
-    And I open the action menu in "Recent activity" "block"
-    And I click on "Delete Recent activity block" "link"
-    And I click on "Delete" "button" in the "Delete block?" "dialogue"
-    And <belowpage> "section" <should_see_other_sections> exist
     And <belowpage> "section" <should_see_other_sections> exist
     And I open "Test forum name 1" actions menu
     And I click on "Edit settings" "link" in the "Test forum name 1" activity
@@ -100,10 +95,6 @@ Feature: Course activity controls works as expected
     And I log in as "teacher1"
     And I am on "Course 1" course homepage with editing mode on
     When I click on <targetpage> "link" in the "region-main" "region"
-    And I add the "Recent activity" block
-    And I open the action menu in "Recent activity" "block"
-    And I click on "Delete Recent activity block" "link"
-    And I press "Yes"
     And <belowpage> "section" <should_see_other_sections> exist
     And I click on "Edit settings" "link" in the "Test forum name 1" activity
     And I should see "Updating Forum"

enrol/self/tests/behat/self_enrolment.feature

@@ -9,6 +9,7 @@ Feature: Users can auto-enrol themself in courses where self enrolment is allowe
       | username | firstname | lastname | email |
       | teacher1 | Teacher | 1 | teacher1@example.com |
       | student1 | Student | 1 | student1@example.com |
+      | student2 | Student | 2 | student2@example.com |
     And the following "courses" exist:
       | fullname | shortname | format |
       | Course 1 | C1 | topics |
@@ -64,13 +65,13 @@ Feature: Users can auto-enrol themself in courses where self enrolment is allowe
   Scenario: Self-enrolment enabled requiring a group enrolment key
     Given I log in as "teacher1"
     When I add "Self enrolment" enrolment method in "Course 1" with:
-      | Custom instance name | Test student enrolment |
-      | Enrolment key | moodle_rules |
-      | Use group enrolment keys | Yes |
+      | Custom instance name     | Test student enrolment |
+      | Enrolment key            | moodle_rules           |
+      | Use group enrolment keys | Yes                    |
     And I am on the "Course 1" "groups" page
     And I press "Create group"
     And I set the following fields to these values:
-      | Group name | Group 1 |
+      | Group name    | Group 1             |
       | Enrolment key | Test-groupenrolkey1 |
     And I press "Save changes"
     And I log out
@@ -82,6 +83,16 @@ Feature: Users can auto-enrol themself in courses where self enrolment is allowe
     Then I should see "Topic 1"
     And I should not see "Enrolment options"
     And I should not see "Enrol me in this course"
+    And I am on the "Course 1" course page logged in as student2
+    And I set the following fields to these values:
+      | Enrolment key | moodle_rules |
+    And I press "Enrol me"
+    And I am on the "Course 1" course page logged in as teacher1
+    And I navigate to course participants
+    And the following should exist in the "participants" table:
+      | First name | Email address        | Roles   | Groups    |
+      | Student 1  | student1@example.com | Student | Group 1   |
+      | Student 2  | student2@example.com | Student | No groups |
 
   @javascript
   Scenario: Edit a self-enrolled user's enrolment from the course participants page

grade/report/grader/tests/behat/tertiary_name_filter.feature

@@ -28,6 +28,8 @@ Feature: Within the grader report, test that we can open our generic filter drop
       | activity | course | idnumber | name                |
       | assign   | C1     | a1       | Test assignment one |
     And I am on the "Course 1" "grades > Grader report > View" page logged in as "teacher1"
+    # This is required for now to prevent the overflow region affecting the report.
+    And I change window size to "large"
 
   Scenario: A teacher can open the filter component
     Given I should see "Filter by name"

install/lang/zh_cn/error.php

@@ -36,7 +36,7 @@ $string['cannotcreatelangdir'] = '无法创建 lang 目录。';
 $string['cannotcreatetempdir'] = '无法创建 temp 目录。';
 $string['cannotdownloadcomponents'] = '无法下载组件';
 $string['cannotdownloadzipfile'] = '无法下载 ZIP 文件。';
-$string['cannotfindcomponent'] = '找不到组件。';
+$string['cannotfindcomponent'] = '找不到组件';
 $string['cannotsavemd5file'] = '无法保存 md5 文件';
 $string['cannotsavezipfile'] = '无法保存 ZIP 文件';
 $string['cannotunzipfile'] = '无法解压文件';

lib/behat/classes/behat_session_trait.php

@@ -761,9 +761,14 @@ trait behat_session_trait {
      *
      * @param string $windowsize size of window.
      * @param bool $viewport If true, changes viewport rather than window size
+     * @param bool $scalesize Whether to scale the size by the WINDOWSCALE environment variable
      * @throws ExpectationException
      */
-    protected function resize_window($windowsize, $viewport = false) {
+    protected function resize_window(
+        string $windowsize,
+        bool $viewport = false,
+        bool $scalesize = true,
+    ): void {
         global $CFG;
 
         // Non JS don't support resize window.
@@ -807,6 +812,16 @@ trait behat_session_trait {
             $height *= $CFG->behat_window_size_modifier;
         }
 
+        if ($scalesize) {
+            // Scale the window size by the WINDOWSCALE environment variable.
+            // This is intended to be used for Behat reruns to negate the impact of browser window size issues.
+            // This allows a per-run, runtime configuration of the scaling, unlike behat_window_size_modifier which
+            // typically applies to all runs.
+            $scalefactor = getenv('WINDOWSCALE') ? floatval(getenv('WINDOWSCALE')) : 1;
+            $width *= $scalefactor;
+            $height *= $scalefactor;
+        }
+
         if ($viewport) {
             // When setting viewport size, we set it so that the document width will be exactly
             // as specified, assuming that there is a vertical scrollbar. (In cases where there is

lib/behat/extension/Moodle/BehatExtension/Driver/WebDriver.php

@@ -87,7 +87,8 @@ class WebDriver extends UpstreamDriver {
             parent::stop();
         } catch (DriverException $e) {
             error_log($e->getMessage());
-            $this->webDriver = null;
+            $rcp = new \ReflectionProperty(parent::class, 'webDriver');
+            $rcp->setValue($this, null);
         }
     }
 }

lib/table/classes/dynamic.php

@@ -41,4 +41,7 @@ namespace core_table;
  * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 interface dynamic {
+    // Classes implementing this interface must define function `public has_capability(): bool`
+    // If it is not defined, the web service `core_table_get_dynamic_table_content` will check capability
+    // 'moodle/site:config' in the system context, allowing only admins to access the table data.
 }

lib/table/classes/external/dynamic/get.php

@@ -219,6 +219,13 @@ class get extends external_api {
         $instance = new $tableclass($uniqueid);
         $instance->set_filterset($filterset);
         self::validate_context($instance->get_context());
+        if (!method_exists($instance, 'has_capability')) {
+            // Method \core_table\dynamic::has_capability() will be added in Moodle 4.5. Until then if it is not
+            // implemented, we will require the admin capability.
+            require_capability('moodle/site:config', \context_system::instance());
+        } else if (!$instance->has_capability()) {
+            throw new \moodle_exception('nopermissiontoaccesspage');
+        }
 
         $instance->set_sortdata($sortdata);
         $alphabet = get_string('alphabet', 'langconfig');

lib/tablelib.php

@@ -204,6 +204,21 @@ class flexible_table {
             TABLE_VAR_RESET  => 'treset',
             TABLE_VAR_DIR    => 'tdir',
         );
+
+        static $notified = [];
+        if (!(defined('AJAX_SCRIPT') && AJAX_SCRIPT) &&
+                $this instanceof \core_table\dynamic &&
+                !method_exists($this, 'has_capability') &&
+                empty($notified[get_class($this)])) {
+            // Classes implementing \core_table\dynamic must have a method has_capability():bool .
+            // This will be enforced in Moodle 4.5.
+            \core\notification::add(
+                get_string('codingerror', 'debug',
+                'Error in class '.get_class($this).'. Some functionality may be available to admins only.'),
+                \core\notification::WARNING
+            );
+            $notified[get_class($this)] = true;
+        }
     }
 
     /**

lib/tests/behat/behat_general.php

@@ -1331,12 +1331,22 @@ EOF;
      * browser window has same viewport size even when you run Behat on multiple operating systems.
      *
      * @throws ExpectationException
-     * @Then /^I change (window|viewport) size to "(mobile|tablet|small|medium|large|\d+x\d+)"$/
-     * @Then /^I change the (window|viewport) size to "(mobile|tablet|small|medium|large|\d+x\d+)"$/
+     * @Then /^I change (window|viewport) size to "(mobile|tablet|small|medium|large|\d+x\d+)"( without runtime scaling)?$/
+     * @Then /^I change the (window|viewport) size to "(mobile|tablet|small|medium|large|\d+x\d+)"( without runtime scaling)?$/
+     * @param string $windowviewport Whether this is a window or viewport size hcange
      * @param string $windowsize size of the window (mobile|tablet|small|medium|large|wxh).
+     * @param null|string $scale whether to lock runtime scaling (string) or to allow it (null)
      */
-    public function i_change_window_size_to($windowviewport, $windowsize) {
-        $this->resize_window($windowsize, $windowviewport === 'viewport');
+    public function i_change_window_size_to(
+        $windowviewport,
+        $windowsize,
+        ?string $scale = null,
+    ): void {
+        $this->resize_window(
+            $windowsize,
+            $windowviewport === 'viewport',
+            $scale === null,
+        );
     }
 
     /**

mod/bigbluebuttonbn/tests/behat/recordings_import.feature

@@ -42,6 +42,7 @@ Feature: Manage and list recordings
     And I select "Test Course 1 (C1)" from the "sourcecourseid" singleselect
     And I select "RoomRecordings" from the "sourcebn" singleselect
     # add the first recording
+    And I change window size to "large"
     And I click on "a.action-icon" "css_element" in the "Recording 1" "table_row"
     # add the second recording
     And I click on "a.action-icon" "css_element" in the "Recording 2" "table_row"
@@ -84,6 +85,7 @@ Feature: Manage and list recordings
   Scenario: I check that I can import recordings from a deleted instance into the Recording activity and then if I delete them
   they are back into the pool to be imported again
     Given I log in as "admin"
+    And I change window size to "large"
     When I am on "Test Course 1" course homepage with editing mode on
     And I delete "RoomRecordings" activity
     # The activity is deleted asynchroneously.

mod/h5pactivity/tests/behat/h5pactivity_completion.feature

@@ -26,7 +26,8 @@ Feature: View activity completion information in the h5p activity
       | packagefilepath    | h5p/tests/fixtures/filltheblanks.h5p |
 
   Scenario: View automatic completion items
-    Given I am on the "Music history" "h5pactivity activity" page logged in as teacher1
+    Given I change window size to "large"
+    And I am on the "Music history" "h5pactivity activity" page logged in as teacher1
     # Teacher view.
     And "Music history" should have the "View" completion condition
     And "Music history" should have the "Receive a grade" completion condition

mod/h5pactivity/tests/behat/h5pactivity_completion_pass_grade.feature

@@ -30,7 +30,8 @@ Feature: Pass grade activity completion information in the h5p activity
 
   Scenario: View automatic completion items
     # Teacher view.
-    Given I am on the "Music history" "h5pactivity activity" page logged in as teacher1
+    Given I change window size to "large"
+    And I am on the "Music history" "h5pactivity activity" page logged in as teacher1
     And "Music history" should have the "View" completion condition
     And "Music history" should have the "Receive a grade" completion condition
     And "Music history" should have the "Receive a passing grade" completion condition

mod/lesson/locallib.php

@@ -2887,15 +2887,17 @@ class lesson extends lesson_base {
 
         if ($this->properties->usepassword && empty($USER->lessonloggedin[$this->id])) {
             $correctpass = false;
-            if (!empty($userpassword) &&
-                    (($this->properties->password == md5(trim($userpassword))) || ($this->properties->password == trim($userpassword)))) {
+
+            $userpassword = trim((string) $userpassword);
+            if ($userpassword !== '' &&
+                    ($this->properties->password === md5($userpassword) || $this->properties->password === $userpassword)) {
                 // With or without md5 for backward compatibility (MDL-11090).
                 $correctpass = true;
                 $USER->lessonloggedin[$this->id] = true;
             } else if (isset($this->properties->extrapasswords)) {
                 // Group overrides may have additional passwords.
                 foreach ($this->properties->extrapasswords as $password) {
-                    if (strcmp($password, md5(trim($userpassword))) === 0 || strcmp($password, trim($userpassword)) === 0) {
+                    if ($password === md5($userpassword) || $password === $userpassword) {
                         $correctpass = true;
                         $USER->lessonloggedin[$this->id] = true;
                     }

mod/lesson/tests/behat/duplicate_lesson_page.feature

@@ -36,6 +36,7 @@ Feature: In a lesson activity, a teacher can duplicate a lesson page
       | id_answer_editor_1 | Previous page |
       | id_jumpto_1 | Previous page |
     And I click on "Image" "button" in the "Page contents" "form_row"
+    And I wait until "Browse repositories..." "button" exists
     And I click on "Browse repositories..." "button"
     And I click on "Private files" "link" in the ".fp-repo-area" "css_element"
     And I click on "moodle_logo.jpg" "link"
@@ -70,6 +71,7 @@ Feature: In a lesson activity, a teacher can duplicate a lesson page
       | id_jumpto_1 | This page |
       | id_score_1 | 0 |
     And I click on "Image" "button" in the "//*[@id='id_answer_editor_0']/ancestor::*[@data-fieldtype='editor']" "xpath_element"
+    And I wait until "Browse repositories..." "button" exists
     And I click on "Browse repositories..." "button"
     And I click on "Private files" "link" in the ".fp-repo-area" "css_element"
     And I click on "moodle_logo.jpg" "link"
@@ -107,6 +109,7 @@ Feature: In a lesson activity, a teacher can duplicate a lesson page
       | id_jumpto_1 | This page |
       | id_score_1 | 0 |
     And I click on "Image" "button" in the "//*[@id='id_response_editor_0']/ancestor::*[@data-fieldtype='editor']" "xpath_element"
+    And I wait until "Browse repositories..." "button" exists
     And I click on "Browse repositories..." "button"
     And I click on "Private files" "link" in the ".fp-repo-area" "css_element"
     And I click on "moodle_logo.jpg" "link"

mod/workshop/tests/behat/workshop_activity_allocation.feature

@@ -0,0 +1,74 @@
+@mod @mod_workshop
+Feature: Teacher can allocate submissions randomly or manually
+  In order to manage submissions
+  As a teacher
+  I should be able to allocate workshop submissions randomly or manually
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email                |
+      | student1 | Student   | One      | student1@example.com |
+      | student2 | Student   | Two      | student2@example.com |
+      | student3 | Student   | Three    | student3@example.com |
+      | teacher1 | Teacher   | 1        | teacher1@example.com |
+    And the following "courses" exist:
+      | fullname | shortname |
+      | Course 1 | C1        |
+    And the following "course enrolments" exist:
+      | user     | course | role           |
+      | student1 | C1     | student        |
+      | student2 | C1     | student        |
+      | student3 | C1     | student        |
+      | teacher1 | C1     | editingteacher |
+    And the following "activities" exist:
+      | activity | name       | course | submissiontypetext |
+      | workshop | Workshop 1 | C1     | 2                  |
+    And I am on the "Course 1" course page logged in as teacher1
+    And I edit assessment form in workshop "Workshop 1" as:
+      | id_description__idx_0_editor | Aspect 1 |
+      | id_description__idx_1_editor | Aspect 2 |
+      | id_description__idx_2_editor | Aspect 3 |
+    And I change phase in workshop "Workshop 1" to "Submission phase"
+    And I am on the "Workshop 1" "workshop activity" page logged in as student1
+    And I add a submission in workshop "Workshop 1" as:
+      | Title              | Submitted by s1    |
+      | Submission content | Some content by s1 |
+    And I am on the "Workshop 1" "workshop activity" page logged in as student2
+    And I add a submission in workshop "Workshop 1" as:
+      | Title              | Submitted by s2    |
+      | Submission content | Some content by s2 |
+    And I am on the "Workshop 1" "workshop activity" page logged in as student3
+    And I add a submission in workshop "Workshop 1" as:
+      | Title              | Submitted by s3    |
+      | Submission content | Some content by s3 |
+
+  Scenario: Teacher can allocate workshop submissions randomly
+    Given I am on the "Workshop 1" "workshop activity" page logged in as teacher1
+    And I click on "Submissions allocation" "link"
+    # Allocate submissions randomly.
+    When I select "Random allocation" from the "jump" singleselect
+    And I set the following fields to these values:
+      | numofreviews | 3 |
+    And I press "Save changes"
+    # Confirm that random allocations was successful.
+    Then I should see "Trying to allocate 3 review(s) per author"
+    And I should see "Randomly assigning 6 allocations"
+    And I should see "New assessment to be done: Student Three is reviewer of Student One"
+    And I should see "New assessment to be done: Student Two is reviewer of Student One"
+    And I should see "New assessment to be done: Student Two is reviewer of Student Three"
+    And I should see "New assessment to be done: Student One is reviewer of Student Three"
+    And I should see "New assessment to be done: Student One is reviewer of Student Two"
+    And I should see "New assessment to be done: Student Three is reviewer of Student Two"
+
+  Scenario: Teacher can allocate workshop submissions manually
+    # Allocate submissions manually.
+    Given I am on the "Workshop 1" "workshop activity" page logged in as teacher1
+    When I allocate submissions in workshop "Workshop 1" as:
+      | Participant | Reviewer    |
+      | Student Two | Student One |
+    # Remove submission allocation.
+    And I click on "//li[contains(text(), 'Student One')]/a[contains(@class, 'action-icon')]" "xpath_element"
+    Then I should see "Are you sure you want to deallocate the selected assessment?"
+    And I press "Yes, I am sure"
+    # Confirm submission allocation was removed.
+    And I should see "Assessment deallocated"

mod/workshop/tests/behat/workshop_submission_max_upload.feature

@@ -0,0 +1,45 @@
+@mod @mod_workshop
+Feature: Student can upload a set number of attachments in submission
+  In order to create a submission with a set number of attachments
+  As a teacher
+  I should be able to set the number of attachments
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email                |
+      | teacher1 | Teacher   | 1        | teacher1@example.com |
+      | student1 | Student   | 1        | student1@example.com |
+    And the following "courses" exist:
+      | fullname | shortname |
+      | Course 1 | C1        |
+    And the following "course enrolments" exist:
+      | user     | course | role           |
+      | teacher1 | C1     | editingteacher |
+      | student1 | C1     | student        |
+    And the following "activities" exist:
+      | activity | name       | course | nattachments |
+      | workshop | Workshop 1 | C1     | 2            |
+    And I am on the "Workshop 1" "workshop activity" page logged in as teacher1
+    And I edit assessment form in workshop "Workshop 1" as:
+      | id_description__idx_0_editor | Aspect1 |
+      | id_description__idx_1_editor | Aspect2 |
+      | id_description__idx_2_editor | Aspect3 |
+    And I change phase in workshop "Workshop 1" to "Submission phase"
+
+  @javascript @_file_upload
+  Scenario: Student can create submission with set number of attachments
+    Given I am on the "Workshop 1" "workshop activity" page logged in as student1
+    When I press "Add submission"
+    # Add... button is visible initially because there are no attachments yet.
+    Then "Add..." "button" should be visible
+    # Add 2 attachments - the set number of attachments.
+    And I upload "mod/workshop/tests/fixtures/moodlelogo.png" file to "Attachment" filemanager
+    And I upload "lib/tests/fixtures/gd-logo.png" file to "Attachment" filemanager
+    # Confirm that Add... button is not visible after set number of attachments is met.
+    And "Add..." "button" should not be visible
+    # Delete one attachment.
+    And I click on "gd-logo.png" "link"
+    And I click on "Delete" "button" in the "Edit gd-logo.png" "dialogue"
+    And I click on "OK" "button" in the "Confirm" "dialogue"
+    # Confirm that Add... button is visible again after 1 attachment is deleted.
+    And "Add..." "button" should be visible

question/type/ddmarker/tests/behat/behat_qtype_ddmarker.php

@@ -68,31 +68,37 @@ class behat_qtype_ddmarker extends behat_base {
         // DOM node so that its centre is over the centre of anothe DOM node.
         // Therefore to make it drag to the specified place, we have to add
         // a target div.
+        // We also need to scroll the marker into view so we can calculate the correct offsetHeight and offsetWidth.
         $markerxpath = $this->marker_xpath($marker);
         $this->execute_script("
                 (function() {
-                    if (document.getElementById('target-{$x}-{$y}')) {
-                        return;
-                    }
-                    var image = document.querySelector('.dropbackground');
-                    var target = document.createElement('div');
-                    target.setAttribute('id', 'target-{$x}-{$y}');
-                    var container = document.querySelector('.droparea');
-                    container.insertBefore(target, image);
-                    var widthRatio = image.offsetWidth / image.naturalWidth;
-                    var heightRatio = image.offsetHeight / image.naturalHeight;
-                    var marker = document.evaluate('{$markerxpath}', document, null, XPathResult.ANY_TYPE, null).iterateNext();
-                    var xadjusted = {$x} * widthRatio
-                                    + (container.offsetWidth - image.offsetWidth) / 2
-                                    + marker.offsetWidth / 2;
-                    var yadjusted = {$y} * heightRatio
-                                    + (container.offsetHeight - image.offsetHeight) / 2
-                                    + marker.offsetHeight / 2;
-                    target.style.setProperty('position', 'absolute');
-                    target.style.setProperty('left', xadjusted + 'px');
-                    target.style.setProperty('top', yadjusted + 'px');
-                    target.style.setProperty('width', '1px');
-                    target.style.setProperty('height', '1px');
+                    require(['core/pending'], function(Pending) {
+                        if (document.getElementById('target-{$x}-{$y}')) {
+                            return;
+                        }
+                        const pendingPromise = new Pending('qtype_ddmarker:drag-drop');
+                        const image = document.querySelector('.dropbackground');
+                        const target = document.createElement('div');
+                        target.setAttribute('id', 'target-{$x}-{$y}');
+                        const container = document.querySelector('.droparea');
+                        container.insertBefore(target, image);
+                        const widthRatio = image.offsetWidth / image.naturalWidth;
+                        const heightRatio = image.offsetHeight / image.naturalHeight;
+                        const marker = document.evaluate('{$markerxpath}', document, null, XPathResult.ANY_TYPE, null).iterateNext();
+                        marker.scrollIntoView();
+                        const xadjusted = {$x} * widthRatio
+                                        + (container.offsetWidth - image.offsetWidth) / 2
+                                        + marker.offsetWidth / 2;
+                        const yadjusted = {$y} * heightRatio
+                                        + (container.offsetHeight - image.offsetHeight) / 2
+                                        + marker.offsetHeight / 2;
+                        target.style.setProperty('position', 'absolute');
+                        target.style.setProperty('left', xadjusted + 'px');
+                        target.style.setProperty('top', yadjusted + 'px');
+                        target.style.setProperty('width', '1px');
+                        target.style.setProperty('height', '1px');
+                        pendingPromise.resolve();
+                    });
                 }())"
         );
 

reportbuilder/classes/table/custom_report_table.php

@@ -386,4 +386,13 @@ class custom_report_table extends base_report_table {
 
         return !empty($CFG->customreportsliveediting);
     }
+
+    /**
+     * Check if the user has the capability to access this table.
+     *
+     * @return bool Return true if capability check passed.
+     */
+    public function has_capability(): bool {
+        return \core_reportbuilder\permission::can_edit_report($this->persistent);
+    }
 }

reportbuilder/classes/table/custom_report_table_view.php

@@ -74,4 +74,13 @@ class custom_report_table_view extends custom_report_table {
 
         return '';
     }
+
+    /**
+     * Check if the user has the capability to access this table.
+     *
+     * @return bool Return true if capability check passed.
+     */
+    public function has_capability(): bool {
+        return \core_reportbuilder\permission::can_view_report($this->persistent);
+    }
 }

reportbuilder/classes/table/system_report_table.php

@@ -299,4 +299,18 @@ class system_report_table extends base_report_table {
 
         return '';
     }
+
+    /**
+     * Check if the user has the capability to access this table.
+     *
+     * @return bool Return true if capability check passed.
+     */
+    public function has_capability(): bool {
+        try {
+            $this->report->require_can_view();
+            return true;
+        } catch (\core_reportbuilder\report_access_exception $e) {
+            return false;
+        }
+    }
 }

reportbuilder/tests/behat/customreports.feature

@@ -164,6 +164,28 @@ Feature: Manage custom reports
       | Name          | My users |
       | Report source | Users    |
 
+  Scenario: Reset filters in system report
+    Given the following "core_reportbuilder > Report" exists:
+      | name    | My report                                |
+      | source  | core_user\reportbuilder\datasource\users |
+    And I log in as "admin"
+    When I navigate to "Reports > Report builder > Custom reports" in site administration
+    And I click on "Filters" "button"
+    And I set the following fields in the "Name" "core_reportbuilder > Filter" to these values:
+      | Name operator | Contains |
+      | Name value    | Lionel   |
+    And I click on "Apply" "button" in the "[data-region='report-filters']" "css_element"
+    And I should see "Filters (1)" in the "#dropdownFiltersButton" "css_element"
+    And I should see "Nothing to display"
+    And I click on "Reset all" "button" in the "[data-region='report-filters']" "css_element"
+    And I should not see "Filters (1)" in the "#dropdownFiltersButton" "css_element"
+    And I should see "Filters" in the "#dropdownFiltersButton" "css_element"
+    And "[data-region='report-filters']" "css_element" should be visible
+    Then I should see "Filters reset"
+    And the following fields in the "Name" "core_reportbuilder > Filter" match these values:
+      | Name operator | Is any value |
+    And I should see "My report" in the "Reports list" "table"
+
   Scenario: Delete custom report
     Given the following "core_reportbuilder > Reports" exist:
       | name      | source                                   |

reportbuilder/tests/behat/filtereditor.feature

@@ -92,7 +92,7 @@ Feature: Manage custom report filters
     And I should see "There are no filters selected" in the "[data-region='active-filters']" "css_element"
     And I should not see "Email address" in the "[data-region='active-filters']" "css_element"
 
-  Scenario: Reset filters in report
+  Scenario: Reset filters in custom report
     Given the following "core_reportbuilder > Reports" exist:
       | name      | source                                   |
       | My report | core_user\reportbuilder\datasource\users |
@@ -102,12 +102,16 @@ Feature: Manage custom report filters
       | Full name operator | Contains |
       | Full name value    | Lionel   |
     And I click on "Apply" "button" in the "[data-region='report-filters']" "css_element"
+    And I should see "Filters (1)" in the "#dropdownFiltersButton" "css_element"
     And I should see "Nothing to display"
     And I click on "Reset all" "button" in the "[data-region='report-filters']" "css_element"
+    And I should not see "Filters (1)" in the "#dropdownFiltersButton" "css_element"
+    And I should see "Filters" in the "#dropdownFiltersButton" "css_element"
+    And "[data-region='report-filters']" "css_element" should be visible
     Then I should see "Filters reset"
     And the following fields in the "Full name" "core_reportbuilder > Filter" match these values:
       | Full name operator | Is any value |
-    And I should see "Admin User" in the "reportbuilder-table" "table"
+    And I should see "Admin User" in the "Users" "table"
 
   Scenario: Use report filters when previewing report
     Given the following "users" exist:

user/classes/table/participants.php

@@ -483,4 +483,17 @@ class participants extends \table_sql implements dynamic_table {
     public function get_context(): context {
         return $this->context;
     }
+
+    /**
+     * Check if the user has the capability to access this table.
+     *
+     * @return bool Return true if capability check passed.
+     */
+    public function has_capability(): bool {
+        global $CFG;
+        require_once($CFG->dirroot . '/course/lib.php');
+
+        $context = $this->course->id == SITEID ? \context_system::instance() : $this->get_context();
+        return course_can_view_participants($context);
+    }
 }

version.php

@@ -29,9 +29,9 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$version  = 2023042409.00;              // 20230424      = branching date YYYYMMDD - do not modify!
+$version  = 2023042410.00;              // 20230424      = branching date YYYYMMDD - do not modify!
                                         //         RR    = release increments - 00 in DEV branches.
                                         //           .XX = incremental changes.
-$release  = '4.2.9 (Build: 20240812)'; // Human-friendly version name
+$release  = '4.2.10 (Build: 20240902)'; // Human-friendly version name
 $branch   = '402';                     // This version's branch.
 $maturity = MATURITY_STABLE;             // This version's maturity level.