Moodle release 4.3.6

Ensure the admin preset export tool has an accurate record of each,
to be observed as sensitive settings when creating an export.

.github/workflows/onebyone.yml

@@ -0,0 +1,143 @@
+name: One by One Testing
+# Run all the individual unit tests one by one, with
+# fully independent PHPUnit executions. Useful to
+# detect issues with some tests that are using stuff
+# that has been made available by others, but is not
+# available when running individually.
+#
+# Note that we aren't using PHPUnit's own isolation
+# here but completely separated runs, one for each
+# test.
+#
+# The workflow will fail reporting all the tests
+# that have failed (and will pass if no failure is
+# detected, of course).
+#
+# It's only executed via workflow dispatch (automated
+# or manual), not by push/tag. And acceptd configuration
+# of phpunit, specially useful to run it with PHPUnit's
+# own isolation or any other option.
+
+on:
+  workflow_dispatch:
+    inputs:
+      phpunit_extra_options:
+        description: Additional options to apply to PHPUnit
+        required: false
+        default: ''
+
+env:
+  chunks: 7
+
+jobs:
+  collect:
+    name: Collect individual unit tests
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{steps.individual-tests.outputs.matrix }}
+
+    steps:
+      - name: Checking out code
+        uses: actions/checkout@v4
+
+      - name: Looking for all individual tests
+        id: individual-tests
+        run: |
+          count=0  # Number of individual tests found.
+          while read -r testfile; do # For each test file.
+              while read -r testname; do # For each unit test in a file.
+                  count=$((count + 1))
+                  # Sent it to the correct chunk file.
+                  chunk=$(((($count % $chunks)) + 1))
+                  echo "$testname $testfile" >> ./chunk_$chunk.txt
+              done < <(grep "function test_" "${testfile}" | sed -r "s/^.*function (test_[a-zA-Z0-9_]+).*/\1/")
+          done < <(find . -name "*_test.php")
+          # Generate the matrix to run tests.
+          echo "matrix=$(ls -1 chunk_*.txt | jq -R -s -c 'split("\n")[:-1]')" >> $GITHUB_OUTPUT
+          echo "$count individual tests collected in $chunks files"
+
+      - name: Upload individual tests files
+        uses: actions/upload-artifact@v4
+        with:
+          name: individual_tests
+          path: chunk_*.txt
+          retention-days: 1
+
+  test:
+    name: Run tests
+    needs: collect
+    runs-on: ubuntu-latest
+    services:
+      exttests:
+        image: moodlehq/moodle-exttests
+        ports:
+          - 8080:80
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+    strategy:
+      fail-fast: false
+      matrix:
+        file: ${{ fromJson(needs.collect.outputs.matrix) }}
+
+    steps:
+      - name: Setting up DB pgsql
+        uses: m4nu56/postgresql-action@v1
+        with:
+          postgresql version: 13
+          postgresql db: test
+          postgresql user: test
+          postgresql password: test
+
+      - name: Setting up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: 8.2
+          ini-values: max_input_vars=5000
+          coverage: none
+
+      - name: Checking out code
+        uses: actions/checkout@v4
+
+      - name: Download individual test files
+        uses: actions/download-artifact@v4
+        with:
+          name: individual_tests # Make all the chunk files available for the next steps.
+
+      - name: Setting up PHPUnit
+        env:
+          dbtype: pgsql
+        run: |
+          echo "pathtophp=$(which php)" >> $GITHUB_ENV
+          cp .github/workflows/config-template.php config.php
+          mkdir ../moodledata
+          sudo locale-gen en_AU.UTF-8
+          php admin/tool/phpunit/cli/init.php --no-composer-self-update
+
+      - name: Run PHPUnit test (one by one)
+        env:
+          dbtype: pgsql
+        run: |
+          status=0
+          count=0
+          while read -r line; do # For each line in the chunk file
+              count=$((count + 1))
+              filter="${line% *}"
+              file="${line#* }"
+              # Run the individual unit test and report problems if needed to.
+              if ! php vendor/bin/phpunit \
+                      --fail-on-empty-test-suite \
+                      --fail-on-warning \
+                      --fail-on-risky \
+                      --filter "$filter" ${{ inputs.phpunit_extra_options }} \
+                      "$file" >/dev/null 2>&1; then
+                  if [ $status -eq 0 ]; then
+                      echo "Problems found, list of PHPUnit commands failing:"
+                  fi
+                  echo "vendor/bin/phpunit --filter '${filter}' ${{ inputs.phpunit_extra_options }} $file"
+                  status=$((status + 1))
+              fi
+          done < ${{ matrix.file }}
+          echo "Finished: $count individual tests executed, $status tests failed"
+          exit $status

.github/workflows/push.yml

@@ -23,10 +23,10 @@ jobs:
 
     steps:
       - name: Checking out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Configuring node & npm
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
 
@@ -105,7 +105,7 @@ jobs:
           coverage: none
 
       - name: Checking out code from ${{ env.GITHUB_REF_SLUG }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setting up PHPUnit
         env:

.github/workflows/web-installer-test.yml

@@ -0,0 +1,23 @@
+name: Web Installer Testing
+
+on:
+  workflow_dispatch:
+
+jobs:
+  InstallationTest:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        php: [8.1, 8.3]
+    steps:
+      - name: Construct repository URL
+        run: echo "REPOSITORY_URL=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" >> $GITHUB_ENV
+        shell: bash
+
+      - uses: moodlehq/moodle-webinstaller-test@main
+        with:
+          repository: ${{ env.REPOSITORY_URL }}
+          branch: ${{ github.ref_name }}
+          php: ${{ matrix.php }}

.github/workflows/windows.yml

@@ -21,10 +21,10 @@ jobs:
           git config --global core.eol lf
 
       - name: Checking out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Configuring node & npm
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
 
@@ -117,7 +117,7 @@ jobs:
           git config --global core.eol lf
 
       - name: Checking out code from ${{ env.GITHUB_REF_SLUG }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       # Needs to be done after php is available, git configured and Moodle checkout has happened.
       - name: Setting up moodle-exttests service

.grunt/tasks/javascript.js

@@ -21,7 +21,7 @@
  */
 
 /**
- * Function to generate the destination for the uglify task
+ * Function to generate the destination for the minification task
  * (e.g. build/file.min.js). This function will be passed to
  * the rename property of files array when building dynamically:
  * http://gruntjs.com/configuring-tasks#building-the-files-object-dynamically
@@ -60,7 +60,6 @@ module.exports = grunt => {
     grunt.registerTask('js', ['amd', 'yui']);
 
     // Register NPM tasks.
-    grunt.loadNpmTasks('grunt-contrib-uglify');
     grunt.loadNpmTasks('grunt-contrib-watch');
     grunt.loadNpmTasks('grunt-rollup');
 
@@ -104,6 +103,7 @@ module.exports = grunt => {
         // The queue runner will run the next `size` items in the queue.
         const runQueue = (size = 1) => {
             queue.splice(0, size).forEach(resolve => {
+                grunt.log.debug(`Item resolved. Kicking off next one.`);
                 resolve();
             });
         };
@@ -113,15 +113,17 @@ module.exports = grunt => {
 
             // The options hook is run in parallel.
             // We can return an unresolved Promise which is queued for later resolution.
-            options: async() => {
+            options: async(options) => {
                 return new Promise(resolve => {
                     queue.push(resolve);
                     startQueue();
+                    return options;
                 });
             },
 
             // When an item in the queue completes, start the next item in the queue.
-            buildEnd: () => {
+            generateBundle: (options, bundle) => {
+                grunt.log.debug(`Finished output phase for ${Object.keys(bundle).join(', ')}`);
                 runQueue();
             },
         };
@@ -155,16 +157,6 @@ module.exports = grunt => {
                         ],
                         presets: [
                             ['@babel/preset-env', {
-                                targets: {
-                                    browsers: [
-                                        ">0.3%",
-                                        "last 2 versions",
-                                        "not ie >= 0",
-                                        "not op_mini all",
-                                        "not Opera > 0",
-                                        "not dead"
-                                    ]
-                                },
                                 modules: false,
                                 useBuiltIns: false
                             }]

.grunt/tasks/jsdoc.js

@@ -20,17 +20,33 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 
-module.exports = grunt => {
-    // Project configuration.
-    grunt.config.merge({
-        jsdoc: {
-            dist: {
-                options: {
-                    configure: ".grunt/jsdoc/jsdoc.conf.js",
-                },
-            },
-        },
-    });
+module.exports = (grunt) => {
+    const path = require('path');
 
-    grunt.loadNpmTasks('grunt-jsdoc');
+    grunt.registerTask('jsdoc', 'Generate JavaScript documentation using jsdoc', function() {
+        const done = this.async();
+        const configuration = path.resolve('.grunt/jsdoc/jsdoc.conf.js');
+
+        grunt.util.spawn({
+            cmd: 'jsdoc',
+            args: [
+                '--configure',
+                configuration,
+            ]
+        }, function(error, result, code) {
+            if (result.stdout) {
+                grunt.log.write(result.stdout);
+            }
+
+            if (result.stderr) {
+                grunt.log.error(result.stderr);
+            }
+            if (error) {
+                grunt.fail.fatal(`JSDoc failed with error code ${code}`);
+            } else {
+                grunt.log.write('JSDoc completed successfully'.green);
+            }
+            done();
+        });
+    });
 };

.grunt/tasks/stylelint.js

@@ -29,6 +29,7 @@ module.exports = grunt => {
                     // Use a fully-qualified path.
                     src: files,
                     options: {
+                        quietDeprecationWarnings: true,
                         configOverrides: {
                             rules: {
                                 // These rules have to be disabled in .stylelintrc for scss compat.
@@ -45,7 +46,10 @@ module.exports = grunt => {
         return {
             stylelint: {
                 scss: {
-                    options: {syntax: 'scss'},
+                    options: {
+                        quietDeprecationWarnings: true,
+                        customSyntax: 'postcss-scss',
+                    },
                     src: files,
                 },
             },

.nvmrc

@@ -1 +1 @@
-lts/gallium
+lts/iron

.stylelintrc

@@ -1,9 +1,14 @@
 {
+    "customSyntax": "postcss-scss",
     "plugins": [
         "stylelint-csstree-validator"
     ],
     "rules": {
-        "csstree/validator": true,
+        "csstree/validator": {
+          "syntaxExtensions": [
+            "sass"
+          ]
+        },
         "at-rule-empty-line-before": [ "always",
           {"except": [ "blockless-after-blockless"], ignore: ["after-comment", "inside-block"]}
         ],
@@ -45,7 +50,7 @@
         "function-name-case": "lower",
         "function-parentheses-newline-inside": "always-multi-line",
         "function-parentheses-space-inside": "never-single-line",
-        "function-url-scheme-blacklist": ["data"],
+        "function-url-scheme-disallowed-list": ["data"],
         "function-whitespace-after": "always",
         "indentation": 4,
         "keyframe-declaration-no-important": true,
@@ -84,12 +89,19 @@
         "selector-type-no-unknown": true,
         "string-no-newline": true,
         "time-min-milliseconds": 100,
-        "unit-blacklist": ["pt"],
+        "unit-disallowed-list": ["pt"],
         "unit-case": "lower",
         "unit-no-unknown": true,
         "value-keyword-case": ["lower", {"ignoreKeywords": ["/(@|$)/"]}],
         "value-list-comma-newline-after": "always-multi-line",
         "value-list-comma-space-after": "always-single-line",
         "value-list-comma-space-before": "never",
-  }
+  },
+  "overrides": [
+    {
+      "files": ["**/yui/**/*.css"],
+      "rules": {
+      }
+    }
+  ]
 }

admin/environment.xml

@@ -3923,6 +3923,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.2" requires="3.11.8">
@@ -3939,6 +3941,7 @@
       <VENDOR name="oracle" version="19" />
     </DATABASE>
     <PHP version="8.0.0" level="required">
+      <RESTRICT function="restrict_php_version_83" message="unsupportedphpversion83" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -4112,6 +4115,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.3" requires="3.11.8">
@@ -4128,6 +4133,7 @@
       <VENDOR name="oracle" version="19" />
     </DATABASE>
     <PHP version="8.0.0" level="required">
+      <RESTRICT function="restrict_php_version_83" message="unsupportedphpversion83" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -4303,6 +4309,8 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="4.4" requires="4.1.2">
@@ -4494,6 +4502,205 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_async_backup" level="recommended">
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="4.5" requires="4.1.2">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="10.6.7" />
+      <VENDOR name="mysql" version="8.0" />
+      <VENDOR name="postgres" version="13" />
+      <VENDOR name="mssql" version="14.0" />
+      <VENDOR name="oracle" version="19" />
+    </DATABASE>
+    <PHP version="8.1.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="mbstringrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+      <PHP_EXTENSION name="sodium" level="required"/>
+      <PHP_EXTENSION name="exif" level="optional"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_sixtyfour_bits" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="sixtyfourbitsrequired" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_max_input_vars" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_admin_dir_usage" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iscustomadminwarnings" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_oracle_usage" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_async_backup" level="recommended">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/presets/classes/manager.php

@@ -761,8 +761,8 @@ class manager {
     public function delete_preset(int $presetid): void {
         global $DB;
 
-        // Check the preset exists.
-        $preset = $DB->get_record('adminpresets', ['id' => $presetid]);
+        // Check the preset exists (cannot delete the pre-installed core "Starter" and "Full" presets).
+        $preset = $DB->get_record('adminpresets', ['id' => $presetid, 'iscore' => self::NONCORE_PRESET]);
         if (!$preset) {
             throw new moodle_exception('errordeleting', 'core_adminpresets');
         }

admin/presets/tests/manager_test.php

@@ -16,6 +16,7 @@
 
 namespace core_adminpresets;
 
+use moodle_exception;
 use stdClass;
 
 /**
@@ -28,6 +29,14 @@ use stdClass;
  * @coversDefaultClass \core_adminpresets\manager
  */
 class manager_test extends \advanced_testcase {
+    /**
+     * Include required libraries.
+     */
+    public static function setUpBeforeClass(): void {
+        global $CFG;
+        require_once($CFG->libdir.'/adminlib.php');
+    }
+
     /**
      * Test the behaviour of protected get_site_settings method.
      *
@@ -599,10 +608,28 @@ class manager_test extends \advanced_testcase {
 
         $manager = new manager();
 
-        $this->expectException(\moodle_exception::class);
+        $this->expectException(moodle_exception::class);
+        $this->expectExceptionMessage('Error deleting from database');
         $manager->delete_preset($unexistingid);
     }
 
+    /**
+     * Test trying to delete the core/pre-defined presets
+     *
+     * @covers ::delete_preset
+     */
+    public function test_delete_preset_core(): void {
+        global $DB;
+
+        $this->resetAfterTest();
+
+        $starterpreset = $DB->get_record('adminpresets', ['iscore' => manager::STARTER_PRESET]);
+
+        $this->expectException(moodle_exception::class);
+        $this->expectExceptionMessage('Error deleting from database');
+        (new manager())->delete_preset($starterpreset->id);
+    }
+
     /**
      * Test the behaviour of delete_preset() method.
      *

admin/renderer.php

@@ -2051,8 +2051,10 @@ class core_admin_renderer extends plugin_renderer_base {
                         // We are checking installed & enabled things
                         if ($environment_result->getLevel() == 'required') {
                             $stringtouse = 'environmentrequirecustomcheck';
-                        } else {
+                        } else if ($environment_result->getLevel() == 'optional') {
                             $stringtouse = 'environmentrecommendcustomcheck';
+                        } else {
+                            $stringtouse = 'environmentshouldfixcustomcheck';
                         }
 
                     } else if ($environment_result->getPart() == 'php_setting') {
@@ -2083,7 +2085,8 @@ class core_admin_renderer extends plugin_renderer_base {
                         if ($status) {                                          //Handle ok result (ok)
                             $status = get_string('statusok');
                         } else {
-                            if ($environment_result->getLevel() == 'optional') {//Handle check result (warning)
+                            // Handle check result (warning).
+                            if (in_array($environment_result->getLevel(), ['optional', 'recommended'])) {
                                 $status = get_string('check');
                                 $warningline = true;
                             } else {                                            //Handle error result (error)

admin/roles/admins.php

@@ -38,6 +38,19 @@ if (!is_siteadmin()) {
 }
 
 $admisselector = new core_role_admins_existing_selector();
+
+if (array_key_exists('siteadmins', $CFG->config_php_settings)) {
+    echo $OUTPUT->header();
+    echo $OUTPUT->heading(get_string('manageadmins', 'core_role'), 3);
+    echo $OUTPUT->notification(get_string('siteadministratorsconfigphp', 'core_role'), \core\output\notification::NOTIFY_INFO);
+    echo $OUTPUT->box_start();
+    echo $OUTPUT->paragraph(get_string('existingadmins', 'core_role'));
+    $admisselector->display();
+    echo $OUTPUT->box_end();
+    echo $OUTPUT->footer();
+    die();
+}
+
 $potentialadmisselector = new core_role_admins_potential_selector();
 
 if ($addusersaction) {

admin/settings/h5p.php

@@ -41,4 +41,18 @@ if (!empty($defaulth5plib)) {
 
     $settings->add(new admin_settings_h5plib_handler_select('h5plibraryhandler', new lang_string('h5plibraryhandler', 'core_h5p'),
         new lang_string('h5plibraryhandler_help', 'core_h5p'), $defaulth5plib));
+
+    $setting = new admin_setting_configtextarea(
+        'core_h5p/h5pcustomcss',
+        new lang_string('h5pcustomcss', 'core_h5p'),
+        new lang_string('h5pcustomcss_help', 'core_h5p'),
+        '',
+        PARAM_NOTAGS
+    );
+    $setting->set_updatedcallback(function () {
+        // Enables use of file_storage constants.
+        \core_h5p\local\library\autoloader::register();
+        \core_h5p\file_storage::generate_custom_styles();
+    });
+    $settings->add($setting);
 }

admin/settings/security.php

@@ -152,7 +152,9 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
     $sensiblesettingsdefault .= 'server_password@@search_solr, ssl_keypassword@@search_solr, ';
     $sensiblesettingsdefault .= 'alternateserver_password@@search_solr, alternatessl_keypassword@@search_solr, ';
     $sensiblesettingsdefault .= 'test_password@@cachestore_redis, password@@mlbackend_python, ';
-    $sensiblesettingsdefault .= 'badges_badgesalt@@none, calendar_exportsalt@@none';
+    $sensiblesettingsdefault .= 'badges_badgesalt@@none, calendar_exportsalt@@none, ';
+    $sensiblesettingsdefault .= 'bigbluebuttonbn_shared_secret@@none, apikey@@tiny_premium, ';
+    $sensiblesettingsdefault .= 'matrixaccesstoken@@communication_matrix';
     $temp->add(new admin_setting_configtextarea('adminpresets/sensiblesettings',
             get_string('sensiblesettings', 'core_adminpresets'),
             get_string('sensiblesettingstext', 'core_adminpresets'),

admin/tests/behat/browse_users.feature

@@ -18,7 +18,7 @@ Feature: An administrator can browse user accounts
     When I navigate to "Users > Accounts > Browse list of users" in site administration
     # Name field always present, email field is default for showidentity.
     Then the following should exist in the "users" table:
-      | First name / Last name | Email address   |
+      | First name           | Email address   |
       | User One             | one@example.com |
       | User Two             | two@example.com |
     # Should not see other identity fields or non-default name fields.
@@ -34,7 +34,7 @@ Feature: An administrator can browse user accounts
       | alternativefullnameformat | firstnamephonetic lastname |
     When I navigate to "Users > Accounts > Browse list of users" in site administration
     Then the following should exist in the "users" table:
-      | First name - phonetic / Last name | Email address   |
+      | First name - phonetic           | Email address   |
       | Yewzer One                      | one@example.com |
       | Yoozare Two                     | two@example.com |
 
@@ -43,7 +43,7 @@ Feature: An administrator can browse user accounts
       | showuseridentity | department,profile_field_frog |
     When I navigate to "Users > Accounts > Browse list of users" in site administration
     Then the following should exist in the "users" table:
-      | First name / Last name | Favourite frog  | Department |
+      | First name           | Favourite frog  | Department |
       | User One             | Kermit          | Attack     |
       | User Two             | Tree            | Defence    |
     And I should not see "Email address" in the "table" "css_element"

admin/tool/admin_presets/classes/local/action/delete.php

@@ -16,6 +16,7 @@
 
 namespace tool_admin_presets\local\action;
 
+use core_adminpresets\manager;
 use moodle_exception;
 
 /**
@@ -34,8 +35,8 @@ class delete extends base {
     public function show(): void {
         global $DB, $OUTPUT;
 
-        // Getting the preset name.
-        $presetdata = $DB->get_record('adminpresets', ['id' => $this->id], 'name');
+        // Check the preset exists (cannot delete the pre-installed core "Starter" and "Full" presets).
+        $presetdata = $DB->get_record('adminpresets', ['id' => $this->id, 'iscore' => manager::NONCORE_PRESET], 'name');
 
         if ($presetdata) {
             $deletetext = get_string('deletepreset', 'tool_admin_presets', $presetdata->name);
@@ -64,7 +65,7 @@ class delete extends base {
      * Delete the DB preset
      */
     public function execute(): void {
-        confirm_sesskey();
+        require_sesskey();
 
         $this->manager->delete_preset($this->id);
 

admin/tool/admin_presets/classes/local/action/export.php

@@ -52,8 +52,6 @@ class export extends base {
      * Stores a preset into the DB.
      */
     public function execute(): void {
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'export', 'mode' => 'execute']);
         $this->moodleform = new export_form($url);
 
@@ -87,7 +85,7 @@ class export extends base {
      * @throws xml_writer_exception
      */
     public function download_xml(): void {
-        confirm_sesskey();
+        require_sesskey();
 
         list($xmlstr, $filename) = $this->manager->download_preset($this->id);
 

admin/tool/admin_presets/classes/local/action/import.php

@@ -40,8 +40,6 @@ class import extends base {
      * Imports the xmlfile into DB
      */
     public function execute(): void {
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'import', 'mode' => 'execute']);
         $this->moodleform = new import_form($url);
 

admin/tool/admin_presets/classes/local/action/load.php

@@ -38,8 +38,6 @@ class load extends base {
     public function execute(): void {
         global $OUTPUT;
 
-        confirm_sesskey();
-
         $url = new \moodle_url('/admin/tool/admin_presets/index.php', ['action' => 'load', 'mode' => 'execute']);
         $this->moodleform = new load_form($url);
 

admin/tool/admin_presets/classes/local/action/rollback.php

@@ -73,7 +73,7 @@ class rollback extends base {
     public function execute(): void {
         global $OUTPUT;
 
-        confirm_sesskey();
+        require_sesskey();
 
         list($presetapp, $rollback, $failures) = $this->manager->revert_preset($this->id);
 

admin/tool/analytics/model.php

@@ -97,28 +97,28 @@ if ($onlycli === false) {
 switch ($action) {
 
     case 'enable':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->enable();
         redirect($returnurl);
         break;
 
     case 'disable':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->update(0, false, false);
         redirect($returnurl);
         break;
 
     case 'delete':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->delete();
         redirect($returnurl);
         break;
 
     case 'edit':
-        confirm_sesskey();
+        require_sesskey();
 
         $invalidcurrenttimesplitting = $model->invalid_timesplitting_selected();
         $potentialtimesplittings = $model->get_potential_timesplittings();
@@ -183,7 +183,7 @@ switch ($action) {
         break;
 
     case 'evaluate':
-        confirm_sesskey();
+        require_sesskey();
 
         if ($model->is_static()) {
             throw new moodle_exception('errornostaticevaluate', 'tool_analytics');
@@ -226,7 +226,7 @@ switch ($action) {
         break;
 
     case 'scheduledanalysis':
-        confirm_sesskey();
+        require_sesskey();
 
         if ($onlycli) {
             throw new moodle_exception('erroronlycli', 'tool_analytics');
@@ -292,7 +292,7 @@ switch ($action) {
         break;
 
     case 'clear':
-        confirm_sesskey();
+        require_sesskey();
 
         $model->clear();
         redirect($returnurl);

admin/tool/behat/tests/behat/tabs.feature

@@ -27,8 +27,8 @@ Feature: Confirm that we can open multiple browser tabs
     # Switch between all the tabs and confirm their different contents.
     Then I should see "You're not enrolled in any course"
     And I switch to "CourseViewer2" tab
-    And I should see "Course 3" in the "h1" "css_element"
+    And "Course 3" "heading" should exist
     And I switch to "CourseViewer1" tab
-    And I should see "Course 2" in the "h1" "css_element"
+    And "Course 2" "heading" should exist
     And I switch to the main tab
-    And I should see "Course 1" in the "h1" "css_element"
+    And "Course 1" "heading" should exist

admin/tool/behat/tests/manager_util_test.php

@@ -25,6 +25,10 @@
  * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 
+namespace tool_behat;
+
+use behat_config_util;
+
 defined('MOODLE_INTERNAL') || die();
 
 global $CFG;
@@ -39,7 +43,7 @@ require_once($CFG->libdir . '/behat/classes/behat_config_manager.php');
  * @copyright  2016 Rajesh Taneja
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
-class tool_behat_manager_util_testcase extends advanced_testcase {
+class manager_util_test extends \advanced_testcase {
 
     /** @var array Fixtures features which are available. */
     private $featurepaths = array(

admin/tool/customlang/tests/behat/customisation_create.feature

@@ -22,12 +22,12 @@ Feature: Within a moodle instance, an administrator should be able to modify lan
   Scenario: Edit an string but don't save it to lang pack.
     When I press "Apply changes and continue editing"
     Then I should not see "moodle documents" in the "page-footer" "region"
-    And I should see "Help and documentation" in the "page-footer" "region"
+    And I should see "Documentation for this page" in the "page-footer" "region"
 
   @javascript
   Scenario: Customize an string as admin and save it to lang pack.
     Given I press "Save changes to the language pack"
     And I should see "There are 1 modified strings."
     When I click on "Continue" "button"
-    Then I should not see "Help and documentation" in the "page-footer" "region"
+    Then I should not see "Documentation for this page" in the "page-footer" "region"
     And I should see "moodle documents" in the "page-footer" "region"

admin/tool/dataprivacy/classes/data_request.php

@@ -156,9 +156,9 @@ class data_request extends persistent {
                 case api::DATAREQUEST_STATUS_EXPIRED:
                     $result = true;
                     break;
-                // Complete requests are expired if the expiry time has elapsed.
+                // Complete requests are expired if the expiry time is a positive value, and has elapsed.
                 case api::DATAREQUEST_STATUS_DOWNLOAD_READY:
-                    $expiryseconds = get_config('tool_dataprivacy', 'privacyrequestexpiry');
+                    $expiryseconds = (int) get_config('tool_dataprivacy', 'privacyrequestexpiry');
                     if ($expiryseconds > 0 && time() >= ($request->get('timemodified') + $expiryseconds)) {
                         $result = true;
                     }
@@ -179,7 +179,12 @@ class data_request extends persistent {
     public static function get_expired_requests($userid = 0) {
         global $DB;
 
-        $expiryseconds = get_config('tool_dataprivacy', 'privacyrequestexpiry');
+        // Complete requests are expired if the expiry time is a positive value, and has elapsed.
+        $expiryseconds = (int) get_config('tool_dataprivacy', 'privacyrequestexpiry');
+        if ($expiryseconds <= 0) {
+            return [];
+        }
+
         $expirytime = strtotime("-{$expiryseconds} second");
         $table = self::TABLE;
         $sqlwhere = 'type = :export_type AND status = :completestatus AND timemodified <= :expirytime';

admin/tool/dataprivacy/lang/en/tool_dataprivacy.php

@@ -47,7 +47,7 @@ $string['cachedef_purpose'] = 'Data purposes';
 $string['cachedef_purpose_overrides'] = 'Purpose overrides in the Data privacy tool';
 $string['cachedef_contextlevel'] = 'Context levels purpose and category';
 $string['cancelrequest'] = 'Cancel request';
-$string['cancelrequestconfirmation'] = 'Do you really want cancel this data request?';
+$string['cancelrequestconfirmation'] = 'Do you want to cancel this data request?';
 $string['cannotreset'] = 'Unable to reset this request. Only rejected requests can be reset.';
 $string['categories'] = 'Categories';
 $string['category'] = 'Category';

admin/tool/dataprivacy/tests/behat/dataexport.feature

@@ -185,7 +185,7 @@ Feature: Data export from the privacy API
     And I reload the page
     And I should see "Download ready" in the "Victim User 1" "table_row"
     And I open the action menu in "Victim User 1" "table_row"
-    And following "Download" should download between "1" and "170000" bytes
+    And following "Download" should download between "1" and "172000" bytes
     And the following config values are set as admin:
       | privacyrequestexpiry | 1 | tool_dataprivacy |
     And I wait "1" seconds

admin/tool/dataprivacy/tests/expired_data_requests_test.php

@@ -26,10 +26,11 @@ require_once('data_privacy_testcase.php');
  * Expired data requests tests.
  *
  * @package    tool_dataprivacy
+ * @covers     \tool_dataprivacy\data_request
  * @copyright  2018 Michael Hawkins
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
-class expired_data_requests_test extends data_privacy_testcase {
+final class expired_data_requests_test extends data_privacy_testcase {
 
     /**
      * Test tearDown.
@@ -107,6 +108,52 @@ class expired_data_requests_test extends data_privacy_testcase {
         $this->assertEquals(0, $DB->count_records('files', $fileconditions));
     }
 
+    /**
+     * Test that data requests are not expired when expiration is disabled (set to zero)
+     */
+    public function test_data_request_expiry_never(): void {
+        global $DB;
+
+        $this->resetAfterTest();
+
+        \core_privacy\local\request\writer::setup_real_writer_instance();
+
+        // Disable request expiry.
+        set_config('privacyrequestexpiry', 0, 'tool_dataprivacy');
+
+        // Create and approve data request.
+        $user = $this->getDataGenerator()->create_user();
+        $usercontext = \context_user::instance($user->id);
+
+        $this->setUser($user->id);
+        $datarequest = api::create_data_request($user->id, api::DATAREQUEST_TYPE_EXPORT);
+        $requestid = $datarequest->get('id');
+
+        $this->setAdminUser();
+        api::approve_data_request($requestid);
+
+        ob_start();
+        $this->runAdhocTasks('\tool_dataprivacy\task\process_data_request_task');
+        ob_end_clean();
+
+        // Run expiry deletion - should not affect test export.
+        $expiredrequests = data_request::get_expired_requests();
+        $this->assertEmpty($expiredrequests);
+        data_request::expire($expiredrequests);
+
+        // Confirm approved and exported.
+        $request = new data_request($requestid);
+        $this->assertEquals(api::DATAREQUEST_STATUS_DOWNLOAD_READY, $request->get('status'));
+        $fileconditions = [
+            'userid' => $user->id,
+            'component' => 'tool_dataprivacy',
+            'filearea' => 'export',
+            'itemid' => $requestid,
+            'contextid' => $usercontext->id,
+        ];
+        $this->assertEquals(2, $DB->count_records('files', $fileconditions));
+    }
+
     /**
      * Test for \tool_dataprivacy\data_request::is_expired()
      * Tests for the expected request status to protect from false positive/negative,

admin/tool/dataprivacy/tests/task/task_test.php

@@ -16,6 +16,7 @@
 
 namespace tool_dataprivacy\task;
 
+use core\task\task_trait;
 use tool_dataprivacy\api;
 
 defined('MOODLE_INTERNAL') || die();
@@ -30,6 +31,8 @@ require_once(__DIR__ . '/../data_privacy_testcase.php');
  */
 class task_test extends \data_privacy_testcase {
 
+    use task_trait;
+
     /**
      * Test tearDown.
      */
@@ -215,17 +218,4 @@ class task_test extends \data_privacy_testcase {
         $this->assertCount(1, \tool_dataprivacy\api::get_data_requests($user->id,
                 [api::DATAREQUEST_STATUS_CANCELLED], [api::DATAREQUEST_TYPE_DELETE]));
     }
-
-    /**
-     * Helper to execute a particular task.
-     *
-     * @param string $task The task.
-     */
-    private function execute_task($task) {
-        // Run the scheduled task.
-        ob_start();
-        $task = \core\task\manager::get_scheduled_task($task);
-        $task->execute();
-        ob_end_clean();
-    }
 }

admin/tool/filetypes/tests/behat/add_filetypes.feature

@@ -120,8 +120,7 @@ Feature: Add customised file types
       | Custom description | Froggy file                               |
     And I press "Save changes"
     # Create a resource activity and add it to a course
-    And I am on "Course 1" course homepage with editing mode on
-    When I add a "File" to section "1"
+    When I add a resource activity to course "Course 1" section "1"
     And I set the following fields to these values:
       | Name        | An example of customised file type |
       | Description | File description                   |

admin/tool/filetypes/tests/tool_filetypes_test.php

@@ -82,12 +82,24 @@ class tool_filetypes_test extends advanced_testcase {
     }
 
     /**
-     * Test get_file_icons() function to confirm no file icons are removed/added by mistake.
+     * Test get_file_icons() function to confirm no file icons are removed by mistake.
      *
      * @covers ::get_file_icons
      */
     public function test_get_file_icons() {
         $icons = utils::get_file_icons();
-        $this->assertCount(31, $icons);
+        $filetypes = core_filetypes::get_types();
+
+        $requiredicons = array_column($filetypes, 'icon');
+        $requireduniqueicons = array_unique($requiredicons);
+
+        // The 'folder' icon is not a file, however the test validates no
+        // file icons are removed by mistake from the directory pix/f.
+        // Adding the folder icon manually completes the scope of this test.
+        $requireduniqueicons[] = 'folder';
+
+        foreach ($requireduniqueicons as $requiredicon) {
+            $this->assertArrayHasKey($requiredicon, $icons, "Icon '$requiredicon' is missing.");
+        }
     }
 }

admin/tool/langimport/classes/locale.php

@@ -57,7 +57,7 @@ class locale {
         }
 
         // Store current locale.
-        $currentlocale = $this->set_locale(LC_ALL, 0);
+        $currentlocale = $this->get_locale();
 
         $locale = get_string_manager()->get_string($stringtofetch, 'langconfig', $a = null, $langpackcode);
 
@@ -79,19 +79,16 @@ class locale {
      * @return string|false Returns the new current locale, or FALSE on error.
      */
     protected function set_locale(int $category = LC_ALL, string $locale = '0') {
-        if (strlen($locale) <= 255 || PHP_OS_FAMILY === 'BSD' || PHP_OS_FAMILY === 'Darwin') {
-            // We can set the whole locale all together.
-            return setlocale($category, $locale);
-        }
+        return \core\locale::set_locale($category, $locale);
+    }
 
-        // Too long locale with linux or windows, let's split it into known and supported categories.
-        $split = explode(';', $locale);
-        foreach ($split as $element) {
-            [$category, $value] = explode('=', $element);
-            if (defined($category)) { // Only if the category exists, there are OS differences.
-                setlocale(constant($category), $value);
-            }
-        }
-        return setlocale(LC_ALL, 0); // Finally, return the complete configured locale.
+    /**
+     * Get the current locale.
+     *
+     * @param int $category
+     * @return string|false
+     */
+    protected function get_locale(int $category = LC_ALL): string|false {
+        return \core\locale::get_locale($category);
     }
 }

admin/tool/langimport/index.php

@@ -114,7 +114,7 @@ if ($mode == DELETION_OF_SELECTED_LANG and (!empty($uninstalllang) or !empty($co
     }
 }
 
-if ($mode == UPDATE_ALL_LANG) {
+if ($mode == UPDATE_ALL_LANG && confirm_sesskey()) {
     core_php_time_limit::raise();
     $controller->update_all_installed_languages();
 }

admin/tool/langimport/templates/langimport.mustache

@@ -87,6 +87,7 @@
                 <div>
                     <form id="updateform" action="{{updateurl}}" method="post">
                         <fieldset>
+                            <input type="hidden" name="sesskey" value="{{sesskey}}">
                             <input type="submit" value="{{#str}}updatelangs, tool_langimport{{/str}}" class="btn btn-secondary">
                             {{#hasmanyinstalledlanguages}}
                                 <p class="mt-2 small">{{#str}} updatelangsnote, tool_langimport, {"taskname": {{#quote}}{{updatelangstaskname}}{{/quote}} }{{/str}}</p>

admin/tool/langimport/tests/locale_test.php

@@ -21,39 +21,59 @@ namespace tool_langimport;
  *
  * @package    tool_langimport
  * @category   test
- * @coversDefaultClass \tool_langimport\locale
+ * @covers \tool_langimport\locale
  * @copyright  2018 Université Rennes 2 {@link https://www.univ-rennes2.fr}
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
-class locale_test extends \advanced_testcase {
+final class locale_test extends \advanced_testcase {
+    /** @var string Locale */
+    protected string $locale;
+
+    #[\Override]
+    public function setUp(): void {
+        parent::setUp();
+        $this->locale = \core\locale::get_locale();
+    }
+
+    #[\Override]
+    public function tearDown(): void {
+        parent::tearDown();
+        \core\locale::set_locale(LC_ALL, $this->locale);
+    }
+
     /**
      * Test that \tool_langimport\locale::check_locale_availability() works as expected.
-     *
-     * @covers ::check_locale_availability
-     * @return void
      */
-    public function test_check_locale_availability() {
-        // Create a mock of set_locale() method to simulate :
-        // - first setlocale() call which backup current locale
-        // - second setlocale() call which try to set new 'es' locale
-        // - third setlocale() call which restore locale.
+    public function test_check_locale_availability(): void {
+        // Create a mock of set_locale() method to simulate:
+        // - get_locale() call which backup current locale
+        // - first set_locale() call which try to set new 'es' locale
+        // - second set_locale() call which restore locale.
         $mock = $this->getMockBuilder(locale::class)
-            ->onlyMethods(['set_locale'])
+            ->onlyMethods([
+                'get_locale',
+                'set_locale',
+            ])
             ->getMock();
-        $mock->method('set_locale')->will($this->onConsecutiveCalls('en', 'es', 'en'));
+        $mock->method('get_locale')->will($this->onConsecutiveCalls('en'));
+        $mock->method('set_locale')->will($this->onConsecutiveCalls('es', 'en'));
 
         // Test what happen when locale is available on system.
         $result = $mock->check_locale_availability('en');
         $this->assertTrue($result);
 
-        // Create a mock of set_locale() method to simulate :
-        // - first setlocale() call which backup current locale
-        // - second setlocale() call which fail to set new locale
-        // - third setlocale() call which restore locale.
+        // Create a mock of set_locale() method to simulate:
+        // - get_locale() call which backup current locale
+        // - first set_locale() call which fail to set new locale
+        // - second set_locale() call which restore locale.
         $mock = $this->getMockBuilder(locale::class)
-            ->onlyMethods(['set_locale'])
+            ->onlyMethods([
+                'get_locale',
+                'set_locale',
+            ])
             ->getMock();
-        $mock->method('set_locale')->will($this->onConsecutiveCalls('en', false, 'en'));
+        $mock->method('get_locale')->will($this->onConsecutiveCalls('en'));
+        $mock->method('set_locale')->will($this->onConsecutiveCalls(false, 'en'));
 
         // Test what happen when locale is not available on system.
         $result = $mock->check_locale_availability('en');
@@ -64,100 +84,4 @@ class locale_test extends \advanced_testcase {
         $this->expectException(\coding_exception::class);
         $locale->check_locale_availability('');
     }
-
-    /**
-     * Test \tool_langimport\locale::set_locale() own logic.
-     *
-     * We have to explicitly test set_locale() own logic and results,
-     * that effectively sets the current locale, so we need to restore
-     * the original locale after every test (ugly, from a purist unit test
-     * point of view, but needed).
-     *
-     * @dataProvider set_locale_provider
-     * @covers ::set_locale
-     *
-     * @param string $set locale string to be set.
-     * @param string $ret expected results returned after setting the locale.
-     */
-    public function test_set_locale(string $set, string $ret) {
-        // Make set_locale() public.
-        $loc = new locale();
-        $rc = new \ReflectionClass(locale::class);
-        $rm = $rc->getMethod('set_locale');
-        $rm->setAccessible(true);
-
-        // Capture current locale for later restore (funnily, using the set_locale() method itself.
-        $originallocale = $rm->invokeArgs($loc, [LC_ALL, 0]);
-
-        // Assert we get the locale defined as expected.
-        $this->assertEquals($ret, $rm->invokeArgs($loc, [LC_ALL, $set]));
-
-        // We have finished, restore the original locale, so this doesn't affect other tests at distance.
-        // (again, funnily, using the very same set_locale() method).
-        $rm->invokeArgs($loc, [LC_ALL, $originallocale]);
-
-    }
-
-    /**
-     * Data provider for test_set_locale().
-     *
-     * Provides a locale to be set (as 'set') and a expected return value (as 'ret'). Note that
-     * some of the locales are OS dependent, so only the ones matching the OS will be provided.
-     *
-     * We make extensive use of the en_AU.UTF-8/English_Australia.1252 locale that is mandatory to
-     * be installed in any system running PHPUnit tests.
-     */
-    public function set_locale_provider(): array {
-        // Let's list the allowed categories by OS.
-        $bsdallowed = ['LC_COLLATE', 'LC_CTYPE', 'LC_MESSAGES', 'LC_MONETARY', 'LC_NUMERIC', 'LC_TIME'];
-        $winallowed = ['LC_COLLATE', 'LC_CTYPE', 'LC_MONETARY', 'LC_NUMERIC', 'LC_TIME'];
-        $linuxallowed = [
-            'LC_COLLATE', 'LC_CTYPE', 'LC_MESSAGES', 'LC_MONETARY', 'LC_NUMERIC', 'LC_TIME',
-            'LC_PAPER', 'LC_NAME', 'LC_ADDRESS', 'LC_TELEPHONE', 'LC_MEASUREMENT', 'LC_IDENTIFICATION'
-        ];
-
-        // The base locale name is also OS dependent.
-        $baselocale = get_string('locale', 'langconfig');
-        if (PHP_OS_FAMILY === 'Windows') {
-            $baselocale = get_string('localewin', 'langconfig');
-        }
-
-        // Here we'll go accumulating cases to be provided.
-        $cases = [];
-
-        // First, the simplest case, just pass a locale name, without categories.
-        $cases['rawlocale'] = [
-            'set' => $baselocale,
-            'ret' => $baselocale,
-        ];
-
-        // Now, let's fill ALL LC categories, we should get back the locale name if all them are set with same value.
-        // Note that this case is the one that, under Linux only, covers the changes performed to the set_locale() method.
-        // Pick the correct categories depending on the OS.
-        $oscategories = $bsdallowed; // Default to BSD/Dawrwin ones because they are the standard 6 supported by PHP.
-        if (PHP_OS_FAMILY === 'Windows') {
-            $oscategories = $winallowed;
-        } else if (PHP_OS_FAMILY === 'Linux') {
-            $oscategories = $linuxallowed;
-        }
-
-        $localestr = '';
-        foreach ($oscategories as $category) {
-            // Format is different by OS too, so let build the string conditionally.
-            if (PHP_OS_FAMILY === 'BSD' || PHP_OS_FAMILY === 'Darwin') {
-                // BSD uses slashes (/) separated list of the 6 values in exact order.
-                $localestr .= '/' . $baselocale;
-            } else {
-                // Linux/Windows use semicolon (;) separated list of category=value pairs.
-                $localestr .= ';' . $category . '=' . $baselocale;
-            }
-        }
-        $cases['allcategories'] = [
-            'set' => trim($localestr, ';/'),
-            'ret' => $baselocale,
-        ];
-
-        // Return all the built cases.
-        return $cases;
-    }
 }

admin/tool/licensemanager/classes/form/edit_license.php

@@ -77,7 +77,7 @@ class edit_license extends moodleform {
         $mform = $this->_form;
 
         $mform->addElement('text', 'shortname', get_string('shortname', 'tool_licensemanager'));
-        $mform->setType('shortname', PARAM_ALPHANUMEXT);
+        $mform->setType('shortname', PARAM_NOTAGS);
         // Shortname is only editable when user is creating a license.
         if ($this->action != manager::ACTION_CREATE) {
             $mform->freeze('shortname');

admin/tool/licensemanager/index.php

@@ -29,7 +29,7 @@ require_once($CFG->libdir . '/licenselib.php');
 require_admin();
 
 $action = optional_param('action', '', PARAM_ALPHANUMEXT);
-$license = optional_param('license', '', PARAM_SAFEDIR);
+$license = optional_param('license', '', PARAM_NOTAGS);
 
 // Route via the manager.
 $licensemanager = new \tool_licensemanager\manager();

admin/tool/licensemanager/tests/behat/delete_license.feature

@@ -37,8 +37,8 @@ Feature: Delete custom licenses
       | Licence version | ##1 March 2019##                    |
     And I press "Save changes"
     And I follow "Private files" in the user menu
-    And I upload "lib/editor/atto/tests/fixtures/moodle-logo.png" file to "Files" filemanager
-    And I click on "moodle-logo.png" "link"
+    And I upload "lib/tests/fixtures/gd-logo.png" file to "Files" filemanager
+    And I click on "gd-logo.png" "link"
     And I set the field "Choose licence" to "Test licence"
     And I press "Update"
     And I press "Save changes"

admin/tool/log/tests/behat/logstore_store_visibility_change.feature

@@ -14,6 +14,6 @@ Feature: In a report, admin can see logstore visibility changes
     And I click on "Enable" "icon" in the "External database log" "table_row"
     And I navigate to "Reports > Config changes" in site administration
     Then the following should exist in the "reportbuilder-table" table:
-      | User       | Plugin               | Setting                  | New value | Original value |
+      | First name | Plugin               | Setting                  | New value | Original value |
       | Admin User | logstore_standard    | tool_logstore_visibility | 0         | 1              |
       | Admin User | logstore_database    | tool_logstore_visibility | 1         | 0              |

admin/tool/lp/classes/output/manage_competency_frameworks_page.php

@@ -75,7 +75,7 @@ class manage_competency_frameworks_page implements renderable, templatable {
             );
             $this->navigation[] = $addpage;
             $competenciesrepository = new single_button(
-                new moodle_url('https://archive.moodle.net/competencies'),
+                new moodle_url('https://moodle.net/search', ['q' => 'competency frameworks']),
                 get_string('competencyframeworksrepository', 'tool_lp'),
                 'get'
             );

admin/tool/lp/templates/course_competencies_page.mustache

@@ -102,7 +102,7 @@
         <strong>{{#str}}activities{{/str}}</strong>
         <ul class="inline list-inline p-2">
         {{#coursemodules}}
-            <li class="list-inline-item"><a href="{{url}}"><img src="{{iconurl}}"> {{name}} </a></li>
+            <li class="list-inline-item"><a href="{{url}}"><img class="icon" src="{{iconurl}}"> {{name}} </a></li>
         {{/coursemodules}}
         {{^coursemodules}}
             <li class="list-inline-item">{{#str}}noactivities, tool_lp{{/str}}</li>

admin/tool/lp/templates/form-user-selector-suggestion.mustache

@@ -49,7 +49,7 @@
     }
 }}
 <span>
-    <img height="12" src="{{profileimageurlsmall}}" alt="" role="presentation">
+    <img height="12" src="{{profileimageurlsmall}}" alt="">
     <span>{{fullname}}</span>
     {{#hasidentity}}
     <span><small>{{identity}}</small></span>

admin/tool/lp/templates/user_competency_summary_in_course.mustache

@@ -49,7 +49,7 @@
         <p>
         <ul class="inline list-inline">
         {{#coursemodules}}
-            <li class="list-inline-item"><a href="{{url}}"><img src="{{iconurl}}"> {{name}} </a></li>
+            <li class="list-inline-item"><a href="{{url}}"><img class="icon" src="{{iconurl}}" alt=""> {{name}} </a></li>
         {{/coursemodules}}
         {{^coursemodules}}
             <li class="list-inline-item"><span class="alert">{{#str}}noactivities, tool_lp{{/str}}</span></li>

admin/tool/lp/templates/user_summary.mustache

@@ -50,7 +50,7 @@
 }}
 <span>
     <a href="{{profileurl}}" title="{{#str}}viewprofile{{/str}}">
-    <img height="18" src="{{profileimageurlsmall}}" alt="" role="presentation">
+    <img height="18" src="{{profileimageurlsmall}}" alt="">
     <span>{{fullname}}</span>
     {{#hasidentity}}
     <span><small>{{identity}}</small></span>

admin/tool/mfa/auth.php

@@ -42,7 +42,20 @@ $PAGE->set_title($pagetitle);
 
 // Logout if it was requested.
 $logout = optional_param('logout', false, PARAM_BOOL);
+$sesskey = optional_param('sesskey', '_none_', PARAM_RAW);
+
 if ($logout) {
+    if (!confirm_sesskey($sesskey)) {
+        echo $OUTPUT->header();
+        echo $OUTPUT->confirm(
+            get_string('logoutconfirm'),
+            new moodle_url($PAGE->url, ['logout' => 1, 'sesskey' => sesskey()]),
+            new moodle_url('/'),
+        );
+        echo $OUTPUT->footer();
+        die;
+    }
+
     if (!empty($SESSION->wantsurl)) {
         // If we have the wantsurl, we should redirect there, to keep it intact.
         $wantsurl = $SESSION->wantsurl;

admin/tool/mfa/classes/hook/after_user_passed_mfa.php

@@ -0,0 +1,51 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_mfa\hook;
+
+use core\hook\described_hook;
+use core\hook\stoppable_trait;
+
+/**
+ * Allow plugins to callback as soon possible after user has passed MFA.
+ *
+ * @package    tool_mfa
+ * @copyright  2024 Juan Leyva
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class after_user_passed_mfa implements
+    described_hook,
+    \Psr\EventDispatcher\StoppableEventInterface {
+    use stoppable_trait;
+
+    /**
+     * Describes the hook purpose.
+     *
+     * @return string
+     */
+    public static function get_hook_description(): string {
+        return 'Allow plugins to callback as soon possible after user has passed MFA.';
+    }
+
+    /**
+     * List of tags that describe this hook.
+     *
+     * @return string[]
+     */
+    public static function get_hook_tags(): array {
+        return ['login'];
+    }
+}

admin/tool/mfa/classes/local/form/verification_field.php

@@ -73,10 +73,11 @@ class verification_field extends \MoodleQuickForm_text {
         return parent::__construct($elementname, $elementlabel, $attributes);
     }
 
-    // @codingStandardsIgnoreStart
     /**
      * Returns HTML for this form element.
      *
+     * phpcs:disable moodle.NamingConventions.ValidFunctionName.LowercaseMethod
+     *
      * @return string
      */
     public function toHtml(): string {
@@ -98,7 +99,6 @@ class verification_field extends \MoodleQuickForm_text {
         }
         return $result;
     }
-    // @codingStandardsIgnoreEnd
 
     /**
      * Setup and return the script for autosubmission while inside the secure layout.

admin/tool/mfa/classes/manager.php

@@ -332,6 +332,10 @@ class manager {
             $event = \tool_mfa\event\user_passed_mfa::user_passed_mfa_event($USER);
             $event->trigger();
 
+            // Allow plugins to callback as soon possible after user has passed MFA.
+            $hook = new \tool_mfa\hook\after_user_passed_mfa();
+            \core\hook\manager::get_instance()->dispatch($hook);
+
             // Add/update record in DB for users last mfa auth.
             self::update_pass_time();
 
@@ -345,12 +349,10 @@ class manager {
             try {
                 // Clear locked user factors, they may now reauth with anything.
                 @$DB->set_field('tool_mfa', 'lockcounter', 0, ['userid' => $USER->id]);
-            // @codingStandardsIgnoreStart
+                // phpcs:ignore Generic.CodeAnalysis.EmptyStatement.DetectedCatch
             } catch (\Exception $e) {
                 // This occurs when upgrade.php hasn't been run. Nothing to do here.
-                // Coding standards ignored, they break on empty catches.
             }
-            // @codingStandardsIgnoreEnd
 
             // Fire post pass state factor actions.
             $factors = factor::get_active_user_factor_types();

admin/tool/mfa/classes/output/renderer.php

@@ -16,6 +16,7 @@
 
 namespace tool_mfa\output;
 
+use core\context\system;
 use tool_mfa\local\factor\object_factor;
 use tool_mfa\local\form\login_form;
 use \html_writer;
@@ -222,7 +223,8 @@ class renderer extends \plugin_renderer_base {
         // Support link.
         $supportemail = $CFG->supportemail;
         if (!empty($supportemail)) {
-            $subject = get_string('email:subject', 'tool_mfa', $SITE->fullname);
+            $subject = get_string('email:subject', 'tool_mfa',
+                format_string($SITE->fullname, true, ['context' => system::instance()]));
             $maillink = \html_writer::link("mailto:$supportemail?Subject=$subject", $supportemail);
             $notification .= get_string('error:support', 'tool_mfa');
             $notification .= \html_writer::tag('p', $maillink);
@@ -333,8 +335,8 @@ class renderer extends \plugin_renderer_base {
 
         // Auth rows.
         $authtypes = get_enabled_auth_plugins(true);
-        $row = [];
         foreach ($authtypes as $authtype) {
+            $row = [];
             $row[] = \html_writer::tag('b', $authtype);
 
             // Setup the overall totals columns.
@@ -635,6 +637,7 @@ class renderer extends \plugin_renderer_base {
                 'hasadditionalfactors' => $hasadditionalfactors,
                 'additionalfactors' => $alladitionalfactors,
                 'authurl' => $authurl->out(),
+                'sesskey' => sesskey(),
                 'supportlink' => $this->get_support_link(),
                 'disablefactor' => $disablefactor
         ];

admin/tool/mfa/factor/email/email.php

@@ -22,13 +22,14 @@
  * @copyright   Catalyst IT
  * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
+
 // Ignore coding standards for login check, this page does not require login.
-// @codingStandardsIgnoreStart
-require_once(__DIR__ . '../../../../../../config.php');
+// phpcs:disable moodle.Files.RequireLogin.Missing
+require_once(__DIR__ . '/../../../../../config.php');
+
 $instanceid = required_param('instance', PARAM_INT);
 $pass = optional_param('pass', '0', PARAM_INT);
 $secret = optional_param('secret', 0, PARAM_INT);
-// @codingStandardsIgnoreEnds
 
 $context = context_system::instance();
 $PAGE->set_context($context);

admin/tool/mfa/index.php

@@ -31,8 +31,7 @@ require_once($CFG->libdir.'/tablelib.php');
 require_login(null, false);
 require_capability('moodle/site:config', context_system::instance());
 
-global $_SERVER;
-$returnurl = $_SERVER['HTTP_REFERER'];
+$returnurl = get_local_referer(false);
 
 $PAGE->set_url('/admin/tool/mfa/index.php');
 

admin/tool/mfa/lib.php

@@ -112,6 +112,10 @@ function tool_mfa_after_config(): void {
  * @return array
  */
 function tool_mfa_bulk_user_actions(): array {
+    if (!has_capability('moodle/site:config', context_system::instance())) {
+        return [];
+    }
+
     return [
         'tool_mfa_reset_factors' => new action_link(
             new moodle_url('/admin/tool/mfa/reset_factor.php'),

admin/tool/mfa/templates/verification_form.mustache

@@ -83,6 +83,7 @@
     <div class="d-flex justify-content-center">
         <form id="cancelmfa" method="POST" action="{{{authurl}}}">
             <input type="hidden" id="{{uniqid}}-logout" name="logout" value="true">
+            <input type="hidden" name="sesskey" value="{{sesskey}}">
             <input type="submit" class="btn btn-secondary"
                    name="cancelmfa" id="cancelmfa_button"
                    value="{{#str}} cancellogin, tool_mfa {{/str}}">

admin/tool/mobile/classes/api.php

@@ -388,6 +388,14 @@ class api {
                 $CFG->searchbanner, FORMAT_HTML, $context)[0];
         }
 
+        if (empty($section) || $section === 'h5psettings') {
+            \core_h5p\local\library\autoloader::register();
+            $customcss = \core_h5p\file_storage::get_custom_styles();
+            if (!empty($customcss)) {
+                $settings->h5pcustomcssurl = $customcss['cssurl']->out() . '?ver=' . $customcss['cssversion'];
+            }
+        }
+
         return $settings;
     }
 
@@ -443,13 +451,13 @@ class api {
     public static function get_qrlogin_key(stdClass $mobilesettings) {
         global $USER;
         // Delete previous keys.
-        delete_user_key('tool_mobile', $USER->id);
+        delete_user_key('tool_mobile/qrlogin', $USER->id);
 
         // Create a new key.
         $iprestriction = !empty($mobilesettings->qrsameipcheck) ? getremoteaddr(null) : null;
         $qrkeyttl = !empty($mobilesettings->qrkeyttl) ? $mobilesettings->qrkeyttl : self::LOGIN_QR_KEY_TTL;
         $validuntil = time() + $qrkeyttl;
-        return create_user_key('tool_mobile', $USER->id, null, $iprestriction, $validuntil);
+        return create_user_key('tool_mobile/qrlogin', $USER->id, null, $iprestriction, $validuntil);
     }
 
     /**

admin/tool/mobile/classes/external.php

@@ -648,8 +648,8 @@ class external extends external_api {
         api::check_autologin_prerequisites($params['userid']);  // Checks https, avoid site admins using this...
 
         // Validate and delete the key.
-        $key = validate_user_key($params['qrloginkey'], 'tool_mobile', null);
-        delete_user_key('tool_mobile', $params['userid']);
+        $key = validate_user_key($params['qrloginkey'], 'tool_mobile/qrlogin', null);
+        delete_user_key('tool_mobile/qrlogin', $params['userid']);
 
         // Double check key belong to user.
         if ($key->userid != $params['userid']) {

admin/tool/mobile/classes/hook_callbacks.php

@@ -0,0 +1,55 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_mobile;
+
+use core\session\utility\cookie_helper;
+
+/**
+ * Allows plugins to add any elements to the footer.
+ *
+ * @package    tool_mobile
+ * @copyright  2024 Juan Leyva
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class hook_callbacks {
+    /**
+     * Callback to recover $SESSION->wantsurl.
+     *
+     * @param \core_user\hook\after_login_completed $hook
+     */
+    public static function after_login_completed(
+        \core_user\hook\after_login_completed $hook,
+    ): void {
+        global $SESSION, $CFG;
+
+        // Check if the user is doing a mobile app launch, if that's the case, ensure $SESSION->wantsurl is correctly set.
+        if (!NO_MOODLE_COOKIES && !empty($_COOKIE['tool_mobile_launch'])) {
+            if (empty($SESSION->wantsurl) || strpos($SESSION->wantsurl, '/tool/mobile/launch.php') === false) {
+                $params = json_decode($_COOKIE['tool_mobile_launch'], true);
+                $SESSION->wantsurl = (new \moodle_url("/$CFG->admin/tool/mobile/launch.php", $params))->out(false);
+            }
+        }
+
+        // Set Partitioned and Secure attributes to the MoodleSession cookie if the user is using the Moodle app.
+        if (\core_useragent::is_moodle_app()) {
+            cookie_helper::add_attributes_to_cookie_response_header(
+                'MoodleSession' . $CFG->sessioncookie,
+                ['Secure', 'Partitioned'],
+            );
+        }
+    }
+}

admin/tool/mobile/classes/local/hooks/user/after_user_passed_mfa.php

@@ -0,0 +1,49 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_mobile\local\hooks\user;
+
+/**
+ * Handles mobile app launches when third-party auth plugins are put in front of MFA.
+ *
+ * @package    tool_mobile
+ * @copyright  2024 Juan Leyva
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class after_user_passed_mfa {
+    /**
+     * Callback to recover $SESSION->wantsurl.
+     *
+     * @param \tool_mfa\hook\after_user_passed_mfa $hook
+     */
+    public static function callback(\tool_mfa\hook\after_user_passed_mfa $hook): void {
+        global $SESSION, $CFG;
+
+        // Check if the user is doing a mobile app launch, if that's the case, ensure $SESSION->wantsurl is correctly set.
+        if (!NO_MOODLE_COOKIES && !empty($_COOKIE['tool_mobile_launch'])) {
+            if (empty($SESSION->wantsurl) || strpos($SESSION->wantsurl, '/tool/mobile/launch.php') === false) {
+                $params = json_decode($_COOKIE['tool_mobile_launch'], true);
+                $SESSION->wantsurl = (new \moodle_url("/$CFG->admin/tool/mobile/launch.php", $params))->out(false);
+                $SESSION->tool_mfa_has_been_redirected = true;  // Indicate MFA that they need to follow $SESSION->wantsurl.
+            }
+            // Invalidate cookie as we won't be needing it anymore.
+            unset($_COOKIE['tool_mobile_launch']);
+            if (!headers_sent()) {  // Just be very cautios as this is a critical code.
+                setcookie('tool_mobile_launch', '', -1, $CFG->sessioncookiepath);
+            }
+        }
+    }
+}

admin/tool/mobile/classes/privacy/provider.php

@@ -66,7 +66,7 @@ class provider implements
                   FROM {user_private_key} k
                   JOIN {user} u ON k.userid = u.id
                   JOIN {context} ctx ON ctx.instanceid = u.id AND ctx.contextlevel = :contextlevel
-                 WHERE k.userid = :userid AND k.script = 'tool_mobile'";
+                 WHERE k.userid = :userid AND (k.script = 'tool_mobile' OR k.script = 'tool_mobile/qrlogin')";
         $params = ['userid' => $userid, 'contextlevel' => CONTEXT_USER];
         $contextlist = new contextlist();
         $contextlist->add_from_sql($sql, $params);
@@ -88,6 +88,7 @@ class provider implements
 
         // Add users based on userkey.
         \core_userkey\privacy\provider::get_user_contexts_with_script($userlist, $context, 'tool_mobile');
+        \core_userkey\privacy\provider::get_user_contexts_with_script($userlist, $context, 'tool_mobile/qrlogin');
     }
 
     /**
@@ -108,6 +109,7 @@ class provider implements
         }
         // Export associated userkeys.
         \core_userkey\privacy\provider::export_userkeys($context, [], 'tool_mobile');
+        \core_userkey\privacy\provider::export_userkeys($context, [], 'tool_mobile/qrlogin');
     }
     /**
      * Export all user preferences for the plugin.
@@ -138,6 +140,7 @@ class provider implements
         $userid = $context->instanceid;
         // Delete all the userkeys.
         \core_userkey\privacy\provider::delete_userkeys('tool_mobile', $userid);
+        \core_userkey\privacy\provider::delete_userkeys('tool_mobile/qrlogin', $userid);
     }
     /**
      * Delete all user data for the specified user, in the specified contexts.
@@ -158,6 +161,7 @@ class provider implements
         $userid = $context->instanceid;
         // Delete all the userkeys.
         \core_userkey\privacy\provider::delete_userkeys('tool_mobile', $userid);
+        \core_userkey\privacy\provider::delete_userkeys('tool_mobile/qrlogin', $userid);
     }
 
     /**
@@ -178,5 +182,6 @@ class provider implements
 
         // Delete all the userkeys.
         \core_userkey\privacy\provider::delete_userkeys('tool_mobile', $userid);
+        \core_userkey\privacy\provider::delete_userkeys('tool_mobile/qrlogin', $userid);
     }
 }

admin/tool/mobile/db/hooks.php

@@ -0,0 +1,38 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Hook callbacks for Moodle app tools
+ *
+ * @package    tool_mobile
+ * @copyright  2024 Juan Leyva
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$callbacks = [
+    [
+        'hook' => \core_user\hook\after_login_completed::class,
+        'callback' => \tool_mobile\hook_callbacks::class . '::after_login_completed',
+        'priority' => 500,
+    ],
+    [
+        'hook' => tool_mfa\hook\after_user_passed_mfa::class,
+        'callback' => 'tool_mobile\local\hooks\user\after_user_passed_mfa::callback',
+        'priority' => 500,
+    ],
+];

admin/tool/mobile/launch.php

@@ -44,6 +44,18 @@ if (!$CFG->enablewebservices) {
     throw new moodle_exception('enablewsdescription', 'webservice');
 }
 
+// Check if the service exists and is enabled.
+$service = $DB->get_record('external_services', ['shortname' => $serviceshortname, 'enabled' => 1]);
+if (empty($service)) {
+    throw new moodle_exception('servicenotavailable', 'webservice');
+}
+
+// Set a cookie indicating that there was a launch to authenticate via the site from the app.
+$ldata = json_encode(['service' => $serviceshortname, 'passport' => $passport,
+    'urlscheme' => $urlscheme, 'confirmed' => (int) $confirmed, 'oauthsso' => $oauthsso]);
+$expires = time() + (15 * MINSECS); // 15 minutes for authentication should be enough.
+setcookie('tool_mobile_launch', $ldata, $expires, $CFG->sessioncookiepath, $CFG->sessioncookiedomain);
+
 // We have been requested to start a SSO process via OpenID.
 if (!empty($oauthsso) && is_enabled_auth('oauth2')) {
     $wantsurl = new moodle_url('/admin/tool/mobile/launch.php',
@@ -56,16 +68,19 @@ if (!empty($oauthsso) && is_enabled_auth('oauth2')) {
 
 // Check if the plugin is properly configured.
 $typeoflogin = get_config('tool_mobile', 'typeoflogin');
-if (empty($SESSION->justloggedin) and
-        $typeoflogin != tool_mobile\api::LOGIN_VIA_BROWSER and
+if (empty($SESSION->justloggedin) &&
+        !is_enabled_auth('oauth2') &&
+        $typeoflogin != tool_mobile\api::LOGIN_VIA_BROWSER &&
         $typeoflogin != tool_mobile\api::LOGIN_VIA_EMBEDDED_BROWSER) {
     throw new moodle_exception('pluginnotenabledorconfigured', 'tool_mobile');
 }
 
-// Check if the service exists and is enabled.
-$service = $DB->get_record('external_services', array('shortname' => $serviceshortname, 'enabled' => 1));
-if (empty($service)) {
-    throw new moodle_exception('servicenotavailable', 'webservice');
+// If the user is using the inapp (embedded) browser, we need to set the Secure and Partitioned attributes to the session cookie.
+if (\core_useragent::is_moodle_app()) {
+    \core\session\utility\cookie_helper::add_attributes_to_cookie_response_header(
+        cookiename: "MoodleSession{$CFG->sessioncookie}",
+        attributes: ['Secure', 'Partitioned'],
+    );
 }
 
 require_login(0, false);
@@ -73,6 +88,10 @@ require_login(0, false);
 // Require an active user: not guest, not suspended.
 core_user::require_active_user($USER);
 
+// Remove cookie.
+unset($_COOKIE['tool_mobile_launch']);
+setcookie('tool_mobile_launch', '', -1, $CFG->sessioncookiepath);
+
 // Get an existing token or create a new one.
 $timenow = time();
 $token = \core_external\util::generate_token_for_current_user($service);
@@ -125,7 +144,7 @@ if ($confirmed or $isios) {
     }
 
     $notice = get_string('clickheretolaunchtheapp', 'tool_mobile');
-    echo html_writer::link($location, $notice, array('id' => 'launchapp'));
+    echo $OUTPUT->box(html_writer::link($location, $notice, ['id' => 'launchapp']), 'generalbox warning centerpara');
     echo html_writer::script(
         "window.onload = function() {
             document.getElementById('launchapp').click();

admin/tool/mobile/lib.php

@@ -271,3 +271,15 @@ function tool_mobile_pre_processor_message_send($procname, $data) {
         $data->fullmessagehtml .= html_writer::tag('p', get_string('readingthisemailgettheapp', 'tool_mobile', $url->out()));
     }
 }
+/**
+ * Callback to add headers before the HTTP headers are sent.
+ *
+ */
+function tool_mobile_before_http_headers() {
+    global $CFG;
+
+    // Set Partitioned and Secure attributes to the MoodleSession cookie if the user is using the Moodle app.
+    if (\core_useragent::is_moodle_app()) {
+        \core\session\utility\cookie_helper::add_attributes_to_cookie_response_header('MoodleSession'.$CFG->sessioncookie, ['Secure', 'Partitioned']);
+    }
+}

admin/tool/mobile/tests/externallib_test.php

@@ -270,6 +270,18 @@ class externallib_test extends externallib_advanced_testcase {
         $this->assertCount(0, $result['warnings']);
         $this->assertEquals($expected, $result['settings']);
 
+        // H5P custom CSS.
+        set_config('h5pcustomcss', '.debug { color: #fab; }', 'core_h5p');
+        \core_h5p\local\library\autoloader::register();
+        \core_h5p\file_storage::generate_custom_styles();
+        $result = external::get_config();
+        $result = external_api::clean_returnvalue(external::get_config_returns(), $result);
+
+        $customcss = \core_h5p\file_storage::get_custom_styles();
+        $expected[] = ['name' => 'h5pcustomcssurl', 'value' => $customcss['cssurl']->out() . '?ver=' . $customcss['cssversion']];
+        $this->assertCount(0, $result['warnings']);
+        $this->assertEquals($expected, $result['settings']);
+
         // Change a value and retrieve filtering by section.
         set_config('commentsperpage', 1);
         $expected[10]['value'] = 1;

admin/tool/mobile/tests/privacy/provider_test.php

@@ -87,7 +87,8 @@ class provider_test extends \core_privacy\tests\provider_testcase {
         $context1 = \context_user::instance($user1->id);
         $context2 = \context_user::instance($user2->id);
         $key1 = get_user_key('tool_mobile', $user1->id);
-        $key2 = get_user_key('tool_mobile', $user2->id);
+        $key2 = get_user_key('tool_mobile/qrlogin', $user1->id);
+        $key3 = get_user_key('tool_mobile', $user2->id);
 
         // Ensure only user1 is found in context1.
         $userlist = new \core_privacy\local\request\userlist($context1, $component);
@@ -175,12 +176,15 @@ class provider_test extends \core_privacy\tests\provider_testcase {
         $context1 = \context_user::instance($user1->id);
         $context2 = \context_user::instance($user2->id);
         $keyvalue1 = get_user_key('tool_mobile', $user1->id);
-        $keyvalue2 = get_user_key('tool_mobile', $user2->id);
+        $keyvalue2 = get_user_key('tool_mobile/qrlogin', $user1->id);
+        $keyvalue3 = get_user_key('tool_mobile', $user2->id);
         $key1 = $DB->get_record('user_private_key', ['value' => $keyvalue1]);
 
-        // Before deletion, we should have 2 user_private_keys.
+        // Before deletion, we should have 2 user_private_keys for tool_mobile and one for tool_mobile/qrlogin.
         $count = $DB->count_records('user_private_key', ['script' => 'tool_mobile']);
         $this->assertEquals(2, $count);
+        $count = $DB->count_records('user_private_key', ['script' => 'tool_mobile/qrlogin']);
+        $this->assertEquals(1, $count);
 
         // Ensure deleting wrong user in the user context does nothing.
         $approveduserids = [$user2->id];
@@ -198,6 +202,8 @@ class provider_test extends \core_privacy\tests\provider_testcase {
         // Ensure only user1's data is deleted, user2's remains.
         $count = $DB->count_records('user_private_key', ['script' => 'tool_mobile']);
         $this->assertEquals(1, $count);
+        $count = $DB->count_records('user_private_key', ['script' => 'tool_mobile/qrlogin']);
+        $this->assertEquals(0, $count);
 
         $params = ['script' => $component];
         $userid = $DB->get_field_select('user_private_key', 'userid', 'script = :script', $params);

admin/tool/moodlenet/index.php

@@ -63,7 +63,7 @@ if ($cancel) {
     }
     redirect($url);
 } else if ($continue) {
-    confirm_sesskey();
+    require_sesskey();
 
     // Handle backups.
     if (strtolower($importinfo->get_resource()->get_extension()) == 'mbz') {

admin/tool/moodlenet/options.php

@@ -81,7 +81,7 @@ switch ($config->type) {
 }
 
 if ($import && $module) {
-    confirm_sesskey();
+    require_sesskey();
 
     $handlerinfo = $handlerregistry->get_resource_handler_for_mod_and_strategy($importinfo->get_resource(), $module, $strategy);
     if (is_null($handlerinfo)) {

admin/tool/phpunit/cli/util.php

@@ -50,12 +50,10 @@ list($options, $unrecognized) = cli_get_params(
     )
 );
 
-if (file_exists(__DIR__.'/../../../../vendor/phpunit/phpunit/composer.json')) {
-    // Composer packages present.
-    require_once(__DIR__.'/../../../../vendor/autoload.php');
-
-} else {
-    // Note: installation via PEAR is not supported any more.
+// Basic check to see if phpunit is installed.
+if (!file_exists(__DIR__.'/../../../../vendor/phpunit/phpunit/composer.json') ||
+        !file_exists(__DIR__.'/../../../../vendor/bin/phpunit') ||
+        !file_exists(__DIR__.'/../../../../vendor/autoload.php')) {
     phpunit_bootstrap_error(PHPUNIT_EXITCODE_PHPUNITMISSING);
 }
 
@@ -74,12 +72,13 @@ if ($options['run']) {
         }
     }
     $_SERVER['argv'] = array_values($_SERVER['argv']);
-    PHPUnit\TextUI\Command::main();
+    require(__DIR__ . '/../../../../vendor/bin/phpunit');
     exit(0);
 }
 
 define('PHPUNIT_UTIL', true);
 
+require(__DIR__.'/../../../../vendor/autoload.php');
 require(__DIR__ . '/../../../../lib/phpunit/bootstrap.php');
 
 // from now on this is a regular moodle CLI_SCRIPT

admin/tool/policy/classes/api.php

@@ -1034,7 +1034,9 @@ class api {
             }
         }
 
-        if ($user->policyagreed != $allresponded) {
+        // MDL-80973: At this point, the policyagreed value in DB could be 0 but $user->policyagreed could be 1 (as it was copied from $USER).
+        // So we need to ensure that the value in DB is set true if all policies were responded.
+        if ($user->policyagreed != $allresponded || $allresponded) {
             $user->policyagreed = $allresponded;
             $DB->set_field('user', 'policyagreed', $allresponded, ['id' => $user->id]);
         }

admin/tool/policy/tests/api_test.php

@@ -579,7 +579,7 @@ class api_test extends \advanced_testcase {
      * Test that accepting policy updates 'policyagreed'
      */
     public function test_accept_policies() {
-        global $DB;
+        global $DB, $USER;
         $this->resetAfterTest();
         $this->setAdminUser();
 
@@ -623,6 +623,12 @@ class api_test extends \advanced_testcase {
 
         api::accept_policies([$policy3->id]);
         $this->assertEquals(1, $DB->get_field('user', 'policyagreed', ['id' => $user2->id]));
+
+        // Ensure policies are always accepted when all are responded regardless the $USER->policyagreed value.
+        $USER->policyagreed = 1;
+        $DB->set_field('user', 'policyagreed', 0, ['id' => $user2->id]);
+        api::accept_policies([$policy3->id]);
+        $this->assertEquals(1, $DB->get_field('user', 'policyagreed', ['id' => $user2->id]));
     }
 
     /**

admin/tool/recyclebin/classes/category_bin.php

@@ -117,7 +117,9 @@ class category_bin extends base_bin {
         // This hack will be removed once recycle bin switches to use its own backup mode, with
         // own preferences and 100% separate from MOODLE_AUTOMATED.
         // TODO: Remove this as part of MDL-65228.
-        $CFG->forced_plugin_settings['backup'] = ['backup_auto_storage' => 0, 'backup_auto_files' => 1];
+        $forcedbackupsettings = $CFG->forced_plugin_settings['backup'] ?? null;
+        $CFG->forced_plugin_settings['backup']['backup_auto_storage'] = 0;
+        $CFG->forced_plugin_settings['backup']['backup_auto_files'] = 1;
 
         // Backup the course.
         $user = get_admin();
@@ -131,9 +133,9 @@ class category_bin extends base_bin {
         );
         $controller->execute_plan();
 
-        // We don't need the forced setting anymore, hence unsetting it.
+        // We don't need the forced setting anymore, hence restore previous settings.
         // TODO: Remove this as part of MDL-65228.
-        unset($CFG->forced_plugin_settings['backup']);
+        $CFG->forced_plugin_settings['backup'] = $forcedbackupsettings;
 
         // Grab the result.
         $result = $controller->get_results();
@@ -251,7 +253,9 @@ class category_bin extends base_bin {
         // This hack will be removed once recycle bin switches to use its own backup mode, with
         // own preferences and 100% separate from MOODLE_AUTOMATED.
         // TODO: Remove this as part of MDL-65228.
-        $CFG->forced_plugin_settings['restore'] = ['restore_general_users' => 1, 'restore_general_groups' => 1];
+        $forcedrestoresettings = $CFG->forced_plugin_settings['restore'] ?? null;
+        $CFG->forced_plugin_settings['restore']['restore_general_users'] = 1;
+        $CFG->forced_plugin_settings['restore']['restore_general_groups'] = 1;
 
         // Define the import.
         $controller = new \restore_controller(
@@ -287,9 +291,9 @@ class category_bin extends base_bin {
         // Run the import.
         $controller->execute_plan();
 
-        // We don't need the forced setting anymore, hence unsetting it.
+        // We don't need the forced setting anymore, hence restore previous settings.
         // TODO: Remove this as part of MDL-65228.
-        unset($CFG->forced_plugin_settings['restore']);
+        $CFG->forced_plugin_settings['restore'] = $forcedrestoresettings;
 
         // Have finished with the controller, let's destroy it, freeing mem and resources.
         $controller->destroy();

admin/tool/recyclebin/classes/course_bin.php

@@ -121,7 +121,9 @@ class course_bin extends base_bin {
         // This hack will be removed once recycle bin switches to use its own backup mode, with
         // own preferences and 100% separate from MOODLE_AUTOMATED.
         // TODO: Remove this as part of MDL-65228.
-        $CFG->forced_plugin_settings['backup'] = ['backup_auto_storage' => 0, 'backup_auto_files' => 1];
+        $forcedbackupsettings = $CFG->forced_plugin_settings['backup'] ?? null;
+        $CFG->forced_plugin_settings['backup']['backup_auto_storage'] = 0;
+        $CFG->forced_plugin_settings['backup']['backup_auto_files'] = 1;
 
         // Backup the activity.
         $user = get_admin();
@@ -145,9 +147,9 @@ class course_bin extends base_bin {
 
         $controller->execute_plan();
 
-        // We don't need the forced setting anymore, hence unsetting it.
+        // We don't need the forced setting anymore, hence restore previous settings.
         // TODO: Remove this as part of MDL-65228.
-        unset($CFG->forced_plugin_settings['backup']);
+        $CFG->forced_plugin_settings['backup'] = $forcedbackupsettings;
 
         // Grab the result.
         $result = $controller->get_results();
@@ -252,7 +254,9 @@ class course_bin extends base_bin {
         // This hack will be removed once recycle bin switches to use its own backup mode, with
         // own preferences and 100% separate from MOODLE_AUTOMATED.
         // TODO: Remove this as part of MDL-65228.
-        $CFG->forced_plugin_settings['restore'] = ['restore_general_users' => 1, 'restore_general_groups' => 1];
+        $forcedrestoresettings = $CFG->forced_plugin_settings['restore'] ?? null;
+        $CFG->forced_plugin_settings['restore']['restore_general_users'] = 1;
+        $CFG->forced_plugin_settings['restore']['restore_general_groups'] = 1;
 
         // Define the import.
         $controller = new \restore_controller(
@@ -284,9 +288,9 @@ class course_bin extends base_bin {
         // Run the import.
         $controller->execute_plan();
 
-        // We don't need the forced setting anymore, hence unsetting it.
+        // We don't need the forced setting anymore, hence restore previous settings.
         // TODO: Remove this as part of MDL-65228.
-        unset($CFG->forced_plugin_settings['restore']);
+        $CFG->forced_plugin_settings['restore'] = $forcedrestoresettings;
 
         // Have finished with the controller, let's destroy it, freeing mem and resources.
         $controller->destroy();

admin/tool/replace/cli/replace.php

@@ -57,7 +57,13 @@ list($options, $unrecognized) = cli_get_params(
     )
 );
 
-if ($options['help'] || $options['search'] === null || $options['replace'] === null) {
+if ($unrecognized) {
+    $unrecognized = implode("\n  ", $unrecognized);
+    cli_error(get_string('cliunknowoption', 'admin', $unrecognized));
+}
+
+// Ensure that user has populated both the search/replace parameters.
+if ($options['help'] || !is_string($options['search']) || !is_string($options['replace'])) {
     echo $help;
     exit(0);
 }

admin/tool/task/lang/en/tool_task.php

@@ -80,6 +80,9 @@ $string['runnow'] = 'Run now';
 $string['runagain'] = 'Run again';
 $string['runadhoc_confirm'] = 'Tasks will run on the web server and may take some time to complete.';
 $string['runadhoc'] = 'Run ad hoc tasks now?';
+$string['runadhoctask'] = 'Run \'{$a->task}\' task ID {$a->taskid}';
+$string['runadhoctasks'] = 'Run all \'{$a}\' tasks';
+$string['runadhoctasksfailed'] = 'Run failed \'{$a}\' tasks';
 $string['runnow_confirm'] = 'Are you sure you want to run this task \'{$a}\' now? The task will run on the web server and may take some time to complete.';
 $string['runclassname'] = 'Run all';
 $string['runclassnamefailedonly'] = 'Run all failed';

admin/tool/task/run_adhoctasks.php

@@ -54,13 +54,19 @@ if ($taskid) {
         throw new \moodle_exception('invalidtaskid');
     }
     $classname = $record->classname;
-    $heading = "Run $classname task Id $taskid";
+    $heading = get_string('runadhoctask', 'tool_task', ['task' => $classname, 'taskid' => $taskid]);
     $tasks = [core\task\manager::adhoc_task_from_record($record)];
 } else {
     if (!$classname) {
         throw new \moodle_exception('noclassname', 'tool_task');
     }
-    $heading = "Run " . s($classname) . " " . ($failedonly ? "failed" : "all")." tasks";
+
+    $heading = get_string(
+        $failedonly ? 'runadhoctasksfailed' : 'runadhoctasks',
+        'tool_task',
+        s($classname),
+    );
+
     $now = time();
     $tasks = array_filter(
         core\task\manager::get_adhoc_tasks($classname, $failedonly, true),
@@ -111,7 +117,7 @@ require_sesskey();
 \core\session\manager::write_close();
 
 // Prepare to handle output via mtrace.
-require('lib.php');
+require_once("{$CFG->dirroot}/{$CFG->admin}/tool/task/lib.php");
 $CFG->mtrace_wrapper = 'tool_task_mtrace_wrapper';
 
 // Run the specified tasks.

admin/tool/task/schedule_task.php

@@ -89,7 +89,8 @@ echo $OUTPUT->select_element_for_append();
 
 // Prepare to handle output via mtrace.
 echo html_writer::start_tag('pre', ['style' => 'color: #fff; background: #333; padding: 1em; min-height: 24lh']);
-require('lib.php');
+
+require_once("{$CFG->dirroot}/{$CFG->admin}/tool/task/lib.php");
 $CFG->mtrace_wrapper = 'tool_task_mtrace_wrapper';
 
 // Run the specified task (this will output an error if it doesn't exist).

admin/tool/task/tests/behat/manage_tasks.feature

@@ -62,8 +62,8 @@ Feature: Manage scheduled tasks
     And I press "Save changes"
     Then I should see "Changes saved"
     And the following should not exist in the "admintable" table:
-      | Name               | Component    | Minute | Hour | Day | Day of week | Month |
-      | Log table cleanup  | Standard log | */5    | 1    | 2   | 4           | 3     |
+      | Name               | Minute | Hour | Day | Day of week | Month |
+      | Log table cleanup  | */5    | 1    | 2   | 4           | 3     |
     And I should see "Log table cleanup" in the "tr.table-primary" "css_element"
 
   Scenario: Disabled plugin's tasks are labelled as disabled too

admin/tool/uploadcourse/tests/helper_test.php

@@ -107,6 +107,7 @@ class helper_test extends \advanced_testcase {
 
     public function test_get_restore_content_dir() {
         global $CFG;
+        require_once($CFG->dirroot . '/backup/util/includes/backup_includes.php');
         $this->resetAfterTest(true);
         $this->setAdminUser();
 

admin/tool/uploaduser/classes/cli_helper.php

@@ -367,6 +367,11 @@ class cli_helper {
                     $firstoption = reset($selectoptions);
                     $default = $firstoption['attr']['value'];
                 }
+
+                // The menu profile field type allows for an empty default value, handle that here.
+                if (preg_match('/^profile_field_/', $name) && $default === '') {
+                    $possiblevalues[] = $default;
+                }
             }
 
             if ($element instanceof \HTML_QuickForm_checkbox) {

admin/tool/uploaduser/classes/process.php

@@ -461,9 +461,22 @@ class process {
             return;
         }
 
-        $matchparam = $this->get_match_on_email() ? ['email' => $user->email] : ['username' => $user->username];
-        if ($existinguser = $DB->get_records('user', $matchparam + ['mnethostid' => $user->mnethostid])) {
-            if (is_array($existinguser) && count($existinguser) !== 1) {
+        if ($this->get_match_on_email()) {
+            // Case-insensitive query for the given email address.
+            $userselect = $DB->sql_equal('email', ':email', false);
+            $userparams = ['email' => $user->email];
+        } else {
+            $userselect = 'username = :username';
+            $userparams = ['username' => $user->username];
+        }
+
+        // Match the user, also accounting for multiple records by email.
+        $existinguser = $DB->get_records_select('user', "{$userselect} AND mnethostid = :mnethostid",
+            $userparams + ['mnethostid' => $user->mnethostid]);
+        $existingusercount = count($existinguser);
+
+        if ($existingusercount > 0) {
+            if ($existingusercount !== 1) {
                 $this->upt->track('status', get_string('duplicateemail', 'tool_uploaduser', $user->email), 'warning');
                 $this->userserrors++;
                 return;
@@ -675,6 +688,17 @@ class process {
                 break;
 
             case UU_USER_ADD_UPDATE:
+                if ($this->get_match_on_email()) {
+                    if ($usersbyname = $DB->get_records('user', ['username' => $user->username])) {
+                        foreach ($usersbyname as $userbyname) {
+                            if (strtolower($userbyname->email) != strtolower($user->email)) {
+                                $this->usersskipped++;
+                                $this->upt->track('status', get_string('usernotaddedusernameexists', 'error'), 'warning');
+                                $skip = true;
+                            }
+                        }
+                    }
+                }
                 break;
 
             case UU_USER_UPDATE:
@@ -1371,8 +1395,14 @@ class process {
                 }
             }
         }
+
+        // Warn user about invalid data values.
         if (($invalid = \core_user::validate($user)) !== true) {
-            $this->upt->track('status', get_string('invaliduserdata', 'tool_uploaduser', s($user->username)), 'warning');
+            $listseparator = get_string('listsep', 'langconfig') . ' ';
+            $this->upt->track('status', get_string('invaliduserdatavalues', 'tool_uploaduser', [
+                'username' => s($user->username),
+                'values' => implode($listseparator, array_keys($invalid)),
+            ]), 'warning');
         }
     }
 

admin/tool/uploaduser/lang/en/tool_uploaduser.php

@@ -50,6 +50,7 @@ The example text file may also be used for testing, as you are able to preview u
 $string['infoprefix'] = 'Info:';
 $string['invalidupdatetype'] = 'This option cannot be selected with the chosen upload type.';
 $string['invaliduserdata'] = 'Invalid data detected for user {$a} and it has been automatically cleaned.';
+$string['invaliduserdatavalues'] = 'Incorrect data ({$a->values}) found for user {$a->username}. This data has been corrected or deleted.';
 $string['invalidtheme'] = 'Theme "{$a}" is not installed and will be ignored.';
 $string['linex'] = 'Line {$a}';
 $string['matchemail'] = 'Match on email address';

admin/tool/uploaduser/tests/behat/upload_users.feature

@@ -296,3 +296,25 @@ Feature: Upload users
     And I navigate to "Users > Accounts > Browse list of users" in site administration
     And I should see "Bilbo Baggins"
     And I should not see "Frodo Baggins"
+
+  @javascript
+  Scenario: Create a new user when matching them on email where where the username already exists
+    Given the following "users" exist:
+      | username | firstname | lastname | email               |
+      | bilbob   | Samwise   | Gamgee   | samwise@example.com |
+      | frodob   | Frodeo    | Baspins  | frodo@example.com   |
+    And I log in as "admin"
+    And I navigate to "Users > Accounts > Upload users" in site administration
+    When I upload "lib/tests/fixtures/upload_users_email_matching.csv" file to "File" filemanager
+    And I press "Upload users"
+    Then I should see "Upload users preview"
+    And I set the following fields to these values:
+      | Upload type            | Add new and update existing users |
+      | Existing user details  | Override with file                |
+      | Match on email address | Yes                               |
+    And I press "Upload users"
+    And I should see "User not added - username already exists under a different email"
+    And I press "Continue"
+    And I navigate to "Users > Accounts > Browse list of users" in site administration
+    And I should see "Samwise Gamgee"
+    And I should see "Frodo Baggins"

admin/tool/uploaduser/tests/upload_users_test.php

@@ -186,6 +186,26 @@ EOF;
         $this->assertEquals('student1', reset($usersasdefaultrole)->username);
     }
 
+    /**
+     * Test that invalid data contained in uploaded CSV triggers appropriate warnings
+     */
+    public function test_user_upload_user_validate(): void {
+        $this->resetAfterTest();
+        $this->setAdminUser();
+
+        $csv = <<<EOF
+username,firstname,lastname,email,country
+student1,Student,One,s1@example.com,Wales
+EOF;
+
+        $output = $this->process_csv_upload($csv, ['--uutype=' . UU_USER_ADDNEW]);
+
+        // We should get the debugging from the user class itself, as well as warning in the output regarding the same.
+        $this->assertDebuggingCalled('The property \'country\' has invalid data and has been cleaned.');
+        $this->assertStringContainsString('Incorrect data (country) found for user student1. ' .
+            'This data has been corrected or deleted.', $output);
+    }
+
     /**
      * Generate cli_helper and mock $_SERVER['argv']
      *

admin/tool/uploaduser/user_form.php

@@ -97,9 +97,6 @@ class admin_uploaduser_form2 extends moodleform {
         $columns = $this->_customdata['columns'];
         $data    = $this->_customdata['data'];
 
-        // I am the template user, why should it be the administrator? we have roles now, other ppl may use this script ;-)
-        $templateuser = $USER;
-
         // upload settings and file
         $mform->addElement('header', 'settingsheader', get_string('settings'));
 
@@ -276,30 +273,19 @@ class admin_uploaduser_form2 extends moodleform {
         $mform->setDefault('autosubscribe', core_user::get_property_default('autosubscribe'));
 
         $mform->addElement('text', 'city', get_string('city'), 'maxlength="120" size="25"');
-        $mform->setType('city', PARAM_TEXT);
-        if (empty($CFG->defaultcity)) {
-            $mform->setDefault('city', $templateuser->city);
-        } else {
-            $mform->setDefault('city', core_user::get_property_default('city'));
-        }
+        $mform->setType('city', core_user::get_property_type('city'));
+        $mform->setDefault('city', core_user::get_property_default('city'));
 
-        $choices = get_string_manager()->get_list_of_countries();
-        $choices = array(''=>get_string('selectacountry').'...') + $choices;
-        $mform->addElement('select', 'country', get_string('selectacountry'), $choices);
-        if (empty($CFG->country)) {
-            $mform->setDefault('country', $templateuser->country);
-        } else {
-            $mform->setDefault('country', core_user::get_property_default('country'));
-        }
+        $mform->addElement('select', 'country', get_string('selectacountry'), core_user::get_property_choices('country'));
+        $mform->setDefault('country', core_user::get_property_default('country') ?: '');
         $mform->setAdvanced('country');
 
-        $choices = core_date::get_list_of_timezones($templateuser->timezone, true);
-        $mform->addElement('select', 'timezone', get_string('timezone'), $choices);
-        $mform->setDefault('timezone', $templateuser->timezone);
+        $mform->addElement('select', 'timezone', get_string('timezone'), core_date::get_list_of_timezones(null, true));
+        $mform->setDefault('timezone', core_user::get_property_default('timezone'));
         $mform->setAdvanced('timezone');
 
-        $mform->addElement('select', 'lang', get_string('preferredlanguage'), get_string_manager()->get_list_of_translations());
-        $mform->setDefault('lang', $templateuser->lang);
+        $mform->addElement('select', 'lang', get_string('preferredlanguage'), core_user::get_property_choices('lang'));
+        $mform->setDefault('lang', core_user::get_property_default('lang'));
         $mform->setAdvanced('lang');
 
         $editoroptions = array('maxfiles'=>0, 'maxbytes'=>0, 'trusttext'=>false, 'forcehttps'=>false);
@@ -313,25 +299,23 @@ class admin_uploaduser_form2 extends moodleform {
         $mform->setForceLtr('idnumber');
 
         $mform->addElement('text', 'institution', get_string('institution'), 'maxlength="255" size="25"');
-        $mform->setType('institution', PARAM_TEXT);
-        $mform->setDefault('institution', $templateuser->institution);
+        $mform->setType('institution', core_user::get_property_type('institution'));
 
         $mform->addElement('text', 'department', get_string('department'), 'maxlength="255" size="25"');
-        $mform->setType('department', PARAM_TEXT);
-        $mform->setDefault('department', $templateuser->department);
+        $mform->setType('department', core_user::get_property_type('department'));
 
         $mform->addElement('text', 'phone1', get_string('phone1'), 'maxlength="20" size="25"');
-        $mform->setType('phone1', PARAM_NOTAGS);
+        $mform->setType('phone1', core_user::get_property_type('phone1'));
         $mform->setAdvanced('phone1');
         $mform->setForceLtr('phone1');
 
         $mform->addElement('text', 'phone2', get_string('phone2'), 'maxlength="20" size="25"');
-        $mform->setType('phone2', PARAM_NOTAGS);
+        $mform->setType('phone2', core_user::get_property_type('phone2'));
         $mform->setAdvanced('phone2');
         $mform->setForceLtr('phone2');
 
         $mform->addElement('text', 'address', get_string('address'), 'maxlength="255" size="25"');
-        $mform->setType('address', PARAM_TEXT);
+        $mform->setType('address', core_user::get_property_type('address'));
         $mform->setAdvanced('address');
 
         // Next the profile defaults

admin/tool/usertours/amd/src/tour.js

@@ -37,6 +37,7 @@ import {eventTypes} from './events';
 import {getString} from 'core/str';
 import {prefetchStrings} from 'core/prefetch';
 import {notifyFilterContentUpdated} from 'core/event';
+import PendingPromise from 'core/pending';
 
 /**
  * The minimum spacing for tour step to display.
@@ -486,14 +487,22 @@ const Tour = class {
             return this.endTour();
         }
 
+        const pendingPromise = new PendingPromise(`tool_usertours/tour:_gotoStep-${stepConfig.stepNumber}`);
+
         if (typeof stepConfig.delay !== 'undefined' && stepConfig.delay && !stepConfig.delayed) {
             stepConfig.delayed = true;
-            window.setTimeout(this._gotoStep.bind(this), stepConfig.delay, stepConfig, direction);
+            window.setTimeout(function(stepConfig, direction) {
+                this._gotoStep(stepConfig, direction);
+                pendingPromise.resolve();
+            }, stepConfig.delay, stepConfig, direction);
 
             return this;
         } else if (!stepConfig.orphan && !this.isStepActuallyVisible(stepConfig)) {
-            let fn = direction == -1 ? 'getPreviousStepNumber' : 'getNextStepNumber';
-            return this.gotoStep(this[fn](stepConfig.stepNumber), direction);
+            const fn = direction == -1 ? 'getPreviousStepNumber' : 'getNextStepNumber';
+            this.gotoStep(this[fn](stepConfig.stepNumber), direction);
+
+            pendingPromise.resolve();
+            return this;
         }
 
         this.hide();
@@ -504,6 +513,7 @@ const Tour = class {
             this.dispatchEvent(eventTypes.stepRendered, {stepConfig});
         }
 
+        pendingPromise.resolve();
         return this;
     }
 
@@ -823,12 +833,14 @@ const Tour = class {
                 left: 0,
             });
 
+            const pendingPromise = new PendingPromise(`tool_usertours/tour:addStepToPage-${stepConfig.stepNumber}`);
             animationTarget
                 .animate({
                     scrollTop: this.calculateScrollTop(stepConfig),
                 }).promise().then(function() {
                         this.positionStep(stepConfig);
                         this.revealStep(stepConfig);
+                        pendingPromise.resolve();
                         return;
                     }.bind(this))
                     .catch(function() {
@@ -900,6 +912,7 @@ const Tour = class {
      */
     revealStep(stepConfig) {
         // Fade the step in.
+        const pendingPromise = new PendingPromise(`tool_usertours/tour:revealStep-${stepConfig.stepNumber}`);
         this.currentStepNode.fadeIn('', $.proxy(function() {
                 // Announce via ARIA.
                 this.announceStep(stepConfig);
@@ -913,6 +926,7 @@ const Tour = class {
                     if (this.currentStepNode) {
                         this.currentStepNode.focus();
                     }
+                    pendingPromise.resolve();
                 }, this), 100);
 
             }, this));
@@ -1160,6 +1174,7 @@ const Tour = class {
             return this;
         }
 
+        const pendingPromise = new PendingPromise('tool_usertours/tour:hide');
         if (this.currentStepNode && this.currentStepNode.length) {
             this.currentStepNode.hide();
             if (this.currentStepPopper) {
@@ -1194,17 +1209,22 @@ const Tour = class {
             this.currentStepConfig = null;
         }
 
-        let fadeTime = 0;
-        if (transition) {
-            fadeTime = 400;
-        }
-
         // Remove the backdrop features.
         $('[data-flexitour="step-background"]').remove();
         $('[data-flexitour="step-backdrop"]').removeAttr('data-flexitour');
-        $('[data-flexitour="backdrop"]').fadeOut(fadeTime, function() {
-            $(this).remove();
-        });
+
+        const backdrop = $('[data-flexitour="backdrop"]');
+        if (backdrop.length) {
+            if (transition) {
+                const backdropRemovalPromise = new PendingPromise('tool_usertours/tour:hide:backdrop');
+                backdrop.fadeOut(400, function() {
+                    $(this).remove();
+                    backdropRemovalPromise.resolve();
+                });
+            } else {
+                backdrop.remove();
+            }
+        }
 
         // Remove aria-describedby and tabindex attributes.
         if (this.currentStepNode && this.currentStepNode.length) {
@@ -1225,6 +1245,8 @@ const Tour = class {
 
         this.currentStepNode = null;
         this.currentStepPopper = null;
+
+        pendingPromise.resolve();
         return this;
     }
 

admin/tool/usertours/classes/local/forms/editstep.php

@@ -116,11 +116,9 @@ class editstep extends \moodleform {
             'changeformat' => 1,
             'trusttext' => true
         ];
-        $objs = $mform->createElement('editor', 'content', get_string('content', 'tool_usertours'), null, $editoroptions);
-        // TODO: MDL-68540 We need to add the editor to a group element because editor element will not work with hideIf.
-        $mform->addElement('group', 'contenthtmlgrp', get_string('content', 'tool_usertours'), [$objs], ' ', false);
-        $mform->addHelpButton('contenthtmlgrp', 'content', 'tool_usertours');
-        $mform->hideIf('contenthtmlgrp', 'contenttype', 'eq', static::CONTENTTYPE_LANGSTRING);
+        $mform->addElement('editor', 'content', get_string('content', 'tool_usertours'), null, $editoroptions);
+        $mform->addHelpButton('content', 'content', 'tool_usertours');
+        $mform->hideIf('content', 'contenttype', 'eq', static::CONTENTTYPE_LANGSTRING);
 
         // Add the step configuration.
         $mform->addElement('header', 'heading_options', get_string('options_heading', 'tool_usertours'));

admin/tool/usertours/classes/manager.php

@@ -283,7 +283,7 @@ class manager {
                 'title' => get_string('importtour', 'tool_usertours'),
             ],
             (object) [
-                'link'  => new \moodle_url('https://archive.moodle.net/tours'),
+                'link'  => new \moodle_url('https://moodle.net/search', ['q' => 'user tours']),
                 'linkproperties' => [
                         'target' => '_blank',
                     ],

admin/tool/usertours/tests/behat/tour_content_type.feature

@@ -27,9 +27,9 @@ Feature: Apply content type to a tour
     And the "Content type" select box should contain "Manual"
     And I select "Language string ID" from the "Content type" singleselect
     And I should see " Language string ID"
-    And "#fgroup_id_contenthtmlgrp" "css_element" should not be visible
+    And I should not see "Content" in the "#fitem_id_content" "css_element"
     And I select "Manual" from the "Content type" singleselect
-    And "#fgroup_id_contenthtmlgrp" "css_element" should be visible
+    And I should see "Content" in the "#fitem_id_content" "css_element"
     And I should not see "Language string ID" in the "#fitem_id_contentlangstring" "css_element"
 
   @javascript

admin/tool/xmldb/actions/edit_field_save/edit_field_save.class.php

@@ -91,12 +91,12 @@ class edit_field_save extends XMLDBAction {
         $comment = trim($comment);
 
         $type       = required_param('type', PARAM_INT);
-        $length     = strtolower(optional_param('length', NULL, PARAM_ALPHANUM));
+        $length     = optional_param('length', null, PARAM_INT);
         $decimals   = optional_param('decimals', NULL, PARAM_INT);
         $notnull    = optional_param('notnull', false, PARAM_BOOL);
         $sequence   = optional_param('sequence', false, PARAM_BOOL);
         $default    = optional_param('default', NULL, PARAM_PATH);
-        $default    = trim($default);
+        $default    = is_null($default) ? $default : trim($default);
 
         $editeddir = $XMLDB->editeddirs[$dirpath];
         $structure = $editeddir->xml_file->getStructure();

admin/tool/xmldb/actions/new_table_from_mysql/new_table_from_mysql.class.php

@@ -36,6 +36,11 @@ class new_table_from_mysql extends XMLDBAction {
     function init() {
         parent::init();
 
+        global $DB;
+        if ($DB->get_dbfamily() !== 'mysql') {
+            throw new moodle_exception('DB family not supported');
+        }
+
         // Set own custom attributes
 
         // Get needed strings
@@ -55,8 +60,6 @@ class new_table_from_mysql extends XMLDBAction {
     function invoke() {
         parent::invoke();
 
-        $result = true;
-
         // Set own core attributes
         $this->does_generate = ACTION_GENERATE_HTML;
 
@@ -125,11 +128,15 @@ class new_table_from_mysql extends XMLDBAction {
         // If table, retrofit information and, if everything works,
         // go to the table edit action
         } else {
-            // Get some params (table is mandatory here)
-            $tableparam = required_param('table', PARAM_CLEAN);
-            $afterparam = required_param('after', PARAM_CLEAN);
+            // Get some params (table is mandatory here).
+            $tableparam = required_param('table', PARAM_ALPHAEXT);
+            $afterparam = required_param('after', PARAM_ALPHAEXT);
 
-            // Create one new xmldb_table
+            if (empty($tableparam) || empty($afterparam)) {
+                throw new moodle_exception('Invalid param value detected.');
+            }
+
+            // Create one new xmldb_table.
             $table = new xmldb_table(strtolower(trim($tableparam)));
             $table->setComment($table->getName() . ' table retrofitted from MySQL');
             // Get fields info from ADODb
@@ -147,7 +154,6 @@ class new_table_from_mysql extends XMLDBAction {
             // Get PK, UK and indexes info from ADODb
             $dbindexes = $DB->get_indexes($tableparam);
             if ($dbindexes) {
-                $lastkey = NULL; //To temp store the last key processed
                 foreach ($dbindexes as $indexname => $dbindex) {
                     // Add the indexname to the array
                     $dbindex['name'] = $indexname;
@@ -156,9 +162,6 @@ class new_table_from_mysql extends XMLDBAction {
                         $key = new xmldb_key(strtolower($dbindex['name']));
                         // Set key with info retrofitted
                         $key->setFromADOKey($dbindex);
-                        // Set default comment to PKs
-                        if ($key->getType() == XMLDB_KEY_PRIMARY) {
-                        }
                         // Add key to the table
                         $table->addKey($key);
 
@@ -172,18 +175,17 @@ class new_table_from_mysql extends XMLDBAction {
                     }
                 }
             }
-            // Finally, add the whole retroffited table to the structure
-            // in the place specified
+            // Finally, add the whole retrofitted table to the structure in the place specified.
             $structure->addTable($table, $afterparam);
         }
 
         // Launch postaction if exists (leave this here!)
-        if ($this->getPostAction() && $result) {
+        if ($this->getPostAction()) {
             return $this->launch($this->getPostAction());
         }
 
         // Return ok if arrived here
-        return $result;
+        return true;
     }
 }
 

admin/user.php

@@ -26,10 +26,6 @@
     $sitecontext = context_system::instance();
     $site = get_site();
 
-    if (!has_capability('moodle/user:update', $sitecontext) and !has_capability('moodle/user:delete', $sitecontext)) {
-        throw new \moodle_exception('nopermissions', 'error', '', 'edit/delete users');
-    }
-
     $stredit   = get_string('edit');
     $strdelete = get_string('delete');
     $strdeletecheck = get_string('deletecheck');

admin/webservice/service_user_settings.php

@@ -33,18 +33,17 @@ $userid = required_param('userid', PARAM_INT);
 admin_externalpage_setup('externalserviceusersettings');
 
 //define nav bar
-$PAGE->set_url('/' . $CFG->admin . '/webservice/service_user_settings.php',
-        array('id' => $serviceid, 'userid'  => $userid));
+$PAGE->set_url('/admin/webservice/service_user_settings.php', ['serviceid' => $serviceid, 'userid'  => $userid]);
 $node = $PAGE->settingsnav->find('externalservices', navigation_node::TYPE_SETTING);
 if ($node) {
     $node->make_active();
 }
-$PAGE->navbar->add(get_string('serviceusers', 'webservice'),
-        new moodle_url('/' . $CFG->admin . '/webservice/service_users.php', array('id' => $serviceid)));
+
+$returnurl = new moodle_url('/admin/webservice/service_users.php', ['id' => $serviceid]);
+$PAGE->navbar->add(get_string('serviceusers', 'webservice'), $returnurl);
 $PAGE->navbar->add(get_string('serviceusersettings', 'webservice'));
 
 $formaction = new moodle_url('', array('id' => $serviceid, 'userid' => $userid));
-$returnurl = new moodle_url('/' . $CFG->admin . '/webservice/service_users.php', array('id' => $serviceid));
 
 $webservicemanager = new webservice();
 $serviceuser = $webservicemanager->get_ws_authorised_user($serviceid, $userid);

analytics/classes/analysable.php

@@ -14,18 +14,8 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
-/**
- * Any element analysers can analyse.
- *
- * @package   core_analytics
- * @copyright 2016 David Monllao {@link http://www.davidmonllao.com}
- * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
- */
-
 namespace core_analytics;
 
-defined('MOODLE_INTERNAL') || die();
-
 /**
  * Any element analysers can analyse.
  *
@@ -37,9 +27,8 @@ interface analysable {
 
     /**
      * Max timestamp.
-     * We are limited by both PHP's max int value and DB (cross-db) max int allowed. Use the smallest one.
      */
-    const MAX_TIME = PHP_INT_MAX < 9999999999 ? PHP_MAX_INT : 9999999999;
+    const MAX_TIME = 9999999999;
 
     /**
      * The analysable unique identifier in the site.

analytics/tests/community_of_inquiry_activities_completed_by_test.php

@@ -14,31 +14,29 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
-/**
- * Unit tests for activities completed by classification.
- *
- * @package   core_analytics
- * @copyright 2017 David Monllaó {@link http://www.davidmonllao.com}
- * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
- */
+namespace core_analytics;
 
-defined('MOODLE_INTERNAL') || die();
+use advanced_testcase;
+use ReflectionClass;
+use ReflectionMethod;
+use stdClass;
 
 /**
  * Unit tests for activities completed by classification.
  *
  * @package   core_analytics
+ * @covers    \core_analytics\local\indicator\community_of_inquiry_activity
  * @copyright 2017 David Monllaó {@link http://www.davidmonllao.com}
  * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
-class community_of_inquiry_activities_completed_by_testcase extends advanced_testcase {
+final class community_of_inquiry_activities_completed_by_test extends advanced_testcase {
 
     /**
      * availability_levels
      *
      * @return array
      */
-    public function availability_levels() {
+    public static function availability_levels(): array {
         return array(
             'activity' => array('activity'),
             'section' => array('section'),
@@ -148,7 +146,7 @@ class community_of_inquiry_activities_completed_by_testcase extends advanced_tes
         $second = $startdate + WEEKSECS;
         $third = $startdate + (WEEKSECS * 2);
         $forth = $startdate + (WEEKSECS * 3);
-        $this->assertCount(1, $method->invoke($indicator, $first, $first + WEEKSECS, $stu1));
+        $this->assertCount(2, $method->invoke($indicator, $first, $first + WEEKSECS, $stu1));
         $this->assertCount(1, $method->invoke($indicator, $second, $second + WEEKSECS, $stu1));
         $this->assertCount(0, $method->invoke($indicator, $third, $third + WEEKSECS, $stu1));
         $this->assertCount(2, $method->invoke($indicator, $forth, $forth + WEEKSECS, $stu1));

auth/lti/auth.php

@@ -110,22 +110,23 @@ class auth_plugin_lti extends \auth_plugin_base {
 
         // The platform user is already linked with a user account.
         if ($this->get_user_binding($launchdata['iss'], $launchdata['sub'])) {
-            // Always sync the PII, regardless of whether we're already authenticated as this user or not.
-            $user = $this->find_or_create_user_from_launch($launchdata, true);
+            $user = $this->find_or_create_user_from_launch($launchdata);
 
             if (isloggedin()) {
                 // If a different user is currently logged in, authenticate the linked user instead.
                 global $USER;
-                if ((int) $USER->id !== $user->id) {
+                if ($USER->id !== $user->id) {
                     complete_user_login($user);
                 }
                 // If the linked user is already logged in, skip the call to complete_user_login() because this affects deep linking
                 // workflows on sites publishing and consuming resources on the same site, due to the regenerated sesskey.
-                return;
             } else {
                 complete_user_login($user);
-                return;
+
             }
+            // Always sync the PII, regardless of whether we're already authenticated as this user or not.
+            $this->update_user_account($user, $launchdata, $launchdata['iss']);
+            return;
         }
 
         // The platform user is not bound to a user account, check provisioning mode now.
@@ -136,7 +137,9 @@ class auth_plugin_lti extends \auth_plugin_base {
         switch ($provisioningmode) {
             case self::PROVISIONING_MODE_AUTO_ONLY:
                 // Automatic provisioning - this will create/migrate a user account and log the user in.
-                complete_user_login($this->find_or_create_user_from_launch($launchdata, true, $legacyconsumersecrets));
+                $user = $this->find_or_create_user_from_launch($launchdata, $legacyconsumersecrets);
+                complete_user_login($user);
+                $this->update_user_account($user, $launchdata, $launchdata['iss']);
                 break;
             case self::PROVISIONING_MODE_PROMPT_NEW_EXISTING:
             case self::PROVISIONING_MODE_PROMPT_EXISTING_ONLY:
@@ -211,21 +214,13 @@ class auth_plugin_lti extends \auth_plugin_base {
      * itself and pass relevant data in - as auth_plugin_lti::complete_login() does.
      *
      * @param array $launchdata all data in the decoded JWT including iss and sub.
-     * @param bool $syncpicture whether to sync the user's picture with the picture sent in the launch.
      * @param array $legacyconsumersecrets all secrets found for the legacy consumer, facilitating user migration.
      * @return stdClass the Moodle user who is mapped to the platform user identified in the JWT data.
      */
-    public function find_or_create_user_from_launch(array $launchdata, bool $syncpicture = false,
-            array $legacyconsumersecrets = []): stdClass {
-
-        if (!$syncpicture) {
-            unset($launchdata['picture']);
-        }
+    public function find_or_create_user_from_launch(array $launchdata, array $legacyconsumersecrets = []): stdClass {
 
         if ($binduser = $this->get_user_binding($launchdata['iss'], $launchdata['sub'])) {
-            $user = \core_user::get_user($binduser);
-            $this->update_user_account($user, $launchdata, $launchdata['iss']);
-            return \core_user::get_user($user->id);
+            return \core_user::get_user($binduser);
         } else {
             // Is the intent to migrate a user account used in legacy launches?
             if (!empty($legacyconsumersecrets)) {
@@ -234,11 +229,10 @@ class auth_plugin_lti extends \auth_plugin_base {
                     $usermigrationclaim = new user_migration_claim($launchdata, $legacyconsumersecrets);
                     $username = 'enrol_lti' .
                         sha1($usermigrationclaim->get_consumer_key() . '::' .
-                        $usermigrationclaim->get_consumer_key() .':' .$usermigrationclaim->get_user_id());
-                    if ($user = \core_user::get_user_by_username($username)) {
+                            $usermigrationclaim->get_consumer_key() . ':' . $usermigrationclaim->get_user_id());
+                    if ($user = core_user::get_user_by_username($username)) {
                         $this->create_user_binding($launchdata['iss'], $launchdata['sub'], $user->id);
-                        $this->update_user_account($user, $launchdata, $launchdata['iss']);
-                        return \core_user::get_user($user->id);
+                        return core_user::get_user($user->id);
                     }
                 } catch (Exception $e) {
                     // There was an issue validating the user migration claim. We don't want to fail auth entirely though.
@@ -247,9 +241,12 @@ class auth_plugin_lti extends \auth_plugin_base {
                         "'{$launchdata['iss']}'. The migration claim could not be validated. A new account will be created.");
                 }
             }
+            // At the point of the creation, to ensure the user_created event correctly reflects the creating user of '0' (the user
+            // performing the action), ensure any active session is terminated and an empty session initialised.
+            $this->empty_session();
+
             $user = $this->create_new_account($launchdata, $launchdata['iss']);
-            $this->update_user_account($user, $launchdata, $launchdata['iss']);
-            return \core_user::get_user($user->id);
+            return core_user::get_user($user->id);
         }
     }
 
@@ -301,6 +298,17 @@ class auth_plugin_lti extends \auth_plugin_base {
         return $binduser;
     }
 
+    /**
+     * If there's an existing session, inits an empty session.
+     *
+     * @return void
+     */
+    protected function empty_session(): void {
+        if (isloggedin()) {
+            \core\session\manager::init_empty_session();
+        }
+    }
+
     /**
      * Check whether a provisioning mode is valid or not.
      *
@@ -361,7 +369,7 @@ class auth_plugin_lti extends \auth_plugin_base {
      * @param array $userdata the user data coming from either a launch or membership service call.
      * @param string $iss the issuer to which the user belongs.
      */
-    protected function update_user_account(stdClass $user, array $userdata, string $iss): void {
+    public function update_user_account(stdClass $user, array $userdata, string $iss): void {
         global $CFG;
         require_once($CFG->dirroot.'/user/lib.php');
         if ($user->auth !== 'lti') {

auth/lti/classes/local/ltiadvantage/event/event_handler.php

@@ -0,0 +1,48 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\local\ltiadvantage\event;
+
+use auth_lti\local\ltiadvantage\utility\cookie_helper;
+use core\event\user_loggedin;
+
+/**
+ * Event handler for auth_lti.
+ *
+ * @package    auth_lti
+ * @copyright  2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class event_handler {
+
+    /**
+     * Allows the plugin to augment Set-Cookie headers when the user_loggedin event is fired as part of complete_user_login() calls.
+     *
+     * @param user_loggedin $event the event
+     * @return void
+     */
+    public static function handle_user_loggedin(user_loggedin $event): void {
+        // The event data isn't important here. The intent of this listener is to ensure that the MoodleSession cookie is set up
+        // properly during LTI launches + login. This means two things:
+        // i) it's set with SameSite=None; Secure; where possible (since OIDC needs HTTPS this will almost always be possible).
+        // ii) it set with the 'Partitioned' attribute, when required.
+        // The former ensures cross-site cookies are sent for embedded launches. The latter is an opt-in flag needed to use Chrome's
+        // partitioning mechanism, CHIPS.
+        if (cookie_helper::cookies_supported()) {
+            cookie_helper::setup_session_cookie();
+        }
+    }
+}

auth/lti/classes/local/ltiadvantage/utility/cookie_helper.php

@@ -0,0 +1,173 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\local\ltiadvantage\utility;
+use core\session\utility\cookie_helper as core_cookie_helper;
+
+/**
+ * Helper class providing utils dealing with cookies in LTI, particularly 3rd party cookies.
+ *
+ * @package    auth_lti
+ * @copyright  2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+final class cookie_helper {
+
+    /** @var int Cookies are not supported. */
+    public const COOKIE_METHOD_NOT_SUPPORTED = 0;
+
+    /** @var int Cookies are supported without explicit partitioning. */
+    public const COOKIE_METHOD_NO_PARTITIONING = 1;
+
+    /** @var int Cookies are supported via explicit partitioning. */
+    public const COOKIE_METHOD_EXPLICIT_PARTITIONING = 2;
+
+    /**
+     * Check whether cookies can be used with the current user agent and, if so, via what method they are set.
+     *
+     * Currently, this tries 2 modes of setting a test cookie:
+     * 1. Setting a SameSite=None, Secure cookie. This will work in any first party context, and in 3rd party contexts for
+     * any browsers supporting automatic partitioning of 3rd party cookies (E.g. Firefox, Brave).
+     * 2. If 1 fails, setting a cookie with the Chrome 'Partitioned' attribute included, opting that cookie into CHIPS. This will
+     * work for Chrome.
+     *
+     * Upon completion of the cookie check, the check sets a SESSION flag indicating the method used to set the cookie, and upgrades
+     * the session cookie ('MoodleSession') using the respective method. This ensure the session cookie will continue to be sent.
+     *
+     * Then, the following methods can be used by client code to query whether the UA supports cookies, and how:
+     * @see self::cookies_supported() - whether it could be set at all.
+     * @see self::get_cookies_supported_mode() - if a cookie could be set, what mode was used to set it.
+     *
+     * This permits client code to make sure it's setting its cookies appropriately (via the advertised method), and allows it to
+     * present notices - such as in the case where a given UA is found to be lacking the requisite cookie support.
+     * E.g.
+     * cookie_helper::do_cookie_check($mypageurl);
+     * if (!cookie_helper::cookies_supported()) {
+     *     // Print a notice stating that cookie support is required.
+     * }
+     * // Elsewhere in other client code...
+     * if (cookie_helper::get_cookies_supported_mode() === cookie_helper::COOKIE_METHOD_EXPLICIT_PARTITIONING) {
+     *     // Set a cookie, making sure to use the helper to also opt-in to partitioning.
+     *     setcookie('myauthcookie', 'myauthcookievalue', ['samesite' => 'None', 'secure' => true]);
+     *     cookie_helper::add_partitioning_to_cookie('myauthcookie');
+     * }
+     *
+     * @param \moodle_url $pageurl the URL of the page making the check, used to redirect back to after setting test cookies.
+     * @return void
+     */
+    public static function do_cookie_check(\moodle_url $pageurl): void {
+        global $_COOKIE, $SESSION, $CFG;
+        $cookiecheck1 = optional_param('cookiecheck1', null, PARAM_INT);
+        $cookiecheck2 = optional_param('cookiecheck2', null, PARAM_INT);
+
+        if (empty($cookiecheck1)) {
+            // Start the cookie check. Set two test cookies - one samesite none, and one partitioned - and redirect.
+            // Set cookiecheck to show the check has started.
+            self::set_test_cookie('cookiecheck1', self::COOKIE_METHOD_NO_PARTITIONING);
+            self::set_test_cookie('cookiecheck2', self::COOKIE_METHOD_EXPLICIT_PARTITIONING, true);
+            $pageurl->params([
+                'cookiecheck1' => self::COOKIE_METHOD_NO_PARTITIONING,
+                'cookiecheck2' => self::COOKIE_METHOD_EXPLICIT_PARTITIONING,
+            ]);
+
+            // LTI needs to guarantee the 'SameSite=None', 'Secure' (and sometimes 'Partitioned') attributes are set on the
+            // MoodleSession cookie. This is done via manipulation of the outgoing headers after the cookie check redirect. To
+            // guarantee these outgoing Set-Cookie headers will be created after the redirect, expire the current cookie.
+            core_cookie_helper::expire_moodlesession();
+
+            redirect($pageurl);
+        } else {
+            // Have already started a cookie check, so check the result.
+            $cookie1received = isset($_COOKIE['cookiecheck1']) && $_COOKIE['cookiecheck1'] == $cookiecheck1;
+            $cookie2received = isset($_COOKIE['cookiecheck2']) && $_COOKIE['cookiecheck2'] == $cookiecheck2;
+
+            if ($cookie1received || $cookie2received) {
+                // The test cookie could be set and received.
+                // Set a session flag storing the method used to set it, and make sure the session cookie uses this method.
+                $cookiemethod = $cookie1received ? self::COOKIE_METHOD_NO_PARTITIONING : self::COOKIE_METHOD_EXPLICIT_PARTITIONING;
+                $SESSION->auth_lti_cookie_method = $cookiemethod;
+
+                self::setup_session_cookie();
+            }
+        }
+    }
+
+    /**
+     * If a cookie check has been made, returns whether cookies could be set or not.
+     *
+     * @return bool whether cookies are supported or not.
+     */
+    public static function cookies_supported(): bool {
+        return self::get_cookies_supported_method() !== self::COOKIE_METHOD_NOT_SUPPORTED;
+    }
+
+    /**
+     * If a cookie check has been made, gets the method used to set a cookie, or self::COOKIE_METHOD_NOT_SUPPORTED if not supported.
+     *
+     * For cookie methods:
+     * @see self::COOKIE_METHOD_NOT_SUPPORTED
+     * @see self::COOKIE_METHOD_NO_PARTITIONING
+     * @see self::COOKIE_METHOD_EXPLICIT_PARTITIONING
+     *
+     * @return int the constant representing the method by which the cookie was set, or not.
+     */
+    public static function get_cookies_supported_method(): int {
+        global $SESSION;
+        return $SESSION->auth_lti_cookie_method ?? self::COOKIE_METHOD_NOT_SUPPORTED;
+    }
+
+    /**
+     * Sets up the session cookie according to the method used in the cookie check, and with SameSite=None; Secure attributes.
+     *
+     * @return void
+     */
+    public static function setup_session_cookie(): void {
+        global $CFG;
+        require_once($CFG->libdir . '/sessionlib.php');
+
+        if (is_moodle_cookie_secure()) {
+            $atts = ['SameSite=None', 'Secure'];
+            if (self::get_cookies_supported_method() == self::COOKIE_METHOD_EXPLICIT_PARTITIONING) {
+                $atts[] = 'Partitioned';
+            }
+            core_cookie_helper::add_attributes_to_cookie_response_header('MoodleSession' . $CFG->sessioncookie, $atts);
+        }
+    }
+
+    /**
+     * Set a test cookie, using SameSite=None; Secure; attributes if possible, and with or without partitioning opt-in.
+     *
+     * @param string $name cookie name
+     * @param string $value cookie value
+     * @param bool $partitioned whether to try to add partitioning opt-in, which requires secure cookies (https sites).
+     * @return void
+     */
+    private static function set_test_cookie(string $name, string $value, bool $partitioned = false): void {
+        global $CFG;
+        require_once($CFG->libdir . '/sessionlib.php');
+
+        $atts = ['expires' => time() + 30];
+        if (is_moodle_cookie_secure()) {
+            $atts['samesite'] = 'none';
+            $atts['secure'] = true;
+        }
+        setcookie($name, $value, $atts);
+
+        if (is_moodle_cookie_secure() && $partitioned) {
+            core_cookie_helper::add_attributes_to_cookie_response_header($name, ['Partitioned']);
+        }
+    }
+}

auth/lti/classes/output/renderer.php

@@ -33,33 +33,32 @@ class renderer extends \plugin_renderer_base {
      * @return string the html.
      */
     public function render_account_binding_options_page(int $provisioningmode): string {
+
         $formaction = new \moodle_url('/auth/lti/login.php');
         $notification = new notification(get_string('firstlaunchnotice', 'auth_lti'), \core\notification::INFO, false);
-        $noauthnotice = new notification(get_string('firstlaunchnoauthnotice', 'auth_lti', get_docs_url('Publish_as_LTI_tool')),
-            \core\notification::WARNING, false);
         $cancreateaccounts = !get_config('moodle', 'authpreventaccountcreation');
         if ($provisioningmode == \auth_plugin_lti::PROVISIONING_MODE_PROMPT_EXISTING_ONLY) {
             $cancreateaccounts = false;
         }
 
-        $accountinfo = ['isloggedin' => isloggedin()];
+        $accountinfo = [];
         if (isloggedin()) {
             global $USER;
-            $accountinfo = array_merge($accountinfo, [
+            $accountinfo = [
                 'firstname' => $USER->firstname,
                 'lastname' => $USER->lastname,
                 'email' => $USER->email,
                 'picturehtml' => $this->output->user_picture($USER,  ['size' => 35, 'class' => 'round']),
-            ]);
+            ];
         }
 
         $context = [
+            'isloggedin' => isloggedin(),
             'info' => $notification->export_for_template($this),
             'formaction' => $formaction->out(),
             'sesskey' => sesskey(),
             'accountinfo' => $accountinfo,
             'cancreateaccounts' => $cancreateaccounts,
-            'noauthnotice' => $noauthnotice->export_for_template($this)
         ];
         return parent::render_from_template('auth_lti/local/ltiadvantage/login', $context);
     }