weekly release 4.4.12+

Automatically generated installer lang files
Moodle release 4.4.12
2025-12-12 14:07:00 +11:00 · 2025-12-11 00:07:55 +00:00 · 2025-12-07 08:05:21 +07:00 · 2025-12-05 08:09:21 +07:00 · 2025-12-04 21:01:37 +07:00 · 2025-12-04 10:34:23 +08:00
1031 changed files with 10887 additions and 3615 deletions
@@ -19,7 +19,7 @@ env:

 jobs:
  Grunt:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04

    steps:
      - name: Checking out code
@@ -61,12 +61,12 @@ jobs:
      matrix:
        include:
          # MySQL builds always run with the lowest PHP supported version.
-          - os: ubuntu-22.04
+          - os: ubuntu-24.04
            php: 8.1
            extensions:
            db: mysqli
          # PostgreSQL builds always run with the highest PHP supported version.
-          - os: ubuntu-22.04
+          - os: ubuntu-24.04
            php: 8.3
            db: pgsql

@@ -0,0 +1,5 @@
+issueNumber: MDL-87079
+notes:
+  core:
+    - message: When responding to pcntl signals, call existing signal handlers.
+      type: fixed
@@ -24,6 +24,7 @@
 */

 define('CLI_SCRIPT', true);
+define('IGNORE_COMPONENT_CACHE', true);

 require(__DIR__.'/../../config.php');
 require_once($CFG->libdir.'/clilib.php');
@@ -55,13 +55,14 @@ If courseid is set, course module/s will be added into the course.

 Options:
 -f, --file=STRING       Path to the backup file.
-c, --categoryid=INT    ID of the course category to restore to.
-C, --courseid=INT      ID of the course to restore to. This option is ignored if categoryid is set.
+-c, --categoryid=INT    ID of the course category to restore to. This option is ignored when restoring an activity and courseid is set.
+-C, --courseid=INT      ID of the course to restore to. This option is ignored when restoring a course and the categoryid is set.
 -s, --showdebugging     Show developer level debugging information
 -h, --help              Print out this help.

 Example:
-\$sudo -u www-data /usr/bin/php admin/cli/restore_backup.php --file=/path/to/backup/file.mbz --categoryid=1\n
+\$sudo -u www-data /usr/bin/php admin/cli/restore_backup.php --file=/path/to/backup/coursebackup.mbz --categoryid=1\n
+\$sudo -u www-data /usr/bin/php admin/cli/restore_backup.php --file=/path/to/backup/activitybackup.mbz --courseid=1\n
 EOL;

    echo $help;
@@ -84,11 +85,15 @@ if ($options['categoryid']) {
    if (!$category = $DB->get_record('course_categories', ['id' => $options['categoryid']], 'id')) {
        throw new \moodle_exception('invalidcategoryid');
    }
-} else if ($options['courseid']) {
+}
+
+if ($options['courseid']) {
    if (!$course = $DB->get_record('course', ['id' => $options['courseid']], 'id')) {
        throw new \moodle_exception('invalidcourseid');
    }
-} else {
+}
+
+if (empty($category) && empty($course)) {
    throw new \moodle_exception('invalidoption');
 }

@@ -100,28 +105,46 @@ $fp = get_file_packer('application/vnd.moodle.backup');
 $fp->extract_to_pathname($options['file'], $path);

 cli_heading(get_string('preprocessingbackupfile'));
-try {
-    list($fullname, $shortname) = restore_dbops::calculate_course_names(0, get_string('restoringcourse', 'backup'),
-        get_string('restoringcourseshortname', 'backup'));

-    if (!empty($course)) {
-        $courseid = $course->id;
-        $rc = new restore_controller($backupdir, $courseid, backup::INTERACTIVE_NO,
-            backup::MODE_GENERAL, $admin->id, backup::TARGET_EXISTING_ADDING);
-    } else {
+try {
+    // Create a temporary restore controller to determine the restore type.
+    $tmprc = new restore_controller($backupdir, SITEID, backup::INTERACTIVE_NO,
+        backup::MODE_GENERAL, $admin->id, backup::TARGET_EXISTING_ADDING);
+    // Restore the backup into a new course if:
+    // - It is a course backup and the category is set.
+    // - It is an activity backup and the course is not set.
+    $restoreasnewcourse = ($tmprc->get_type() === backup::TYPE_1COURSE && !empty($category)) ||
+        ($tmprc->get_type() !== backup::TYPE_1COURSE && empty($course));
+    // Make sure to clean up the temporary restore controller.
+    $tmprc->destroy();
+
+    if ($restoreasnewcourse) {
+        list($fullname, $shortname) = restore_dbops::calculate_course_names(0, get_string('restoringcourse', 'backup'),
+            get_string('restoringcourseshortname', 'backup'));
        $courseid = restore_dbops::create_new_course($fullname, $shortname, $category->id);
        $rc = new restore_controller($backupdir, $courseid, backup::INTERACTIVE_NO,
            backup::MODE_GENERAL, $admin->id, backup::TARGET_NEW_COURSE);
+    } else {
+        $courseid = $course->id;
+        $rc = new restore_controller($backupdir, $courseid, backup::INTERACTIVE_NO,
+            backup::MODE_GENERAL, $admin->id, backup::TARGET_EXISTING_ADDING);
    }
    $rc->execute_precheck();
    $rc->execute_plan();
    $rc->destroy();

-    // Rename course name if the backup is from course module and restore to category.
-    if (empty($course)) {
+    // Rename the course's full and short names with the backup file's original names if the backup file is an activity backup
+    // that is restored to a new course.
+    if ($restoreasnewcourse && $rc->get_type() !== backup::TYPE_1COURSE) {
        $course = get_course($courseid);
-        list($fullname, $shortname) = restore_dbops::calculate_course_names(0, get_string('restoretonewcourse', 'backup'),
-            get_string('newcourse'));
+        $backupinfo = $rc->get_info();
+        $tmpfullname = $backupinfo->original_course_fullname ?? get_string('restoretonewcourse', 'backup');
+        $tmpshortname = $backupinfo->original_course_shortname ?? get_string('newcourse');
+        list($fullname, $shortname) = restore_dbops::calculate_course_names(
+            courseid: 0,
+            fullname: $tmpfullname,
+            shortname: $tmpshortname,
+        );
        $course->fullname = $fullname;
        $course->shortname = $shortname;
        $course->visible = 1;
@@ -3835,6 +3835,7 @@
      <PHP_EXTENSION name="fileinfo" level="required"/>
      <PHP_EXTENSION name="sodium" level="optional"/>
      <PHP_EXTENSION name="exif" level="optional"/>
+      <PHP_EXTENSION name="filter" level="required"/>
    </PHP_EXTENSIONS>
    <PHP_SETTINGS>
      <PHP_SETTING name="memory_limit" value="96M" level="required">
@@ -4327,6 +4328,7 @@
      <VENDOR name="oracle" version="19" />
    </DATABASE>
    <PHP version="8.1.0" level="required">
+      <RESTRICT function="restrict_php_version_84" message="unsupportedphpversion84" />
    </PHP>
    <PCREUNICODE level="optional">
      <FEEDBACK>
@@ -4410,6 +4412,7 @@
      <PHP_EXTENSION name="fileinfo" level="required"/>
      <PHP_EXTENSION name="sodium" level="required"/>
      <PHP_EXTENSION name="exif" level="optional"/>
+      <PHP_EXTENSION name="filter" level="required"/>
    </PHP_EXTENSIONS>
    <PHP_SETTINGS>
      <PHP_SETTING name="memory_limit" value="96M" level="required">
@@ -4522,6 +4525,7 @@
      <VENDOR name="oracle" version="19" />
    </DATABASE>
    <PHP version="8.1.0" level="required">
+      <RESTRICT function="restrict_php_version_84" message="unsupportedphpversion84" />
    </PHP>
    <PCREUNICODE level="optional">
      <FEEDBACK>
@@ -4605,6 +4609,7 @@
      <PHP_EXTENSION name="fileinfo" level="required"/>
      <PHP_EXTENSION name="sodium" level="required"/>
      <PHP_EXTENSION name="exif" level="optional"/>
+      <PHP_EXTENSION name="filter" level="required"/>
    </PHP_EXTENSIONS>
    <PHP_SETTINGS>
      <PHP_SETTING name="memory_limit" value="96M" level="required">
@@ -4714,6 +4719,7 @@
      <VENDOR name="mysql" version="8.4" />
      <VENDOR name="postgres" version="14" />
      <VENDOR name="mssql" version="14.0" />
+      <VENDOR name="auroramysql" version="8.0" />
    </DATABASE>
    <PHP version="8.2.0" level="required">
    </PHP>
@@ -4799,6 +4805,7 @@
      <PHP_EXTENSION name="fileinfo" level="required"/>
      <PHP_EXTENSION name="sodium" level="required"/>
      <PHP_EXTENSION name="exif" level="optional"/>
+      <PHP_EXTENSION name="filter" level="required"/>
    </PHP_EXTENSIONS>
    <PHP_SETTINGS>
      <PHP_SETTING name="memory_limit" value="96M" level="required">
@@ -4893,6 +4900,413 @@
      </CUSTOM_CHECK>
      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_async_backup" level="recommended">
      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_aurora_version" level="optional">
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="5.1" requires="4.2.3">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="10.11.0" />
+      <VENDOR name="mysql" version="8.4" />
+      <VENDOR name="postgres" version="15" />
+      <VENDOR name="mssql" version="14.0" />
+      <VENDOR name="auroramysql" version="8.0" />
+    </DATABASE>
+    <PHP version="8.2.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="mbstringrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+      <PHP_EXTENSION name="sodium" level="required"/>
+      <PHP_EXTENSION name="exif" level="optional"/>
+      <PHP_EXTENSION name="filter" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="zend.exception_ignore_args" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingzendexceptionignoreargs" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_sixtyfour_bits" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="sixtyfourbitsrequired" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_max_input_vars" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_admin_dir_usage" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iscustomadminwarnings" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_async_backup" level="recommended">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_aurora_version" level="optional">
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="5.2" requires="4.4">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="10.11.0" />
+      <VENDOR name="mysql" version="8.4" />
+      <VENDOR name="postgres" version="16" />
+      <VENDOR name="mssql" version="15.0" />
+      <VENDOR name="auroramysql" version="8.0" />
+    </DATABASE>
+    <PHP version="8.3.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="mbstringrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+      <PHP_EXTENSION name="sodium" level="required"/>
+      <PHP_EXTENSION name="exif" level="optional"/>
+      <PHP_EXTENSION name="filter" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="zend.exception_ignore_args" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingzendexceptionignoreargs" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK function="\core\environment::check_composer_dependencies_installed" level="optional" />
+      <CUSTOM_CHECK function="\core\environment::check_composer_developer_dependencies_not_installed" level="optional" />
+      <CUSTOM_CHECK function="\core\environment::check_composer_dependencies_optimised" level="optional" />
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_sixtyfour_bits" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="sixtyfourbitsrequired" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_max_input_vars" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_admin_dir_usage" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iscustomadminwarnings" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_async_backup" level="recommended">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_aurora_version" level="optional">
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
 </COMPATIBILITY_MATRIX>
@@ -923,8 +923,14 @@ if (empty($CFG->disabledevlibdirscheck) && (is_dir($CFG->dirroot.'/vendor') || i
 // Check if the site is being foced onto ssl.
 $overridetossl = !empty($CFG->overridetossl);

-// Check if moodle campaign content setting is enabled or not.
-$showcampaigncontent = !isset($CFG->showcampaigncontent) || $CFG->showcampaigncontent;
+if (defined('BEHAT_SITE_RUNNING') && BEHAT_SITE_RUNNING) {
+    // We need to add this in order to be able to verify the showcampaigncontent setting behaviour during behat tests.
+    $showcampaigncontent = get_config('core', 'showcampaigncontent');
+    $showcampaigncontent = $showcampaigncontent === 'true';
+} else {
+    // Check if moodle campaign content setting is enabled or not.
+    $showcampaigncontent = !isset($CFG->showcampaigncontent) || $CFG->showcampaigncontent;
+}

 // Encourage admins to enable the user feedback feature if it is not enabled already.
 $showfeedbackencouragement = empty($CFG->enableuserfeedback);
@@ -23,6 +23,8 @@
 * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */

+define('IGNORE_COMPONENT_CACHE', true);
+
 require_once('../config.php');
 require_once($CFG->libdir.'/adminlib.php');

@@ -51,6 +51,14 @@ if ($hassiteconfig) {

        $temp->add(new admin_setting_countrycodes('allcountrycodes', new lang_string('allcountrycodes', 'core_admin'),
            new lang_string('configallcountrycodes', 'core_admin')));
+
+        $temp->add(new admin_setting_configtext(
+            'geopluginapikey',
+            new lang_string('geopluginapikey', 'core_admin'),
+            new lang_string('geopluginapikey_desc', 'core_admin'),
+            '',
+            PARAM_TEXT,
+        ));
    }

    $ADMIN->add('location', $temp);
@@ -81,6 +81,8 @@ class behat_admin extends behat_base {

            $this->execute('behat_forms::i_set_the_field_with_xpath_to', [$fieldxpath, $value]);
            $this->execute("behat_general::i_click_on", [get_string('savechanges'), 'button']);
+            // Wait for the page to be redirected.
+            $this->execute("behat_general::i_wait_to_be_redirected");
        }
    }

@@ -90,6 +90,7 @@ Feature: An administrator can browse user accounts
      | username | firstname | lastname | email             | confirmed |
      | user3    | User      | Three    | three@example.com | 0         |
    And I navigate to "Users > Accounts > Browse list of users" in site administration
+    And I change window size to "large"
    Then I should see "Confirmation pending" in the "User Three" "table_row"
    And I press "Resend confirmation email" action in the "User Three" report row
    And I should see "Confirmation email sent successfully"
@@ -18,6 +18,7 @@ Feature: Verify the breadcrumbs in webservice tokens site administration pages
    And "Manage tokens" "link" should exist in the ".breadcrumb" "css_element"
    And "Web services" "link" should exist in the ".breadcrumb" "css_element"
    And I set the field "User" to "John Doe"
+    And I set the field "Service" to "Moodle mobile web service"
    And I press "Save changes"
    When I click on "Delete" "link"
    Then "Delete token" "text" should exist in the ".breadcrumb" "css_element"
@@ -0,0 +1,17 @@
+@core @core_admin
+Feature: Toggle campaign banner visibility
+  In order to control the visibility of the campaign banner content
+  As an admin
+  I need to be able to disable the campaign banner display
+
+  Scenario Outline: Admin can disable the campaign banner display
+    Given the following config values are set as admin:
+      | showcampaigncontent | <showcampaigncontent> |
+    And I log in as "admin"
+    When I navigate to "Notifications" in site administration
+    Then "//iframe[@id='campaign-content']" "xpath_element" <display> exist
+
+    Examples:
+      | showcampaigncontent | display    |
+      | true                | should     |
+      | false               | should not |
@@ -36,6 +36,10 @@ if (function_exists('opcache_reset')) {
 define('CLI_SCRIPT', true);
 define('CACHE_DISABLE_ALL', true);

+// It makes no sense to use BEHAT_CLI for this script (the Behat launch scripts expect to start
+// from the normal environment), so in case user has set tne environment variable, disable it.
+putenv('BEHAT_CLI=0');
+
 // Basic functions.
 require_once(__DIR__ . '/../../../../lib/clilib.php');
 require_once(__DIR__ . '/../../../../lib/behat/lib.php');
@@ -31,6 +31,10 @@ define('ABORT_AFTER_CONFIG', true);
 define('CACHE_DISABLE_ALL', true);
 define('NO_OUTPUT_BUFFERING', true);

+// It makes no sense to use BEHAT_CLI for this script (the Behat launch scripts expect to start
+// from the normal environment), so in case user has set tne environment variable, disable it.
+putenv('BEHAT_CLI=0');
+
 require_once(__DIR__ .'/../../../../config.php');
 require_once(__DIR__.'/../../../../lib/clilib.php');
 require_once(__DIR__.'/../../../../lib/behat/lib.php');
@@ -39,6 +39,10 @@ define('NO_OUTPUT_BUFFERING', true);
 define('IGNORE_COMPONENT_CACHE', true);
 define('ABORT_AFTER_CONFIG', true);

+// It makes no sense to use BEHAT_CLI for this script (the Behat launch scripts expect to start
+// from the normal environment), so in case user has set tne environment variable, disable it.
+putenv('BEHAT_CLI=0');
+
 require_once(__DIR__ . '/../../../../lib/clilib.php');

 // CLI options.
@@ -33,6 +33,10 @@ if (isset($_SERVER['REMOTE_ADDR'])) {
    die(); // No access from web!.
 }

+// It makes no sense to use BEHAT_CLI for this script (the Behat launch scripts expect to start
+// from the normal environment), so in case user has set tne environment variable, disable it.
+putenv('BEHAT_CLI=0');
+
 // Basic functions.
 require_once(__DIR__ . '/../../../../lib/clilib.php');
 require_once(__DIR__ . '/../../../../lib/behat/lib.php');
@@ -87,6 +87,7 @@ $action = optional_param('action', '', PARAM_ALPHA);
 // Handle any single operation actions.
 if ($action == 'requestanalysis') {
    if ($courseid != 0) {
+        require_sesskey();
        scheduler::request_course_analysis($courseid);
        if ($courseid == SITEID) {
            redirect(accessibility::get_plugin_url());
@@ -0,0 +1,70 @@
+<?php
+// This file is part of Moodle - https://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <https://www.gnu.org/licenses/>.
+
+namespace tool_capability;
+
+// phpcs:disable moodle.PHPUnit.TestCaseProvider.dataProviderSyntaxMethodNotFound
+
+/**
+ * Detect common problems in capability definitions of plugins.
+ *
+ * @group     plugin_checks
+ * @package   tool_capability
+ * @copyright 2025 Petr Skoda
+ * @license   https://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+final class plugin_checks_test extends \core\tests\plugin_checks_testcase {
+    /**
+     * Verify contents of plugin db/access.php file.
+     *
+     * @dataProvider all_plugins_provider
+     * @coversNothing
+     *
+     * @param string $component
+     * @param string $plugintype
+     * @param string $pluginname
+     * @param string $dir
+     */
+    public function test_db_access_file(string $component, string $plugintype, string $pluginname, string $dir): void {
+        global $CFG;
+
+        $stringmanager = get_string_manager();
+        $corerolefile = "$CFG->dirroot/lang/en/role.php";
+        $langfile = "$dir/lang/en/$component.php";
+
+        $file = "$dir/db/access.php";
+        $capabilities = $this->fetch_array_from_file($file, 'capabilities');
+        if (!$capabilities) {
+            $this->expectNotToPerformAssertions();
+            return;
+        }
+
+        foreach ($capabilities as $capname => $capability) {
+            if ($plugintype === 'qbank' && str_starts_with($capname, 'moodle/question:')) {
+                // Question bank capabilities are irregular.
+                $strname = explode('/', $capname, 2)[1];
+                $this->assertTrue($stringmanager->string_exists($strname, 'core_role'),
+                    "Missing capability name string '$strname' in $corerolefile");
+                continue;
+            }
+            $this->assertMatchesRegularExpression("|^$plugintype/$pluginname:[a-z0-9_]+$|", $capname);
+            $strname = substr($capname, strlen($plugintype) + 1);
+            $this->assertTrue($stringmanager->string_exists($strname, $component),
+                "Missing capability name string '$strname' in $langfile");
+            $this->assertSame($capname, clean_param($capname, PARAM_CAPABILITY));
+        }
+    }
+}
@@ -123,6 +123,7 @@ class expired_contexts_manager {
            $expiredcontext = new expired_context(0, $orphan);
            $expiredcontext->delete();
        }
+        $orphaned->close();

        // Delete any child of a user context.
        $parentpath = $DB->sql_concat('ctxuser.path', "'/%'");
@@ -143,6 +144,7 @@ class expired_contexts_manager {
            $expiredcontext = new expired_context(0, $child);
            $expiredcontext->delete();
        }
+        $userchildren->close();
    }

    /**
@@ -127,7 +127,6 @@ $string['dporolemapping'] = 'Privacy officer role mapping';
 $string['dporolemapping_desc'] = 'The privacy officer can manage data requests. The capability tool/dataprivacy:managedatarequests must be allowed for a role to be listed as a privacy officer role mapping option.';
 $string['editcategories'] = 'Edit categories';
 $string['editcategory'] = 'Edit category';
-$string['editcategories'] = 'Edit categories';
 $string['editdefaults'] = 'Edit defaults: {$a}';
 $string['editmoduledefaults'] = 'Edit module defaults';
 $string['editpurpose'] = 'Edit purpose';
@@ -0,0 +1,77 @@
+@tool @tool_lp @tool_lp_framework
+Feature: Manage CRUD operations for competencies
+  In order to perform CRUD operations on competencies
+  As a manager
+  I need to be able to create, read, update and delete competencies
+
+  Background:
+    Given the following "core_competency > frameworks" exist:
+      | shortname | idnumber |
+      | CF1       | CF1      |
+    And the following "core_competency > competencies" exist:
+      | shortname | competencyframework | idnumber | description    |
+      | C1        | CF1                 | C1ID     | C1 description |
+    And I log in as "admin"
+    And I navigate to "Competencies > Competency frameworks" in site administration
+    And I click on "CF1 (CF1)" "link"
+
+  @javascript
+  Scenario: Create a new competency
+    # Targets the `CF1` element to make `Add competency` button visible and accessible to avoid ambiguity with the other 'CF1' element on the screen.
+    Given I click on "//span[text()='CF1']" "xpath_element"
+    When I press "Add competency"
+    And I set the field "Name" to "C2"
+    And I set the field "Description" to "C2 description"
+    And I set the field "ID number" to "C2ID"
+    And I press "Save changes"
+    # Access the newly created competencies to ensure that correct information was registered.
+    Then "Competency created" "text" should exist
+    And "C2" "text" should appear after "C1" "text"
+    And I select "C2" of the competency tree
+    And "C2ID" "text" should exist
+    And "C2 description" "text" should exist
+
+  @javascript
+  Scenario: Read a competency
+    When I select "C1" of the competency tree
+    # Confirm that selected competency info displayed matches registered info.
+    Then "C1ID" "text" should exist
+    And "C1 description" "text" should exist
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    # Similar to the previous step, to avoid ambiguity with the competency framework "Edit", target css element with data-action=edit.
+    And I click on "[data-action=edit]" "css_element"
+    # Confirm that the details displayed when accessing edit screen values match registered data.
+    And the field "Name" matches value "C1"
+    And the field "Description" matches value "C1 description"
+    And the field "ID number" matches value "C1ID"
+
+  @javascript
+  Scenario: Update a competency
+    Given I select "C1" of the competency tree
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    # Similar to the previous step, to avoid ambiguity with the competency framework "Edit", target css element with data-action=edit.
+    When I click on "[data-action=edit]" "css_element"
+    And I set the field "Name" to "C2"
+    And I set the field "Description" to "C2 description"
+    And I set the field "ID number" to "C2ID"
+    And I press "Save changes"
+    Then "Competency updated" "text" should exist
+    And "C1" "text" should not exist
+    And "C2" "text" should exist
+    And I select "C2" of the competency tree
+    And "C2ID" "text" should exist
+    And "C1ID" "text" should not exist
+    And "C2 description" "text" should exist
+    And "C1 description" "text" should not exist
+
+  @javascript
+  Scenario: Delete a competency
+    Given I select "C1" of the competency tree
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    When I click on "Delete" "link"
+    And I click on "Delete" "button" in the "Confirm" "dialogue"
+    # Confirm that "C1" competency was successfully deleted.
+    Then "C1" "text" should not exist
@@ -0,0 +1,63 @@
+@tool @tool_lp @tool_lp_framework
+Feature: Move and cross-reference competencies
+  In order to move and cross-reference competencies
+  As a manager
+  I need to be open the competency's menu items.
+
+  Background:
+    Given the following "core_competency > frameworks" exist:
+      | shortname | idnumber |
+      | CF1       | CF1      |
+    And the following "core_competency > competencies" exist:
+      | shortname | competencyframework |
+      | C1        | CF1                 |
+      | C2        | CF1                 |
+      | C3        | CF1                 |
+      | C4        | CF1                 |
+    And I log in as "admin"
+    And I navigate to "Competencies > Competency frameworks" in site administration
+    And I click on "CF1 (CF1)" "link"
+
+  @javascript
+  Scenario: Move a competency using Move up/Move down menu items
+    Given I select "C1" of the competency tree
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    When I click on "Move down" "link"
+    Then "C1" "text" should appear after "C2" "text"
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    And I click on "Move up" "link"
+    And "C1" "text" should appear before "C2" "text"
+
+  @javascript
+  Scenario: Move a competency using Relocate menu item
+    Given I select "C3" of the competency tree
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    When I click on "Relocate" "link"
+    And I click on "C1" "text" in the "Move competency" "dialogue"
+    And I click on "Move" "button" in the "Move competency" "dialogue"
+    Then "C1" "text" should appear before "C3" "text"
+    And "C3" "text" should appear before "C2" "text"
+    And I select "C3" of the competency tree
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    # Similar to the previous step, to avoid ambiguity with the competency framework "Edit", target css element with data-action=edit.
+    And I click on "[data-action=edit]" "css_element"
+    And "C1" "text" should exist
+    And "No parent (top-level competency)" "text" should not exist
+    And I press "Cancel"
+    And "C1" "text" should appear before "C3" "text"
+    And "C3" "text" should appear before "C2" "text"
+
+  @javascript
+  Scenario: Cross-reference a competency
+    Given I select "C1" of the competency tree
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    When I click on "Add cross-referenced competency" "link"
+    And I click on "C2" "text" in the "Competency picker" "dialogue"
+    And I click on "Add" "button" in the "Competency picker" "dialogue"
+    Then "Cross-referenced competencies:" "text" should exist
+    And I should see "C2 cmp2"
@@ -46,11 +46,11 @@ Feature: See the competencies for an activity on the course competencies page.
    When I follow "Competencies"
    Then I should see "Test-Comp1"
    And I should see "Test-Comp2"
-    And I set the field "Filter competencies by resource or activity" to "PageName1"
+    And I set the competency filter "Filter competencies by resource or activity" to "PageName1"
    And I press the enter key
    And I should see "Test-Comp1"
    And I should not see "Test-Comp2"
-    And I set the field "Filter competencies by resource or activity" to "PageName2"
+    And I set the competency filter "Filter competencies by resource or activity" to "PageName2"
    And I press the enter key
    And I should not see "Test-Comp1"
    And I should not see "Test-Comp2"
@@ -16,16 +16,10 @@ Feature: Manage plan workflow
      | usermanageownplan | User manage own plan role | user |
      | manageplan | Manager all plans role | manager |
    And the following "role capabilities" exist:
-      | role                   | moodle/competency:planmanageowndraft | moodle/competency:planmanageown |
-      | usermanageowndraftplan | allow                                |                                 |
-      | usermanageownplan      | allow                                | allow                           |
-      | manageplan             | allow                                | allow                           |
-    And the following "role capability" exists:
-      | role                                | manageplan |
-      | moodle/competency:planmanage        | allow      |
-      | moodle/competency:planview          | allow      |
-      | moodle/competency:planreview        | allow      |
-      | moodle/competency:planrequestreview | allow      |
+      | role                   | moodle/competency:planmanageowndraft | moodle/competency:planmanageown | moodle/competency:planmanage | moodle/competency:planview | moodle/competency:planreview | moodle/competency:planrequestreview |
+      | usermanageowndraftplan | allow                                |                                 |                              |                            |                              |                                     |
+      | usermanageownplan      | allow                                | allow                           |                              |                            |                              |                                     |
+      | manageplan             | allow                                | allow                           | allow                        | allow                      | allow                        | allow                               |
    And the following "role assigns" exist:
      | user  | role | contextlevel | reference |
      | user1 | usermanageowndraftplan | System |  |
@@ -53,8 +47,7 @@ Feature: Manage plan workflow
      | lp                      | System       | 1         | my-index        | content       |

  Scenario: User can manages his own plan draft
-    Given I log in as "user1"
-    And I follow "Profile" in the user menu
+    Given I am on the "user1" "user > profile" page logged in as user1
    When I follow "Learning plans"
    Then I should see "List of learning plans"
    And I should see "Test-Plan1"
@@ -63,11 +56,9 @@ Feature: Manage plan workflow
    And I should see "Waiting for review"
    And I click on "Cancel review" of edit menu in the "Test-Plan1" row
    And I should see "Draft"
-    And I log out

  Scenario: User can manages his own plan
-    Given I log in as "user2"
-    And I follow "Profile" in the user menu
+    Given I am on the "user2" "user > profile" page logged in as user2
    When I follow "Learning plans"
    Then I should see "List of learning plans"
    And I should see "Test-Plan2"
@@ -82,11 +73,11 @@ Feature: Manage plan workflow
    And I should see "Active"
    And I click on "Complete this learning plan" of edit menu in the "Test-Plan2" row
    And I click on "Complete this learning plan" "button" in the "Confirm" "dialogue"
+    And I wait until the page is ready
    And I should see "Complete"
    And I click on "Reopen this learning plan" of edit menu in the "Test-Plan2" row
    And I click on "Reopen this learning plan" "button" in the "Confirm" "dialogue"
    And I should see "Active"
-    And I log out

  Scenario: Manager can see learning plan with status waiting for review
    Given the following "core_competency > plans" exist:
@@ -96,7 +87,6 @@ Feature: Manage plan workflow
    When I log in as "manager1"
    Then I should see "Test-Plan3"
    And I should not see "Test-Plan4"
-    And I log out

  Scenario: Manager can start review of learning plan with status waiting for review
    Given the following "core_competency > plans" exist:
@@ -108,7 +98,6 @@ Feature: Manage plan workflow
    And I should see "Test-Plan3"
    When I follow "Start review"
    Then I should see "In review"
-    And I log out

  Scenario: Manager can reject a learning plan with status in review
    Given the following "core_competency > plans" exist:
@@ -121,7 +110,6 @@ Feature: Manage plan workflow
    And I should see "In review"
    When I follow "Finish review"
    Then I should see "Draft"
-    And I log out

  Scenario: Manager can accept a learning plan with status in review
    Given the following "core_competency > plans" exist:
@@ -134,7 +122,6 @@ Feature: Manage plan workflow
    And I should see "In review"
    When I follow "Make active"
    Then I should see "Active"
-    And I log out

  Scenario: Manager send back to draft an active learning plan
    Given the following "core_competency > plans" exist:
@@ -150,7 +137,6 @@ Feature: Manage plan workflow
    And I follow "Learning plans"
    Then I should see "Draft"
    And I should not see "Active"
-    And I log out

  Scenario: Manager change an active learning plan to completed
    Given the following "core_competency > plans" exist:
@@ -169,7 +155,6 @@ Feature: Manage plan workflow
    And I follow "Learning plans"
    Then I should see "Complete"
    And I should not see "Active"
-    And I log out

  Scenario: Manager reopen a complete learning plan
    Given the following "core_competency > plans" exist:
@@ -187,4 +172,67 @@ Feature: Manage plan workflow
    And I follow "Learning plans"
    Then I should see "Active"
    And I should not see "Complete"
-    And I log out
+
+  Scenario: Student learning plan derived from templates can be completed
+    Given the following "core_competency > templates" exist:
+      | shortname |
+      | LPT1      |
+    And the following "core_competency > template_competencies" exist:
+      | template | competency |
+      | LPT1     | Test-Comp1 |
+    And I log in as "admin"
+    And I navigate to "Competencies > Learning plan templates" in site administration
+    # Select 1 user to assign to create learning plans for using template.
+    And I click on ".template-userplans" "css_element" in the "LPT1" "table_row"
+    And I set the field "Select users" to "user1"
+    And I press "Create learning plans"
+    And I click on "LPT1" "link" in the "LPT1" "table_row"
+    When I click on "Complete this learning plan" "link"
+    And I click on "Complete this learning plan" "button" in the "Confirm" "dialogue"
+    # Add a short wait to ensure the page has loaded before checking that "Complete" "text" exists.
+    And I wait until the page is ready
+    # Confirm that student's learning plan template is marked as Completed.
+    Then "Complete" "text" should exist
+    And "Reopen this learning plan" "link" should exist
+
+  Scenario: Learning plan template updates are not reflected on plans already completed
+    Given the following "core_competency > templates" exist:
+      | shortname |
+      | LPT1      |
+    And the following "core_competency > template_competencies" exist:
+      | template | competency |
+      | LPT1     | Test-Comp1 |
+    And I log in as "admin"
+    And I navigate to "Competencies > Learning plan templates" in site administration
+    # Select 2 users to assign to create learning plans for using template.
+    And I click on ".template-userplans" "css_element" in the "LPT1" "table_row"
+    And I set the field "Select users" to "user1"
+    And I press "Create learning plans"
+    And I set the field "Select users" to "user2"
+    And I press "Create learning plans"
+    # Complete the learning plan for User 1.
+    And I click on "LPT1" "link" in the "User 1" "table_row"
+    And I click on "Complete this learning plan" "link"
+    And I click on "Complete this learning plan" "button" in the "Confirm" "dialogue"
+    # Add another competency to the learning plan template.
+    And the following "core_competency > template_competencies" exist:
+      | template | competency |
+      | LPT1     | Test-Comp2 |
+    # Navigate back to the list of Learning plan templates in order to access User 1's learning plan.
+    And I navigate to "Competencies > Learning plan templates" in site administration
+    And I click on ".template-userplans" "css_element" in the "LPT1" "table_row"
+    # Confirm that only the first competency is reflected on User 1's learning plan since it's already completed.
+    When I click on "LPT1" "link" in the "User 1" "table_row"
+    Then "Test-Comp2" "link" should not exist
+    And "Test-Comp2" "text" should not exist
+    And "Test-Comp1" "link" should exist
+    And "Test-Comp1" "text" should exist
+    # Navigate back to list of Learning plan templates in order to access User 2's learning plan.
+    And I navigate to "Competencies > Learning plan templates" in site administration
+    And I click on ".template-userplans" "css_element" in the "LPT1" "table_row"
+    # Confirm that both competencies are reflected on User 2's learning plan since it's not yet completed.
+    And I click on "LPT1" "link" in the "User 2" "table_row"
+    And "Test-Comp2" "link" should exist
+    And "Test-Comp2" "text" should exist
+    And "Test-Comp1" "link" should exist
+    And "Test-Comp1" "text" should exist
@@ -0,0 +1,60 @@
+@tool @tool_lp @core_cohort
+Feature: Cohorts can be synchronized with learning plans
+  In order to create learning plans for cohort members
+  As an admin
+  I need to be able to synchronise cohorts with learning plans
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email             |
+      | user1    | User      | One      | user1@example.com |
+      | user2    | User      | Two      | user2@example.com |
+    And the following "cohorts" exist:
+      | name     | idnumber |
+      | Cohort 1 | CH1      |
+    And the following "cohort members" exist:
+      | user  | cohort |
+      | user1 | CH1    |
+      | user2 | CH1    |
+    And the following "core_competency > frameworks" exist:
+      | shortname | idnumber |
+      | CF1       | CF1      |
+    And the following "core_competency > competencies" exist:
+      | shortname | competencyframework | idnumber |
+      | C1        | CF1                 | C1       |
+    And the following "core_competency > templates" exist:
+      | shortname |
+      | LPT1      |
+    And the following "core_competency > template_competencies" exist:
+      | template | competency |
+      | LPT1     | C1         |
+
+  @javascript
+  Scenario: Cohorts can be synchronised with learning plans
+    Given I log in as "admin"
+    # Navigate to the list of learning plan templates in order to add cohorts.
+    And I navigate to "Competencies > Learning plan templates" in site administration
+    When I click on "Add cohorts to sync" of edit menu in the "LPT1" row
+    And I set the field "Select cohorts to sync" to "Cohort 1"
+    And I press "Add cohorts"
+    And I wait until the page is ready
+    # Confirm that 2 learning plans were created for members of the cohort.
+    Then "2 learning plans were created" "text" should exist
+    # Confirm current screen is still "Cohorts synced to this learning plan template screen"
+    And "Cohorts synced to this learning plan template" "text" should exist
+    # Confirm that the cohort is now added to the learning plan template.
+    And the following should exist in the "generaltable" table:
+      | Name     | Cohort ID |
+      | Cohort 1 | CH1       |
+    # Navigate back to the list of learning plan templates to view updated list.
+    And I navigate to "Competencies > Learning plan templates" in site administration
+    # Confirm that the added cohort and learning plans are now reflected on the list of Learning plan templates.
+    And the following should exist in the "generaltable" table:
+      | Name | Category | Cohorts | Learning plans |
+      | LPT1 | System   | 1       | 2              |
+    And I click on ".template-userplans" "css_element" in the "LPT1" "table_row"
+    # Confirm that learning plans were created for all cohort members.
+    And the following should exist in the "generaltable" table:
+      | Name | First name | Email address     |
+      | LPT1 | User One   | user1@example.com |
+      | LPT1 | User Two   | user2@example.com |
@@ -41,6 +41,18 @@ class manager {
    /** @var int */
    const REDIR_LOOP_THRESHOLD = 5;

+    /** @var array These components and related fileareas will not redirect. */
+    const ALLOWED_COMPONENTS = [
+        'core_admin' => [
+            'logocompact',
+            'logo',
+            'favicon',
+        ],
+        'tool_mfa' => [
+            'guidance',
+        ],
+    ];
+
    /**
     * Displays a debug table with current factor information.
     *
@@ -424,6 +436,37 @@ class manager {
            return self::NO_REDIRECT;
        }

+        // Ensure we have a moodle_url object if a string is provided.
+        if (is_string($url)) {
+            $url = new \moodle_url($url);
+        }
+
+        // Check for pluginfile.php urls.
+        $pluginfileurl = new \moodle_url('/pluginfile.php');
+        if ($url->compare($pluginfileurl)) {
+            // Get the slash arguments.
+            $args = explode('/', ltrim($url->get_slashargument(), '/'));
+
+            // Remove the contextid because we do not need it for this check.
+            array_shift($args);
+
+            // Get the component and filearea.
+            $component = clean_param(array_shift($args), PARAM_COMPONENT);
+            $filearea = clean_param(array_shift($args), PARAM_AREA);
+
+            // Check allowed components.
+            if (!array_key_exists($component, static::ALLOWED_COMPONENTS)) {
+                return self::REDIRECT;
+            }
+
+            // Check allowed fileareas.
+            if (!in_array($filearea, static::ALLOWED_COMPONENTS[$component])) {
+                return self::REDIRECT;
+            }
+
+            return self::NO_REDIRECT;
+        }
+
        // Remove all params before comparison.
        $url->remove_all_params();

@@ -442,12 +485,6 @@ class manager {
            }
        }

-        // Dont redirect logo images from pluginfile.php (for example: logo in header).
-        $logourl = new \moodle_url('/pluginfile.php/1/core_admin/logocompact/');
-        if ($url->compare($logourl)) {
-            return self::NO_REDIRECT;
-        }
-
        // Admin not setup.
        if (!empty($CFG->adminsetuppending)) {
            return self::NO_REDIRECT;
@@ -469,12 +506,6 @@ class manager {
            return self::NO_REDIRECT;
        }

-        // Enrolment.
-        $enrol = new \moodle_url('/enrol/index.php');
-        if ($enrol->compare($url, URL_MATCH_BASE)) {
-            return self::NO_REDIRECT;
-        }
-
        // Guest access.
        if (isguestuser()) {
            return self::NO_REDIRECT;
@@ -500,11 +531,8 @@ class manager {
        }

        // WS/AJAX check.
+        // Prevents any potential bypassing of multi-factor authentication.
        if (WS_SERVER || AJAX_SCRIPT) {
-            if (isset($SESSION->mfa_pending) && !empty($SESSION->mfa_pending)) {
-                // Allow AJAX and WS, but never from auth.php.
-                return self::NO_REDIRECT;
-            }
            return self::REDIRECT_EXCEPTION;
        }

@@ -41,7 +41,8 @@ class factor_email_renderer extends plugin_renderer_base {
        $authurl = new \moodle_url('/admin/tool/mfa/factor/email/email.php',
            ['instance' => $instance->id, 'pass' => 1, 'secret' => $instance->secret]);
        $authurlstring = \html_writer::link($authurl, get_string('email:link', 'factor_email'));
-        $blockurl = new \moodle_url('/admin/tool/mfa/factor/email/email.php', ['instance' => $instanceid]);
+        $blockurl = new \moodle_url('/admin/tool/mfa/factor/email/email.php',
+            ['instance' => $instance->id, 'secret' => $instance->secret]);
        $blockurlstring = \html_writer::link($blockurl, get_string('email:stoploginlink', 'factor_email'));
        $geoinfo = iplookup_find_location($instance->createdfromip);

@@ -42,7 +42,8 @@ $PAGE->set_cacheable(false);
 $instance = $DB->get_record('tool_mfa', ['id' => $instanceid]);
 $factor = \tool_mfa\plugininfo\factor::get_factor('email');

-// If pass is set, require login to force $SESSION and user, and pass for that session.
+// If pass is set, do checks and pass for this session.
+// Require login to force $SESSION and user, and pass for that session.
 if (!empty($instance) && $pass != 0 && $secret != 0) {
    require_login();
    if ($factor->get_state() === \tool_mfa\plugininfo\factor::STATE_LOCKED) {
@@ -69,8 +70,12 @@ $form = new \factor_email\form\email($url);

 if ($form->is_cancelled()) {
    redirect(new moodle_url('/'));
-} else if ($fromform = $form->get_data()) {
-    if (empty($instance)) {
+}
+
+// If submitted without the pass param, is a cancel request - do checks and revoke email factor.
+if ($fromform = $form->get_data()) {
+    // Only allow revoke attempts from requests with a valid instance and secret.
+    if (empty($instance) || empty($secret) || $instance->secret != $secret) {
        $message = get_string('error:badcode', 'factor_email');
    } else {
        $user = $DB->get_record('user', ['id' => $instance->userid]);
@@ -33,7 +33,7 @@ $string['email:loginlink'] = 'Or, if you\'re on the same device, use this {$a}.'
 $string['email:message'] = 'Here\'s your verification code for {$a->sitename} ({$a->siteurl}).';
 $string['email:originatingip'] = 'This login request was made from \'{$a}\'';
 $string['email:revokelink'] = 'If this wasn\'t you, you can {$a}.';
-$string['email:revokesuccess'] = 'This code has been successfully revoked. All sessions for {$a} have been ended.
+$string['email:revokesuccess'] = 'This code has been successfully revoked. All sessions for this user have been ended.
    Email will not be usable as a factor until account security has been verified.';
 $string['email:subject'] = 'Here\'s your verification code';
 $string['email:stoploginlink'] = 'stop this login attempt';
@@ -29,7 +29,7 @@ require_once(__DIR__ . '/../../../config.php');
 $PAGE->set_context(\context_system::instance());
 $PAGE->set_url(new moodle_url('/admin/tool/mfa/guide.php'));
 $PAGE->set_title(get_string('guidance', 'tool_mfa'));
-$PAGE->set_pagelayout('standard');
+$PAGE->set_pagelayout('secure');

 // If guidance page isn't enabled, just redir back to home.
 if (!get_config('tool_mfa', 'guidance')) {
@@ -109,8 +109,8 @@ function tool_mfa_after_config(): void {
 /**
 * Serves any files for the guidance page.
 *
- * @param stdClass $course
- * @param stdClass $cm
+ * @param stdClass|null $course
+ * @param stdClass|null $cm
 * @param context $context
 * @param string $filearea
 * @param array $args
@@ -118,7 +118,7 @@ function tool_mfa_after_config(): void {
 * @param array $options
 * @return bool
 */
-function tool_mfa_pluginfile(stdClass $course, stdClass $cm, context $context, string $filearea,
+function tool_mfa_pluginfile(stdClass|null $course, stdClass|null $cm, context $context, string $filearea,
    array $args, bool $forcedownload, array $options = []): bool {
    // Hardcode to only send guidance files from the top level.
    $fs = get_file_storage();
@@ -23,6 +23,6 @@
    {
    }
 }}
-<a href='{{config.wwwroot}}/admin/tool/mfa/guide.php'>
+<a href='{{config.wwwroot}}/admin/tool/mfa/guide.php' target='_blank'>
    {{#str}} guidance, tool_mfa {{/str}}
 </a>
@@ -241,11 +241,6 @@ final class manager_test extends \advanced_testcase {
        $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($badurl, false));
        $this->setUser($user);

-        // Enrolment.
-        $enrolurl = new \moodle_url('/enrol/index.php');
-        $this->assertEquals(\tool_mfa\manager::REDIRECT, \tool_mfa\manager::should_require_mfa($badurl, false));
-        $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($enrolurl, false));
-
        // Guest User.
        $this->assertEquals(\tool_mfa\manager::REDIRECT, \tool_mfa\manager::should_require_mfa($badurl, false));
        $this->setGuestUser();
@@ -266,6 +261,27 @@ final class manager_test extends \advanced_testcase {
        \core\session\manager::loginas($user2->id, $syscontext, false);
        $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($badurl, false));
        $this->setUser($user);
+
+        // Access logocompact via pluginfile.
+        $logourl = new \moodle_url('/pluginfile.php/1/core_admin/logocompact/');
+        $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($logourl, false));
+
+        // Access logo via pluginfile.
+        $logourl = new \moodle_url('/pluginfile.php/1/core_admin/logo/');
+        $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($logourl, false));
+
+        // Access favicon via pluginfile.
+        $logourl = new \moodle_url('/pluginfile.php/1/core_admin/favicon/');
+        $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($logourl, false));
+
+        // Access guidance files.
+        $guideurl = new \moodle_url('/pluginfile.php/1/tool_mfa/guidance/0/capybara.png');
+        $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($guideurl, false));
+
+        // Access private area.
+        $user3 = $this->getDataGenerator()->create_user();
+        $privateurl = new \moodle_url("/pluginfile.php/{$user3->id}/user/private/privatefile.png");
+        $this->assertEquals(\tool_mfa\manager::REDIRECT, \tool_mfa\manager::should_require_mfa($privateurl, false));
    }

    /**
@@ -34,6 +34,10 @@ if (function_exists('opcache_reset')) {

 define('IGNORE_COMPONENT_CACHE', true);

+// It makes no sense to use BEHAT_CLI for this script (you cannot initialise PHPunit starting from
+// the Behat environment), so in case user has set tne environment variable, disable it.
+putenv('BEHAT_CLI=0');
+
 require_once(__DIR__.'/../../../../lib/clilib.php');
 require_once(__DIR__.'/../../../../lib/phpunit/bootstraplib.php');
 require_once(__DIR__.'/../../../../lib/testing/lib.php');
@@ -30,6 +30,10 @@ if (isset($_SERVER['REMOTE_ADDR'])) {

 define('IGNORE_COMPONENT_CACHE', true);

+// It makes no sense to use BEHAT_CLI for this script (you cannot initialise PHPunit starting from
+// the Behat environment), so in case user has set tne environment variable, disable it.
+putenv('BEHAT_CLI=0');
+
 require_once(__DIR__.'/../../../../lib/clilib.php');
 require_once(__DIR__.'/../../../../lib/phpunit/bootstraplib.php');
 require_once(__DIR__.'/../../../../lib/testing/lib.php');
@@ -42,7 +42,7 @@ $string['activate'] = 'Set status to "Active"';
 $string['activating'] = 'Activating a policy';
 $string['activateconfirm'] = '<p>You are about to activate policy <em>\'{$a->name}\'</em> and make the version <em>\'{$a->revision}\'</em> the current one.</p><p>All users will be required to agree to this new policy version to be able to use the site.</p>';
 $string['activateconfirmyes'] = 'Activate';
-$string['agreepolicies'] = 'Please agree to the following policies';
+$string['agreepolicies'] = 'Please agree to the following policies:';
 $string['backtoprevious'] = 'Go back to previous page';
 $string['backtotop'] = 'Back to top';
 $string['cachedef_policy_optional'] = 'Cache of the optional/compulsory flag for policy versions';
@@ -74,8 +74,8 @@ $string['filterplaceholder'] = 'Search keyword or select filter';
 $string['filterpolicy'] = 'Policy: {$a}';
 $string['guestconsent:continue'] = 'Continue';
 $string['guestconsentmessage'] = 'If you continue browsing this website, you agree to our policies:';
-$string['iagree'] = 'I agree to the {$a}';
-$string['idontagree'] = 'No thanks, I decline {$a}';
+$string['iagree'] = 'I agree to the {$a}.';
+$string['idontagree'] = 'I don\'t agree to the {$a}.';
 $string['iagreetothepolicy'] = 'Give consent';
 $string['inactivate'] = 'Set status to "Inactive"';
 $string['inactivating'] = 'Inactivating a policy';
@@ -94,9 +94,9 @@ $string['newpolicy'] = 'New policy';
 $string['newversion'] = 'New version';
 $string['noactivepolicies'] = 'There are no policies with an active version.';
 $string['nofiltersapplied'] = 'No filters applied';
-$string['nopermissiontoagreedocs'] = 'No permission to agree to the policies';
+$string['nopermissiontoagreedocs'] = 'No permission to agree to the policies.';
 $string['nopermissiontoagreedocs_desc'] = 'Sorry, you do not have the required permissions to agree to the policies.<br />You will not be able to use this site until the following policies are agreed:';
-$string['nopermissiontoagreedocsbehalf'] = 'No permission to agree to the policies on behalf of this user';
+$string['nopermissiontoagreedocsbehalf'] = 'No permission to agree to the policies on behalf of this user.';
 $string['nopermissiontoagreedocsbehalf_desc'] = 'Sorry, you do not have the required permission to agree to the following policies on behalf of {$a}:';
 $string['nopermissiontoagreedocscontact'] = 'For more help:';
 $string['nopermissiontoviewpolicyversion'] = 'You do not have permissions to view this policy version.';
@@ -34,13 +34,13 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
    Then I should see "This site policy"
    And I should not see "Course overview"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
    And I press "Next"
    And I should see "Calendar"
    And I log out
    And I log in as "manager"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
    And I press "Next"
    And I navigate to "Users > Privacy and policies > User agreements" in site administration
    And "Accepted" "text" should exist in the "User One" "table_row"
@@ -53,7 +53,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
      | tool/policy:acceptbehalf | allow   |
    When I log in as "manager"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
    And I press "Next"
    And I navigate to "Users > Privacy and policies > Manage policies" in site administration
    And I click on "1 of 4 (25%)" "link" in the "This site policy" "table_row"
@@ -76,7 +76,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
      | tool/policy:acceptbehalf | allow   |
    When I log in as "manager"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
    And I press "Next"
    And I should see "Calendar"
    And I navigate to "Users > Privacy and policies > Manage policies" in site administration
@@ -104,16 +104,16 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
    And I press "Next"
    And I should see "This privacy policy"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
    And I press "Next"
    And I should see "Calendar"
    And I log out
    And I log in as "manager"
    And I press "Next"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
    And I press "Next"
    And I navigate to "Users > Privacy and policies > User agreements" in site administration
    And "Accepted" "text" should exist in the "User One" "table_row"
@@ -142,8 +142,8 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
    When I log in as "manager"
    And I press "Next"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
    And I press "Next"
    And I navigate to "Users > Privacy and policies > User agreements" in site administration
    And I click on "Accept This site policy" "link" in the "User One" "table_row"
@@ -176,8 +176,8 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
    When I log in as "manager"
    And I press "Next"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
    And I press "Next"
    And I navigate to "Users > Privacy and policies > User agreements" in site administration
    And I click on "Accept This site policy" "link" in the "User One" "table_row"
@@ -198,7 +198,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
  Scenario: Policies and agreements profile link visible for current user
    Given I log in as "user1"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
    And I press "Next"
    When I follow "Profile" in the user menu
    # User can see his own agreements link in the profile.
@@ -217,7 +217,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
      | tool/policy:acceptbehalf | allow   |
    And I log in as "manager"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
    And I press "Next"
    # User can see agreements link in other user profiles because has the capability for accepting on behalf of them.
    When I am on "Course1" course homepage
@@ -231,7 +231,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
      | tool/policy:acceptbehalf | allow   |
    When I log in as "manager"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
    And I press "Next"
    And I log out
    And I am on the "manager" "user > profile" page logged in as "admin"
@@ -267,8 +267,8 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
    When I log in as "manager"
    And I press "Next"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
    And I press "Next"
    And I navigate to "Users > Privacy and policies > User agreements" in site administration
    And I click on "Select" "checkbox" in the "User One" "table_row"
@@ -290,7 +290,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
    And I should see "This site policy"
    And I should not see "Course overview"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
    And I press "Next"
    And I should see "Calendar"
    And I log out
@@ -4,7 +4,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
  As a user
  I need to be able to accept site policy during sign up

-  Scenario: Accept policy on sign up, no site policy
+  Scenario: Accept policy on sign up manage by plugin, no site policy
    Given the following config values are set as admin:
      | registerauth    | email |
      | passwordpolicy  | 0     |
@@ -16,13 +16,13 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I set the following fields to these values:
      | Username      | user1                 |
      | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com     |
+      | Email (again) | user1@example.com     |
      | First name    | User1                 |
      | Last name     | L1                    |
    And I press "Create my new account"
    And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
    And I confirm email for "user1"
    And I should see "Thanks, User1 L1"
    And I should see "Your registration has been confirmed"
@@ -50,13 +50,13 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I set the following fields to these values:
      | Username      | user1                 |
      | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
      | First name    | User1                 |
      | Last name     | L1                    |
    And I press "Create my new account"
    And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
    And I confirm email for "user1"
    And I should see "Thanks, User1 L1"
    And I should see "Your registration has been confirmed"
@@ -85,23 +85,23 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should see "short text2"
    And I should see "full text2"
    And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
    And I should see "This site policy" in the "region-main" "region"
    And I should see "short text2"
    And I should not see "full text2"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
    And I press "Next"
    And I should not see "I understand and agree"
    And I set the following fields to these values:
      | Username      | user1                 |
      | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
      | First name    | User1                 |
      | Last name     | L1                    |
    And I press "Create my new account"
    And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
    And I confirm email for "user1"
    And I should see "Thanks, User1 L1"
    And I should see "Your registration has been confirmed"
@@ -137,7 +137,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should see "short text3"
    And I should see "full text3"
    And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
    And I should see "This site policy" in the "region-main" "region"
    And I should see "short text2"
    And I should not see "full text2"
@@ -147,20 +147,20 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should not see "This guests policy" in the "region-main" "region"
    And I should not see "short text4"
    And I should not see "full text4"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
    And I press "Next"
    And I should not see "I understand and agree"
    And I set the following fields to these values:
      | Username      | user1                 |
      | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
      | First name    | User1                 |
      | Last name     | L1                    |
    And I press "Create my new account"
    And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
    And I confirm email for "user1"
    And I should see "Thanks, User1 L1"
    And I should see "Your registration has been confirmed"
@@ -197,23 +197,23 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should see "short text2"
    And I should see "full text2"
    And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
    And I should see "This site policy"
    And I should see "short text2"
    And I should not see "full text2"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
    And I press "Next"
    And I should not see "I understand and agree"
    And I set the following fields to these values:
      | Username      | user1                 |
      | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
      | First name    | User1                 |
      | Last name     | L1                    |
    And I press "Create my new account"
    And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
    And I confirm email for "user1"
    And I should see "Thanks, User1 L1"
    And I should see "Your registration has been confirmed"
@@ -244,19 +244,19 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I press "Next"
    And I should see "This privacy policy"
    And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
    And I should see "This site policy"
    And I should see "This privacy policy"
    # Confirm that a notification is displayed if none of the policies are accepted.
-    When I set the field "I agree to the This site policy" to "0"
-    And I set the field "I agree to the This privacy policy" to "0"
+    When I set the field "I agree to the This site policy." to "0"
+    And I set the field "I agree to the This privacy policy." to "0"
    And I press "Next"
-    Then I should see "Please agree to the following policies"
+    Then I should see "Please agree to the following policies:"
    And I should see "Before continuing you need to acknowledge all these policies."
    # Confirm that a notification is displayed if only some policies are accepted.
-    When I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "0"
-    Then I should see "Please agree to the following policies"
+    When I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "0"
+    Then I should see "Please agree to the following policies:"
    And I should see "Before continuing you need to acknowledge all these policies."

  Scenario: Accept policy on login, do not accept all policies
@@ -276,23 +276,23 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I press "Next"
    And I should see "This privacy policy"
    And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
    And I should see "This site policy"
    And I should see "This privacy policy"
    # Confirm that a notification is displayed if none of the policies are accepted.
-    When I set the field "I agree to the This site policy" to "0"
-    And I set the field "I agree to the This privacy policy" to "0"
+    When I set the field "I agree to the This site policy." to "0"
+    And I set the field "I agree to the This privacy policy." to "0"
    And I press "Next"
-    Then I should see "Please agree to the following policies"
+    Then I should see "Please agree to the following policies:"
    And I should see "Before continuing you need to acknowledge all these policies."
    # Confirm that a notification is displayed if only some policies are accepted.
-    When I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "0"
-    Then I should see "Please agree to the following policies"
+    When I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "0"
+    Then I should see "Please agree to the following policies:"
    And I should see "Before continuing you need to acknowledge all these policies."
    # Confirm that user can not browse the site (edit their profile).
    When I follow "Profile" in the user menu
-    Then I should see "Please agree to the following policies"
+    Then I should see "Please agree to the following policies:"

  Scenario: Accept policy on login, accept all policies
    Given the following config values are set as admin:
@@ -311,14 +311,14 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I press "Next"
    And I should see "This privacy policy"
    And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
    And I should see "This site policy"
    And I should see "This privacy policy"
    # User accepts all policies.
-    When I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    When I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
    And I press "Next"
-    Then I should not see "Please agree to the following policies"
+    Then I should not see "Please agree to the following policies:"
    And I should not see "Before continuing you need to acknowledge all these policies."
    # Confirm that user can login and browse the site (edit their profile).
    When I open my profile in edit mode
@@ -328,7 +328,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    When I log in as "user1"
    Then I should not see "This site policy"
    And I should not see "This privacy policy"
-    And I should not see "Please agree to the following policies"
+    And I should not see "Please agree to the following policies:"
    # Confirm that user can login and browse the site (edit their profile).
    When I open my profile in edit mode
    Then the field "First name" matches value "User"
@@ -350,14 +350,14 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I press "Next"
    And I should see "This privacy policy"
    And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
    And I should see "This site policy"
    And I should see "This privacy policy"
    # User accepts all policies.
-    When I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    When I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
    And I press "Next"
-    Then I should not see "Please agree to the following policies"
+    Then I should not see "Please agree to the following policies:"
    # Confirm that user can login and browse the site (edit their profile).
    When I open my profile in edit mode
    Then the field "First name" matches value "User"
@@ -385,7 +385,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should not see "This privacy policy"
    Then I should see "This third parties policy"
    And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
    And I should see "This third parties policy"
    And I set the field "This third parties policy" to "1"
    And I press "Next"
@@ -407,12 +407,12 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I log in as "user1"
    And I should see "This site policy"
    And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
    And I should see "This site policy"
    # User accepts policy.
-    When I set the field "I agree to the This site policy" to "1"
+    When I set the field "I agree to the This site policy." to "1"
    And I press "Next"
-    Then I should not see "Please agree to the following policies"
+    Then I should not see "Please agree to the following policies:"
    # Confirm that user can login and browse the site (edit their profile).
    When I open my profile in edit mode
    Then the field "First name" matches value "User"
@@ -437,13 +437,13 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should see "short text2 new version"
    And I should see "full text2 new version"
    When I press "Next"
-    Then I should see "Please agree to the following policies"
+    Then I should see "Please agree to the following policies:"
    And I should see "This site policy new version"
    And I should see "short text2 new version"
    # User accepts policy.
-    And I set the field "I agree to the This site policy new version" to "1"
+    And I set the field "I agree to the This site policy new version." to "1"
    When I press "Next"
-    Then I should not see "Please agree to the following policies"
+    Then I should not see "Please agree to the following policies:"
    # Confirm that user can login and browse the site (edit their profile).
    When I open my profile in edit mode
    Then the field "First name" matches value "User"
@@ -504,28 +504,28 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should see "short text3"
    And I should see "full text3"
    When I press "Next"
-    Then I should see "Please agree to the following policies"
+    Then I should see "Please agree to the following policies:"
    And I should see "This site policy" in the "region-main" "region"
    And I should see "short text2"
    And I should see "This privacy policy" in the "region-main" "region"
    And I should see "short text3"
    And I should not see "This guests policy" in the "region-main" "region"
    And I should not see "short text4"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
    When I press "Next"
    Then I should not see "I understand and agree"
    And I should see "New account"
    And I set the following fields to these values:
      | Username      | user1                 |
      | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
      | First name    | User1                 |
      | Last name     | L1                    |
    When I press "Create my new account"
    Then I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
    And I follow "Log in"
    When I click on "Create new account" "link"
    # Confirm that the user can view and accept policies when attempting to create another account.
@@ -537,7 +537,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should see "short text3"
    And I should see "full text3"
    When I press "Next"
-    Then I should see "Please agree to the following policies"
+    Then I should see "Please agree to the following policies:"
    And I should see "This site policy" in the "region-main" "region"
    And I should see "short text2"
    And I should not see "full text2"
@@ -547,8 +547,8 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should not see "This guests policy" in the "region-main" "region"
    And I should not see "short text4"
    And I should not see "full text4"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
    When I press "Next"
    Then I should not see "I understand and agree"
    And I should see "New account"
@@ -572,8 +572,8 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should see "Please read our This privacy policy"
    And I press "Next"
    And I should see "Viewing this page on behalf of User 1"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
    And I press "Next"
    And I log out
    And I log in as "user1"
@@ -599,15 +599,15 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    When I log in as "manager"
    And I press "Next"
    And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
    And I press "Next"
    And I am on the "user1" "user > profile" page
    And I follow "Log in as"
    Then I should see "You are logged in as User 1"
    And I press "Continue"
    And I should see "Policies and agreements"
-    And I should see "No permission to agree to the policies on behalf of this user"
+    And I should see "No permission to agree to the policies on behalf of this user."
    And I should see "Sorry, you do not have the required permission to agree to the following policies on behalf of User 1"

  Scenario: Accept policy on sign up as a guest, one policy
@@ -631,23 +631,23 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should see "short text2"
    And I should see "full text2"
    And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
    And I should see "This site policy"
    And I should see "short text2"
    And I should not see "full text2"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
    And I press "Next"
    And I should not see "I understand and agree"
    And I set the following fields to these values:
      | Username      | user1                 |
      | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
      | First name    | User1                 |
      | Last name     | L1                    |
    And I press "Create my new account"
    And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
    And I confirm email for "user1"
    And I should see "Thanks, User1 L1"
    And I should see "Your registration has been confirmed"
@@ -680,12 +680,12 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    Then I should see "Digital maturity declaration" in the "region-main" "region"
    And I should see "You declare be old enough"
    And I should see "Here goes content."
-    And I press "I agree to the Digital maturity declaration"
+    And I press "I agree to the Digital maturity declaration."
    # The second policy with the agreement style "on its own page" must be accepted now.
    And I should see "Terms of Service" in the "region-main" "region"
    And I should see "We teach, you learn"
    And I should see "Here goes content."
-    And I press "I agree to the Terms of Service"
+    And I press "I agree to the Terms of Service."
    # Only now we see the remaining consent page policies.
    And I should see "Policy 1 out of 2"
    And I should see "Privacy policy" in the "region-main" "region"
@@ -697,26 +697,26 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should see "We eat cookies, srsly"
    And I should see "Here goes content."
    And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
    And I should see "Privacy policy"
    And I should see "Cookies policy"
    And I should not see "Digital maturity declaration" in the "region-main" "region"
    And I should not see "Terms of Service" in the "region-main" "region"
    And I should not see "Here goes content."
-    And I set the field "I agree to the Privacy policy" to "1"
-    And I set the field "I agree to the Cookies policy" to "1"
+    And I set the field "I agree to the Privacy policy." to "1"
+    And I set the field "I agree to the Cookies policy." to "1"
    And I press "Next"
    And I should see "New account"
    And I set the following fields to these values:
      | Username      | user1                 |
      | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
      | First name    | User1                 |
      | Last name     | L1                    |
    And I press "Create my new account"
    And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
    And I confirm email for "user1"
    And I should see "Thanks, User1 L1"
    And I should see "Your registration has been confirmed"
@@ -751,7 +751,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    Then I should see "Digital maturity declaration" in the "region-main" "region"
    And I should see "You declare be old enough"
    And I should see "Here goes content."
-    And I press "I agree to the Digital maturity declaration"
+    And I press "I agree to the Digital maturity declaration."
    # The second policy with the agreement style "on its own page" must be accepted now.
    And I should see "Terms of Service" in the "region-main" "region"
    And I should see "We teach, you learn"
@@ -762,7 +762,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should see "Terms of Service" in the "region-main" "region"
    And I should see "We teach, you learn"
    And I should see "Here goes content."
-    And I press "I agree to the Terms of Service"
+    And I press "I agree to the Terms of Service."
    # Only now we see the remaining consent page policies.
    And I should see "Policy 1 out of 2"
    And I should see "Privacy policy" in the "region-main" "region"
@@ -774,14 +774,14 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    And I should see "We eat cookies, srsly"
    And I should see "Here goes content."
    And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
    And I should see "Privacy policy"
    And I should see "Cookies policy"
    And I should not see "Digital maturity declaration" in the "region-main" "region"
    And I should not see "Terms of Service" in the "region-main" "region"
    And I should not see "Here goes content."
-    And I set the field "I agree to the Privacy policy" to "1"
-    And I set the field "I agree to the Cookies policy" to "1"
+    And I set the field "I agree to the Privacy policy." to "1"
+    And I set the field "I agree to the Cookies policy." to "1"
    And I press "Next"
    And I follow "Profile" in the user menu
    # User can see his own agreements in the profile.
@@ -809,15 +809,15 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    Then I should see "Privacy policy" in the "region-main" "region"
    And I should see "We scan your thoughts"
    And I should see "Here goes content."
-    And I press "I agree to the Privacy policy"
+    And I press "I agree to the Privacy policy."
    And I should see "Digital maturity declaration" in the "region-main" "region"
    And I should see "You declare be old enough"
    And I should see "Here goes content."
-    And I press "I agree to the Digital maturity declaration"
+    And I press "I agree to the Digital maturity declaration."
    And I should see "Terms of Service" in the "region-main" "region"
    And I should see "We teach, you learn"
    And I should see "Here goes content."
-    And I press "I agree to the Terms of Service"
+    And I press "I agree to the Terms of Service."
    And I follow "Profile" in the user menu
    And I follow "Policies and agreements"
    And "Accepted" "text" should exist in the "Privacy policy" "table_row"
@@ -844,21 +844,21 @@ Feature: User must accept policy managed by this plugin when logging in and sign
    Then I should see "Digital maturity declaration" in the "region-main" "region"
    And I should see "You declare be old enough"
    And I should see "Here goes content."
-    And I press "I agree to the Digital maturity declaration"
+    And I press "I agree to the Digital maturity declaration."
    And I should see "Cookies policy" in the "region-main" "region"
    And I should see "We eat cookies, srsly"
-    And I press "I agree to the Cookies policy"
+    And I press "I agree to the Cookies policy."
    And I should see "New account"
    And I set the following fields to these values:
      | Username      | user1                 |
      | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
      | First name    | User1                 |
      | Last name     | L1                    |
    And I press "Create my new account"
    And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
    And I confirm email for "user1"
    And I should see "Thanks, User1 L1"
    And I should see "Your registration has been confirmed"
@@ -61,7 +61,7 @@ Feature: Manage policies
      | Policy1    | v1       | full text2 | short text2 | active   |
    And I log in as "manager"
    And I press "Next"
-    And I set the field "I agree to the Policy1" to "1"
+    And I set the field "I agree to the Policy1." to "1"
    And I press "Next"
    And I navigate to "Users > Privacy and policies > Manage policies" in site administration
    And I click on "Edit" "link" in the "Policy1" "table_row"
@@ -83,7 +83,7 @@ Feature: Manage policies
      | Policy1    | v1       | full text2 | short text2 | active   |
    And I log in as "manager"
    And I press "Next"
-    And I set the field "I agree to the Policy1" to "1"
+    And I set the field "I agree to the Policy1." to "1"
    And I press "Next"
    And I navigate to "Users > Privacy and policies > Manage policies" in site administration
    And I click on "Edit" "link" in the "Policy1" "table_row"
@@ -101,7 +101,7 @@ Feature: Manage policies
      | Policy1    | v1       | full text2 | short text2 | active   |
    And I log in as "manager"
    And I press "Next"
-    And I set the field "I agree to the Policy1" to "1"
+    And I set the field "I agree to the Policy1." to "1"
    And I press "Next"
    And I navigate to "Users > Privacy and policies > Manage policies" in site administration
    And I click on "Edit" "link" in the "Policy1" "table_row"
@@ -180,7 +180,7 @@ Feature: Manage policies
      | Policy1    | v1       | full text2 | short text2 | active   |
    And I log in as "manager"
    And I press "Next"
-    And I set the field "I agree to the Policy1" to "1"
+    And I set the field "I agree to the Policy1." to "1"
    And I press "Next"
    And I navigate to "Users > Privacy and policies > Manage policies" in site administration
    And I click on "Set status to \"Inactive\"" "link" in the "Policy1" "table_row"
@@ -218,7 +218,7 @@ Feature: Manage policies
      | Policy1    | v1       | full text2 | short text2 | active   |
    And I log in as "manager"
    And I press "Next"
-    And I set the field "I agree to the Policy1" to "1"
+    And I set the field "I agree to the Policy1." to "1"
    And I press "Next"
    And I navigate to "Users > Privacy and policies > Manage policies" in site administration
    And I click on "Set status to \"Inactive\"" "link" in the "Policy1" "table_row"
@@ -247,7 +247,7 @@ Feature: Manage policies
      | Policy1    | v1       | full text2 | short text2 | active   |
    And I log in as "user1"
    And I press "Next"
-    And I set the field "I agree to the Policy1" to "1"
+    And I set the field "I agree to the Policy1." to "1"
    And I press "Next"
    And I follow "Preferences" in the user menu
    And I should see "Preferences"
@@ -70,26 +70,26 @@ Feature: Optional policies
    And I should see "OwnPageCompulsory1" in the "region-main" "region"
    And I should see "short text4" in the "region-main" "region"
    And I should see "full text4" in the "region-main" "region"
-    And I press "I agree to the OwnPageCompulsory1"
+    And I press "I agree to the OwnPageCompulsory1."
    # Compulsory policies displayed on the consent page are shown next and must be agreed.
    And I should see "ConsentPageCompulsory1"
    And I should see "short text3" in the "region-main" "region"
    And I should see "full text3" in the "region-main" "region"
    And I press "Next"
-    And I should see "Please agree to the following policies"
-    And I set the field "I agree to the ConsentPageCompulsory1" to "1"
+    And I should see "Please agree to the following policies:"
+    And I set the field "I agree to the ConsentPageCompulsory1." to "1"
    And I press "Next"
    # The signup form can be submitted and a new account created.
    And I set the following fields to these values:
      | Username      | user3               |
      | Password      | user3                 |
-      | Email address | user3@address.invalid |
-      | Email (again) | user3@address.invalid |
+      | Email address | user3@example.com    |
+      | Email (again) | user3@example.com   |
      | First name    | User3                 |
      | Last name       | L3                    |
    And I press "Create my new account"
    And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user3@address.invalid"
+    And I should see "An email should have been sent to your address at user3@example.com"
    And I confirm email for "user3"
    And I should see "Thanks, User3 L3"
    And I should see "Your registration has been confirmed"
@@ -99,7 +99,7 @@ Feature: Optional policies
    Then I should see "OwnPageOptional1"
    And I should see "short text5" in the "region-main" "region"
    And I should see "full text5" in the "region-main" "region"
-    And I press "No thanks, I decline OwnPageOptional1"
+    And I press "I don't agree to the OwnPageOptional1"
    # Then come policies displayed on the consent page.
    And I should see "ConsentPageOptional1" in the "region-main" "region"
    And I should see "short text1" in the "region-main" "region"
@@ -109,9 +109,9 @@ Feature: Optional policies
    And I should see "short text2" in the "region-main" "region"
    And I should see "full text2" in the "region-main" "region"
    And I press "Next"
-    And I should see "Please agree to the following policies"
-    And I set the field "I agree to the ConsentPageOptional1" to "1"
-    And I set the field "No thanks, I decline ConsentPageOptional2" to "0"
+    And I should see "Please agree to the following policies:"
+    And I set the field "I agree to the ConsentPageOptional1." to "1"
+    And I set the field "I don't agree to the ConsentPageOptional2" to "0"
    And I press "Next"
    # Accepted and declined policies are shown in the profile.
    And I follow "Profile" in the user menu
@@ -132,14 +132,14 @@ Feature: Optional policies
    Then I should see "OwnPageOptional1"
    And I should see "short text5" in the "region-main" "region"
    And I should see "full text5" in the "region-main" "region"
-    And I press "I agree to the OwnPageOptional1"
+    And I press "I agree to the OwnPageOptional1."
    # Then come policies displayed on the consent page.
    And I should see "ConsentPageOptional1" in the "region-main" "region"
    And I should see "short text1" in the "region-main" "region"
    And I should see "full text1" in the "region-main" "region"
    And I press "Next"
-    And I should see "Please agree to the following policies"
-    And I set the field "No thanks, I decline ConsentPageOptional1" to "0"
+    And I should see "Please agree to the following policies:"
+    And I set the field "I don't agree to the ConsentPageOptional1" to "0"
    And I press "Next"
    # Accepted and declined policies are shown in the profile.
    And I follow "Profile" in the user menu
@@ -152,7 +152,7 @@ Feature: Optional policies
      | Name                   | Content    | Summary     | Agreementstyle | Optional  |
      | OwnPageOptional1       | full text1 | short text1 | 1              | 1         |
    And I log in as "user1"
-    And I press "I agree to the OwnPageOptional1"
+    And I press "I agree to the OwnPageOptional1."
    And I follow "Profile" in the user menu
    And I follow "Policies and agreements"
    And "Accepted" "text" should exist in the "OwnPageOptional1" "table_row"
@@ -177,7 +177,7 @@ Feature: Optional policies
      | Name                   | Content    | Summary     | Agreementstyle | Optional  |
      | OwnPageOptional1       | full text1 | short text1 | 1              | 1         |
    And I log in as "user1"
-    And I press "I agree to the OwnPageOptional1"
+    And I press "I agree to the OwnPageOptional1."
    And I follow "Profile" in the user menu
    And I follow "Policies and agreements"
    And "Accepted" "text" should exist in the "OwnPageOptional1" "table_row"
@@ -202,12 +202,12 @@ Feature: Optional policies
      | OwnPageOptional1       | full text1 | short text1 | 1              | 1         |
      | OwnPageOptional2       | full text2 | short text2 | 1              | 1         |
    And I log in as "user1"
-    And I press "I agree to the OwnPageOptional1"
-    And I press "No thanks, I decline OwnPageOptional2"
+    And I press "I agree to the OwnPageOptional1."
+    And I press "I don't agree to the OwnPageOptional2"
    And I log out
    And I log in as "manager"
-    And I press "I agree to the OwnPageOptional1"
-    And I press "I agree to the OwnPageOptional2"
+    And I press "I agree to the OwnPageOptional1."
+    And I press "I agree to the OwnPageOptional2."
    When I navigate to "Users > Privacy and policies > User agreements" in site administration
    # User One has accepted just some policies.
    Then "Partially accepted" "text" should exist in the "User One" "table_row"
@@ -228,8 +228,8 @@ Feature: Optional policies
      | OwnPageOptional1       | full text1 | short text1 | 1              | 1         |
      | OwnPageOptional2       | full text2 | short text2 | 1              | 1         |
    And I log in as "user1"
-    And I press "I agree to the OwnPageOptional1"
-    And I press "No thanks, I decline OwnPageOptional2"
+    And I press "I agree to the OwnPageOptional1."
+    And I press "I don't agree to the OwnPageOptional2"
    And I log out
    And I log in as "admin"
    When I navigate to "Users > Privacy and policies > User agreements" in site administration
@@ -178,12 +178,7 @@ class tool_uploadcourse_helper {
     * @return enrol_plugin[]
     */
    public static function get_enrolment_plugins() {
-        $cache = cache::make('tool_uploadcourse', 'helper');
-        if (($enrol = $cache->get('enrol')) === false) {
-            $enrol = enrol_get_plugins(false);
-            $cache->set('enrol', $enrol);
-        }
-        return $enrol;
+        return enrol_get_plugins(false);
    }

    /**
@@ -208,12 +208,11 @@ class helper {
     * @return  \moodle_url             The URL.
     */
    public static function get_duplicate_tour_link($tourid) {
-        $link = new \moodle_url('/admin/tool/usertours/configure.php', [
+        return new \moodle_url('/admin/tool/usertours/configure.php', [
            'action'    => manager::ACTION_DUPLICATETOUR,
            'id'        => $tourid,
+            'sesskey'   => sesskey(),
        ]);
-
-        return $link;
    }

    /**
@@ -503,8 +503,9 @@ class manager {
     * @param   int         $tourid     The ID of the tour to duplicate.
     */
    protected function duplicate_tour($tourid) {
-        $tour = helper::get_tour($tourid);
+        require_sesskey();

+        $tour = helper::get_tour($tourid);
        $export = $tour->to_record();
        // Remove the id.
        unset($export->id);
@@ -102,7 +102,6 @@ $string['name'] = 'Name';
 $string['name_help'] = 'The name of a tour may be added as plain text, enclosed in multilang tags (for use with the multi-language content filter) if required.

 Alternatively, a language string ID may be entered in the format identifier,component (with no brackets or space after the comma).';
-$string['newstep'] = 'Create step';
 $string['newstep'] = 'New step';
 $string['newtour'] = 'Create a new tour';
 $string['next'] = 'Next';
@@ -1,12 +0,0 @@
-@tool @tool_xmldb
-Feature: The Reconcile XMLDB files report works and all the files are ok
-  In order to ensure that all the XMLDB Editor xml files are generated properly
-  As a developer
-  I need to be able to run the Reconcile XMLDB files report and verify that everything is ok
-
-  Scenario: The Reconcile XMLDB files reports that all files are ok
-    Given I log in as "admin"
-    And I navigate to "Development > XMLDB editor" in site administration
-    When I follow "[Reconcile XMLDB files]"
-    Then I should see "Look for XMLDB files needing reconciling"
-    And I should see "All files are OK. No reconciling is needed."
@@ -1925,6 +1925,7 @@ class model {
                $uniqueid = $this->get_time_splitting()->append_rangeindex($dbprediction->sampleid, $dbprediction->rangeindex);
                $predictionrecords[$uniqueid]->id = $dbprediction->id;
            }
+            $dbpredictions->close();
        }

        return $predictionrecords;
@@ -370,7 +370,7 @@ class core_auth_external extends external_api {
     * @throws moodle_exception
     */
    public static function resend_confirmation_email($username, $password, $redirect = '') {
-        global $PAGE;
+        global $PAGE, $CFG;

        $warnings = array();
        $params = self::validate_parameters(
@@ -387,20 +387,27 @@ class core_auth_external extends external_api {
        $username = trim(core_text::strtolower($params['username']));
        $password = $params['password'];

+        $user = core_user::get_user_by_username($username);
+
+        if (!empty($user) && $user->confirmed) {
+            if (!empty($CFG->protectusernames)) {
+                throw new moodle_exception('invalidlogin');
+            }
+            throw new moodle_exception('alreadyconfirmed');
+        }
+
        if (is_restored_user($username)) {
+            if (!empty($CFG->protectusernames)) {
+                throw new moodle_exception('invalidlogin');
+            }
            throw new moodle_exception('restoredaccountresetpassword', 'webservice');
        }

        $user = authenticate_user_login($username, $password);
-
        if (empty($user)) {
            throw new moodle_exception('invalidlogin');
        }

-        if ($user->confirmed) {
-            throw new moodle_exception('alreadyconfirmed');
-        }
-
        // Check if we should redirect the user once the user is confirmed.
        $confirmationurl = null;
        if (!empty($params['redirect'])) {
@@ -15,13 +15,13 @@ Feature: User must accept policy when logging in and signing up
    And I set the following fields to these values:
      | Username      | user1                 |
      | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | student1@example.com  |
+      | Email (again) | student1@example.com  |
      | First name    | User1                 |
      | Last name     | L1                    |
    And I press "Create my new account"
    And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at student1@example.com"
    And I confirm email for "user1"
    And I should see "Thanks, User1 L1"
    And I should see "Your registration has been confirmed"
@@ -45,14 +45,14 @@ Feature: User must accept policy when logging in and signing up
    And I set the following fields to these values:
      | Username      | user1                 |
      | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com     |
+      | Email (again) | user1@example.com     |
      | First name    | User1                 |
      | Last name     | L1                    |
      | I understand and agree | 1            |
    And I press "Create my new account"
    And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
    And I confirm email for "user1"
    And I should see "Thanks, User1 L1"
    And I should see "Your registration has been confirmed"
@@ -67,8 +67,8 @@ Feature: User must accept policy when logging in and signing up
  Scenario Outline: Email validation during email registration
    Given the following config values are set as admin:
      | allowaccountssameemail | <allowsameemail> |
-      | registerauth           | email              |
-      | passwordpolicy         | 0                  |
+      | registerauth           | email            |
+      | passwordpolicy         | 0                |
    And the following "users" exist:
      | username | firstname | lastname | email          |
      | s1       | John      | Doe      | s1@example.com |
@@ -104,6 +104,7 @@ class auth_plugin_lti extends \auth_plugin_base {
     * @param int $provisioningmode the desired account provisioning mode, which controls the auth flow for unbound users.
     * @param array $legacyconsumersecrets an array of secrets used by the legacy consumer if a migration claim exists.
     * @throws coding_exception if the specified provisioning mode is invalid.
+     * @throws moodle_exception if user authentication fails.
     */
    public function complete_login(array $launchdata, moodle_url $returnurl, int $provisioningmode,
            array $legacyconsumersecrets = []): void {
@@ -112,6 +113,19 @@ class auth_plugin_lti extends \auth_plugin_base {
        if ($this->get_user_binding($launchdata['iss'], $launchdata['sub'])) {
            $user = $this->find_or_create_user_from_launch($launchdata);

+            if ($user->suspended) {
+                $failurereason = AUTH_LOGIN_SUSPENDED;
+                $event = \core\event\user_login_failed::create([
+                    'userid' => $user->id,
+                    'other' => [
+                        'username' => $user->username,
+                        'reason' => $failurereason
+                    ]
+                ]);
+                $event->trigger();
+                throw new moodle_exception('invalidlogin', 'core');
+            }
+
            if (isloggedin()) {
                // If a different user is currently logged in, authenticate the linked user instead.
                global $USER;
@@ -25,7 +25,7 @@
 require_once('../../config.php');

 $issuerid = required_param('id', PARAM_INT);
-$wantsurl = new moodle_url(optional_param('wantsurl', '', PARAM_URL));
+$wantsurl = new moodle_url(optional_param('wantsurl', '', PARAM_LOCALURL));

 $PAGE->set_context(context_system::instance());
 $PAGE->set_url(new moodle_url('/auth/oauth2/login.php', ['id' => $issuerid]));
@@ -181,6 +181,7 @@ final class external_test extends externallib_advanced_testcase {
        $this->assertTrue($result['success']);
        $this->assertEmpty($result['warnings']);

+        set_config('protectusernames', 0);
        $_SERVER['HTTP_USER_AGENT'] = 'no browser'; // Hack around missing user agent in CLI scripts.
        $this->expectException('\moodle_exception');
        $this->expectExceptionMessage('error/invalidlogin');
@@ -204,6 +205,7 @@ final class external_test extends externallib_advanced_testcase {
        $this->assertTrue($result['success']);
        $this->assertEmpty($result['warnings']);

+        set_config('protectusernames', 0);
        $_SERVER['HTTP_USER_AGENT'] = 'no browser'; // Hack around missing user agent in CLI scripts.
        $this->expectException('\moodle_exception');
        $this->expectExceptionMessage('error/invalidlogin');
@@ -234,6 +236,13 @@ final class external_test extends externallib_advanced_testcase {
        $result = external_api::clean_returnvalue(core_auth_external::confirm_user_returns(), $result);
        $this->assertTrue($result['success']);

+        // Keep protectusernames enabled so the call returns invalidlogin exception.
+        $this->expectException('\moodle_exception');
+        $this->expectExceptionMessage('error/invalidlogin');
+        core_auth_external::resend_confirmation_email($username, $password);
+
+        // Now disable protectusernames and expect an exception.
+        set_config('protectusernames', 0);
        $this->expectException('\moodle_exception');
        $this->expectExceptionMessage('error/alreadyconfirmed');
        core_auth_external::resend_confirmation_email($username, $password);
@@ -73,7 +73,15 @@ class auth_plugin_webservice extends auth_plugin_base {
    function user_login_webservice($username, $password) {
        global $CFG, $DB;
        // special web service login
-        if ($user = $DB->get_record('user', array('username'=>$username, 'mnethostid'=>$CFG->mnet_localhost_id))) {
+        $user = $DB->get_record('user', [
+            'username' => $username,
+            'auth' => 'webservice',
+            'deleted' => '0',
+            'suspended' => '0',
+            'mnethostid' => $CFG->mnet_localhost_id,
+        ]);
+
+        if ($user) {
            return validate_internal_user_password($user, $password);
        }
        return false;
@@ -117,6 +117,11 @@ abstract class frontend {
        foreach ($enabled as $plugin => $info) {
            // Create plugin front-end object.
            $class = '\availability_' . $plugin . '\frontend';
+            if (!class_exists($class)) {
+                continue;
+            }
+
+            /** @var \core_availability\frontend $frontend */
            $frontend = new $class();

            // Add to array of required YUI modules.
@@ -792,11 +792,10 @@ abstract class info {
        // plugin could also rely on the completion plugin.
        $pluginmanager = \core_plugin_manager::instance();
        $enabled = $pluginmanager->get_enabled_plugins('availability');
-        $componentparams = new \stdClass();
        foreach ($enabled as $plugin => $info) {
-            // Use the static method.
+            /** @var \core_availability\condition $class */
            $class = '\availability_' . $plugin . '\condition';
-            if ($class::completion_value_used($course, $cmid)) {
+            if (class_exists($class) && $class::completion_value_used($course, $cmid)) {
                return true;
            }
        }
@@ -220,9 +220,9 @@ class tree extends tree_node {

            // First see if it's a condition. These have a defined type.
            if (isset($child->type)) {
-                // Look for a plugin of this type.
+                /** @var \core_availability\condition $classname */
                $classname = '\availability_' . $child->type . '\condition';
-                if (!array_key_exists($child->type, $enabled)) {
+                if (!array_key_exists($child->type, $enabled) || !class_exists($classname)) {
                    if ($lax) {
                        // On load of existing settings, ignore if class
                        // doesn't exist.
@@ -197,8 +197,7 @@ abstract class restore_qtype_plugin extends restore_plugin {
                $this->questionanswercacheid = $newquestionid;
                // Cache all cleaned answers for a simple text match.
                foreach ($answers as $answer) {
-                    // MDL-30018: Clean in the same way as {@link xml_writer::xml_safe_utf8()}.
-                    $clean = preg_replace('/[\x-\x8\xb-\xc\xe-\x1f\x7f]/is','', $answer->answer); // Clean CTRL chars.
+                    $clean = core_text::trim_ctrl_chars($answer->answer); // Clean CTRL chars.
                    $clean = preg_replace("/\r\n|\r/", "\n", $clean); // Normalize line ending.
                    $this->questionanswercache[$clean] = $answer->id;
                }
@@ -5271,8 +5271,7 @@ class restore_create_categories_and_questions extends restore_structure_step {
                $potentialhints = $DB->get_records('question_hints',
                        array('questionid' => $newquestionid), '', 'id, hint');
                foreach ($potentialhints as $potentialhint) {
-                    // Clean in the same way than {@link xml_writer::xml_safe_utf8()}.
-                    $cleanhint = preg_replace('/[\x-\x8\xb-\xc\xe-\x1f\x7f]/is','', $potentialhint->hint); // Clean CTRL chars.
+                    $cleanhint = core_text::trim_ctrl_chars($potentialhint->hint); // Clean CTRL chars.
                    $cleanhint = preg_replace("/\r\n|\r/", "\n", $cleanhint); // Normalize line ending.
                    if ($cleanhint === $data->hint) {
                        $newitemid = $data->id;
@@ -253,14 +253,14 @@ class xml_writer {
    }

    /**
-     * Perform some UTF-8 cleaning, stripping the control chars (\x0-\x1f)
-     * but tabs (\x9), newlines (\xa) and returns (\xd). The delete control
+     * Perform some UTF-8 cleaning, stripping the control chars (\x00-\x1f)
+     * but tabs (\x09), newlines (\xa) and returns (\xd). The delete control
     * char (\x7f) is also included. All them are forbiden in XML 1.0 specs.
     * The expression below seems to be UTF-8 safe too because it simply
     * ignores the rest of characters. Also normalize linefeeds and return chars.
     */
    protected function xml_safe_utf8($content) {
-        $content = preg_replace('/[\x-\x8\xb-\xc\xe-\x1f\x7f]/is', '', $content ?? ''); // clean CTRL chars.
+        $content = core_text::trim_ctrl_chars($content ?? '');
        $content = preg_replace("/\r\n|\r/", "\n", $content); // Normalize line&return=>line
        return fix_utf8($content);
    }
@@ -82,6 +82,16 @@ if (!$badge->is_active()) {
    die();
 }

+if (!empty($role)) {
+    if (!user_has_role_assignment($USER->id, $role, $context->id) && !$isadmin) {
+        // User does not have the role passed by the parameter.
+        echo $OUTPUT->header();
+        echo $OUTPUT->notification(get_string('wrongrole', 'badges'));
+        echo $OUTPUT->footer();
+        die();
+    }
+}
+
 $returnurl = new moodle_url('recipients.php', array('id' => $badge->id));
 $returnlink = html_writer::link($returnurl, $strrecipients);
 $actionbar = new \core_badges\output\standard_action_bar($PAGE, $badge->type, false, false, $returnurl);
@@ -60,6 +60,7 @@ if (!empty($issuedbadge->recipient->id)) {
    $assertionid = $assertion->get_assertion_hash();
    $assertionentityid = $assertiondata['id'];
    $badgeadded = false;
+    $issuerexists = false;
    if (badges_open_badges_backpack_api() == OPEN_BADGES_V2) {
        $sitebackpack = badges_get_site_primary_backpack();
        $api = new \core_badges\backpack_api($sitebackpack);
@@ -71,62 +72,75 @@ if (!empty($issuedbadge->recipient->id)) {
            $issuer = $assertion->get_issuer();
            if (!($issuerentityid = badges_external_get_mapping($sitebackpack->id, OPEN_BADGES_V2_TYPE_ISSUER, $issuer['email']))) {
                $response = $api->put_issuer($issuer);
-                if (!$response) {
-                    throw new moodle_exception('invalidrequest', 'error');
+                if ($response) {
+                    $issuerexists = true;
+                    $issuerentityid = $response->id;
+                    badges_external_create_mapping(
+                        $sitebackpack->id,
+                        OPEN_BADGES_V2_TYPE_ISSUER,
+                        $issuer['email'],
+                        $issuerentityid,
+                    );
                }
-                $issuerentityid = $response->id;
-                badges_external_create_mapping($sitebackpack->id, OPEN_BADGES_V2_TYPE_ISSUER, $issuer['email'],
-                    $issuerentityid);
            }
-            // Create badge.
-            $badge = $assertion->get_badge_class(false);
-            $badgeid = $assertion->get_badge_id();
-            if (!($badgeentityid = badges_external_get_mapping($sitebackpack->id, OPEN_BADGES_V2_TYPE_BADGE, $badgeid))) {
-                $response = $api->put_badgeclass($issuerentityid, $badge);
-                if (!$response) {
-                    throw new moodle_exception('invalidrequest', 'error');
+            if ($issuerexists) {
+                // Create badge.
+                $badge = $assertion->get_badge_class(false);
+                $badgeid = $assertion->get_badge_id();
+                if (!($badgeentityid = badges_external_get_mapping($sitebackpack->id, OPEN_BADGES_V2_TYPE_BADGE, $badgeid))) {
+                    $response = $api->put_badgeclass($issuerentityid, $badge);
+                    if ($response) {
+                        $badgeentityid = $response->id;
+                        badges_external_create_mapping(
+                            $sitebackpack->id,
+                            OPEN_BADGES_V2_TYPE_BADGE,
+                            $badgeid,
+                            $badgeentityid,
+                        );
+                    }
                }
-                $badgeentityid = $response->id;
-                badges_external_create_mapping($sitebackpack->id, OPEN_BADGES_V2_TYPE_BADGE, $badgeid,
-                    $badgeentityid);
-            }

-            // Create assertion (Award the badge!).
-            $assertionentityid = badges_external_get_mapping(
-                $sitebackpack->id,
-                OPEN_BADGES_V2_TYPE_ASSERTION,
-                $assertionid
-            );
-
-            if ($assertionentityid && strpos($sitebackpack->backpackapiurl, 'badgr')) {
-                $assertionentityid = badges_generate_badgr_open_url(
-                    $sitebackpack,
-                    OPEN_BADGES_V2_TYPE_ASSERTION,
-                    $assertionentityid
-                );
-            }
-
-            // Create an assertion for the recipient in the issuer's account.
-            if (!$assertionentityid) {
-                $response = $api->put_badgeclass_assertion($badgeentityid, $assertiondata);
-                if (!$response) {
-                    throw new moodle_exception('invalidrequest', 'error');
-                }
-                $assertionentityid = badges_generate_badgr_open_url($sitebackpack, OPEN_BADGES_V2_TYPE_ASSERTION, $response->id);
-                $badgeadded = true;
-                badges_external_create_mapping($sitebackpack->id, OPEN_BADGES_V2_TYPE_ASSERTION, $assertionid,
-                    $response->id);
-            } else {
-                // An assertion already exists. Make sure it's up to date.
-                $internalid = badges_external_get_mapping(
+                // Create assertion (Award the badge!).
+                $assertionentityid = badges_external_get_mapping(
                    $sitebackpack->id,
                    OPEN_BADGES_V2_TYPE_ASSERTION,
-                    $assertionid,
-                    'externalid'
+                    $assertionid
                );
-                $response = $api->update_assertion($internalid, $assertiondata);
-                if (!$response) {
-                    throw new moodle_exception('invalidrequest', 'error');
+
+                if ($assertionentityid && strpos($sitebackpack->backpackapiurl, 'badgr')) {
+                    $assertionentityid = badges_generate_badgr_open_url(
+                        $sitebackpack,
+                        OPEN_BADGES_V2_TYPE_ASSERTION,
+                        $assertionentityid
+                    );
+                }
+
+                // Create an assertion for the recipient in the issuer's account.
+                if (!$assertionentityid) {
+                    $response = $api->put_badgeclass_assertion($badgeentityid, $assertiondata);
+                    if ($response) {
+                        $assertionentityid = badges_generate_badgr_open_url(
+                            $sitebackpack,
+                            OPEN_BADGES_V2_TYPE_ASSERTION,
+                            $response->id,
+                        );
+                        $badgeadded = true;
+                        badges_external_create_mapping(
+                            $sitebackpack->id,
+                            OPEN_BADGES_V2_TYPE_ASSERTION,
+                            $assertionid,
+                            $response->id,
+                        );
+                    }
+                } else {
+                    // An assertion already exists. Make sure it's up to date.
+                    $internalid = badges_external_get_mapping(
+                        $sitebackpack->id,
+                        OPEN_BADGES_V2_TYPE_ASSERTION,
+                        $assertionid,
+                        'externalid'
+                    );
+                    $response = $api->update_assertion($internalid, $assertiondata);
                }
            }
        }
@@ -136,21 +150,61 @@ if (!empty($issuedbadge->recipient->id)) {
    // - If a user and site backpack have the same provider we can skip this as Badgr automatically maps recipients
    // based on email address.
    // - This is only needed when the backpacks are from different regions.
-    if ($assertionentityid && !badges_external_get_mapping($userbackpack->id, OPEN_BADGES_V2_TYPE_ASSERTION, $assertionid)) {
+    if (
+        $assertionentityid
+        && (!$issuerexists || !badges_external_get_mapping($userbackpack->id, OPEN_BADGES_V2_TYPE_ASSERTION, $assertionid))
+    ) {
        $userapi = new \core_badges\backpack_api($userbackpack, $backpack);
        $userapi->authenticate();
        $response = $userapi->import_badge_assertion($assertionentityid);
-        if (!$response) {
-            throw new moodle_exception('invalidrequest', 'error');
+        if ($response) {
+            $assertionentityid = $response->id;
+            $badgeadded = true;
+            badges_external_create_mapping(
+                $userbackpack->id,
+                OPEN_BADGES_V2_TYPE_ASSERTION,
+                $assertionid,
+                $assertionentityid,
+            );
        }
-        $assertionentityid = $response->id;
-        $badgeadded = true;
-        badges_external_create_mapping($userbackpack->id, OPEN_BADGES_V2_TYPE_ASSERTION, $assertionid,
-            $assertionentityid);
    }

-    $response = $badgeadded ? ['success' => 'addedtobackpack'] : ['warning' => 'existsinbackpack'];
-    redirect(new moodle_url('/badges/mybadges.php', $response));
+    if ($badgeadded) {
+        $message = get_string('addedtobackpack', 'badges');
+        $messagetype = \core\output\notification::NOTIFY_SUCCESS;
+    } else {
+        if (isset($userapi) && !empty($userapi->get_errors())) {
+            // If the api used to import the badge to the backpack has errors, show them to inform the user.
+            if (array_filter($userapi->get_errors(), fn($element) => str_contains($element, "DUPLICATE_BADGE"))) {
+                // Duplicated badges are displayed as a warning.
+                $message = get_string('existsinbackpack', 'badges');
+                $messagetype = \core\output\notification::NOTIFY_WARNING;
+            } else {
+                // If the userapi has any other errors, we will use those to inform the user.
+                $message = get_string(
+                    'error:cannotsendtobackpack',
+                    'badges',
+                    implode($userapi->get_errors()),
+                );
+                $messagetype = \core\output\notification::NOTIFY_ERROR;
+            }
+        } else if (isset($api) && !empty($api->get_errors())) {
+            // If the api used to create/update the issuer has errors, show them to inform the user.
+            $errors = $api->get_errors() ?? [get_string('invalidrequest', 'error')];
+            $message = get_string(
+                'error:cannotsendtobackpack',
+                'badges',
+                implode($errors),
+            );
+            $messagetype = \core\output\notification::NOTIFY_ERROR;
+        }
+    }
+
+    redirect(
+        url: new moodle_url('/badges/mybadges.php'),
+        message: $message,
+        messagetype: $messagetype,
+    );
 } else {
    redirect(new moodle_url('/badges/mybadges.php'));
 }
@@ -56,7 +56,7 @@ if ($action == 'delete' && $confirm && confirm_sesskey()) {
    } else {
        $msg = get_string('sitebackpacknotdeleted', 'badges');
    }
-} else if ($action == 'moveup' || $action == 'movedown') {
+} else if (($action == 'moveup' || $action == 'movedown') && confirm_sesskey()) {
    // If no backpack has been selected, there isn't anything to move.
    if (empty($id)) {
        redirect($url);
@@ -668,6 +668,20 @@ class backpack_api {
        return backpack_api_mapping::get_authentication_error();
    }

+    /**
+     * List all errors occurred during the requests to the backpack.
+     *
+     * @return array The list of errors.
+     */
+    public function get_errors(): array {
+        $errors = [];
+        foreach ($this->mappings as $mapping) {
+            $errors = array_merge($errors, $mapping->get_errors());
+        }
+
+        return $errors;
+    }
+
    /**
     * Get the list of badges in a collection.
     *
@@ -85,6 +85,9 @@ class backpack_api_mapping {
    /** @var int OpenBadges version 1 or 2. */
    protected $backpackapiversion;

+    /** @var array Errors encountered during the request. */
+    protected $errors = [];
+
    /**
     * Create a mapping.
     *
@@ -150,6 +153,26 @@ class backpack_api_mapping {
        return self::$authenticationerror;
    }

+    /**
+     * Get the errors encountered during the request.
+     *
+     * @return array The list of errors.
+     */
+    public function get_errors() {
+        return $this->errors;
+    }
+
+    /**
+     * Add an error to the list of errors.
+     *
+     * @param string $error The error message.
+     * @return self This instance for method chaining.
+     */
+    public function add_error(string $error): self {
+        $this->errors[] = $error;
+        return $this;
+    }
+
    /**
     * Does the action match this mapping?
     *
@@ -372,6 +395,23 @@ class backpack_api_mapping {
            $response = $curl->put($url, $post, $options);
        }
        $response = json_decode($response);
+        if ($response === null) {
+            $this->add_error(get_string('invalidrequest', 'error'));
+            return null;
+        }
+        if (isset($response->status) && isset($response->status->success) && $response->status->success != true) {
+            // If the response wasn't successful, store the errors and return null.
+            if (isset($response->validationErrors)) {
+                $error = implode(', ', $response->validationErrors);
+            } else if (isset($response->status->description)) {
+                $error = $response->status->description;
+            } else {
+                $error = get_string('invalidrequest', 'error');
+            }
+            $this->add_error($error);
+            return null;
+        }
+
        if (isset($response->result)) {
            $response = $response->result;
        }
@@ -56,13 +56,13 @@
            <td> {{{backpackweburl}}} </td>
            <td>
                {{#canmoveup}}
-                    <a href="{{baseurl}}?id={{id}}&action=moveup">{{#pix}}t/up, core,{{#str}}moveup{{/str}}{{/pix}}</a>
+                    <a href="{{baseurl}}?id={{id}}&sesskey={{sesskey}}&action=moveup">{{#pix}}t/up, core,{{#str}}moveup{{/str}}{{/pix}}</a>
                {{/canmoveup}}
                {{^canmoveup}}
                    {{#pix}}spacer, moodle{{/pix}}
                {{/canmoveup}}
                {{#canmovedown}}
-                    <a href="{{baseurl}}?id={{id}}&action=movedown">{{#pix}}t/down, core,{{#str}}movedown{{/str}}{{/pix}}</a>
+                    <a href="{{baseurl}}?id={{id}}&sesskey={{sesskey}}&action=movedown">{{#pix}}t/down, core,{{#str}}movedown{{/str}}{{/pix}}</a>
                {{/canmovedown}}
                {{^canmovedown}}
                    {{#pix}}spacer, moodle{{/pix}}
@@ -15,7 +15,7 @@
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.

 /**
- * Script to let a user edit the properties of a particular RSS feed.
+ * Script to let a user view the output of a particular RSS feed.
 *
 * @package   block_rss_client
 * @copyright 2009 Tim Hunt
@@ -26,9 +26,6 @@ require_once(__DIR__ . '/../../config.php');
 require_once($CFG->libdir .'/simplepie/moodle_simplepie.php');

 require_login();
-if (isguestuser()) {
-    throw new \moodle_exception('guestsarenotallowed');
-}

 $returnurl = optional_param('returnurl', '', PARAM_LOCALURL);
 $courseid = optional_param('courseid', 0, PARAM_INT);
@@ -46,6 +43,11 @@ if ($courseid) {
    $PAGE->set_context($context);
 }

+$managesharedfeeds = has_capability('block/rss_client:manageanyfeeds', $context);
+if (!$managesharedfeeds) {
+    require_capability('block/rss_client:manageownfeeds', $context);
+}
+
 $urlparams = array('rssid' => $rssid);
 if ($courseid) {
    $urlparams['courseid'] = $courseid;
@@ -56,10 +58,18 @@ if ($returnurl) {
 $PAGE->set_url('/blocks/rss_client/viewfeed.php', $urlparams);
 $PAGE->set_pagelayout('popup');

-$rssrecord = $DB->get_record('block_rss_client', array('id' => $rssid), '*', MUST_EXIST);
+if ($managesharedfeeds) {
+    $select = 'id = :id AND (userid = :userid OR shared = 1)';
+} else {
+    $select = 'id = :id AND userid = :userid';
+}
+
+$rssrecord = $DB->get_record_select('block_rss_client', $select, [
+    'id' => $rssid,
+    'userid' => $USER->id,
+], '*', MUST_EXIST);

 $rss = new moodle_simplepie($rssrecord->url);
-
 if ($rss->error()) {
    debugging($rss->error());
    throw new \moodle_exception('errorfetchingrssfeed');
@@ -34,15 +34,21 @@ $PAGE->set_url(new moodle_url('/blog/external_blogs.php'));
 require_capability('moodle/blog:manageexternal', $context);

 $delete = optional_param('delete', null, PARAM_INT);
+$confirm = optional_param('confirm', false, PARAM_BOOL);

 $strexternalblogs = get_string('externalblogs', 'blog');
 $straddnewexternalblog = get_string('addnewexternalblog', 'blog');
 $strblogs = get_string('blogs', 'blog');
-$message = null;

-if ($delete && confirm_sesskey()) {
-    $externalblog = $DB->get_record('blog_external', array('id' => $delete));
-    if ($externalblog->userid == $USER->id) {
+$PAGE->set_title("{$strblogs}: {$strexternalblogs}");
+$PAGE->set_pagelayout('standard');
+
+if ($delete) {
+    $externalblog = $DB->get_record('blog_external', ['id' => $delete, 'userid' => $USER->id], '*', MUST_EXIST);
+
+    if ($confirm) {
+        require_sesskey();
+
        // Delete the external blog.
        $DB->delete_records('blog_external', array('id' => $delete));

@@ -60,23 +66,28 @@ if ($delete && confirm_sesskey()) {
        $event = \core\event\blog_external_removed::create($eventparms);
        $event->add_record_snapshot('blog_external', $externalblog);
        $event->trigger();
-        $message = get_string('externalblogdeleted', 'blog');
+
+        redirect($PAGE->url, get_string('externalblogdeleted', 'blog'));
+    } else {
+        echo $OUTPUT->header();
+        echo $OUTPUT->heading("{$strexternalblogs}: " . s($externalblog->name), 2);
+
+        echo $OUTPUT->confirm(
+            get_string('deleteexternalblog', 'blog'),
+            new moodle_url($PAGE->url->out_omit_querystring(), ['delete' => $delete, 'confirm' => 1]),
+            $PAGE->url,
+        );
+
+        echo $OUTPUT->footer();
+        die;
    }
 }

 $blogs = $DB->get_records('blog_external', array('userid' => $USER->id));

-$PAGE->set_heading(fullname($USER));
-$PAGE->set_title("$strblogs: $strexternalblogs");
-$PAGE->set_pagelayout('standard');
-
 echo $OUTPUT->header();
 echo $OUTPUT->heading($strexternalblogs, 2);

-if (!empty($message)) {
-    echo $OUTPUT->notification($message);
-}
-
 echo $OUTPUT->box_start('generalbox boxaligncenter');

 if (!empty($blogs)) {
@@ -99,10 +110,8 @@ if (!empty($blogs)) {
        $editurl = new moodle_url('/blog/external_blog_edit.php', array('id' => $blog->id));
        $editicon = $OUTPUT->action_icon($editurl, new pix_icon('t/edit', get_string('editexternalblog', 'blog')));

-        $deletelink = new moodle_url('/blog/external_blogs.php', array('delete' => $blog->id, 'sesskey' => sesskey()));
-        $action = new confirm_action(get_string('externalblogdeleteconfirm', 'blog'));
-        $deleteicon = $OUTPUT->action_icon($deletelink, new pix_icon('t/delete', get_string('deleteexternalblog', 'blog')),
-                                           $action);
+        $deletelink = new moodle_url('/blog/external_blogs.php', ['delete' => $blog->id]);
+        $deleteicon = $OUTPUT->action_icon($deletelink, new pix_icon('t/delete', get_string('deleteexternalblog', 'blog')));

        $table->data[] = new html_table_row(array($blog->name,
                                                  $blog->url,
@@ -915,10 +915,10 @@ class core_calendar_external extends external_api {
        $formoptions['eventtypes'] = $allowedeeventtypes;
        if ($courseid) {
            require_once($CFG->libdir . '/grouplib.php');
-            $groupcoursedata = groups_get_course_data($courseid);
-            if (!empty($groupcoursedata->groups)) {
+            $groupcoursedata = groups_get_all_groups($courseid);
+            if (!empty($groupcoursedata)) {
                $formoptions['groups'] = [];
-                foreach ($groupcoursedata->groups as $groupid => $groupdata) {
+                foreach ($groupcoursedata as $groupid => $groupdata) {
                    $formoptions['groups'][$groupid] = $groupdata->name;
                }
            }
@@ -3639,9 +3639,9 @@ function calendar_output_fragment_event_form($args) {

    if (is_null($eventid)) {
        if (!empty($courseid)) {
-            $groupcoursedata = groups_get_course_data($courseid);
+            $groupcoursedata = groups_get_all_groups($courseid);
            $formoptions['groups'] = [];
-            foreach ($groupcoursedata->groups as $groupid => $groupdata) {
+            foreach ($groupcoursedata as $groupid => $groupdata) {
                $formoptions['groups'][$groupid] = $groupdata->name;
            }
        }
@@ -3683,9 +3683,9 @@ function calendar_output_fragment_event_form($args) {
        $formoptions['event'] = $event;

        if (!empty($event->courseid)) {
-            $groupcoursedata = groups_get_course_data($event->courseid);
+            $groupcoursedata = groups_get_all_groups($event->courseid);
            $formoptions['groups'] = [];
-            foreach ($groupcoursedata->groups as $groupid => $groupdata) {
+            foreach ($groupcoursedata as $groupid => $groupdata) {
                $formoptions['groups'][$groupid] = $groupdata->name;
            }
        }
@@ -41,8 +41,8 @@ final class rrule_manager_test extends \advanced_testcase {
        global $DB;
        $this->resetAfterTest();

-        // Set our timezone based on the timezone in the RFC's samples (US/Eastern).
-        $tz = 'US/Eastern';
+        // Set our timezone based on the timezone in the RFC's samples (America/New_York).
+        $tz = 'America/New_York';
        $this->setTimezone($tz);
        $timezone = new \DateTimeZone($tz);
        // Create our event's DTSTART date based on RFC's samples (most commonly used in RFC is 1997-09-02 09:00:00 EDT).
@@ -685,8 +685,8 @@ final class rrule_manager_test extends \advanced_testcase {

        // Change the start date for forever events to 9am of the 2nd day of the current month and year.
        $this->change_event_startdate(date('Ym02\T090000'));
-        $startdatetime = new \DateTime(date('Y-m-d H:i:s', $this->event->timestart));
-        $startdate = new \DateTime(date('Y-m-d', $this->event->timestart));
+        $startdatetime = new \DateTime(date('Y-m-d H:i:s', $this->event->timestart), new \DateTimeZone('Australia/Perth'));
+        $startdate = new \DateTime(date('Y-m-d', $this->event->timestart), new \DateTimeZone('Australia/Perth'));

        $offsetinterval = $startdatetime->diff($startdate, true);
        $interval = new \DateInterval('P12M');
@@ -842,8 +842,8 @@ final class rrule_manager_test extends \advanced_testcase {
        // Change the start date for forever events to 9am of the 2nd day of the current month and year.
        $this->change_event_startdate(date('Ym02\T090000'));

-        $startdatetime = new \DateTime(date('Y-m-d H:i:s', $this->event->timestart));
-        $startdate = new \DateTime(date('Y-m-d', $this->event->timestart));
+        $startdatetime = new \DateTime(date('Y-m-d H:i:s', $this->event->timestart), new \DateTimeZone('Australia/Perth'));
+        $startdate = new \DateTime(date('Y-m-d', $this->event->timestart), new \DateTimeZone('Australia/Perth'));

        $offsetinterval = $startdatetime->diff($startdate, true);
        $interval = new \DateInterval('P12M');
@@ -1201,8 +1201,8 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_every_other_day_forever(): void {
        global $DB;

-        // Change the start date for forever events to 9am of the current date in US/Eastern time.
-        $this->change_event_startdate(date('Ymd\T090000'), 'US/Eastern');
+        // Change the start date for forever events to 9am of the current date in America/New_York time.
+        $this->change_event_startdate(date('Ymd\T090000'), 'America/New_York');

        $startdatetime = new \DateTime(date('Y-m-d H:i:s', $this->event->timestart));
        $interval = new \DateInterval('P2D');
@@ -1271,7 +1271,7 @@ final class rrule_manager_test extends \advanced_testcase {
        global $DB;

        // Change our event's date to 01-01-1998, based on the example from the RFC.
-        $this->change_event_startdate('19980101T090000', 'US/Eastern');
+        $this->change_event_startdate('19980101T090000', 'America/New_York');

        $rrule = 'FREQ=YEARLY;UNTIL=20000131T090000Z;BYMONTH=1;BYDAY=SU,MO,TU,WE,TH,FR,SA';
        $mang = new rrule_manager($rrule);
@@ -1305,7 +1305,7 @@ final class rrule_manager_test extends \advanced_testcase {
        global $DB;

        // Change our event's date to 01-01-1998, based on the example from the RFC.
-        $this->change_event_startdate('19980101T090000', 'US/Eastern');
+        $this->change_event_startdate('19980101T090000', 'America/New_York');

        $rrule = 'FREQ=DAILY;UNTIL=20000131T090000Z;BYMONTH=1';
        $mang = new rrule_manager($rrule);
@@ -1403,8 +1403,8 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_every_other_week_forever(): void {
        global $DB;

-        // Change the start date for forever events to 9am of the current date in US/Eastern time.
-        $this->change_event_startdate(date('Ymd\T090000'), 'US/Eastern');
+        // Change the start date for forever events to 9am of the current date in America/New_York time.
+        $this->change_event_startdate(date('Ymd\T090000'), 'America/New_York');

        $interval = new \DateInterval('P2W');

@@ -1614,7 +1614,7 @@ final class rrule_manager_test extends \advanced_testcase {
        global $DB;

        // Change our event's date to 05-09-1997, based on the example from the RFC.
-        $startdatetime = $this->change_event_startdate('19970905T090000', 'US/Eastern');
+        $startdatetime = $this->change_event_startdate('19970905T090000', 'America/New_York');
        $startdate = new \DateTime(date('Y-m-d', $this->event->timestart));
        $offsetinterval = $startdatetime->diff($startdate, true);

@@ -1650,7 +1650,7 @@ final class rrule_manager_test extends \advanced_testcase {
        global $DB;

        // Change our event's date to 05-09-1997, based on the example from the RFC.
-        $startdatetime = $this->change_event_startdate('19970905T090000', 'US/Eastern');
+        $startdatetime = $this->change_event_startdate('19970905T090000', 'America/New_York');
        $startdate = new \DateTime(date('Y-m-d', $this->event->timestart));
        $offsetinterval = $startdatetime->diff($startdate, true);

@@ -1688,7 +1688,7 @@ final class rrule_manager_test extends \advanced_testcase {
        global $DB;

        // Change our event's date to 05-09-1997, based on the example from the RFC.
-        $startdatetime = $this->change_event_startdate('19970907T090000', 'US/Eastern');
+        $startdatetime = $this->change_event_startdate('19970907T090000', 'America/New_York');
        $startdate = new \DateTime(date('Y-m-d', $this->event->timestart));
        $offsetinterval = $startdatetime->diff($startdate, true);

@@ -1731,7 +1731,7 @@ final class rrule_manager_test extends \advanced_testcase {
        global $DB;

        // Change our event's date to 05-09-1997, based on the example from the RFC.
-        $startdatetime = $this->change_event_startdate('19970922T090000', 'US/Eastern');
+        $startdatetime = $this->change_event_startdate('19970922T090000', 'America/New_York');
        $startdate = new \DateTime($startdatetime->format('Y-m-d'));
        $offsetinterval = $startdatetime->diff($startdate, true);

@@ -1773,7 +1773,7 @@ final class rrule_manager_test extends \advanced_testcase {
        global $DB;

        // Change our event's date to 28 September of the current year, based on the example from the RFC.
-        $this->change_event_startdate(date('Y0928\T090000'), 'US/Eastern');
+        $this->change_event_startdate(date('Y0928\T090000'), 'America/New_York');

        $rrule = 'FREQ=MONTHLY;BYMONTHDAY=-3';
        $mang = new rrule_manager($rrule);
@@ -1859,7 +1859,7 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_every_first_and_last_day_of_the_month_10_count(): void {
        global $DB;

-        $startdatetime = $this->change_event_startdate('19970930T090000', 'US/Eastern');
+        $startdatetime = $this->change_event_startdate('19970930T090000', 'America/New_York');
        $startdate = new \DateTime($startdatetime->format('Y-m-d'));
        $offsetinterval = $startdatetime->diff($startdate, true);

@@ -1904,7 +1904,7 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_every_18_months_days_10_to_15_10_count(): void {
        global $DB;

-        $startdatetime = $this->change_event_startdate('19970910T090000', 'US/Eastern');
+        $startdatetime = $this->change_event_startdate('19970910T090000', 'America/New_York');

        $rrule = 'FREQ=MONTHLY;INTERVAL=18;COUNT=10;BYMONTHDAY=10,11,12,13,14,15';
        $mang = new rrule_manager($rrule);
@@ -1949,9 +1949,9 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_every_tuesday_every_other_month_forever(): void {
        global $DB;

-        // Change the start date for forever events to 9am of the Tuesday on or before of the current date in US/Eastern time.
+        // Change the start date for forever events to 9am of the Tuesday on or before of the current date in America/New_York time.
        $nexttuesday = new \DateTime('next Tuesday');
-        $this->change_event_startdate($nexttuesday->format('Ymd\T090000'), 'US/Eastern');
+        $this->change_event_startdate($nexttuesday->format('Ymd\T090000'), 'America/New_York');

        $rrule = 'FREQ=MONTHLY;INTERVAL=2;BYDAY=TU';
        $mang = new rrule_manager($rrule);
@@ -2004,7 +2004,7 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_yearly_in_june_july_10_count(): void {
        global $DB;

-        $startdatetime = $this->change_event_startdate('19970610T090000', 'US/Eastern');
+        $startdatetime = $this->change_event_startdate('19970610T090000', 'America/New_York');

        $rrule = 'FREQ=YEARLY;COUNT=10;BYMONTH=6,7';
        $mang = new rrule_manager($rrule);
@@ -2047,7 +2047,7 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_every_other_year_in_june_july_10_count(): void {
        global $DB;

-        $startdatetime = $this->change_event_startdate('19970310T090000', 'US/Eastern');
+        $startdatetime = $this->change_event_startdate('19970310T090000', 'America/New_York');

        $rrule = 'FREQ=YEARLY;INTERVAL=2;COUNT=10;BYMONTH=1,2,3';
        $mang = new rrule_manager($rrule);
@@ -2094,7 +2094,7 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_every_3_years_1st_100th_200th_days_10_count(): void {
        global $DB;

-        $startdatetime = $this->change_event_startdate('19970101T090000', 'US/Eastern');
+        $startdatetime = $this->change_event_startdate('19970101T090000', 'America/New_York');

        $rrule = 'FREQ=YEARLY;INTERVAL=3;COUNT=10;BYYEARDAY=1,100,200';
        $mang = new rrule_manager($rrule);
@@ -2144,7 +2144,7 @@ final class rrule_manager_test extends \advanced_testcase {
        // Change our event's date to the 20th Monday of the current year.
        $twentiethmonday = new \DateTime(date('Y-01-01'));
        $twentiethmonday->modify('+20 Monday');
-        $startdatetime = $this->change_event_startdate($twentiethmonday->format('Ymd\T000000'), 'US/Eastern');
+        $startdatetime = $this->change_event_startdate($twentiethmonday->format('Ymd\T000000'), 'America/New_York');

        $interval = new \DateInterval('P1Y');

@@ -2190,7 +2190,7 @@ final class rrule_manager_test extends \advanced_testcase {
        // Change our event's date to the start of the 20th week of the current year.
        $twentiethweek = new \DateTime(date('Y-01-01'));
        $twentiethweek->setISODate($twentiethweek->format('Y'), 20);
-        $startdatetime = $this->change_event_startdate($twentiethweek->format('Ymd\T090000'), 'US/Eastern');
+        $startdatetime = $this->change_event_startdate($twentiethweek->format('Ymd\T090000'), 'America/New_York');

        $startdate = clone($startdatetime);
        $startdate->modify($startdate->format('Y-m-d'));
@@ -2237,9 +2237,9 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_every_thursday_in_march_forever(): void {
        global $DB;

-        // Change our event's date to the first Thursday of March of the current year at 9am US/Eastern time.
+        // Change our event's date to the first Thursday of March of the current year at 9am America/New_York time.
        $firstthursdayofmarch = new \DateTime('first Thursday of March');
-        $startdatetime = $this->change_event_startdate($firstthursdayofmarch->format('Ymd\T090000'), 'US/Eastern');
+        $startdatetime = $this->change_event_startdate($firstthursdayofmarch->format('Ymd\T090000'), 'America/New_York');

        $interval = new \DateInterval('P1Y');

@@ -2296,9 +2296,9 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_every_thursday_june_july_august_forever(): void {
        global $DB;

-        // Change our event's date to the first Thursday of June in the current year at 9am US/Eastern time.
+        // Change our event's date to the first Thursday of June in the current year at 9am America/New_York time.
        $firstthursdayofjune = new \DateTime('first Thursday of June');
-        $startdatetime = $this->change_event_startdate($firstthursdayofjune->format('Ymd\T090000'), 'US/Eastern');
+        $startdatetime = $this->change_event_startdate($firstthursdayofjune->format('Ymd\T090000'), 'America/New_York');

        $startdate = new \DateTime($startdatetime->format('Y-m-d'));

@@ -2353,8 +2353,8 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_friday_the_thirteenth_forever(): void {
        global $DB;

-        // Change our event's date to the first Thursday of June in the current year at 9am US/Eastern time.
-        $this->change_event_startdate(date('Ymd\T090000'), 'US/Eastern');
+        // Change our event's date to the first Thursday of June in the current year at 9am America/New_York time.
+        $this->change_event_startdate(date('Ymd\T090000'), 'America/New_York');

        $rrule = 'FREQ=MONTHLY;BYDAY=FR;BYMONTHDAY=13';
        $mang = new rrule_manager($rrule);
@@ -2390,10 +2390,10 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_first_saturday_following_first_sunday_forever(): void {
        global $DB;

-        // Change our event's date to the next Saturday after the first Sunday of the the current month at 9am US/Eastern time.
+        // Change our event's date to the next Saturday after the first Sunday of the current month at 9am America/New_York time.
        $firstsaturdayafterfirstsunday = new \DateTime('first Sunday of this month');
        $firstsaturdayafterfirstsunday->modify('next Saturday');
-        $startdatetime = $this->change_event_startdate($firstsaturdayafterfirstsunday->format('Ymd\T090000'), 'US/Eastern');
+        $startdatetime = $this->change_event_startdate($firstsaturdayafterfirstsunday->format('Ymd\T090000'), 'America/New_York');
        $startdate = new \DateTime($startdatetime->format('Y-m-d'));
        $offset = $startdatetime->diff($startdate, true);

@@ -2451,7 +2451,7 @@ final class rrule_manager_test extends \advanced_testcase {
        $electiondate->modify('+1 Tuesday');

        // Use the most recent election date as the starting date of our recurring events.
-        $startdatetime = $this->change_event_startdate($electiondate->format('Ymd\T090000'), 'US/Eastern');
+        $startdatetime = $this->change_event_startdate($electiondate->format('Ymd\T090000'), 'America/New_York');
        $startdate = new \DateTime($startdatetime->format('Y-m-d'));
        $offset = $startdatetime->diff($startdate, true);

@@ -2494,7 +2494,7 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_monthly_bysetpos_3_count(): void {
        global $DB;

-        $this->change_event_startdate('19970904T090000', 'US/Eastern');
+        $this->change_event_startdate('19970904T090000', 'America/New_York');

        $rrule = 'FREQ=MONTHLY;COUNT=3;BYDAY=TU,WE,TH;BYSETPOS=3';
        $mang = new rrule_manager($rrule);
@@ -2531,7 +2531,7 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_second_to_the_last_weekday_of_the_month(): void {
        global $DB;

-        $this->change_event_startdate('19970929T090000', 'US/Eastern');
+        $this->change_event_startdate('19970929T090000', 'America/New_York');

        $rrule = 'FREQ=MONTHLY;BYDAY=MO,TU,WE,TH,FR;BYSETPOS=-2;COUNT=7';
        $mang = new rrule_manager($rrule);
@@ -2756,7 +2756,7 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_weekly_byday_with_wkst_mo(): void {
        global $DB;

-        $this->change_event_startdate('19970805T090000', 'US/Eastern');
+        $this->change_event_startdate('19970805T090000', 'America/New_York');

        $rrule = 'FREQ=WEEKLY;INTERVAL=2;COUNT=4;BYDAY=TU,SU;WKST=MO';
        $mang = new rrule_manager($rrule);
@@ -2789,7 +2789,7 @@ final class rrule_manager_test extends \advanced_testcase {
    public function test_weekly_byday_with_wkst_su(): void {
        global $DB;

-        $this->change_event_startdate('19970805T090000', 'US/Eastern');
+        $this->change_event_startdate('19970805T090000', 'America/New_York');

        $rrule = 'FREQ=WEEKLY;INTERVAL=2;COUNT=4;BYDAY=TU,SU;WKST=SU';
        $mang = new rrule_manager($rrule);
@@ -2869,7 +2869,7 @@ final class rrule_manager_test extends \advanced_testcase {
     * Change the event's timestart (DTSTART) based on the test's needs.
     *
     * @param string $datestr The date string. In 'Ymd\This' format. e.g. 19990902T090000.
-     * @param null|string $timezonestr A valid timezone string. e.g. 'US/Eastern'.
+     * @param null|string $timezonestr A valid timezone string. e.g. 'America/New_York'.
     *                                 If not provided, the default timezone will be used.
     * @return bool|DateTime
     */
@@ -55,11 +55,11 @@ class cohorts extends system_report {
            "{$entitymainalias}.component");

        // Check if report needs to show a specific category.
-        $contextid = $this->get_parameter('contextid', 0, PARAM_INT);
-        $showall = $this->get_parameter('showall', true, PARAM_BOOL);
-        if (!$showall) {
+        if (!$this->get_context() instanceof context_system || !$this->get_parameter('showall', false, PARAM_BOOL)) {
            $paramcontextid = database::generate_param_name();
-            $this->add_base_condition_sql("{$entitymainalias}.contextid = :$paramcontextid", [$paramcontextid => $contextid]);
+            $this->add_base_condition_sql("{$entitymainalias}.contextid = :{$paramcontextid}", [
+                $paramcontextid => $this->get_context()->id,
+            ]);
        }

        // Now we can call our helper methods to add the content we want to include in the report.
@@ -77,14 +77,7 @@ class cohorts extends system_report {
     * @return bool
     */
    protected function can_view(): bool {
-        $contextid = $this->get_parameter('contextid', 0, PARAM_INT);
-        if ($contextid) {
-            $context = context::instance_by_id($contextid, MUST_EXIST);
-        } else {
-            $context = context_system::instance();
-        }
-
-        return has_any_capability(['moodle/cohort:manage', 'moodle/cohort:view'], $context);
+        return has_any_capability(['moodle/cohort:manage', 'moodle/cohort:view'], $this->get_context());
    }

    /**
@@ -98,10 +91,8 @@ class cohorts extends system_report {
    public function add_columns(cohort $cohortentity): void {

        $entitymainalias = $cohortentity->get_table_alias('cohort');
-        $showall = $this->get_parameter('showall', false, PARAM_BOOL);
-
        // Category column. An extra callback is appended in order to extend the current column formatting.
-        if ($showall) {
+        if ($this->get_context() instanceof context_system && $this->get_parameter('showall', false, PARAM_BOOL)) {
            $this->add_column_from_entity('cohort:context')
                ->add_callback(static function(string $value, stdClass $cohort): string {
                    $context = context::instance_by_id($cohort->contextid);
@@ -195,10 +186,11 @@ class cohorts extends system_report {
     */
    protected function add_actions(): void {

-        $contextid = $this->get_parameter('contextid', 0, PARAM_INT);
-        $showall = $this->get_parameter('showall', true, PARAM_BOOL);
-        $returnurl = (new moodle_url('/cohort/index.php',
-            ['id' => ':id', 'contextid' => $contextid, 'showall' => $showall]))->out(false);
+        $returnurl = (new moodle_url('/cohort/index.php', [
+            'id' => ':id',
+            'contextid' => $this->get_context()->id,
+            'showall' => $this->get_parameter('showall', false, PARAM_BOOL),
+        ]))->out(false);

        // Hide action. It will be only shown if the property 'visible' is true and user has 'moodle/cohort:manage' capabillity.
        $this->add_action((new action(
@@ -405,6 +405,12 @@ class core_cohort_external extends external_api {
                $results = $results + cohort_get_available_cohorts($context, COHORT_ALL, $limitfrom, $limitnum, $query);
            }
        } else if ($includes == 'all') {
+            $contextsystem = context_system::instance();
+            if (!$context instanceof context_system &&
+                    !has_any_capability(['moodle/cohort:view', 'moodle/cohort:manage'], $contextsystem)) {
+
+                throw new required_capability_exception($contextsystem, 'moodle/cohort:view', 'nopermissions', '');
+            }
            $results = cohort_get_all_cohorts($limitfrom, $limitnum, $query);
            $results = $results['cohorts'];
        } else {
@@ -104,8 +104,7 @@ if ($editcontrols = cohort_edit_controls($context, $baseurl)) {
    echo $OUTPUT->render($editcontrols);
 }

-$reportparams = ['contextid' => $context->id, 'showall' => $showall];
-$report = system_report_factory::create(cohorts::class, $context, '', '', 0, $reportparams);
+$report = system_report_factory::create(cohorts::class, $context, '', '', 0, ['showall' => $showall]);

 // Check if it needs to search by name.
 if (!empty($searchquery)) {
@@ -672,6 +672,7 @@ final class externallib_test extends externallib_advanced_testcase {
        role_assign($userrole, $catuser->id, $catcontext->id);

        // Enrol user in the course.
+        $this->getDataGenerator()->enrol_user($creator->id, $course->id);
        $this->getDataGenerator()->enrol_user($courseuser->id, $course->id, 'courserole');

        $syscontext = array('contextid' => \context_system::instance()->id);
@@ -758,18 +759,27 @@ final class externallib_test extends externallib_advanced_testcase {
        $this->assertCount(4, $result['cohorts']);

        // A user in the course context with the system cohort:view capability. Check that all the system cohorts are returned.
-        $this->setUser($courseuser);
        $result = core_cohort_external::search_cohorts("Cohortsearch", $coursecontext, 'all');
-        $this->assertCount(2, $result['cohorts']);
-        $this->assertEquals('Cohortsearch 1', $result['cohorts'][$cohort1->id]->name);
+        $this->assertCount(4, $result['cohorts']);
+
+        // A user in the course context without the ability to view system cohorts.
+        $this->setUser($courseuser);
+        try {
+            $result = core_cohort_external::search_cohorts("Cohortsearch", $coursecontext, 'all');
+            $this->fail('Exception expected');
+        } catch (\Throwable $e) {
+            $this->assertInstanceOf(\required_capability_exception::class, $e);
+            $this->assertStringContainsString('(View site-wide cohorts)', $e->getMessage());
+        }

        // Detect invalid parameter $includes.
        $this->setUser($creator);
        try {
            $result = core_cohort_external::search_cohorts("Cohortsearch", $syscontext, 'invalid');
-            $this->fail('Invalid parameter includes');
-        } catch (\coding_exception $e) {
-            // All good.
+            $this->fail('Exception expected');
+        } catch (\Throwable $e) {
+            $this->assertInstanceOf(\coding_exception::class, $e);
+            $this->assertStringContainsString('Invalid parameter value for \'includes\'', $e->getMessage());
        }
    }
 }
@@ -1,4 +1,4 @@
-@core @core_contentbank @core_h5p @contenttype_h5p @_switch_iframe @javascript
+@core @core_contentbank @core_h5p @contenttype_h5p @_switch_iframe
 Feature: H5P file upload to content bank for admins
  In order import new H5P content to content bank
  As an admin
@@ -16,6 +16,7 @@ Feature: H5P file upload to content bank for admins
    And I expand "Site pages" node
    And I click on "Content bank" "link"

+  @javascript
  Scenario: Admins can upload .h5p extension files to content bank
    Given I should not see "filltheblanks.h5p"
    When I click on "Upload" "link"
@@ -27,6 +28,7 @@ Feature: H5P file upload to content bank for admins
    And I wait until the page is ready
    Then I should see "filltheblanks.h5p"

+  @javascript
  Scenario: Admins can see uploaded H5P contents
    Given I should not see "filltheblanks.h5p"
    When I click on "Upload" "link"
@@ -40,6 +42,7 @@ Feature: H5P file upload to content bank for admins
    And I switch to "h5p-iframe" class iframe
    Then I should see "Of which countries"

+  @javascript
  Scenario: Users can't see content managed by disabled plugins
    Given I click on "Upload" "link"
    And I click on "Choose a file..." "button"
@@ -55,6 +58,7 @@ Feature: H5P file upload to content bank for admins
    When I navigate to "Plugins > Content bank" in site administration
    Then I should not see "filltheblanks.h5p"

+  @javascript
  Scenario: Contents in a context are not available from other contexts
    Given the following "courses" exist:
      | fullname | shortname | category |
@@ -75,6 +79,7 @@ Feature: H5P file upload to content bank for admins
    And I click on "Content bank" "link"
    And I should not see "filltheblanks.h5p"

+  @javascript
  Scenario: Admins can upload and deployed content types when libraries are not installed
    Given I navigate to "H5P > Manage H5P content types" in site administration
    And I should not see "Fill in the Blanks"
@@ -95,6 +100,7 @@ Feature: H5P file upload to content bank for admins
    And I navigate to "H5P > Manage H5P content types" in site administration
    And I should see "Fill in the Blanks"

+  @javascript
  Scenario: Uploading invalid packages throws error
    Given the following "user private files" exist:
      | user  | filepath                            |
@@ -122,3 +128,28 @@ Feature: H5P file upload to content bank for admins
    And I wait until the page is ready
    And I should see "It is not possible to unzip it"
    And I should not see "Sorry, this file is not valid"
+
+  @_file_upload @javascript
+  Scenario: Uploading invalid file types is not allowed
+    Given I am on the "Content bank" page logged in as "admin"
+    When I click on "Upload" "link"
+    And I click on "Choose a file..." "button"
+    And I click on "Upload a file" "link" in the ".fp-repo-area" "css_element"
+    And I set the field "Attachment" to "#dirroot#/course/tests/fixtures/image.jpg"
+    And I press "Upload this file"
+    # Confirm that jpg files cannot be added to content bank.
+    Then "Image (JPEG) filetype cannot be accepted." "text" should exist
+    And I click on "OK" "button" in the "Error" "dialogue"
+    And I click on "Close" "button" in the "File picker" "dialogue"
+    And I click on "Cancel" "button" in the "Upload" "dialogue"
+    # Confirm that jpg file was not added to the content bank.
+    And "No content available" "text" should exist
+    And I should not see "1.jpg"
+
+  Scenario: File upload for content bank can be disabled by admin
+    Given I log in as "admin"
+    And I navigate to "Plugins > Content bank > Manage content types" in site administration
+    When I follow "Disable"
+    And I am on the "Content bank" page
+    # Confirm that "Upload" does not exist after admin disabled from Plugins > Content bank > Manage content types.
+    Then "Upload" "link" should not exist
@@ -0,0 +1,38 @@
+@core @core_contentbank @core_h5p @contentbank_h5p
+Feature: Content bank contents are retained when course is restored
+  In order to restore content bank contents
+  As a manager
+  I need to be able to restore course containing the content bank
+
+  Background:
+    Given the following "courses" exist:
+      | fullname | shortname |
+      | Course 1 | C1        |
+    And the following "course enrolments" exist:
+      | user  | course | role           |
+      | admin | C1     | editingteacher |
+    And the following "contentbank content" exist:
+      | contextlevel | reference | contenttype     | user  | contentname       | filepath                              |
+      | Course       | C1        | contenttype_h5p | admin | filltheblanks.h5p | /h5p/tests/fixtures/filltheblanks.h5p |
+    And I log in as "admin"
+    And I am on "Course 1" course homepage with editing mode on
+    And the following config values are set as admin:
+      | unaddableblocks | | theme_boost|
+    # TODO MDL-57120 site "Content bank" link not accessible without navigation block.
+    And I add the "Navigation" block if not present
+
+  @javascript
+  Scenario: Deleted courses with content banks can be restored
+    Given I navigate to "Courses > Manage courses and categories" in site administration
+    And I click on "delete" action for "Course 1" in management course listing
+    And I click on "Delete" "button" in the "Confirm" "dialogue"
+    And I press "Continue"
+    And I navigate to "Recycle bin" in current page administration
+    And I click on "Restore" "link" in the "Course 1" "table_row"
+    And I am on "Course 1" course homepage
+    And I expand "Site pages" node
+    When I click on "Content bank" "link"
+    And I click on "filltheblanks.h5p" "link"
+    And I switch to "h5p-player" class iframe
+    And I switch to "h5p-iframe" class iframe
+    Then I should see "Of which countries are Berlin, Washington, Beijing, Canberra and Brasilia the capitals?"
@@ -941,6 +941,8 @@ class core_course_external extends external_api {
        $params = self::validate_parameters(self::create_courses_parameters(),
                        array('courses' => $courses));

+        $courseconfig = get_config('moodlecourse');
+
        $availablethemes = core_component::get_plugin_list('theme');
        $availablelangs = get_string_manager()->get_list_of_translations();

@@ -967,6 +969,14 @@ class core_course_external extends external_api {
                throw new moodle_exception('errorinvalidparam', 'webservice', '', 'shortname');
            }

+            // Make sure start/end date are correctly set.
+            if (!array_key_exists('startdate', $course)) {
+                $course['startdate'] = usergetmidnight(time());
+            }
+            if (!array_key_exists('enddate', $course) && $courseconfig->courseenddateenabled) {
+                $course['enddate'] = $course['startdate'] + $courseconfig->courseduration;
+            }
+
            // Make sure lang is valid
            if (array_key_exists('lang', $course)) {
                if (empty($availablelangs[$course['lang']])) {
@@ -988,6 +998,8 @@ class core_course_external extends external_api {
                }
            }

+            $course['showactivitydates'] = $courseconfig->showactivitydates;
+
            //force visibility if ws user doesn't have the permission to set it
            $category = $DB->get_record('course_categories', array('id' => $course['categoryid']));
            if (!has_capability('moodle/course:visibility', $context)) {
@@ -995,7 +1007,6 @@ class core_course_external extends external_api {
            }

            //set default value for completion
-            $courseconfig = get_config('moodlecourse');
            if (completion_info::is_enabled_for_site()) {
                if (!array_key_exists('enablecompletion', $course)) {
                    $course['enablecompletion'] = $courseconfig->enablecompletion;
@@ -4252,7 +4263,7 @@ class core_course_external extends external_api {

        self::validate_context($usercontext);

-        if ($userid != $USER->id and !has_capability('moodle/user:viewdetails', $usercontext)) {
+        if ($userid != $USER->id && !has_capability('moodle/user:viewalldetails', $usercontext)) {
            return array();
        }

@@ -4302,22 +4313,28 @@ class core_course_external extends external_api {
     * @param int $groupid Group id from which the users will be obtained
     * @param bool $onlyactive Whether to return only the active enrolled users or all enrolled users in the course.
     * @return array List of users
-     * @throws invalid_parameter_exception
     */
    public static function get_enrolled_users_by_cmid(int $cmid, int $groupid = 0, bool $onlyactive = false) {
-    global $PAGE;
+        global $PAGE;
+
        $warnings = [];

-        self::validate_parameters(self::get_enrolled_users_by_cmid_parameters(), [
-                'cmid' => $cmid,
-                'groupid' => $groupid,
-                'onlyactive' => $onlyactive,
+        [
+            'cmid' => $cmid,
+            'groupid' => $groupid,
+            'onlyactive' => $onlyactive,
+        ] = self::validate_parameters(self::get_enrolled_users_by_cmid_parameters(), [
+            'cmid' => $cmid,
+            'groupid' => $groupid,
+            'onlyactive' => $onlyactive,
        ]);

        list($course, $cm) = get_course_and_cm_from_cmid($cmid);
        $coursecontext = context_course::instance($course->id);
        self::validate_context($coursecontext);

+        course_require_view_participants($coursecontext);
+
        $enrolledusers = get_enrolled_users($coursecontext, '', $groupid, 'u.*', null, 0, 0, $onlyactive);

        $users = array_map(function ($user) use ($PAGE) {
@@ -4596,9 +4613,17 @@ class core_course_external extends external_api {
        $coursecontext = context_course::instance($courseid);
        self::validate_context($coursecontext);

-        $activeplugin = get_config('core', 'activitychooseractivefooter');
+        // The active plugin must be set, and be present on the site.
+        $activeplugin = clean_param(
+            get_config('core', 'activitychooseractivefooter'),
+            PARAM_COMPONENT,
+        );

-        if ($activeplugin !== COURSE_CHOOSER_FOOTER_NONE) {
+        if (
+            $activeplugin !== COURSE_CHOOSER_FOOTER_NONE &&
+            !empty($activeplugin) &&
+            core_component::get_component_directory($activeplugin) !== null
+        ) {
            $footerdata = component_callback($activeplugin, 'custom_chooser_footer', [$courseid, $sectionid]);
            return [
                'footer' => true,
@@ -422,8 +422,10 @@ export default class {
     * @param {array} cmIds the list of course modules ids
     * @param {bool} complete the new completion value
     */
-    cmCompletion(stateManager, cmIds, complete) {
+    async cmCompletion(stateManager, cmIds, complete) {
        const newState = (complete) ? 1 : 0;
+        const action = (newState == 1) ? 'cm_complete' : 'cm_uncomplete';
+        const logEntry = this._getLoggerEntry(stateManager, action, cmIds);
        stateManager.setReadOnly(false);
        cmIds.forEach((id) => {
            const element = stateManager.get('cm', id);
@@ -433,6 +435,7 @@ export default class {
            }
        });
        stateManager.setReadOnly(true);
+        stateManager.addLoggerEntry(await logEntry);
    }

    /**
@@ -362,6 +362,9 @@ class stateactions {
            // We need to get the latest modinfo on each iteration because the section numbers change.
            $modinfo = get_fast_modinfo($course);
            $section = $modinfo->get_section_info_by_id($sectionid, MUST_EXIST);
+            if (!course_can_delete_section($course, $section)) {
+                continue;
+            }
            // Send all activity deletions.
            if (!empty($modinfo->sections[$section->section])) {
                foreach ($modinfo->sections[$section->section] as $modnumber) {
@@ -150,47 +150,3 @@ Feature: Course index completion icons
      | 1    | False    |
    When I am on the "C1" "Course" page logged in as "student1"
    And "Done" "icon" should exist in the "courseindex-content" "region"
-
-  @javascript
-  Scenario: Activities with custom completion rules could fail
-    Given the following "activity" exists:
-      | activity                 | scorm                                                         |
-      | course                   | C1                                                            |
-      | name                     | Music history                                              |
-      | packagefilepath          | mod/scorm/tests/packages/RuntimeMinimumCalls_SCORM12-mini.zip |
-      | maxattempt               | 1                                                             |
-      | latattemptlock           | 1                                                             |
-      # Add requirements
-      | completion               | 2                                                             |
-      | completionscorerequired  | 90                                                            |
-    Given I am on the "Music history" "scorm activity" page logged in as student1
-    # We need a little taller window because Firefox is, apparently, unable to auto-scroll within
-    # an iframe, so we need to ensure that the "Save changes" button is visible in the viewport.
-    And I change window size to "large"
-    And I press "Enter"
-    And I switch to the main frame
-    And I click on "Par?" "list_item"
-    And I switch to "scorm_object" iframe
-    And I wait until the page is ready
-    And I switch to the main frame
-    And I click on "Keeping Score" "list_item"
-    And I switch to "scorm_object" iframe
-    And I wait until the page is ready
-    And I switch to the main frame
-    And I click on "Other Scoring Systems" "list_item"
-    And I switch to "scorm_object" iframe
-    And I wait until the page is ready
-    And I switch to the main frame
-    And I click on "The Rules of Golf" "list_item"
-    And I switch to "scorm_object" iframe
-    And I wait until the page is ready
-    And I switch to the main frame
-    And I click on "Playing Golf Quiz" "list_item"
-    And I switch to "scorm_object" iframe
-    And I wait until the page is ready
-    And I click on "[id='question_com.scorm.golfsamples.interactions.playing_1_1']" "css_element"
-    And I press "Submit Answers"
-    And I wait until "Score: 20" "text" exists
-    And I switch to the main frame
-    And I click on "Exit activity" "link"
-    And "Failed" "icon" should exist in the "courseindex-content" "region"
@@ -0,0 +1,120 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+declare(strict_types=1);
+
+namespace core_courseformat\external;
+
+defined('MOODLE_INTERNAL') || die();
+
+use core_courseformat\stateactions;
+use core_courseformat\stateupdates;
+
+global $CFG;
+require_once($CFG->dirroot . '/webservice/tests/helpers.php');
+
+/**
+ * Tests for the delete section test class.
+ *
+ * @package    core_courseformat
+ * @copyright  2025 Laurent David <laurent.david@moodle.com>
+ * @category   test
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @coversDefaultClass \core_courseformat\stateactions
+ */
+final class delete_section_test extends \externallib_advanced_testcase {
+
+    /**
+     * Setup to ensure that fixtures are loaded.
+     */
+    public static function setupBeforeClass(): void { // phpcs:ignore
+        global $CFG;
+        require_once($CFG->dirroot . '/course/format/tests/fixtures/format_theunittestdelete.php');
+    }
+
+    /**
+     * Test the webservice can execute the section_delete action.
+     *
+     * @covers ::section_delete
+     * @dataProvider section_delete_provider
+     * @param int $sectionum
+     * @param string $format
+     * @param array $formatoptions
+     * @param int $expectedsectionum
+     *
+     * @throws \moodle_exception
+     */
+    public function test_delete_section(int $sectionum, string $format, array $formatoptions, int $expectedsectionum): void {
+        $this->resetAfterTest();
+
+        $course =
+            $this->getDataGenerator()->create_course(array_merge(
+                ['numsections' => $sectionum, 'format' => $format],
+                $formatoptions,
+            ));
+        $teacher = $this->getDataGenerator()->create_and_enrol($course, 'editingteacher');
+        // Execute the method.
+        $courseformat = course_get_format($course->id);
+        $updates = new stateupdates($courseformat);
+        $modinfo = get_fast_modinfo($course);
+        $sections  = $modinfo->get_section_info_all();
+        $sectionsid = array_map(function ($section) {
+            return $section->id;
+        }, $sections);
+        $actions = new stateactions();
+        $this->setUser($teacher);
+        $actions->section_delete(
+            $updates,
+            $course,
+            $sectionsid
+        );
+        // Check result.
+        $modinfo = get_fast_modinfo($course);
+        $sections  = $modinfo->get_section_info_all();
+        $this->assertCount($expectedsectionum, $sections);
+        if ($format == 'theunittestdelete') {
+            $this->assertDebuggingCalled();
+        }
+    }
+
+    /**
+     * Data provider for the test_delete_section method.
+     *
+     * @return array
+     */
+    public static function section_delete_provider(): array {
+        return [
+            'format topic' => [
+                'sectionum' => 4,
+                'format' => 'topics',
+                'formatoptions' => [],
+                'expectedsectionum' => 1,
+            ],
+            'format theunittestdelete' => [
+                'sectionum' => 4,
+                'format' => 'theunittestdelete',
+                'formatoptions' => [],
+                'expectedsectionum' => 5,
+            ],
+            'format theunittestdelete can delete' => [
+                'sectionum' => 4,
+                'format' => 'theunittestdelete',
+                'formatoptions' => ['can_delete_sections' => true],
+                'expectedsectionum' => 1,
+            ],
+        ];
+    }
+}
@@ -0,0 +1,70 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+defined('MOODLE_INTERNAL') || die();
+require_once(__DIR__ . '/format_theunittest.php');
+
+/**
+ * Fixture for fake course format testing course format API.
+ *
+ * @package    core_courseformat
+ * @copyright  2025 Laurent David <laurent.david@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class format_theunittestdelete extends format_theunittest {
+
+    /**
+     * Definitions of the additional options that format uses
+     *
+     * @param bool $foreditform
+     * @return array of options
+     */
+    public function course_format_options($foreditform = false) {
+        static $courseformatoptions = false;
+        if ($courseformatoptions === false) {
+            $courseformatoptions = parent::course_format_options(true);
+            $courseformatoptionsadditional = [
+                'can_delete_sections' => [
+                    'default' => false,
+                    'type' => PARAM_BOOL,
+                ],
+            ];
+            $courseformatoptions = array_merge_recursive($courseformatoptions, $courseformatoptionsadditional);
+        }
+        return $courseformatoptions;
+    }
+
+    /**
+     * Whether this format allows to delete sections
+     *
+     * Here for test purpose we just can delete one section every two sections
+     *
+     * Do not call this function directly, instead use course_can_delete_section()
+     *
+     * @param int|stdClass|section_info $section
+     * @return bool
+     */
+    public function can_delete_section($section) {
+        return $this->get_format_options()['can_delete_sections'] ?? false;
+    }
+
+    /**
+     * Returns true if this course format uses sections
+     */
+    public function uses_sections() {
+        return true;
+    }
+}
@@ -1156,7 +1156,14 @@ class core_course_renderer extends plugin_renderer_base {
            // This is a request for the course information.
            $courseid = required_param('courseid', PARAM_INT);

-            $course = $DB->get_record('course', array('id' => $courseid), '*', MUST_EXIST);
+            $course = $DB->get_record('course', ['id' => $courseid], '*', IGNORE_MISSING);
+            if ($course === false) {
+                throw new \moodle_exception('invalidcourseid');
+            }
+            $coursecontext = context_course::instance($course->id, MUST_EXIST);
+            if ($course->visible == 0 && !has_capability('moodle/course:viewhiddencourses', $coursecontext)) {
+                throw new \moodle_exception('invalidcourseid');
+            }

            $chelper = new coursecat_helper();
            $chelper->set_show_courses(self::COURSECAT_SHOW_COURSES_EXPANDED);
@@ -3850,6 +3850,12 @@ final class externallib_test extends externallib_advanced_testcase {
        $this->assignUserCapability('moodle/user:viewdetails', $usercontext, $teacherroleid);

        // Sorted by course id DESC.
+        // User without moodle/user:viewalldetails capability will not be able to see the course details.
+        $result = core_course_external::get_recent_courses($student->id);
+        $this->assertCount(0, $result);
+
+        // User with moodle/user:viewalldetails capability will be able to see the course details.
+        $this->assignUserCapability('moodle/user:viewalldetails', $usercontext, $teacherroleid);
        $result = core_course_external::get_recent_courses($student->id);
        $this->assertCount(1, $result);
        $this->assertEquals($courses[0]->id, array_shift($result)->id);
@@ -3953,6 +3959,12 @@ final class externallib_test extends externallib_advanced_testcase {

        $this->assertEquals(2, count($users['users']));
        $this->assertEquals($expectedusers, $users);
+
+        // Prohibit the capability for viewing course participants.
+        $this->unassignUserCapability('moodle/course:viewparticipants', null, null, $course1->id);
+        $this->expectException(required_capability_exception::class);
+        $this->expectExceptionMessage('Sorry, but you do not currently have permissions to do that (View participants)');
+        core_course_external::get_enrolled_users_by_cmid($forum1->cmid);
    }

    /**
@@ -259,6 +259,20 @@ class tool_provider extends ToolProvider {
            // Get the updated user record.
            $user = $DB->get_record('user', ['id' => $user->id]);
        } else {
+            if ($dbuser->suspended) {
+                require_once($CFG->libdir . '/authlib.php');
+                $failurereason = AUTH_LOGIN_SUSPENDED;
+                $event = \core\event\user_login_failed::create([
+                    'userid' => $dbuser->id,
+                    'other' => [
+                        'username' => $dbuser->username,
+                        'reason' => $failurereason
+                    ]
+                ]);
+                $event->trigger();
+                throw new moodle_exception('invalidlogin', 'core');
+            }
+
            if (helper::user_match($user, $dbuser)) {
                $user = $dbuser;
            } else {
@@ -84,11 +84,20 @@ function filter_tex_sanitize_formula(string $texexp): string {
        '\afterassignment', '\expandafter', '\noexpand', '\special',
        '\let', '\futurelet', '\else', '\fi', '\chardef', '\makeatletter', '\afterground',
        '\noexpand', '\line', '\mathcode', '\item', '\section', '\mbox', '\declarerobustcommand',
-        '\ExplSyntaxOn', '\pdffiledump',
+        '\ExplSyntaxOn', '\pdffiledump', '\mathtex',
    ];

    $allowlist = ['inputenc'];

+    // Add encoded backslash (&#92;) versions of backslashed items to deny list.
+    $encodedslashdenylist = array_map(function($value) {
+        $encoded = str_replace('\\', '&#92;', $value);
+        // Return an encoded slash version if a slash is found, otherwise null so we can filter it off.
+        return $encoded != $value ? $encoded : null;
+    }, $denylist);
+    $encodedslashdenylist = array_filter($encodedslashdenylist);
+    $denylist = array_merge($denylist, $encodedslashdenylist);
+
    // Prepare the denylist for regular expression.
    $denylist = array_map(function($value){
        return '/' . preg_quote($value, '/') . '/i';
@@ -203,7 +203,7 @@ class fetch extends external_api {
                        $definitionid,
                        'remark',
                        $filling['remark'],
-                        (int) $filling['remarkformat']
+                        (int) FORMAT_HTML
                    );
                }

@@ -857,16 +857,19 @@ class gradingform_guide_instance extends gradingform_instance {
        parent::update($data);

        foreach ($data['criteria'] as $criterionid => $record) {
+            // Hardcoding/defaulting to html format for new/existing record
+            $record['remarkformat'] = FORMAT_HTML;
+
            if (!array_key_exists($criterionid, $currentgrade['criteria'])) {
                $newrecord = array('instanceid' => $this->get_id(), 'criterionid' => $criterionid,
-                    'score' => $record['score'], 'remarkformat' => FORMAT_MOODLE);
+                    'score' => $record['score'], 'remarkformat' => $record['remarkformat']);
                if (isset($record['remark'])) {
                    $newrecord['remark'] = $record['remark'];
                }
                $DB->insert_record('gradingform_guide_fillings', $newrecord);
            } else {
                $newrecord = array('id' => $currentgrade['criteria'][$criterionid]['id']);
-                foreach (array('score', 'remark'/*, 'remarkformat' TODO */) as $key) {
+                foreach (array('score', 'remark', 'remarkformat') as $key) {
                    if (isset($record[$key]) && $currentgrade['criteria'][$criterionid][$key] != $record[$key]) {
                        $newrecord[$key] = $record[$key];
                    }
@@ -76,6 +76,16 @@ class gradingform_guide_renderer extends plugin_renderer_base {
                    $criterion[$key] = '';
                }
            }
+
+            // Set a default description format if not set.
+            if (!array_key_exists('descriptionformat', $criterion)) {
+                $criterion['descriptionformat'] = FORMAT_MOODLE;
+            }
+
+            // Set a default description markers format if not set.
+            if (!array_key_exists('descriptionmarkersformat', $criterion)) {
+                $criterion['descriptionmarkersformat'] = FORMAT_MOODLE;
+            }
        }

        $criteriontemplate = html_writer::start_tag('tr', array('class' => 'criterion'. $criterion['class'],
@@ -398,6 +408,11 @@ class gradingform_guide_renderer extends plugin_renderer_base {
                          'title' => get_string('clicktocopy', 'gradingform_guide'),
                          'id' => '{NAME}[comments][{COMMENT-id}]', 'class'=>'markingguidecomment'));
            } else {
+                  // Set a default description format if not set.
+                if (!array_key_exists('descriptionformat', $comment)) {
+                    $comment['descriptionformat'] = FORMAT_MOODLE;
+                }
+
                $description = format_text($comment['description'], $comment['descriptionformat']);
            }
            // Retain newlines as <br> tags when displaying 'frequently used comments'.
@@ -0,0 +1,104 @@
+@gradingform @gradingform_guide
+Feature: Marking guide criterion can be edited and replaced
+  In order to edit and replace a marking guide criterion
+  As a teacher
+  I need to have an existing marking guide criterion
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email                |
+      | teacher1 | Teacher   | 1        | teacher1@example.com |
+      | student1 | Student   | 1        | student1@example.com |
+    And the following "courses" exist:
+      | fullname | shortname | format |
+      | Course 1 | C1        | topics |
+    And the following "course enrolments" exist:
+      | user     | course | role           |
+      | teacher1 | C1     | editingteacher |
+      | student1 | C1     | student        |
+    And the following "activities" exist:
+      | activity | course | name     | advancedgradingmethod_submissions | assignsubmission_onlinetext_enabled |
+      | assign   | C1     | Assign 1 | guide                             | 1                                   |
+    And I am on the "Course 1" course page logged in as teacher1
+    And I go to "Assign 1" advanced grading definition page
+    And I set the following fields to these values:
+      | Name        | Assign 1 marking guide    |
+      | Description | Marking guide description |
+    And I define the following marking guide:
+      | Criterion name   | Description for students         | Description for markers         | Maximum score |
+      | Grade Criteria 1 | Grade 1 description for students | Grade 1 description for markers | 70            |
+      | Grade Criteria 2 | Grade 2 description for students | Grade 2 description for markers | 30            |
+    And I define the following frequently used comments:
+      | Comment 1 |
+      | Comment 2 |
+      | Comment 3 |
+    And I press "Save marking guide and make it ready"
+    And the following "mod_assign > submissions" exist:
+      | assign   | user      | onlinetext                       |
+      | Assign 1 | student1  | I'm the student first submission |
+    And I am on the "Assign 1" "assign activity" page
+    And I go to "Student 1" "Assign 1" activity advanced grading page
+    And I grade by filling the marking guide with:
+      | Grade Criteria 1 | 50 | Comment 1 |
+      | Grade Criteria 2 | 20 | Comment 2 |
+    And I press "Save changes"
+
+  @javascript
+  Scenario: Marking guide frequently used comments can be updated and reordered
+    Given I go to "Assign 1" advanced grading definition page
+    And I click on "Move up" "button" in the "Comment 3" "table_row"
+    And I click on "Move down" "button" in the "Comment 1" "table_row"
+    When I press "Save"
+    # Confirm that the order of the frequently used comments are updated.
+    Then "Comment 3" "text" should appear before "Comment 1" "text"
+    And "Comment 2" "text" should appear after "Comment 1" "text"
+    And I am on the "Assign 1" "assign activity" page
+    And I go to "Student 1" "Assign 1" activity advanced grading page
+    # Confirm that there are no changes to the existing marking records.
+    And I should see "Comment 1" in the "Grade Criteria 1" "table_row"
+    And I should see "Comment 2" in the "Grade Criteria 2" "table_row"
+
+  @javascript
+  Scenario: Marking guide criterion can be modified
+    Given I go to "Assign 1" advanced grading definition page
+    And I click on "Delete criterion" "button" in the "Grade Criteria 1" "table_row"
+    And I press "Yes"
+    And I wait "1" seconds
+    And I should not see "Grade Criteria 1"
+    And I press "Add criterion"
+    # Used xpath_element selectors in order to differentiate multiple criterion fields.
+    And I click on "//table[@id='guide-criteria']//tr[@class='criterion odd last']//div[@class='criterionname']" "xpath_element"
+    # Set the new criterion name.
+    And I set the field with xpath "//input[@id='guide-criteria-NEWID1-shortname']" to "Grade Criteria 3"
+    And I click on "//table[@id='guide-criteria']//tr[@class='criterion odd last']//div[@class='criteriondesc']//span[@class='textvalue']" "xpath_element"
+    # Set the new criterion description for students.
+    And I set the field with xpath "//textarea[@id='guide[criteria][NEWID1][description]']" to "Grade 3 description for students"
+    And I click on "//table[@id='guide-criteria']//tr[@class='criterion odd last']//div[@class='criteriondescmarkers']//span[@class='textvalue']" "xpath_element"
+    # Set the new criterion description for markers.
+    And I set the field with xpath "//textarea[@id='guide[criteria][NEWID1][descriptionmarkers]']" to "Grade 3 description for markers"
+    And I click on "//table[@id='guide-criteria']//tr[@class='criterion odd last']//div[@class='criterionmaxscore']//span[@class='textvalue']" "xpath_element"
+    # Set the new criterion max score.
+    And I set the field with xpath "//input[@id='guide[criteria][NEWID1][maxscore]']" to "70"
+    When I press "Save"
+    Then "You are about to save significant changes to a marking guide that has already been used for grading. The gradebook value will be unchanged, but the marking guide will be hidden from students until their item is regraded." "text" should exist
+    And I press "Continue"
+    And I am on the "Assign 1" "assign activity" page logged in as student1
+    # Confirm that the remarks for each grading criterion are not displayed.
+    And "Comment 1" "text" should not exist
+    And "Comment 2" "text" should not exist
+    # Confirm that the submission is not regraded.
+    And I should see "70.00 / 100.00"
+    # Regrade the submission.
+    And I am on the "Course 1" course page logged in as teacher1
+    And I go to "Student 1" "Assign 1" activity advanced grading page
+    And I grade by filling the marking guide with:
+      | Grade Criteria 2 | 15 | Comment 3 |
+      | Grade Criteria 3 | 50 | Comment 2 |
+    And I press "Save changes"
+    And I am on the "Assign 1" "assign activity" page logged in as student1
+    # Confirm that submission is re-marked and regraded.
+    And I should see "65.00 / 100.00"
+    And I should see the marking guide information displayed as:
+      | criteria         | description                      | remark    | maxscore | criteriascore |
+      | Grade Criteria 2 | Grade 2 description for students | Comment 3 | 30       | 15 / 30       |
+      | Grade Criteria 3 | Grade 3 description for students | Comment 2 | 70       | 50 / 70       |
@@ -0,0 +1,44 @@
+@gradingform @gradingform_guide
+Feature: Verify listings and grading submissions
+  In order to verify grade listing
+  As a teacher
+  I need to be able to see grades in the correct column
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email           |
+      | student  | Student   | One      | one@example.com |
+      | teacher  | Teacher   | One      | t1@example.com  |
+    And the following "courses" exist:
+      | shortname | fullname |
+      | C1        | Course 1 |
+    And the following "course enrolments" exist:
+      | user    | course | role           |
+      | student | C1     | student        |
+      | teacher | C1     | editingteacher |
+    And the following "activities" exist:
+      | activity | name    | course | advancedgradingmethod_submissions | assignsubmission_onlinetext_enabled |
+      | assign   | Assign1 | C1     | guide                             | 1                                   |
+    And I am on the "Course 1" course page logged in as teacher
+    And I go to "Assign1" advanced grading definition page
+    And I set the following fields to these values:
+      | Name        | Assign1 marking guide     |
+      | Description | Marking guide description |
+    And I define the following marking guide:
+      | Criterion name | Description for students         | Description for markers         | Maximum score |
+      | Criteria 1     | Grade 1 description for students | Grade 1 description for markers | 100           |
+    And I press "Save marking guide and make it ready"
+    And the following "mod_assign > submissions" exist:
+      | assign  | user    | onlinetext                           |
+      | Assign1 | student | This is a submission for assignment  |
+
+  @javascript
+  Scenario: Mark and view all grades in submissions table
+    Given I am on the "Assign1" "assign activity" page
+    And I click on "View all submission" "link"
+    And I click on "Grade" "link" in the "Student One" "table_row"
+    And I grade by filling the marking guide with:
+      | Criteria 1 | 50 | Excellent work! |
+    And I press "Save changes"
+    When I follow "View all submissions"
+    Then "Student One" row "Grade" column of "generaltable" table should contain "50"
@@ -196,7 +196,7 @@ class fetch extends external_api {
                        $definitionid,
                        'remark',
                        $filling['remark'],
-                        (int) $filling['remarkformat']
+                        (int) FORMAT_HTML
                    );
                }

@@ -863,16 +863,19 @@ class gradingform_rubric_instance extends gradingform_instance {
        $currentgrade = $this->get_rubric_filling();
        parent::update($data);
        foreach ($data['criteria'] as $criterionid => $record) {
+            // Hardcoding/defaulting to html format for new/existing record
+            $record['remarkformat'] = FORMAT_HTML;
+
            if (!array_key_exists($criterionid, $currentgrade['criteria'])) {
                $newrecord = array('instanceid' => $this->get_id(), 'criterionid' => $criterionid,
-                    'levelid' => $record['levelid'], 'remarkformat' => FORMAT_MOODLE);
+                    'levelid' => $record['levelid'], 'remarkformat' => $record['remarkformat']);
                if (isset($record['remark'])) {
                    $newrecord['remark'] = $record['remark'];
                }
                $DB->insert_record('gradingform_rubric_fillings', $newrecord);
            } else {
                $newrecord = array('id' => $currentgrade['criteria'][$criterionid]['id']);
-                foreach (array('levelid', 'remark'/*, 'remarkformat' */) as $key) {
+                foreach (array('levelid', 'remark', 'remarkformat') as $key) {
                    // TODO MDL-31235 format is not supported yet
                    if (isset($record[$key]) && $currentgrade['criteria'][$criterionid][$key] != $record[$key]) {
                        $newrecord[$key] = $record[$key];
@@ -115,6 +115,16 @@ class gradingform_rubric_renderer extends plugin_renderer_base {
            $descriptiontdparams['aria-label'] = get_string('criterion', 'gradingform_rubric', s($criterion['description']));
        }

+        // Default value for criterion ids.
+        // Edge case: submitting empty grade when remark field is disabled.
+        // Reason: we need the criteria keys for the clear_attempt to clear the rubric fillings.
+        if ($mode == gradingform_rubric_controller::DISPLAY_EVAL) {
+            $criteriontemplate .= html_writer::empty_tag('input', [
+                'type' => 'hidden',
+                'name' => '{NAME}[criteria][{CRITERION-id}][]',
+            ]);
+        }
+
        // Description cell.
        $criteriontemplate .= html_writer::tag('td', $description, $descriptiontdparams);

@@ -77,6 +77,7 @@ class grade_import_form extends moodleform {
            $mform->addElement('text', 'iprestriction', get_string('keyiprestriction', 'userkey'), array('size'=>80));
            $mform->addHelpButton('iprestriction', 'keyiprestriction', 'userkey');
            $mform->setDefault('iprestriction', getremoteaddr()); // own IP - just in case somebody does not know what user key is
+            $mform->setType('iprestriction', PARAM_RAW_TRIMMED);

            $mform->addElement('date_time_selector', 'validuntil', get_string('keyvaliduntil', 'userkey'), array('optional'=>true));
            $mform->addHelpButton('validuntil', 'keyvaliduntil', 'userkey');
@@ -140,17 +140,21 @@ class provider implements
                    break;
                default:
                    if (strpos($name, 'grade_report_grader_collapsed_categories') === 0) {
-                        $prefname = 'grade_report_grader_collapsed_categories';
+                        $prefname = $name;
                        $courseid = substr($name, strlen('grade_report_grader_collapsed_categories'));
                        $transformedvalue = $value;
-                        $course = get_course($courseid);
-                        $prefdescription = get_string(
-                            'privacy:request:preference:'.$prefname,
-                            'gradereport_grader',
-                            (object) [
-                                'name' => $course->fullname,
-                            ]
-                        );
+                        try {
+                            $course = get_course($courseid);
+                            $prefdescription = get_string(
+                                'privacy:request:preference:grade_report_grader_collapsed_categories',
+                                'gradereport_grader',
+                                (object) [
+                                    'name' => $course->fullname,
+                                ]
+                            );
+                        } catch (\dml_missing_record_exception $exception) {
+                            continue 2;
+                        }
                    }
            }

@@ -90,12 +90,22 @@ final class provider_test extends \core_privacy\tests\provider_testcase {
     * Ensure that export_user_preferences returns preferences.
     */
    public function test_export_user_preferences_multiple(): void {
-        // Create a course and add a user preference.
        $user = $this->getDataGenerator()->create_user();
        $this->setUser($user);
-        $course = $this->getDataGenerator()->create_course();
-        $collapsed = serialize(['aggregatesonly' => array(), 'gradesonly' => array()]);
-        set_user_preference('grade_report_grader_collapsed_categories'.$course->id, $collapsed, $user);
+
+        // Set preference for an invalid course.
+        set_user_preference('grade_report_grader_collapsed_categories42', serialize(['gradesonly' => []]));
+
+        // Set preferences for a couple of valid courses.
+        $courseone = $this->getDataGenerator()->create_course();
+        $courseonepreferencename = "grade_report_grader_collapsed_categories{$courseone->id}";
+        $courseonepreferencevalue = serialize(['aggregatesonly' => [], 'gradesonly' => []]);
+        set_user_preference($courseonepreferencename, $courseonepreferencevalue);
+
+        $coursetwo = $this->getDataGenerator()->create_course();
+        $coursetwopreferencename = "grade_report_grader_collapsed_categories{$coursetwo->id}";
+        $coursetwopreferencevalue = serialize(['gradesonly' => [], 'aggregatesonly' => []]);
+        set_user_preference($coursetwopreferencename, $coursetwopreferencevalue);

        // Validate exported data.
        provider::export_user_preferences($user->id);
@@ -104,10 +114,22 @@ final class provider_test extends \core_privacy\tests\provider_testcase {
        $writer = writer::with_context($context);
        $this->assertTrue($writer->has_any_data());
        $prefs = $writer->get_user_preferences('gradereport_grader');
-        $this->assertCount(1, (array) $prefs);
+        $this->assertCount(2, (array) $prefs);
+
+        $this->assertEquals($courseonepreferencevalue, $prefs->{$courseonepreferencename}->value);
        $this->assertEquals(
-            get_string('privacy:request:preference:grade_report_grader_collapsed_categories', 'gradereport_grader', ['name' => $course->fullname]),
-            $prefs->grade_report_grader_collapsed_categories->description
+            get_string('privacy:request:preference:grade_report_grader_collapsed_categories', 'gradereport_grader', [
+                'name' => $courseone->fullname,
+            ]),
+            $prefs->{$courseonepreferencename}->description,
+        );
+
+        $this->assertEquals($coursetwopreferencevalue, $prefs->{$coursetwopreferencename}->value);
+        $this->assertEquals(
+            get_string('privacy:request:preference:grade_report_grader_collapsed_categories', 'gradereport_grader', [
+                'name' => $coursetwo->fullname,
+            ]),
+            $prefs->{$coursetwopreferencename}->description,
        );
    }
 }
@@ -107,6 +107,7 @@ switch ($itemtype) {
        // display the user select zero state.
        if (is_null($itemid) || !array_key_exists($itemid, grade_report::get_gradable_users($courseid, $currentgroup))) {
            $itemtype = 'user_select';
+            unset($SESSION->gradereport_singleview["useritem-{$context->id}"]);
        }
        break;
    case 'grade_select':
@@ -129,6 +130,7 @@ switch ($itemtype) {
        // The item id (grade item id) cannot be defined, display the grade select zero state.
        if (is_null($itemid) || !array_key_exists($itemid, $gtree->get_items())) {
            $itemtype = 'grade_select';
+            unset($SESSION->gradereport_singleview["gradeitem-{$context->id}"]);
        }
        break;
 }
@@ -237,6 +237,9 @@ Feature: We can use Single view
    When I navigate to "View > Single view" in the course gradebook
    Then I should see "Search for a user to view all their grades" in the "region-main" "region"
    And I should not see "Gronya,Beecham" in the "region-main" "region"
+    # edge case coverage: to ensure session variable not causing error upon second visit
+    And I reload the page
+    And I should see "Search for a user to view all their grades" in the "region-main" "region"

  Scenario: Teacher does not see his last viewed user report if that user is no longer enrolled in the course.
    Given I navigate to "View > Single view" in the course gradebook
@@ -247,6 +250,9 @@ Feature: We can use Single view
    When I am on the "Course 1" "grades > Single view > View" page
    Then I should see "Search for a user to view all their grades" in the "region-main" "region"
    And I should not see "Gronya,Beecham" in the "region-main" "region"
+    # edge case coverage: to ensure session variable not causing error upon second visit
+    And I reload the page
+    And I should see "Search for a user to view all their grades" in the "region-main" "region"

  Scenario: Teacher does not see his last viewed grade item report if the item no longer exists in the course.
    Given I navigate to "View > Single view" in the course gradebook
@@ -258,3 +264,6 @@ Feature: We can use Single view
    When I navigate to "View > Single view" in the course gradebook
    Then I should see "Select a grade item above" in the "region-main" "region"
    And I should not see "Test grade item" in the "region-main" "region"
+    # edge case coverage: to ensure session variable not causing error upon second visit
+    And I reload the page
+    And I should see "Select a grade item above" in the "region-main" "region"
--- a/Show More
+++ b/Show More