Moodle release 4.5.9

- Removal of the navigation role on main and zero-state template
- Add accessibility extra tests for the block_overview

.github/workflows/onebyone.yml

@@ -51,7 +51,7 @@ jobs:
                   chunk=$(((($count % $chunks)) + 1))
                   echo "$testname $testfile" >> ./chunk_$chunk.txt
               done < <(grep "function test_" "${testfile}" | sed -r "s/^.*function (test_[a-zA-Z0-9_]+).*/\1/")
-          done < <(find . -name "*_test.php")
+          done < <(find . -name "*_test.php" -not -path "*/fixtures/*")
           # Generate the matrix to run tests.
           echo "matrix=$(ls -1 chunk_*.txt | jq -R -s -c 'split("\n")[:-1]')" >> $GITHUB_OUTPUT
           echo "$count individual tests collected in $chunks files"

.github/workflows/push.yml

@@ -19,7 +19,7 @@ env:
 
 jobs:
   Grunt:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checking out code
@@ -61,12 +61,12 @@ jobs:
       matrix:
         include:
           # MySQL builds always run with the lowest PHP supported version.
-          - os: ubuntu-22.04
+          - os: ubuntu-24.04
             php: 8.1
             extensions:
             db: mysqli
           # PostgreSQL builds always run with the highest PHP supported version.
-          - os: ubuntu-22.04
+          - os: ubuntu-24.04
             php: 8.3
             db: pgsql
 

MDL-87443-2025121117305654.yml

@@ -0,0 +1,7 @@
+issueNumber: MDL-87443
+notes:
+  core:
+    - message: >-
+        There is a new Behat `toast_message` named selector to more easily
+        assert the presence of Toast messages on the page
+      type: improved

UPGRADING.md

@@ -6,6 +6,192 @@ More detailed information on key changes can be found in the [Developer update n
 
 The format of this change log follows the advice given at [Keep a CHANGELOG](https://keepachangelog.com).
 
+## 4.5.9
+
+### core
+
+#### Changed
+
+- `\core\output\core_renderer::confirm()`'s `$displayoptions` parameter now also accepts a `headinglevel` option that developers can use to specify the heading level of the confirmation's heading. If not specified, the confirmation heading will be rendered in an `h4` tag.
+
+  For more information see [MDL-87694](https://tracker.moodle.org/browse/MDL-87694)
+
+## 4.5.8
+
+### core
+
+#### Changed
+
+- The Hook Manager now uses localcache instead of caching via MUC.
+
+  For more information see [MDL-87107](https://tracker.moodle.org/browse/MDL-87107)
+
+#### Fixed
+
+- `restore_qtype_plugin::unset_excluded_fields` now returns the modified questiondata structure,
+  in order to support structures that contain arrays.
+  If your qtype plugin overrides `restore_qtype_plugin::remove_excluded_question_data` without
+  calling the parent method, you may need to modify your overridden method to use the returned
+  value.
+
+  For more information see [MDL-85975](https://tracker.moodle.org/browse/MDL-85975)
+- When responding to pcntl signals, call existing signal handlers.
+
+  For more information see [MDL-87079](https://tracker.moodle.org/browse/MDL-87079)
+
+### mod_glossary
+
+#### Added
+
+- Function mod_glossary_rating_can_see_item_ratings is now implemented for checking permissions to view ratings.
+
+  For more information see [MDL-86960](https://tracker.moodle.org/browse/MDL-86960)
+
+## 4.5.7
+
+### core
+
+#### Added
+
+- The Behat `::execute()` method now accepts an array-style callable in addition to the string `classname::method` format.
+
+  The following formats are now accepted:
+
+  ```php
+  // String format:
+  $this->execute('behat_general::i_click_on', [...]);
+
+  // Array format:
+  $this->execute([behat_general::class,' i_click_on'], [...]);
+  ```
+
+  For more information see [MDL-86231](https://tracker.moodle.org/browse/MDL-86231)
+- The `\externallib_advanced_testcase` has been replaced by `\core_external\tests\externallib_testcase` and is now autoloadable.
+
+  For more information see [MDL-86283](https://tracker.moodle.org/browse/MDL-86283)
+
+### core_badges
+
+#### Added
+
+- A number of new static methods have been added to `core_badges\backpack_api` to support the new Canvas Credentials backpack provider. These methods allow you to retrieve lists of providers and regions, check if Canvas Credentials fields should be displayed, and get a region URL or API URL based on a given region ID. The new methods include `get_providers`, `get_regions`, `display_canvas_credentials_fields`, `get_region_url`, `get_region_api_url`, `get_regionid_from_url`, and `is_canvas_credentials_region`.
+
+  For more information see [MDL-86174](https://tracker.moodle.org/browse/MDL-86174)
+
+### core_grades
+
+#### Added
+
+- New 'is_gradable()' function has been created to return whether the item has any gradeitem that is GRADE_TYPE_VALUE or GRADE_TYPE_SCALE.
+
+  For more information see [MDL-85837](https://tracker.moodle.org/browse/MDL-85837)
+
+### core_message
+
+#### Added
+
+- The `contexturl` property to `\core\message\message` instances can now contain `\core\url` values in addition to plain strings
+
+  For more information see [MDL-83080](https://tracker.moodle.org/browse/MDL-83080)
+
+## 4.5.6
+
+### core
+
+#### Added
+
+- Add a new method has_valid_group in \core\report_helper that will return true or false depending if the user has a valid group. This is mainly false in case the user is not in any group in SEPARATEGROUPS. Used in report_log and report_loglive
+
+  For more information see [MDL-84464](https://tracker.moodle.org/browse/MDL-84464)
+
+#### Changed
+
+- The `\core\attribute\deprecated` attribute constructor `$replacement` parameter now defaults to null, and can be omitted
+
+  For more information see [MDL-84531](https://tracker.moodle.org/browse/MDL-84531)
+- Added a new `\core\deprecation::emit_deprecation()` method which should be used in places where a deprecation is known to occur. This method will throw debugging if no deprecation notice was found, for example:
+  ```php
+  public function deprecated_method(): void {
+      \core\deprecation::emit_deprecation([self::class, __FUNCTION__]);
+  }
+  ```
+
+  For more information see [MDL-85897](https://tracker.moodle.org/browse/MDL-85897)
+
+### core_message
+
+#### Added
+
+- The web service `core_message_get_member_info` additionally returns `cancreatecontact` which is a boolean value for a user's permission to add a contact.
+
+  For more information see [MDL-72123](https://tracker.moodle.org/browse/MDL-72123)
+
+## 4.5.5
+
+### core
+
+#### Added
+
+- - Added is_site_registered_in_hub method in lib/classes/hub/api.php to
+    check if the site is registered or not.
+  - Added get_secret method in lib/classes/hub/registration.php to get site's secret.
+
+  For more information see [MDL-83448](https://tracker.moodle.org/browse/MDL-83448)
+- Added a new optional param to adhoc_task_failed and scheduled_task_failed to allow skipping log finalisation when called from a separate task.
+
+  For more information see [MDL-84442](https://tracker.moodle.org/browse/MDL-84442)
+- There is a new `core/page_title` Javascript module for manipulating the current page title
+
+  For more information see [MDL-84804](https://tracker.moodle.org/browse/MDL-84804)
+
+### core_auth
+
+#### Added
+
+- A new method called `get_additional_upgrade_token_parameters` has been added to `oauth2_client` class. This will allow custom clients to override this one and add their extra parameters for upgrade token request.
+
+  For more information see [MDL-80380](https://tracker.moodle.org/browse/MDL-80380)
+
+### core_user
+
+#### Added
+
+- New method `\core_user::get_dummy_fullname(...)` for returning dummy user fullname comprised of configured name fields only
+
+  For more information see [MDL-82132](https://tracker.moodle.org/browse/MDL-82132)
+
+## 4.5.4
+
+### core
+
+#### Added
+
+- Behat now supports email content verification using Mailpit.
+  You can check the contents of an email using the step `Then the email to "user@example.com" with subject containing "subject" should contain "content".`
+  To use this feature:
+  1. Ensure that Mailpit is running
+  2. Define the following constants in your `config.php`:
+      - `TEST_EMAILCATCHER_MAIL_SERVER` - The Mailpit server address (e.g. `0.0.0.0:1025`)
+      - `TEST_EMAILCATCHER_API_SERVER` - The Mailpit API server (qe.g. `http://localhost:8025`)
+
+  3. Ensure that the email catcher is set up using the step `Given an email catcher server is configured`.
+
+  For more information see [MDL-75971](https://tracker.moodle.org/browse/MDL-75971)
+- The public method `get_slashargument` has been added to the `url` class.
+
+  For more information see [MDL-84351](https://tracker.moodle.org/browse/MDL-84351)
+- A new method, `core_text::trim_ctrl_chars()`, has been introduced to clean control characters from text. This ensures cleaner input handling and prevents issues caused by invisible or non-printable characters
+
+  For more information see [MDL-84907](https://tracker.moodle.org/browse/MDL-84907)
+
+### core_files
+
+#### Added
+
+- A new function `file_clear_draft_area()` has been added to delete the files in a draft area.
+
+  For more information see [MDL-72050](https://tracker.moodle.org/browse/MDL-72050)
+
 ## 4.5.3
 
 ### core_question

admin/category.php

@@ -118,6 +118,10 @@ foreach ($settingspage->children as $childpage) {
                 }
                 $outputhtml .= html_writer::tag('div', '<!-- -->', array('class' => 'clearer'));
                 $outputhtml .= $setting->output_html($data);
+                if ($childpage->has_dependencies()) {
+                    $opts = ['dependencies' => $childpage->get_dependencies_for_javascript()];
+                    $PAGE->requires->js_call_amd('core/showhidesettings', 'init', [$opts]);
+                }
             }
             $outputhtml .= html_writer::end_tag('fieldset');
         }

admin/cli/maintenance.php

@@ -69,7 +69,7 @@ if ($options['enablelater']) {
     }
 
     $time = time() + ($options['enablelater']*60);
-    set_config('maintenance_later', $time);
+    set_config('maintenance_later', $time, null, true);
 
     echo get_string('clistatusenabledlater', 'admin', userdate($time))."\n";
     return 0;
@@ -77,23 +77,32 @@ if ($options['enablelater']) {
 } else if ($options['enable']) {
     if (file_exists("$CFG->dataroot/climaintenance.html")) {
         // The maintenance is already enabled, nothing to do.
-    } else {
-        enable_cli_maintenance_mode();
+        exit(0);
+    }
+    enable_cli_maintenance_mode();
+    set_config('maintenance_enabled', 'cli mode', null, true);
+
+    if (isset($CFG->maintenance_later)) {
+        unset_config('maintenance_later', null, true);
     }
-    set_config('maintenance_enabled', 0);
-    unset_config('maintenance_later');
     echo get_string('sitemaintenanceoncli', 'admin')."\n";
     exit(0);
 
 } else if ($options['enableold']) {
-    set_config('maintenance_enabled', 1);
-    unset_config('maintenance_later');
+    set_config('maintenance_enabled', 1, null, true);
+    if (isset($CFG->maintenance_later)) {
+        unset_config('maintenance_later', null, true);
+    }
     echo get_string('sitemaintenanceon', 'admin')."\n";
     exit(0);
 
 } else if ($options['disable']) {
-    set_config('maintenance_enabled', 0);
-    unset_config('maintenance_later');
+    if ($CFG->maintenance_enabled !== '0') {
+        set_config('maintenance_enabled', 0, null, true);
+    }
+    if (isset($CFG->maintenance_later)) {
+        unset_config('maintenance_later', null, true);
+    }
     if (file_exists("$CFG->dataroot/climaintenance.html")) {
         unlink("$CFG->dataroot/climaintenance.html");
     }

admin/cli/purge_caches.php

@@ -24,6 +24,7 @@
  */
 
 define('CLI_SCRIPT', true);
+define('IGNORE_COMPONENT_CACHE', true);
 
 require(__DIR__.'/../../config.php');
 require_once($CFG->libdir.'/clilib.php');

admin/cli/restore_backup.php

@@ -55,13 +55,14 @@ If courseid is set, course module/s will be added into the course.
 
 Options:
 -f, --file=STRING       Path to the backup file.
--c, --categoryid=INT    ID of the course category to restore to.
--C, --courseid=INT      ID of the course to restore to. This option is ignored if categoryid is set.
+-c, --categoryid=INT    ID of the course category to restore to. This option is ignored when restoring an activity and courseid is set.
+-C, --courseid=INT      ID of the course to restore to. This option is ignored when restoring a course and the categoryid is set.
 -s, --showdebugging     Show developer level debugging information
 -h, --help              Print out this help.
 
 Example:
-\$sudo -u www-data /usr/bin/php admin/cli/restore_backup.php --file=/path/to/backup/file.mbz --categoryid=1\n
+\$sudo -u www-data /usr/bin/php admin/cli/restore_backup.php --file=/path/to/backup/coursebackup.mbz --categoryid=1\n
+\$sudo -u www-data /usr/bin/php admin/cli/restore_backup.php --file=/path/to/backup/activitybackup.mbz --courseid=1\n
 EOL;
 
     echo $help;
@@ -84,11 +85,15 @@ if ($options['categoryid']) {
     if (!$category = $DB->get_record('course_categories', ['id' => $options['categoryid']], 'id')) {
         throw new \moodle_exception('invalidcategoryid');
     }
-} else if ($options['courseid']) {
+}
+
+if ($options['courseid']) {
     if (!$course = $DB->get_record('course', ['id' => $options['courseid']], 'id')) {
         throw new \moodle_exception('invalidcourseid');
     }
-} else {
+}
+
+if (empty($category) && empty($course)) {
     throw new \moodle_exception('invalidoption');
 }
 
@@ -100,28 +105,46 @@ $fp = get_file_packer('application/vnd.moodle.backup');
 $fp->extract_to_pathname($options['file'], $path);
 
 cli_heading(get_string('preprocessingbackupfile'));
-try {
-    list($fullname, $shortname) = restore_dbops::calculate_course_names(0, get_string('restoringcourse', 'backup'),
-        get_string('restoringcourseshortname', 'backup'));
 
-    if (!empty($course)) {
-        $courseid = $course->id;
-        $rc = new restore_controller($backupdir, $courseid, backup::INTERACTIVE_NO,
-            backup::MODE_GENERAL, $admin->id, backup::TARGET_EXISTING_ADDING);
-    } else {
+try {
+    // Create a temporary restore controller to determine the restore type.
+    $tmprc = new restore_controller($backupdir, SITEID, backup::INTERACTIVE_NO,
+        backup::MODE_GENERAL, $admin->id, backup::TARGET_EXISTING_ADDING);
+    // Restore the backup into a new course if:
+    // - It is a course backup and the category is set.
+    // - It is an activity backup and the course is not set.
+    $restoreasnewcourse = ($tmprc->get_type() === backup::TYPE_1COURSE && !empty($category)) ||
+        ($tmprc->get_type() !== backup::TYPE_1COURSE && empty($course));
+    // Make sure to clean up the temporary restore controller.
+    $tmprc->destroy();
+
+    if ($restoreasnewcourse) {
+        list($fullname, $shortname) = restore_dbops::calculate_course_names(0, get_string('restoringcourse', 'backup'),
+            get_string('restoringcourseshortname', 'backup'));
         $courseid = restore_dbops::create_new_course($fullname, $shortname, $category->id);
         $rc = new restore_controller($backupdir, $courseid, backup::INTERACTIVE_NO,
             backup::MODE_GENERAL, $admin->id, backup::TARGET_NEW_COURSE);
+    } else {
+        $courseid = $course->id;
+        $rc = new restore_controller($backupdir, $courseid, backup::INTERACTIVE_NO,
+            backup::MODE_GENERAL, $admin->id, backup::TARGET_EXISTING_ADDING);
     }
     $rc->execute_precheck();
     $rc->execute_plan();
     $rc->destroy();
 
-    // Rename course name if the backup is from course module and restore to category.
-    if (empty($course)) {
+    // Rename the course's full and short names with the backup file's original names if the backup file is an activity backup
+    // that is restored to a new course.
+    if ($restoreasnewcourse && $rc->get_type() !== backup::TYPE_1COURSE) {
         $course = get_course($courseid);
-        list($fullname, $shortname) = restore_dbops::calculate_course_names(0, get_string('restoretonewcourse', 'backup'),
-            get_string('newcourse'));
+        $backupinfo = $rc->get_info();
+        $tmpfullname = $backupinfo->original_course_fullname ?? get_string('restoretonewcourse', 'backup');
+        $tmpshortname = $backupinfo->original_course_shortname ?? get_string('newcourse');
+        list($fullname, $shortname) = restore_dbops::calculate_course_names(
+            courseid: 0,
+            fullname: $tmpfullname,
+            shortname: $tmpshortname,
+        );
         $course->fullname = $fullname;
         $course->shortname = $shortname;
         $course->visible = 1;

admin/cli/uninstall_plugins.php

@@ -158,13 +158,13 @@ if ($options['plugins']) {
         if (is_null($plugin)) {
             cli_writeln('Unknown plugin: ' . $component);
         } else {
-            $pluginstring = $plugin->component . "\t" . $plugin->displayname;
+            $pluginstring = $component . "\t" . $plugin->displayname;
 
-            if ($pluginman->can_uninstall_plugin($plugin->component)) {
+            if ($pluginman->can_uninstall_plugin($component)) {
                 if ($options['run']) {
                     cli_writeln('Uninstalling: ' . $pluginstring);
                     $progress = new progress_trace_buffer(new text_progress_trace(), true);
-                    $pluginman->uninstall_plugin($plugin->component, $progress);
+                    $pluginman->uninstall_plugin($component, $progress);
                     $progress->finished();
                     cli_write($progress->get_buffer());
                 } else {

admin/environment.xml

@@ -3835,6 +3835,7 @@
       <PHP_EXTENSION name="fileinfo" level="required"/>
       <PHP_EXTENSION name="sodium" level="optional"/>
       <PHP_EXTENSION name="exif" level="optional"/>
+      <PHP_EXTENSION name="filter" level="required"/>
     </PHP_EXTENSIONS>
     <PHP_SETTINGS>
       <PHP_SETTING name="memory_limit" value="96M" level="required">
@@ -4327,6 +4328,7 @@
       <VENDOR name="oracle" version="19" />
     </DATABASE>
     <PHP version="8.1.0" level="required">
+      <RESTRICT function="restrict_php_version_84" message="unsupportedphpversion84" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -4410,6 +4412,7 @@
       <PHP_EXTENSION name="fileinfo" level="required"/>
       <PHP_EXTENSION name="sodium" level="required"/>
       <PHP_EXTENSION name="exif" level="optional"/>
+      <PHP_EXTENSION name="filter" level="required"/>
     </PHP_EXTENSIONS>
     <PHP_SETTINGS>
       <PHP_SETTING name="memory_limit" value="96M" level="required">
@@ -4522,6 +4525,7 @@
       <VENDOR name="oracle" version="19" />
     </DATABASE>
     <PHP version="8.1.0" level="required">
+      <RESTRICT function="restrict_php_version_84" message="unsupportedphpversion84" />
     </PHP>
     <PCREUNICODE level="optional">
       <FEEDBACK>
@@ -4605,6 +4609,7 @@
       <PHP_EXTENSION name="fileinfo" level="required"/>
       <PHP_EXTENSION name="sodium" level="required"/>
       <PHP_EXTENSION name="exif" level="optional"/>
+      <PHP_EXTENSION name="filter" level="required"/>
     </PHP_EXTENSIONS>
     <PHP_SETTINGS>
       <PHP_SETTING name="memory_limit" value="96M" level="required">
@@ -4714,6 +4719,7 @@
       <VENDOR name="mysql" version="8.4" />
       <VENDOR name="postgres" version="14" />
       <VENDOR name="mssql" version="14.0" />
+      <VENDOR name="auroramysql" version="8.0" />
     </DATABASE>
     <PHP version="8.2.0" level="required">
     </PHP>
@@ -4799,6 +4805,7 @@
       <PHP_EXTENSION name="fileinfo" level="required"/>
       <PHP_EXTENSION name="sodium" level="required"/>
       <PHP_EXTENSION name="exif" level="optional"/>
+      <PHP_EXTENSION name="filter" level="required"/>
     </PHP_EXTENSIONS>
     <PHP_SETTINGS>
       <PHP_SETTING name="memory_limit" value="96M" level="required">
@@ -4893,6 +4900,413 @@
       </CUSTOM_CHECK>
       <CUSTOM_CHECK file="lib/upgradelib.php" function="check_async_backup" level="recommended">
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_aurora_version" level="optional">
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="5.1" requires="4.2.3">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="10.11.0" />
+      <VENDOR name="mysql" version="8.4" />
+      <VENDOR name="postgres" version="15" />
+      <VENDOR name="mssql" version="14.0" />
+      <VENDOR name="auroramysql" version="8.0" />
+    </DATABASE>
+    <PHP version="8.2.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="mbstringrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+      <PHP_EXTENSION name="sodium" level="required"/>
+      <PHP_EXTENSION name="exif" level="optional"/>
+      <PHP_EXTENSION name="filter" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="zend.exception_ignore_args" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingzendexceptionignoreargs" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_sixtyfour_bits" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="sixtyfourbitsrequired" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_max_input_vars" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_admin_dir_usage" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iscustomadminwarnings" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_async_backup" level="recommended">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_aurora_version" level="optional">
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="5.2" requires="4.4">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="10.11.0" />
+      <VENDOR name="mysql" version="8.4" />
+      <VENDOR name="postgres" version="16" />
+      <VENDOR name="mssql" version="15.0" />
+      <VENDOR name="auroramysql" version="8.0" />
+    </DATABASE>
+    <PHP version="8.3.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="mbstringrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+      <PHP_EXTENSION name="sodium" level="required"/>
+      <PHP_EXTENSION name="exif" level="optional"/>
+      <PHP_EXTENSION name="filter" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="zend.exception_ignore_args" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingzendexceptionignoreargs" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK function="\core\environment::check_composer_dependencies_installed" level="optional" />
+      <CUSTOM_CHECK function="\core\environment::check_composer_developer_dependencies_not_installed" level="optional" />
+      <CUSTOM_CHECK function="\core\environment::check_composer_dependencies_optimised" level="optional" />
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_sixtyfour_bits" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="sixtyfourbitsrequired" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_max_input_vars" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_admin_dir_usage" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iscustomadminwarnings" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_xmlrpc_usage" level="optional">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mod_assignment" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_db_prefix_length" level="required">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_async_backup" level="recommended">
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_aurora_version" level="optional">
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/index.php

@@ -916,8 +916,14 @@ if (empty($CFG->disabledevlibdirscheck) && (is_dir($CFG->dirroot.'/vendor') || i
 // Check if the site is being foced onto ssl.
 $overridetossl = !empty($CFG->overridetossl);
 
-// Check if moodle campaign content setting is enabled or not.
-$showcampaigncontent = !isset($CFG->showcampaigncontent) || $CFG->showcampaigncontent;
+if (defined('BEHAT_SITE_RUNNING') && BEHAT_SITE_RUNNING) {
+    // We need to add this in order to be able to verify the showcampaigncontent setting behaviour during behat tests.
+    $showcampaigncontent = get_config('core', 'showcampaigncontent');
+    $showcampaigncontent = $showcampaigncontent === 'true';
+} else {
+    // Check if moodle campaign content setting is enabled or not.
+    $showcampaigncontent = !isset($CFG->showcampaigncontent) || $CFG->showcampaigncontent;
+}
 
 // Encourage admins to enable the user feedback feature if it is not enabled already.
 $showfeedbackencouragement = empty($CFG->enableuserfeedback);
@@ -931,6 +937,13 @@ $result = new environment_results('custom_checks');
 $result = check_xmlrpc_usage($result);
 $xmlrpcwarning = !is_null($result) ? get_string($result->getFeedbackStr(), 'admin') : '';
 
+// Check whether MoodleNet features are enabled and warn about removal.
+$moodlenetwarning = '';
+$moodlenetenabled = get_config('tool_moodlenet', 'enablemoodlenet');
+if ($moodlenetenabled) {
+    $moodlenetwarning = get_string('moodlenetremovalwarning', 'admin');
+}
+
 admin_externalpage_setup('adminnotifications');
 
 $output = $PAGE->get_renderer('core', 'admin');
@@ -940,4 +953,4 @@ echo $output->admin_notifications_page($maturity, $insecuredataroot, $errorsdisp
                                        $registered, $cachewarnings, $eventshandlers, $themedesignermode, $devlibdir,
                                        $mobileconfigured, $overridetossl, $invalidforgottenpasswordurl, $croninfrequent,
                                        $showcampaigncontent, $showfeedbackencouragement, $servicesandsupportcontent,
-                                       $xmlrpcwarning);
+                                       $xmlrpcwarning, $moodlenetwarning);

admin/purgecaches.php

@@ -23,6 +23,8 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 
+define('IGNORE_COMPONENT_CACHE', true);
+
 require_once('../config.php');
 require_once($CFG->libdir.'/adminlib.php');
 

admin/registration/index.php

@@ -34,8 +34,10 @@ admin_externalpage_setup('registrationmoodleorg');
 
 $unregistration = optional_param('unregistration', false, PARAM_BOOL);
 $confirm = optional_param('confirm', false, PARAM_BOOL);
+// Consider the site 'registered' if records exist locally and at the hub.
+$siteisregistered = \core\hub\registration::is_registered() && core\hub\api::is_site_registered_in_hub();
 
-if ($unregistration && \core\hub\registration::is_registered()) {
+if ($unregistration && $siteisregistered) {
     if ($confirm) {
         require_sesskey();
         \core\hub\registration::unregister(false, false);
@@ -60,7 +62,7 @@ if (!$returnurl = optional_param('returnurl', null, PARAM_LOCALURL)) {
     $returnurl = $isinitialregistration ? '/admin/index.php' : '/admin/registration/index.php';
 }
 
-$siteregistrationform = new \core\hub\site_registration_form();
+$siteregistrationform = new \core\hub\site_registration_form(null, ['registered' => $siteisregistered]);
 $siteregistrationform->set_data(['returnurl' => $returnurl]);
 if ($fromform = $siteregistrationform->get_data()) {
 
@@ -86,7 +88,7 @@ echo $OUTPUT->header();
 // Current status of registration.
 
 $notificationtype = \core\output\notification::NOTIFY_ERROR;
-if (\core\hub\registration::is_registered()) {
+if ($siteisregistered) {
     $lastupdated = \core\hub\registration::get_last_updated();
     if ($lastupdated == 0) {
         $registrationmessage = get_string('pleaserefreshregistrationunknown', 'admin');
@@ -104,7 +106,7 @@ if (\core\hub\registration::is_registered()) {
 }
 
 // Heading.
-if (\core\hub\registration::is_registered()) {
+if ($siteisregistered) {
     echo $OUTPUT->heading(get_string('registerwithmoodleorgupdate', 'core_hub'));
 } else if ($isinitialregistration) {
     echo $OUTPUT->heading(get_string('registerwithmoodleorgcomplete', 'core_hub'));
@@ -117,7 +119,7 @@ echo $renderer->moodleorg_registration_message();
 
 $siteregistrationform->display();
 
-if (\core\hub\registration::is_registered()) {
+if ($siteisregistered) {
     // Unregister link.
     $unregisterhuburl = new moodle_url("/admin/registration/index.php", ['unregistration' => 1]);
     echo html_writer::div(html_writer::link($unregisterhuburl, get_string('unregister', 'hub')), 'unregister mt-2');

admin/renderer.php

@@ -279,6 +279,7 @@ class core_admin_renderer extends plugin_renderer_base {
      * @param bool $showfeedbackencouragement Whether the feedback encouragement content should be displayed or not.
      * @param bool $showservicesandsupport Whether the services and support content should be displayed or not.
      * @param string $xmlrpcwarning XML-RPC deprecation warning message.
+     * @param string $moodlenetwarning MoodleNet removal warning message.
      *
      * @return string HTML to output.
      */
@@ -288,7 +289,7 @@ class core_admin_renderer extends plugin_renderer_base {
             $themedesignermode = false, $devlibdir = false, $mobileconfigured = false,
             $overridetossl = false, $invalidforgottenpasswordurl = false, $croninfrequent = false,
             $showcampaigncontent = false, bool $showfeedbackencouragement = false, bool $showservicesandsupport = false,
-            $xmlrpcwarning = '') {
+            $xmlrpcwarning = '', $moodlenetwarning = '') {
 
         global $CFG;
         $output = '';
@@ -314,6 +315,7 @@ class core_admin_renderer extends plugin_renderer_base {
         $output .= $this->mobile_configuration_warning($mobileconfigured);
         $output .= $this->forgotten_password_url_warning($invalidforgottenpasswordurl);
         $output .= $this->mnet_deprecation_warning($xmlrpcwarning);
+        $output .= $this->moodlenet_removal_warning($moodlenetwarning);
         $output .= $this->userfeedback_encouragement($showfeedbackencouragement);
         $output .= $this->services_and_support_content($showservicesandsupport);
         $output .= $this->campaign_content($showcampaigncontent);
@@ -2218,7 +2220,7 @@ class core_admin_renderer extends plugin_renderer_base {
     public function moodleorg_registration_message() {
         $a = new stdClass();
         $a->moreinformation = '#id_sitestats'; // More information anchor.
-        $a->moodleapp = HUB_MOODLEORGHUBURL . '/solutions/moodle-app/';
+        $a->moodleapp = MOODLE_PRODUCTURL . '/solutions/moodle-app/';
         $out = format_text(get_string('registerwithmoodleorginfo', 'core_hub', $a), FORMAT_MARKDOWN);
 
         $out .= html_writer::link(
@@ -2267,6 +2269,20 @@ class core_admin_renderer extends plugin_renderer_base {
         return $this->warning($xmlrpcwarning);
     }
 
+    /**
+     * Display a warning about the removal of MoodleNet integration.
+     *
+     * @param string $moodlenetwarning The warning message
+     * @return string HTML to output.
+     */
+    protected function moodlenet_removal_warning($moodlenetwarning) {
+        if (empty($moodlenetwarning)) {
+            return '';
+        }
+
+        return $this->warning($moodlenetwarning);
+    }
+
     /**
      * Renders the theme selector list.
      *

admin/settings/badges.php

@@ -65,6 +65,21 @@ if (($hassiteconfig || has_any_capability(array(
             new lang_string('allowexternalbackpack', 'badges'),
             new lang_string('allowexternalbackpack_desc', 'badges'), 1));
 
+    $defaultcanvasregions = [
+        'Australia|https://au.badgr.io|https://api.au.badgr.io/v2',
+        'Canada|https://ca.badgr.io|https://api.ca.badgr.io/v2',
+        'Europe|https://eu.badgr.io|https://api.eu.badgr.io/v2',
+        'Singapore|https://sg.badgr.io|https://api.sg.badgr.io/v2',
+        'United States|https://badgr.io|https://api.badgr.io/v2',
+    ];
+    $globalsettings->add(new admin_setting_configtextarea(
+        'badges_canvasregions',
+        new lang_string('canvasregions', 'badges'),
+        new lang_string('canvasregions_desc', 'badges'),
+        implode("\n", $defaultcanvasregions),
+        PARAM_RAW,
+    ));
+
     $ADMIN->add('badges', $globalsettings);
 
     $ADMIN->add('badges',

admin/settings/location.php

@@ -70,6 +70,14 @@ if ($hassiteconfig) {
 
         $temp->add(new admin_setting_configtext('googlemapkey3', new lang_string('googlemapkey3', 'core_admin'),
             new lang_string('googlemapkey3_help', 'core_admin'), '', PARAM_RAW, 60));
+
+        $temp->add(new admin_setting_configtext(
+            'geopluginapikey',
+            new lang_string('geopluginapikey', 'core_admin'),
+            new lang_string('geopluginapikey_desc', 'core_admin'),
+            '',
+            PARAM_TEXT,
+        ));
     }
 
     $ADMIN->add('location', $temp);

admin/tests/behat/behat_admin.php

@@ -81,6 +81,8 @@ class behat_admin extends behat_base {
 
             $this->execute('behat_forms::i_set_the_field_with_xpath_to', [$fieldxpath, $value]);
             $this->execute("behat_general::i_click_on", [get_string('savechanges'), 'button']);
+            // Wait for the page to be redirected.
+            $this->execute("behat_general::i_wait_to_be_redirected");
         }
     }
 

admin/tests/behat/browse_users.feature

@@ -79,7 +79,7 @@ Feature: An administrator can browse user accounts
   Scenario: Delete a user account
     Given I navigate to "Users > Accounts > Browse list of users" in site administration
     And I press "Delete" action in the "User One" report row
-    And I should see "Are you absolutely sure you want to completely delete the user User One" in the "Delete user" "dialogue"
+    And I should see "Are you sure you want to delete user User One" in the "Delete user" "dialogue"
     And I click on "Delete" "button" in the "Delete user" "dialogue"
     Then I should see "Deleted user User One"
     And I should not see "User One" in the "reportbuilder-table" "table"
@@ -90,6 +90,7 @@ Feature: An administrator can browse user accounts
       | username | firstname | lastname | email             | confirmed |
       | user3    | User      | Three    | three@example.com | 0         |
     And I navigate to "Users > Accounts > Browse list of users" in site administration
+    And I change window size to "large"
     Then I should see "Confirmation pending" in the "User Three" "table_row"
     And I press "Resend confirmation email" action in the "User Three" report row
     And I should see "Confirmation email sent successfully"

admin/tests/behat/toggle_campaign_display.feature

@@ -0,0 +1,17 @@
+@core @core_admin
+Feature: Toggle campaign banner visibility
+  In order to control the visibility of the campaign banner content
+  As an admin
+  I need to be able to disable the campaign banner display
+
+  Scenario Outline: Admin can disable the campaign banner display
+    Given the following config values are set as admin:
+      | showcampaigncontent | <showcampaigncontent> |
+    And I log in as "admin"
+    When I navigate to "Notifications" in site administration
+    Then "//iframe[@id='campaign-content']" "xpath_element" <display> exist
+
+    Examples:
+      | showcampaigncontent | display    |
+      | true                | should     |
+      | false               | should not |

admin/tool/admin_presets/tests/behat/apply_presets.feature

@@ -20,9 +20,9 @@ Feature: I can apply presets
     And I navigate to "Plugins > Course formats > Manage course formats" in site administration
     And "Disable" "icon" should exist in the "Social" "table_row"
     And I navigate to "Plugins > Question behaviours > Manage question behaviours" in site administration
-    And "Enabled" "icon" should exist in the "Immediate feedback with CBM" "table_row"
+    And "Enabled" "link" should exist in the "Immediate feedback with CBM" "table_row"
     And I navigate to "Plugins > Question types > Manage question types" in site administration
-    And "Enabled" "icon" should exist in the "Calculated multichoice" "table_row"
+    And "Enabled" "link" should exist in the "Calculated multichoice" "table_row"
     When I navigate to "Site admin presets" in site administration
     And I press "Review settings and apply" action in the "Starter" report row
     And I should see "Setting changes"
@@ -113,9 +113,9 @@ Feature: I can apply presets
     And I navigate to "Plugins > Course formats > Manage course formats" in site administration
     And "Disable" "icon" should not exist in the "Social" "table_row"
     And I navigate to "Plugins > Question behaviours > Manage question behaviours" in site administration
-    And "Enabled" "icon" should not exist in the "Immediate feedback with CBM" "table_row"
+    And "Enabled" "link" should not exist in the "Immediate feedback with CBM" "table_row"
     And I navigate to "Plugins > Question types > Manage question types" in site administration
-    And "Enabled" "icon" should not exist in the "Calculated multichoice" "table_row"
+    And "Enabled" "link" should not exist in the "Calculated multichoice" "table_row"
 
   Scenario: Re-applying Starter Moodle preset does not display setting changes
 #   Apply Starter preset.

admin/tool/admin_presets/tests/behat/revert_changes.feature

@@ -27,9 +27,9 @@ Feature: I can revert changes after a load
     And I navigate to "Plugins > Course formats > Manage course formats" in site administration
     And "Disable" "icon" should not exist in the "Social" "table_row"
     And I navigate to "Plugins > Question behaviours > Manage question behaviours" in site administration
-    And "Enabled" "icon" should not exist in the "Immediate feedback with CBM" "table_row"
+    And "Enabled" "link" should not exist in the "Immediate feedback with CBM" "table_row"
     And I navigate to "Plugins > Question types > Manage question types" in site administration
-    And "Enabled" "icon" should not exist in the "Calculated multichoice" "table_row"
+    And "Enabled" "link" should not exist in the "Calculated multichoice" "table_row"
     And I navigate to "Site admin presets" in site administration
     And I press "Show version history" action in the "Starter" report row
     When I click on "Restore this version" "link"
@@ -45,6 +45,6 @@ Feature: I can revert changes after a load
     And I navigate to "Plugins > Course formats > Manage course formats" in site administration
     And "Disable" "icon" should exist in the "Social" "table_row"
     And I navigate to "Plugins > Question behaviours > Manage question behaviours" in site administration
-    And "Enabled" "icon" should exist in the "Immediate feedback with CBM" "table_row"
+    And "Enabled" "link" should exist in the "Immediate feedback with CBM" "table_row"
     And I navigate to "Plugins > Question types > Manage question types" in site administration
-    And "Enabled" "icon" should exist in the "Calculated multichoice" "table_row"
+    And "Enabled" "link" should exist in the "Calculated multichoice" "table_row"

admin/tool/behat/cli/init.php

@@ -36,6 +36,10 @@ if (function_exists('opcache_reset')) {
 define('CLI_SCRIPT', true);
 define('CACHE_DISABLE_ALL', true);
 
+// It makes no sense to use BEHAT_CLI for this script (the Behat launch scripts expect to start
+// from the normal environment), so in case user has set tne environment variable, disable it.
+putenv('BEHAT_CLI=0');
+
 // Basic functions.
 require_once(__DIR__ . '/../../../../lib/clilib.php');
 require_once(__DIR__ . '/../../../../lib/behat/lib.php');

admin/tool/behat/cli/run.php

@@ -31,6 +31,10 @@ define('ABORT_AFTER_CONFIG', true);
 define('CACHE_DISABLE_ALL', true);
 define('NO_OUTPUT_BUFFERING', true);
 
+// It makes no sense to use BEHAT_CLI for this script (the Behat launch scripts expect to start
+// from the normal environment), so in case user has set tne environment variable, disable it.
+putenv('BEHAT_CLI=0');
+
 require_once(__DIR__ .'/../../../../config.php');
 require_once(__DIR__.'/../../../../lib/clilib.php');
 require_once(__DIR__.'/../../../../lib/behat/lib.php');

admin/tool/behat/cli/util.php

@@ -39,6 +39,10 @@ define('NO_OUTPUT_BUFFERING', true);
 define('IGNORE_COMPONENT_CACHE', true);
 define('ABORT_AFTER_CONFIG', true);
 
+// It makes no sense to use BEHAT_CLI for this script (the Behat launch scripts expect to start
+// from the normal environment), so in case user has set tne environment variable, disable it.
+putenv('BEHAT_CLI=0');
+
 require_once(__DIR__ . '/../../../../lib/clilib.php');
 
 // CLI options.

admin/tool/behat/cli/util_single_run.php

@@ -33,6 +33,10 @@ if (isset($_SERVER['REMOTE_ADDR'])) {
     die(); // No access from web!.
 }
 
+// It makes no sense to use BEHAT_CLI for this script (the Behat launch scripts expect to start
+// from the normal environment), so in case user has set tne environment variable, disable it.
+putenv('BEHAT_CLI=0');
+
 // Basic functions.
 require_once(__DIR__ . '/../../../../lib/clilib.php');
 require_once(__DIR__ . '/../../../../lib/behat/lib.php');

admin/tool/brickfield/db/uninstall.php

@@ -24,5 +24,14 @@
 
 defined('MOODLE_INTERNAL') || die;
 
-// Remove the 'enableaccessibilitytools' configuration setting in case of reinstall.
-unset_config('enableaccessibilitytools');
+/**
+ * Plugin uninstall code.
+ *
+ * @return true
+ */
+function xmldb_tool_brickfield_uninstall(): bool {
+    // Remove the 'enableaccessibilitytools' configuration setting in case of reinstall.
+    unset_config('enableaccessibilitytools');
+
+    return true;
+}

admin/tool/brickfield/index.php

@@ -87,6 +87,7 @@ $action = optional_param('action', '', PARAM_ALPHA);
 // Handle any single operation actions.
 if ($action == 'requestanalysis') {
     if ($courseid != 0) {
+        require_sesskey();
         scheduler::request_course_analysis($courseid);
         if ($courseid == SITEID) {
             redirect(accessibility::get_plugin_url());

admin/tool/capability/tests/plugin_checks_test.php

@@ -0,0 +1,70 @@
+<?php
+// This file is part of Moodle - https://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <https://www.gnu.org/licenses/>.
+
+namespace tool_capability;
+
+// phpcs:disable moodle.PHPUnit.TestCaseProvider.dataProviderSyntaxMethodNotFound
+
+/**
+ * Detect common problems in capability definitions of plugins.
+ *
+ * @group     plugin_checks
+ * @package   tool_capability
+ * @copyright 2025 Petr Skoda
+ * @license   https://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+final class plugin_checks_test extends \core\tests\plugin_checks_testcase {
+    /**
+     * Verify contents of plugin db/access.php file.
+     *
+     * @dataProvider all_plugins_provider
+     * @coversNothing
+     *
+     * @param string $component
+     * @param string $plugintype
+     * @param string $pluginname
+     * @param string $dir
+     */
+    public function test_db_access_file(string $component, string $plugintype, string $pluginname, string $dir): void {
+        global $CFG;
+
+        $stringmanager = get_string_manager();
+        $corerolefile = "$CFG->dirroot/lang/en/role.php";
+        $langfile = "$dir/lang/en/$component.php";
+
+        $file = "$dir/db/access.php";
+        $capabilities = $this->fetch_array_from_file($file, 'capabilities');
+        if (!$capabilities) {
+            $this->expectNotToPerformAssertions();
+            return;
+        }
+
+        foreach ($capabilities as $capname => $capability) {
+            if ($plugintype === 'qbank' && str_starts_with($capname, 'moodle/question:')) {
+                // Question bank capabilities are irregular.
+                $strname = explode('/', $capname, 2)[1];
+                $this->assertTrue($stringmanager->string_exists($strname, 'core_role'),
+                    "Missing capability name string '$strname' in $corerolefile");
+                continue;
+            }
+            $this->assertMatchesRegularExpression("|^$plugintype/$pluginname:[a-z0-9_]+$|", $capname);
+            $strname = substr($capname, strlen($plugintype) + 1);
+            $this->assertTrue($stringmanager->string_exists($strname, $component),
+                "Missing capability name string '$strname' in $langfile");
+            $this->assertSame($capname, clean_param($capname, PARAM_CAPABILITY));
+        }
+    }
+}

admin/tool/componentlibrary/content/moodle/components/actionmenu.md

@@ -39,7 +39,7 @@ The component output classes can render an action menu entirely in PHP. The step
 
 The following code is a basic example of an action menu:
 
-{{< php >}}
+```php
 /** @var core_renderer $output*/
 $output = $PAGE->get_renderer('core');
 
@@ -54,11 +54,11 @@ $menu->add(new action_menu_link(
 ));
 
 echo $output->render($menu);
-{{< / php >}}
+```
 
 And this is the same example but passing the items in the creation:
 
-{{< php >}}
+```php
 /** @var core_renderer $output*/
 $output = $PAGE->get_renderer('core');
 
@@ -72,32 +72,64 @@ $menu = new action_menu([
 ]);
 
 echo $output->render($menu);
-{{< / php >}}
+```
 
 ### Setup the menu trigger
 
-By default, the action menu trigger is a cog icon. However, the class has methods to convert it to a kebab menu or even display any arbitrary content.
+By default, the action menu trigger is a button that uses the `t/edit_menu` icon and is displayed with a caret. However, the class has methods to convert it to a kebab menu or even display any arbitrary content.
 
-Example of a kebab menu:
+#### Example of a kebab menu
 
-{{< php >}}
+```php
 /** @var core_renderer $output*/
 $output = $PAGE->get_renderer('core');
 
 $menu = new action_menu();
 $menu->set_kebab_trigger(get_string('edit'), $output);
 $menu->set_additional_classes('fields-actions');
-{{< / php >}}
+```
 
-Example of a custom trigger:
+#### Customising the menu trigger
 
-{{< php >}}
-/** @var core_renderer $output*/
-$output = $PAGE->get_renderer('core');
+##### Trigger with a text label
 
+```php
+// This example displays an "Edit" label for the trigger.
 $menu = new action_menu();
 $menu->set_menu_trigger(get_string('edit'));
-{{< / php >}}
+```
+
+##### Trigger with an icon
+
+This example displays an icon for the trigger. When rendering the menu trigger button as an icon button, ensure that the icon is rendered as a decorative image. If you are using a `pix_icon`, pass an empty `$alt` parameter to make the icon decorative.
+
+The accessible name of the icon button should be set within the button element itself. You can set an accessible name for the icon trigger button either by:
+* Using the `::set_action_label()` method.
+```php
+$menu = new action_menu();
+// Make sure the pix icon is rendered as a decorative image by passing an empty alt parameter.
+$icon = $output->pix_icon('t/edit', '');
+$menu->set_menu_trigger($icon);
+$menu->set_action_label(get_string('edit'));
+```
+
+* Or alternatively, by adding a visually hidden text alongside the icon.
+```php
+$menu = new action_menu();
+// Make sure the pix icon is rendered as a decorative image by passing an empty alt parameter.
+$icon = $output->pix_icon('t/edit', '');
+// Add a visually hidden text label for the trigger button.
+$icon .= html_writer::span(get_string('edit'), 'sr-only');
+$menu->set_menu_trigger($icon);
+```
+
+##### Removing the caret symbol
+
+You may also remove the caret symbol by adding a `no-caret` class to the `triggerextraclasses` property.
+
+```php
+$menu->triggerextraclasses = 'no-caret';
+```
 
 ### Add items
 
@@ -108,7 +140,7 @@ Secondary items: are displayed inside the action menu dropdown.
 
 The item location must be configured before adding the element. The following example shows different ways to add primary and secondary menu items.
 
-{{< php >}}
+```php
 // Primary items examples.
 $menu->add(new action_menu_link(
     new moodle_url($PAGE->url),
@@ -134,7 +166,7 @@ $menu->add(new action_menu_link_secondary(
     new pix_icon('t/user', ''),
     'Action link example',
 ));
-{{< / php >}}
+```
 
 ## Types of items
 
@@ -178,7 +210,7 @@ Construct params:
 
 The following example creates a subpanel using a renderable choicelist instance:
 
-{{< php >}}
+```php
 /** @var core_renderer $output*/
 $output = $PAGE->get_renderer('core');
 
@@ -205,7 +237,7 @@ $menu->add(new core\output\local\action_menu\subpanel(
 ));
 
 echo $output->render($menu);
-{{< / php >}}
+```
 
 ### HTML string
 

admin/tool/componentlibrary/examples/actionmenu.php

@@ -77,7 +77,7 @@ echo '<p><strong>Important note:</strong> actions menus are not prepared
     to be displayed inside iframes. You may need to scroll to see the
     action menu options.</p>';
 
-echo $output->heading("Action menu default example", 4);
+echo $output->heading("Action menu default example", 3);
 
 $menu = new action_menu();
 
@@ -87,11 +87,11 @@ $menu->add($subpanel);
 $menu->add($basicactionlink);
 
 echo '<div class="border m-3 p-3 d-flex flex-row">';
-echo '<div class="flex-fill">Example of default an action menu</div><div>';
+echo '<div class="flex-fill">An action menu rendered without customisation</div><div>';
 echo $OUTPUT->render($menu);
 echo '</div></div>';
 
-echo $output->heading("Kebab menu example", 4);
+echo $output->heading("Kebab menu example", 3);
 
 $menu = new action_menu();
 $menu->set_kebab_trigger(get_string('edit'), $output);
@@ -106,11 +106,11 @@ $menu->add(new core\output\local\action_menu\subpanel(
 $menu->add($basicactionlink);
 
 echo '<div class="border m-3 p-3 d-flex flex-row">';
-echo '<div class="flex-fill">Example of kebab menu</div><div>';
+echo '<div class="flex-fill">An action menu with a kebab menu trigger button</div><div>';
 echo $OUTPUT->render($menu);
 echo '</div></div>';
 
-echo $output->heading("Custom trigger menu example", 4);
+echo $output->heading("Custom trigger menu examples", 3);
 
 $menu = new action_menu();
 $menu->set_menu_trigger(get_string('edit'));
@@ -124,11 +124,53 @@ $menu->add(new core\output\local\action_menu\subpanel(
 $menu->add($basicactionlink);
 
 echo '<div class="border m-3 p-3 d-flex flex-row">';
-echo '<div class="flex-fill">Example of kebab menu</div><div>';
+echo '<div class="flex-fill">An action menu with a menu trigger button with a custom text label</div><div>';
 echo $OUTPUT->render($menu);
 echo '</div></div>';
 
-echo $output->heading("Primary actions menu example", 4);
+$links = [
+    $basicactionlink,
+    $basicactionlink,
+];
+$moreicon = $OUTPUT->pix_icon('i/moremenu', '');
+$editicon = $OUTPUT->pix_icon('t/edit', '');
+
+$menu = new action_menu($links);
+
+$menu->set_menu_trigger($moreicon);
+$menu->set_action_label(get_string('moremenu'));
+$menu->triggerattributes = [
+    'title' => get_string('moremenu'),
+];
+
+echo '<div class="border m-3 p-3 d-flex flex-row">';
+echo '<div class="flex-fill">An action menu with only an icon for its custom menu trigger button</div>';
+echo html_writer::div($OUTPUT->render($menu));
+echo '</div>';
+
+echo '<div class="border m-3 p-3 d-flex flex-row">';
+echo '<div class="flex-fill">An action menu with only an icon for its custom menu trigger button with the caret removed</div>';
+$menu->triggerextraclasses = 'no-caret';
+echo html_writer::div($OUTPUT->render($menu));
+echo '</div>';
+
+$menu = new action_menu($links);
+$menu->set_menu_trigger($editicon . ' ' . get_string('edit'));
+
+echo '<div class="border m-3 p-3 d-flex flex-row">';
+echo '<div class="flex-fill">An action menu with an icon and visible text for its custom menu trigger button</div>';
+echo html_writer::div($OUTPUT->render($menu));
+echo '</div>';
+
+$menu = new action_menu($links);
+$menu->set_menu_trigger($editicon . ' ' . html_writer::span(get_string('edit'), 'sr-only'));
+
+echo '<div class="border m-3 p-3 d-flex flex-row">';
+echo '<div class="flex-fill">An action menu with an icon and visually hidden text for its custom menu trigger button</div>';
+echo html_writer::div($OUTPUT->render($menu));
+echo '</div>';
+
+echo $output->heading("Primary actions menu example", 3);
 
 $menu = new action_menu();
 $menu->set_menu_trigger(get_string('edit'));

admin/tool/dataprivacy/classes/expired_contexts_manager.php

@@ -123,6 +123,7 @@ class expired_contexts_manager {
             $expiredcontext = new expired_context(0, $orphan);
             $expiredcontext->delete();
         }
+        $orphaned->close();
 
         // Delete any child of a user context.
         $parentpath = $DB->sql_concat('ctxuser.path', "'/%'");
@@ -143,6 +144,7 @@ class expired_contexts_manager {
             $expiredcontext = new expired_context(0, $child);
             $expiredcontext->delete();
         }
+        $userchildren->close();
     }
 
     /**

admin/tool/dataprivacy/classes/output/data_requests_table.php

@@ -162,7 +162,7 @@ class data_requests_table extends table_sql {
      */
     public function col_userid($data) {
         $user = $data->foruser;
-        return html_writer::link($user->profileurl, $user->fullname, ['title' => get_string('viewprofile')]);
+        return html_writer::link($user->profileurl, $user->fullname);
     }
 
     /**
@@ -183,7 +183,7 @@ class data_requests_table extends table_sql {
      */
     public function col_requestedby($data) {
         $user = $data->requestedbyuser;
-        return html_writer::link($user->profileurl, $user->fullname, ['title' => get_string('viewprofile')]);
+        return html_writer::link($user->profileurl, $user->fullname);
     }
 
     /**

admin/tool/dataprivacy/lang/en/tool_dataprivacy.php

@@ -127,7 +127,6 @@ $string['dporolemapping'] = 'Privacy officer role mapping';
 $string['dporolemapping_desc'] = 'The privacy officer can manage data requests. The capability tool/dataprivacy:managedatarequests must be allowed for a role to be listed as a privacy officer role mapping option.';
 $string['editcategories'] = 'Edit categories';
 $string['editcategory'] = 'Edit category';
-$string['editcategories'] = 'Edit categories';
 $string['editdefaults'] = 'Edit defaults: {$a}';
 $string['editmoduledefaults'] = 'Edit module defaults';
 $string['editpurpose'] = 'Edit purpose';

admin/tool/dataprivacy/templates/my_data_requests.mustache

@@ -138,7 +138,7 @@
               }}>
                 <td>{{typename}}</td>
                 <td>{{#userdate}} {{timecreated}}, {{#str}} strftimedatetime, core_langconfig {{/str}} {{/userdate}}</td>
-                <td><a href="{{requestedbyuser.profileurl}}" title="{{#str}}viewprofile{{/str}}">{{requestedbyuser.fullname}}</a></td>
+                <td><a href="{{requestedbyuser.profileurl}}">{{requestedbyuser.fullname}}</a></td>
                 <td>
                     <span class="badge {{statuslabelclass}}" title="{{statuslabeltitle}}">{{statuslabel}}</span>
                 </td>

admin/tool/dataprivacy/templates/request_details.mustache

@@ -62,7 +62,7 @@
         </div>
         <div class="flex-grow-1 ms-3">
             <h4 class="mt-0 mb-1">
-                <a href="{{foruser.profileurl}}" title="{{#str}}viewprofile{{/str}}">{{foruser.fullname}}</a>
+                <a href="{{foruser.profileurl}}">{{foruser.fullname}}</a>
             </h4>
             <a href="mailto:{{foruser.email}}">{{foruser.email}}</a>
             <div class="clearfix mt-1 mb-1">
@@ -76,7 +76,7 @@
             </span>
             <span class="float-start me-1">
                 <strong>{{#str}}requestbydetail, tool_dataprivacy{{/str}}</strong>
-                <span><a href="{{requestedbyuser.profileurl}}" title="{{#str}}viewprofile{{/str}}">{{requestedbyuser.fullname}}</a></span>
+                <span><a href="{{requestedbyuser.profileurl}}">{{requestedbyuser.fullname}}</a></span>
             </span>
             </div>
             {{#canreview}}

admin/tool/dataprivacy/tests/behat/user_data_request.feature

@@ -0,0 +1,100 @@
+@tool @tool_dataprivacy
+Feature: Authorized users can request others personal data
+  In order to export or access another users data
+  As a designated role
+  I need the correct permissions
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email                |
+      | user1    | User1     | One      | user1@example.com    |
+      | user2    | User2     | Two      | user2@example.com    |
+      | officer1 | Officer1  | One      | officer1@example.com |
+    # Create Privacy Officer Role.
+    And the following "role" exists:
+      | shortname                                    | privacyofficer  |
+      | name                                         | Privacy Officer |
+      | context_system                               | 1               |
+      | tool/dataprivacy:managedataregistry          | allow           |
+      | tool/dataprivacy:managedatarequests          | allow           |
+      | tool/dataprivacy:makedatarequestsforchildren | allow           |
+      | moodle/site:configview                       | allow           |
+      | moodle/category:viewhiddencategories         | allow           |
+      | moodle/course:viewhiddencourses              | allow           |
+      | moodle/course:viewhiddenactivities           | allow           |
+      | moodle/course:view                           | allow           |
+    # Create Parent Role.
+    And the following "role" exists:
+      | shortname                                    | parentrole  |
+      | name                                         | Parent Role |
+      | context_user                                 | 1           |
+      | moodle/user:viewdetails                      | allow       |
+      | moodle/user:viewalldetails                   | allow       |
+      | moodle/user:readuserblogs                    | allow       |
+      | moodle/user:readuserposts                    | allow       |
+      | moodle/user:viewuseractivitiesreport         | allow       |
+      | moodle/user:editprofile                      | allow       |
+      | tool/policy:acceptbehalf                     | allow       |
+      | tool/dataprivacy:makedatarequestsforchildren | allow       |
+    # Add permission to allow parent to make requests on behalf of child user.
+    And the following config values are set as admin:
+      | contactdataprotectionofficer | 1 | tool_dataprivacy |
+    And I log in as "admin"
+
+  @javascript
+  Scenario: Privacy officer can request for other user's personal data
+    Given I navigate to "Users > Permissions > Assign system roles" in site administration
+    # Assign Privacy Officer role to officer1.
+    And I follow "Privacy Officer"
+    And I set the field "addselect_searchtext" to "Officer1"
+    And I set the field "addselect" to "Officer1 One (officer1@example.com)"
+    And I press "Add"
+    # Navigate to home in order to navigate properly to Privacy settings.
+    And I am on site homepage
+    # Select Privacy officer in the Orivacy officer role mapping setting.
+    And I navigate to "Users > Privacy and policies > Privacy settings" in site administration
+    And I click on "Privacy Officer" "checkbox"
+    And I press "Save changes"
+    And I log in as "officer1"
+    And I navigate to "Users > Privacy and policies > Data requests" in site administration
+    # Create a new request as the designated privacy officer.
+    When I follow "New request"
+    And I set the field "User" to "User1 One"
+    And I set the field "Comment" to "User One data"
+    And I press "Save changes"
+    # Confirm that the new data request is successfully created for selected user with status "Awaiting approval".
+    Then the following should exist in the "generaltable" table:
+      | Type   | User      | Requested by | Status            | Message       |
+      | Export | User1 One | Officer1 One | Awaiting approval | User One data |
+
+  @javascript
+  Scenario: Parent user can request data on behalf of child user
+    Given I navigate to "Users > Accounts > Browse list of users" in site administration
+    And I follow "User1 One"
+    And I click on "Preferences" "link" in the ".profile_tree" "css_element"
+    # Assign user2 as parent for user1.
+    And I follow "Assign roles relative to this user"
+    And I follow "Parent"
+    And I set the field "Potential users" to "User2 Two (user2@example.com)"
+    And I click on "Add" "button" in the "#page-content" "css_element"
+    And I log in as "user2"
+    And I follow "Profile" in the user menu
+    And I follow "Data requests"
+    # As parent, create a data request for a child user.
+    And I follow "New request"
+    And I click on "User" "field"
+    When I type "User1 One"
+    # Confirm that only the parent's child users can be searched and selected.
+    Then I should see "User1 One"
+    And I type "User2 Two"
+    And I should see "No suggestions"
+    And I type "Officer1 One"
+    And I should see "No suggestions"
+    And I set the field "Search" to "User1"
+    And I set the field "Comment" to "This is a comment"
+    And I press "Save changes"
+    # Confirm that data request was successfully made by parent on behalf of child user.
+    And I should see "Your request has been submitted to the privacy officer"
+    And the following should exist in the "generaltable" table:
+      | Type                                       | Requested by | Status            | Message           |
+      | Export all of my personal data (User1 One) | User2 Two    | Awaiting approval | This is a comment |

admin/tool/lp/classes/output/manage_competency_frameworks_page.php

@@ -28,6 +28,7 @@ use renderable;
 use templatable;
 use renderer_base;
 use single_button;
+use action_link;
 use stdClass;
 use moodle_url;
 use context;
@@ -65,6 +66,8 @@ class manage_competency_frameworks_page implements renderable, templatable {
      * @param context $pagecontext The page context
      */
     public function __construct(context $pagecontext) {
+        global $OUTPUT;
+
         $this->pagecontext = $pagecontext;
 
         if (competency_framework::can_manage_context($this->pagecontext)) {
@@ -74,10 +77,13 @@ class manage_competency_frameworks_page implements renderable, templatable {
                 'get'
             );
             $this->navigation[] = $addpage;
-            $competenciesrepository = new single_button(
+
+            $icon = $OUTPUT->pix_icon('i/externallink', get_string('opensinnewwindow'), 'moodle', ['class' => 'ms-1']);
+            $competenciesrepository = new action_link(
                 new moodle_url('https://moodle.net/search', ['q' => 'competency frameworks']),
-                get_string('competencyframeworksrepository', 'tool_lp'),
-                'get'
+                get_string('competencyframeworksrepository', 'tool_lp') . $icon,
+                null,
+                ['target' => '_blank', 'class' => 'btn btn-secondary ms-sm-2'],
             );
             $this->navigation[] = $competenciesrepository;
         }

admin/tool/lp/templates/user_summary.mustache

@@ -49,7 +49,7 @@
     }
 }}
 <span>
-    <a href="{{profileurl}}" title="{{#str}}viewprofile{{/str}}">
+    <a href="{{profileurl}}">
     <img height="18" src="{{profileimageurlsmall}}" alt="">
     <span>{{fullname}}</span>
     {{#hasidentity}}

admin/tool/lp/tests/behat/competency_crud.feature

@@ -0,0 +1,77 @@
+@tool @tool_lp @tool_lp_framework
+Feature: Manage CRUD operations for competencies
+  In order to perform CRUD operations on competencies
+  As a manager
+  I need to be able to create, read, update and delete competencies
+
+  Background:
+    Given the following "core_competency > frameworks" exist:
+      | shortname | idnumber |
+      | CF1       | CF1      |
+    And the following "core_competency > competencies" exist:
+      | shortname | competencyframework | idnumber | description    |
+      | C1        | CF1                 | C1ID     | C1 description |
+    And I log in as "admin"
+    And I navigate to "Competencies > Competency frameworks" in site administration
+    And I click on "CF1 (CF1)" "link"
+
+  @javascript
+  Scenario: Create a new competency
+    # Targets the `CF1` element to make `Add competency` button visible and accessible to avoid ambiguity with the other 'CF1' element on the screen.
+    Given I click on "//span[text()='CF1']" "xpath_element"
+    When I press "Add competency"
+    And I set the field "Name" to "C2"
+    And I set the field "Description" to "C2 description"
+    And I set the field "ID number" to "C2ID"
+    And I press "Save changes"
+    # Access the newly created competencies to ensure that correct information was registered.
+    Then "Competency created" "text" should exist
+    And "C2" "text" should appear after "C1" "text"
+    And I select "C2" of the competency tree
+    And "C2ID" "text" should exist
+    And "C2 description" "text" should exist
+
+  @javascript
+  Scenario: Read a competency
+    When I select "C1" of the competency tree
+    # Confirm that selected competency info displayed matches registered info.
+    Then "C1ID" "text" should exist
+    And "C1 description" "text" should exist
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    # Similar to the previous step, to avoid ambiguity with the competency framework "Edit", target css element with data-action=edit.
+    And I click on "[data-action=edit]" "css_element"
+    # Confirm that the details displayed when accessing edit screen values match registered data.
+    And the field "Name" matches value "C1"
+    And the field "Description" matches value "C1 description"
+    And the field "ID number" matches value "C1ID"
+
+  @javascript
+  Scenario: Update a competency
+    Given I select "C1" of the competency tree
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    # Similar to the previous step, to avoid ambiguity with the competency framework "Edit", target css element with data-action=edit.
+    When I click on "[data-action=edit]" "css_element"
+    And I set the field "Name" to "C2"
+    And I set the field "Description" to "C2 description"
+    And I set the field "ID number" to "C2ID"
+    And I press "Save changes"
+    Then "Competency updated" "text" should exist
+    And "C1" "text" should not exist
+    And "C2" "text" should exist
+    And I select "C2" of the competency tree
+    And "C2ID" "text" should exist
+    And "C1ID" "text" should not exist
+    And "C2 description" "text" should exist
+    And "C1 description" "text" should not exist
+
+  @javascript
+  Scenario: Delete a competency
+    Given I select "C1" of the competency tree
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    When I click on "Delete" "link"
+    And I click on "Delete" "button" in the "Confirm" "dialogue"
+    # Confirm that "C1" competency was successfully deleted.
+    Then "C1" "text" should not exist

admin/tool/lp/tests/behat/competency_management.feature

@@ -0,0 +1,63 @@
+@tool @tool_lp @tool_lp_framework
+Feature: Move and cross-reference competencies
+  In order to move and cross-reference competencies
+  As a manager
+  I need to be open the competency's menu items.
+
+  Background:
+    Given the following "core_competency > frameworks" exist:
+      | shortname | idnumber |
+      | CF1       | CF1      |
+    And the following "core_competency > competencies" exist:
+      | shortname | competencyframework |
+      | C1        | CF1                 |
+      | C2        | CF1                 |
+      | C3        | CF1                 |
+      | C4        | CF1                 |
+    And I log in as "admin"
+    And I navigate to "Competencies > Competency frameworks" in site administration
+    And I click on "CF1 (CF1)" "link"
+
+  @javascript
+  Scenario: Move a competency using Move up/Move down menu items
+    Given I select "C1" of the competency tree
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    When I click on "Move down" "link"
+    Then "C1" "text" should appear after "C2" "text"
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    And I click on "Move up" "link"
+    And "C1" "text" should appear before "C2" "text"
+
+  @javascript
+  Scenario: Move a competency using Relocate menu item
+    Given I select "C3" of the competency tree
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    When I click on "Relocate" "link"
+    And I click on "C1" "text" in the "Move competency" "dialogue"
+    And I click on "Move" "button" in the "Move competency" "dialogue"
+    Then "C1" "text" should appear before "C3" "text"
+    And "C3" "text" should appear before "C2" "text"
+    And I select "C3" of the competency tree
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    # Similar to the previous step, to avoid ambiguity with the competency framework "Edit", target css element with data-action=edit.
+    And I click on "[data-action=edit]" "css_element"
+    And "C1" "text" should exist
+    And "No parent (top-level competency)" "text" should not exist
+    And I press "Cancel"
+    And "C1" "text" should appear before "C3" "text"
+    And "C3" "text" should appear before "C2" "text"
+
+  @javascript
+  Scenario: Cross-reference a competency
+    Given I select "C1" of the competency tree
+    # Targets the unique 'Edit' link needed to open the menu, avoiding ambiguity with the other 'Edit' link.
+    And I click on "//a[@href='#' and text()='Edit']" "xpath_element"
+    When I click on "Add cross-referenced competency" "link"
+    And I click on "C2" "text" in the "Competency picker" "dialogue"
+    And I click on "Add" "button" in the "Competency picker" "dialogue"
+    Then "Cross-referenced competencies:" "text" should exist
+    And I should see "C2 cmp2"

admin/tool/lp/tests/behat/course_competencies.feature

@@ -46,11 +46,11 @@ Feature: See the competencies for an activity on the course competencies page.
     When I follow "Competencies"
     Then I should see "Test-Comp1"
     And I should see "Test-Comp2"
-    And I set the field "Filter competencies by resource or activity" to "PageName1"
+    And I set the competency filter "Filter competencies by resource or activity" to "PageName1"
     And I press the enter key
     And I should see "Test-Comp1"
     And I should not see "Test-Comp2"
-    And I set the field "Filter competencies by resource or activity" to "PageName2"
+    And I set the competency filter "Filter competencies by resource or activity" to "PageName2"
     And I press the enter key
     And I should not see "Test-Comp1"
     And I should not see "Test-Comp2"

admin/tool/lp/tests/behat/plan_workflow.feature

@@ -16,16 +16,10 @@ Feature: Manage plan workflow
       | usermanageownplan | User manage own plan role | user |
       | manageplan | Manager all plans role | manager |
     And the following "role capabilities" exist:
-      | role                   | moodle/competency:planmanageowndraft | moodle/competency:planmanageown |
-      | usermanageowndraftplan | allow                                |                                 |
-      | usermanageownplan      | allow                                | allow                           |
-      | manageplan             | allow                                | allow                           |
-    And the following "role capability" exists:
-      | role                                | manageplan |
-      | moodle/competency:planmanage        | allow      |
-      | moodle/competency:planview          | allow      |
-      | moodle/competency:planreview        | allow      |
-      | moodle/competency:planrequestreview | allow      |
+      | role                   | moodle/competency:planmanageowndraft | moodle/competency:planmanageown | moodle/competency:planmanage | moodle/competency:planview | moodle/competency:planreview | moodle/competency:planrequestreview |
+      | usermanageowndraftplan | allow                                |                                 |                              |                            |                              |                                     |
+      | usermanageownplan      | allow                                | allow                           |                              |                            |                              |                                     |
+      | manageplan             | allow                                | allow                           | allow                        | allow                      | allow                        | allow                               |
     And the following "role assigns" exist:
       | user  | role | contextlevel | reference |
       | user1 | usermanageowndraftplan | System |  |
@@ -53,8 +47,7 @@ Feature: Manage plan workflow
       | lp                      | System       | 1         | my-index        | content       |
 
   Scenario: User can manages his own plan draft
-    Given I log in as "user1"
-    And I follow "Profile" in the user menu
+    Given I am on the "user1" "user > profile" page logged in as user1
     When I follow "Learning plans"
     Then I should see "List of learning plans"
     And I should see "Test-Plan1"
@@ -63,11 +56,9 @@ Feature: Manage plan workflow
     And I should see "Waiting for review"
     And I click on "Cancel review" of edit menu in the "Test-Plan1" row
     And I should see "Draft"
-    And I log out
 
   Scenario: User can manages his own plan
-    Given I log in as "user2"
-    And I follow "Profile" in the user menu
+    Given I am on the "user2" "user > profile" page logged in as user2
     When I follow "Learning plans"
     Then I should see "List of learning plans"
     And I should see "Test-Plan2"
@@ -82,11 +73,11 @@ Feature: Manage plan workflow
     And I should see "Active"
     And I click on "Complete this learning plan" of edit menu in the "Test-Plan2" row
     And I click on "Complete this learning plan" "button" in the "Confirm" "dialogue"
+    And I wait until the page is ready
     And I should see "Complete"
     And I click on "Reopen this learning plan" of edit menu in the "Test-Plan2" row
     And I click on "Reopen this learning plan" "button" in the "Confirm" "dialogue"
     And I should see "Active"
-    And I log out
 
   Scenario: Manager can see learning plan with status waiting for review
     Given the following "core_competency > plans" exist:
@@ -96,7 +87,6 @@ Feature: Manage plan workflow
     When I log in as "manager1"
     Then I should see "Test-Plan3"
     And I should not see "Test-Plan4"
-    And I log out
 
   Scenario: Manager can start review of learning plan with status waiting for review
     Given the following "core_competency > plans" exist:
@@ -108,7 +98,6 @@ Feature: Manage plan workflow
     And I should see "Test-Plan3"
     When I follow "Start review"
     Then I should see "In review"
-    And I log out
 
   Scenario: Manager can reject a learning plan with status in review
     Given the following "core_competency > plans" exist:
@@ -121,7 +110,6 @@ Feature: Manage plan workflow
     And I should see "In review"
     When I follow "Finish review"
     Then I should see "Draft"
-    And I log out
 
   Scenario: Manager can accept a learning plan with status in review
     Given the following "core_competency > plans" exist:
@@ -134,7 +122,6 @@ Feature: Manage plan workflow
     And I should see "In review"
     When I follow "Make active"
     Then I should see "Active"
-    And I log out
 
   Scenario: Manager send back to draft an active learning plan
     Given the following "core_competency > plans" exist:
@@ -150,7 +137,6 @@ Feature: Manage plan workflow
     And I follow "Learning plans"
     Then I should see "Draft"
     And I should not see "Active"
-    And I log out
 
   Scenario: Manager change an active learning plan to completed
     Given the following "core_competency > plans" exist:
@@ -169,7 +155,6 @@ Feature: Manage plan workflow
     And I follow "Learning plans"
     Then I should see "Complete"
     And I should not see "Active"
-    And I log out
 
   Scenario: Manager reopen a complete learning plan
     Given the following "core_competency > plans" exist:
@@ -187,4 +172,67 @@ Feature: Manage plan workflow
     And I follow "Learning plans"
     Then I should see "Active"
     And I should not see "Complete"
-    And I log out
+
+  Scenario: Student learning plan derived from templates can be completed
+    Given the following "core_competency > templates" exist:
+      | shortname |
+      | LPT1      |
+    And the following "core_competency > template_competencies" exist:
+      | template | competency |
+      | LPT1     | Test-Comp1 |
+    And I log in as "admin"
+    And I navigate to "Competencies > Learning plan templates" in site administration
+    # Select 1 user to assign to create learning plans for using template.
+    And I click on ".template-userplans" "css_element" in the "LPT1" "table_row"
+    And I set the field "Select users" to "user1"
+    And I press "Create learning plans"
+    And I click on "LPT1" "link" in the "LPT1" "table_row"
+    When I click on "Complete this learning plan" "link"
+    And I click on "Complete this learning plan" "button" in the "Confirm" "dialogue"
+    # Add a short wait to ensure the page has loaded before checking that "Complete" "text" exists.
+    And I wait until the page is ready
+    # Confirm that student's learning plan template is marked as Completed.
+    Then "Complete" "text" should exist
+    And "Reopen this learning plan" "link" should exist
+
+  Scenario: Learning plan template updates are not reflected on plans already completed
+    Given the following "core_competency > templates" exist:
+      | shortname |
+      | LPT1      |
+    And the following "core_competency > template_competencies" exist:
+      | template | competency |
+      | LPT1     | Test-Comp1 |
+    And I log in as "admin"
+    And I navigate to "Competencies > Learning plan templates" in site administration
+    # Select 2 users to assign to create learning plans for using template.
+    And I click on ".template-userplans" "css_element" in the "LPT1" "table_row"
+    And I set the field "Select users" to "user1"
+    And I press "Create learning plans"
+    And I set the field "Select users" to "user2"
+    And I press "Create learning plans"
+    # Complete the learning plan for User 1.
+    And I click on "LPT1" "link" in the "User 1" "table_row"
+    And I click on "Complete this learning plan" "link"
+    And I click on "Complete this learning plan" "button" in the "Confirm" "dialogue"
+    # Add another competency to the learning plan template.
+    And the following "core_competency > template_competencies" exist:
+      | template | competency |
+      | LPT1     | Test-Comp2 |
+    # Navigate back to the list of Learning plan templates in order to access User 1's learning plan.
+    And I navigate to "Competencies > Learning plan templates" in site administration
+    And I click on ".template-userplans" "css_element" in the "LPT1" "table_row"
+    # Confirm that only the first competency is reflected on User 1's learning plan since it's already completed.
+    When I click on "LPT1" "link" in the "User 1" "table_row"
+    Then "Test-Comp2" "link" should not exist
+    And "Test-Comp2" "text" should not exist
+    And "Test-Comp1" "link" should exist
+    And "Test-Comp1" "text" should exist
+    # Navigate back to list of Learning plan templates in order to access User 2's learning plan.
+    And I navigate to "Competencies > Learning plan templates" in site administration
+    And I click on ".template-userplans" "css_element" in the "LPT1" "table_row"
+    # Confirm that both competencies are reflected on User 2's learning plan since it's not yet completed.
+    And I click on "LPT1" "link" in the "User 2" "table_row"
+    And "Test-Comp2" "link" should exist
+    And "Test-Comp2" "text" should exist
+    And "Test-Comp1" "link" should exist
+    And "Test-Comp1" "text" should exist

admin/tool/lp/tests/behat/synchronize_cohorts_lp.feature

@@ -0,0 +1,60 @@
+@tool @tool_lp @core_cohort
+Feature: Cohorts can be synchronized with learning plans
+  In order to create learning plans for cohort members
+  As an admin
+  I need to be able to synchronise cohorts with learning plans
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email             |
+      | user1    | User      | One      | user1@example.com |
+      | user2    | User      | Two      | user2@example.com |
+    And the following "cohorts" exist:
+      | name     | idnumber |
+      | Cohort 1 | CH1      |
+    And the following "cohort members" exist:
+      | user  | cohort |
+      | user1 | CH1    |
+      | user2 | CH1    |
+    And the following "core_competency > frameworks" exist:
+      | shortname | idnumber |
+      | CF1       | CF1      |
+    And the following "core_competency > competencies" exist:
+      | shortname | competencyframework | idnumber |
+      | C1        | CF1                 | C1       |
+    And the following "core_competency > templates" exist:
+      | shortname |
+      | LPT1      |
+    And the following "core_competency > template_competencies" exist:
+      | template | competency |
+      | LPT1     | C1         |
+
+  @javascript
+  Scenario: Cohorts can be synchronised with learning plans
+    Given I log in as "admin"
+    # Navigate to the list of learning plan templates in order to add cohorts.
+    And I navigate to "Competencies > Learning plan templates" in site administration
+    When I click on "Add cohorts to sync" of edit menu in the "LPT1" row
+    And I set the field "Select cohorts to sync" to "Cohort 1"
+    And I press "Add cohorts"
+    And I wait until the page is ready
+    # Confirm that 2 learning plans were created for members of the cohort.
+    Then "2 learning plans were created" "text" should exist
+    # Confirm current screen is still "Cohorts synced to this learning plan template screen"
+    And "Cohorts synced to this learning plan template" "text" should exist
+    # Confirm that the cohort is now added to the learning plan template.
+    And the following should exist in the "generaltable" table:
+      | Name     | Cohort ID |
+      | Cohort 1 | CH1       |
+    # Navigate back to the list of learning plan templates to view updated list.
+    And I navigate to "Competencies > Learning plan templates" in site administration
+    # Confirm that the added cohort and learning plans are now reflected on the list of Learning plan templates.
+    And the following should exist in the "generaltable" table:
+      | Name | Category | Cohorts | Learning plans |
+      | LPT1 | System   | 1       | 2              |
+    And I click on ".template-userplans" "css_element" in the "LPT1" "table_row"
+    # Confirm that learning plans were created for all cohort members.
+    And the following should exist in the "generaltable" table:
+      | Name | First name | Email address     |
+      | LPT1 | User One   | user1@example.com |
+      | LPT1 | User Two   | user2@example.com |

admin/tool/mfa/action.php

@@ -169,6 +169,17 @@ switch ($action) {
         echo $OUTPUT->heading(get_string('managefactor', 'factor_' . $factorobject->name));
         echo $OUTPUT->active_factors($factor);
         echo $OUTPUT->single_button($returnurl, get_string('back'));
+
+        // Displays a setup additional button in case it is needed.
+        if ($factorobject->show_additional_setup_button()) {
+            echo $OUTPUT->single_button(
+                url: new \moodle_url('action.php', ['action' => 'setup', 'factor' => $factor]),
+                label:  $factorobject->get_additional_setup_string(),
+                method: 'post',
+                options: ['type' => 'primary'],
+            );
+        }
+
         // JS for modal confirming replace and revoke actions.
         $PAGE->requires->js_call_amd('tool_mfa/confirmation_modal', 'init', [$context->id]);
 

admin/tool/mfa/classes/local/factor/object_factor_base.php

@@ -421,6 +421,18 @@ abstract class object_factor_base implements object_factor {
         return $this->has_setup();
     }
 
+    /**
+     * Returns true if a button should be shown to add factors of the same kind on the preferences page.
+     * For example, give user's the ability to set up multiple security keys.
+     *
+     * Override in child class if necessary.
+     *
+     * @return bool
+     */
+    public function show_additional_setup_button(): bool {
+        return false;
+    }
+
     /**
      * Returns true if a factor requires input from the user to verify.
      *
@@ -578,6 +590,18 @@ abstract class object_factor_base implements object_factor {
         return get_string('setupfactor', 'tool_mfa');
     }
 
+    /**
+     * Gets the string for additional setup button on preferences page.
+     * If the user has the ability to set up multiple security keys.
+     *
+     * Override in child class if necessary.
+     *
+     * @return string
+     */
+    public function get_additional_setup_string(): string {
+        return get_string('setupfactorbuttonadditional', 'tool_mfa');
+    }
+
     /**
      * Gets the string for manage button on preferences page.
      *

admin/tool/mfa/classes/manager.php

@@ -41,6 +41,18 @@ class manager {
     /** @var int */
     const REDIR_LOOP_THRESHOLD = 5;
 
+    /** @var array These components and related fileareas will not redirect. */
+    const ALLOWED_COMPONENTS = [
+        'core_admin' => [
+            'logocompact',
+            'logo',
+            'favicon',
+        ],
+        'tool_mfa' => [
+            'guidance',
+        ],
+    ];
+
     /**
      * Displays a debug table with current factor information.
      *
@@ -424,6 +436,52 @@ class manager {
             return self::NO_REDIRECT;
         }
 
+        // Ensure we have a moodle_url object if a string is provided.
+        if (is_string($url)) {
+            $url = new \moodle_url($url);
+        }
+
+        // Admin not setup.
+        if (!empty($CFG->adminsetuppending)) {
+            return self::NO_REDIRECT;
+        }
+
+        // Honor prevent_redirect.
+        if ($preventredirect) {
+            return self::NO_REDIRECT;
+        }
+
+        // Login as.
+        if (\core\session\manager::is_loggedinas()) {
+            return self::NO_REDIRECT;
+        }
+
+        // Check for pluginfile.php urls.
+        $pluginfileurl = new \moodle_url('/pluginfile.php');
+        if ($url->compare($pluginfileurl)) {
+            // Get the slash arguments.
+            $args = explode('/', ltrim($url->get_slashargument(), '/'));
+
+            // Remove the contextid because we do not need it for this check.
+            array_shift($args);
+
+            // Get the component and filearea.
+            $component = clean_param(array_shift($args), PARAM_COMPONENT);
+            $filearea = clean_param(array_shift($args), PARAM_AREA);
+
+            // Check allowed components.
+            if (!array_key_exists($component, static::ALLOWED_COMPONENTS)) {
+                return self::REDIRECT;
+            }
+
+            // Check allowed fileareas.
+            if (!in_array($filearea, static::ALLOWED_COMPONENTS[$component])) {
+                return self::REDIRECT;
+            }
+
+            return self::NO_REDIRECT;
+        }
+
         // Remove all params before comparison.
         $url->remove_all_params();
 
@@ -442,39 +500,11 @@ class manager {
             }
         }
 
-        // Dont redirect logo images from pluginfile.php (for example: logo in header).
-        $logourl = new \moodle_url('/pluginfile.php/1/core_admin/logocompact/');
-        if ($url->compare($logourl)) {
-            return self::NO_REDIRECT;
-        }
-
-        // Admin not setup.
-        if (!empty($CFG->adminsetuppending)) {
-            return self::NO_REDIRECT;
-        }
-
-        // Initial installation.
-        // We get this for free from get_plugins_with_function.
-
-        // Upgrade check.
-        // We get this for free from get_plugins_with_function.
-
-        // Honor prevent_redirect.
-        if ($preventredirect) {
-            return self::NO_REDIRECT;
-        }
-
         // User not properly setup.
         if (user_not_fully_set_up($USER)) {
             return self::NO_REDIRECT;
         }
 
-        // Enrolment.
-        $enrol = new \moodle_url('/enrol/index.php');
-        if ($enrol->compare($url, URL_MATCH_BASE)) {
-            return self::NO_REDIRECT;
-        }
-
         // Guest access.
         if (isguestuser()) {
             return self::NO_REDIRECT;
@@ -485,11 +515,6 @@ class manager {
             return self::NO_REDIRECT;
         }
 
-        // Login as.
-        if (\core\session\manager::is_loggedinas()) {
-            return self::NO_REDIRECT;
-        }
-
         // Site policy.
         if (isset($USER->policyagreed) && !$USER->policyagreed) {
             $manager = new \core_privacy\local\sitepolicy\manager();
@@ -499,12 +524,16 @@ class manager {
             }
         }
 
+        // Site policies from tool_policy.
+        $policyviewurl = new \moodle_url('/admin/tool/policy/view.php');
+        $policyindexurl = new \moodle_url('/admin/tool/policy/index.php');
+        if ($policyviewurl->compare($url, URL_MATCH_BASE) || $policyindexurl->compare($url, URL_MATCH_BASE)) {
+            return self::NO_REDIRECT;
+        }
+
         // WS/AJAX check.
+        // Prevents any potential bypassing of multi-factor authentication.
         if (WS_SERVER || AJAX_SCRIPT) {
-            if (isset($SESSION->mfa_pending) && !empty($SESSION->mfa_pending)) {
-                // Allow AJAX and WS, but never from auth.php.
-                return self::NO_REDIRECT;
-            }
             return self::REDIRECT_EXCEPTION;
         }
 

admin/tool/mfa/classes/output/renderer.php

@@ -379,7 +379,7 @@ class renderer extends \plugin_renderer_base {
                         WHERE deleted = 0
                         AND suspended = 0
                     GROUP BY auth";
-        $allusersinfo = $DB->get_records_sql($alluserssql, []);
+        $allusersinfo = $DB->get_records_sql_menu($alluserssql);
 
         $noncompletesql = "SELECT u.auth, COUNT(u.id)
                              FROM {user} u
@@ -388,7 +388,7 @@ class renderer extends \plugin_renderer_base {
                               AND (mfaa.lastverified < ?
                                OR mfaa.lastverified IS NULL)
                          GROUP BY u.auth";
-        $noncompleteinfo = $DB->get_records_sql($noncompletesql, [$lookback, $lookback]);
+        $noncompleteinfo = $DB->get_records_sql_menu($noncompletesql, [$lookback, $lookback]);
 
         $nologinsql = "SELECT auth, COUNT(id)
                          FROM {user}
@@ -396,7 +396,7 @@ class renderer extends \plugin_renderer_base {
                           AND suspended = 0
                           AND lastlogin < ?
                      GROUP BY auth";
-        $nologininfo = $DB->get_records_sql($nologinsql, [$lookback]);
+        $nologininfo = $DB->get_records_sql_menu($nologinsql, [$lookback]);
 
         $mfauserssql = "SELECT auth,
                             COUNT(DISTINCT tm.userid)
@@ -406,7 +406,7 @@ class renderer extends \plugin_renderer_base {
                         AND u.deleted = 0
                         AND u.suspended = 0
                     GROUP BY u.auth";
-        $mfausersinfo = $DB->get_records_sql($mfauserssql, [$lookback]);
+        $mfausersinfo = $DB->get_records_sql_menu($mfauserssql, [$lookback]);
 
         $factorsusedsql = "SELECT CONCAT(u.auth, '_', tm.factor) as id,
                                 COUNT(*)
@@ -417,7 +417,7 @@ class renderer extends \plugin_renderer_base {
                             AND u.suspended = 0
                             AND (tm.revoked = 0 OR (tm.revoked = 1 AND tm.timemodified > ?))
                         GROUP BY CONCAT(u.auth, '_', tm.factor)";
-        $factorsusedinfo = $DB->get_records_sql($factorsusedsql, [$lookback, $lookback]);
+        $factorsusedinfo = $DB->get_records_sql_menu($factorsusedsql, [$lookback, $lookback]);
 
         // Auth rows.
         $authtypes = get_enabled_auth_plugins(true);
@@ -426,10 +426,10 @@ class renderer extends \plugin_renderer_base {
             $row[] = \html_writer::tag('b', $authtype);
 
             // Setup the overall totals columns.
-            $row[] = $allusersinfo[$authtype]->count ?? '-';
-            $row[] = $mfausersinfo[$authtype]->count ?? '-';
-            $row[] = $noncompleteinfo[$authtype]->count ?? '-';
-            $row[] = $nologininfo[$authtype]->count ?? '-';
+            $row[] = $allusersinfo[$authtype] ?? '-';
+            $row[] = $mfausersinfo[$authtype] ?? '-';
+            $row[] = $noncompleteinfo[$authtype] ?? '-';
+            $row[] = $nologininfo[$authtype] ?? '-';
 
             // Create a running counter for the total.
             $authtotal = 0;
@@ -439,7 +439,7 @@ class renderer extends \plugin_renderer_base {
                 if (!empty($column)) {
                     // Get the information from the data key.
                     $key = $authtype . '_' . $column;
-                    $count = $factorsusedinfo[$key]->count ?? 0;
+                    $count = $factorsusedinfo[$key] ?? 0;
                     $authtotal += $count;
 
                     $row[] = $count ? format_float($count, 0) : '-';

admin/tool/mfa/factor/email/classes/output/renderer.php

@@ -41,7 +41,8 @@ class factor_email_renderer extends plugin_renderer_base {
         $authurl = new \moodle_url('/admin/tool/mfa/factor/email/email.php',
             ['instance' => $instance->id, 'pass' => 1, 'secret' => $instance->secret]);
         $authurlstring = \html_writer::link($authurl, get_string('email:link', 'factor_email'));
-        $blockurl = new \moodle_url('/admin/tool/mfa/factor/email/email.php', ['instance' => $instanceid]);
+        $blockurl = new \moodle_url('/admin/tool/mfa/factor/email/email.php',
+            ['instance' => $instance->id, 'secret' => $instance->secret]);
         $blockurlstring = \html_writer::link($blockurl, get_string('email:stoploginlink', 'factor_email'));
         $geoinfo = iplookup_find_location($instance->createdfromip);
 

admin/tool/mfa/factor/email/email.php

@@ -42,7 +42,8 @@ $PAGE->set_cacheable(false);
 $instance = $DB->get_record('tool_mfa', ['id' => $instanceid]);
 $factor = \tool_mfa\plugininfo\factor::get_factor('email');
 
-// If pass is set, require login to force $SESSION and user, and pass for that session.
+// If pass is set, do checks and pass for this session.
+// Require login to force $SESSION and user, and pass for that session.
 if (!empty($instance) && $pass != 0 && $secret != 0) {
     require_login();
     if ($factor->get_state() === \tool_mfa\plugininfo\factor::STATE_LOCKED) {
@@ -69,8 +70,12 @@ $form = new \factor_email\form\email($url);
 
 if ($form->is_cancelled()) {
     redirect(new moodle_url('/'));
-} else if ($fromform = $form->get_data()) {
-    if (empty($instance)) {
+}
+
+// If submitted without the pass param, is a cancel request - do checks and revoke email factor.
+if ($fromform = $form->get_data()) {
+    // Only allow revoke attempts from requests with a valid instance and secret.
+    if (empty($instance) || empty($secret) || $instance->secret != $secret) {
         $message = get_string('error:badcode', 'factor_email');
     } else {
         $user = $DB->get_record('user', ['id' => $instance->userid]);

admin/tool/mfa/factor/email/lang/en/factor_email.php

@@ -33,7 +33,7 @@ $string['email:loginlink'] = 'Or, if you\'re on the same device, use this {$a}.'
 $string['email:message'] = 'Here\'s your verification code for {$a->sitename} ({$a->siteurl}).';
 $string['email:originatingip'] = 'This login request was made from \'{$a}\'';
 $string['email:revokelink'] = 'If this wasn\'t you, you can {$a}.';
-$string['email:revokesuccess'] = 'This code has been successfully revoked. All sessions for {$a} have been ended.
+$string['email:revokesuccess'] = 'This code has been successfully revoked. All sessions for this user have been ended.
     Email will not be usable as a factor until account security has been verified.';
 $string['email:subject'] = 'Here\'s your verification code';
 $string['email:stoploginlink'] = 'stop this login attempt';

admin/tool/mfa/factor/sms/classes/factor.php

@@ -351,7 +351,10 @@ class factor extends object_factor_base {
      * @return bool
      */
     public function show_setup_buttons(): bool {
-        return true;
+        if (get_config('factor_sms', 'smsgateway') > 0) {
+            return true;
+        }
+        return false;
     }
 
     /**

admin/tool/mfa/factor/sms/db/upgrade.php

@@ -76,5 +76,25 @@ function xmldb_factor_sms_upgrade(int $oldversion): bool {
     // Automatically generated Moodle v4.5.0 release upgrade line.
     // Put any upgrade step following this.
 
+    if ($oldversion < 2024100702) {
+        // Ensure default values are applied for the MFA SMS factor when upgrading.
+        $config = get_config('factor_sms');
+
+        // Set the weight to the default value (100) if it is misconfigured (e.g. set to 0).
+        $weight = $config->weight ?? null;
+        if (isset($weight) && (int)$weight <= 0) {
+            set_config('weight', 100, 'factor_sms');
+        }
+
+        // Set the duration to the default value (30 minutes) if it is misconfigured (e.g. set to 0).
+        $duration = $config->duration ?? null;
+        if (isset($duration) && (int)$duration <= 0) {
+            set_config('duration', 30 * MINSECS, 'factor_sms');
+        }
+
+        // MFA savepoint reached.
+        upgrade_plugin_savepoint(true, 2024100702, 'factor', 'sms');
+    }
+
     return true;
 }

admin/tool/mfa/factor/sms/lang/en/factor_sms.php

@@ -55,7 +55,7 @@ $string['settings:gateway_help'] = 'The SMS provider you wish to send messages v
 $string['settings:heading'] = 'Users will receive an SMS with 6-digit code during login, which they must enter to complete the login process.
 
 Users will need to register their mobile phone number first.';
-$string['settings:setupdesc'] = '<br><br>To use SMS as an authentication factor, you first need to <a href="{$a}">set up an SMS gateway</a>.';
+$string['settings:setupdesc'] = 'To use SMS as an authentication factor, you first need to <a href="{$a}">set up an SMS gateway</a>.';
 $string['settings:smsgateway'] = 'SMS gateway';
 $string['settings:smsgateway_help'] = 'Select a gateway from the list, or <a href="{$a}">create a new gateway</a>.';
 $string['setupfactor'] = 'Set up SMS';

admin/tool/mfa/factor/sms/settings.php

@@ -51,70 +51,63 @@ if ($ADMIN->fulltree) {
         ),
     );
 
+    // Get available gateways, or link to gateway creation.
+    $gateways = [0 => new lang_string('none')];
     if (count($gatewayrecords) > 0) {
-        $gateways = [0 => new lang_string('none')];
         foreach ($gatewayrecords as $record) {
             $values = explode('\\', $record->gateway);
             $gatewayname = new lang_string('pluginname', $values[0]);
             $gateways[$record->id] = $record->name . ' (' . $gatewayname . ')';
         }
-
-        $settings->add(
-            new admin_setting_configselect(
-                'factor_sms/smsgateway',
-                new lang_string('settings:smsgateway', 'factor_sms'),
-                new lang_string('settings:smsgateway_help', 'factor_sms', $smsconfigureurl),
-                0,
-                $gateways,
-            ),
-        );
-
-        $enabled = new admin_setting_configcheckbox(
-            'factor_sms/enabled',
-            new lang_string('settings:enablefactor', 'tool_mfa'),
-            new lang_string('settings:enablefactor_help', 'tool_mfa'),
-            0,
-        );
-        $enabled->set_updatedcallback(function () {
-            \tool_mfa\manager::do_factor_action(
-                'sms',
-                get_config('factor_sms', 'enabled') ? 'enable' : 'disable',
-            );
-        });
-        $settings->add($enabled);
-
-        $settings->add(
-            new admin_setting_configtext(
-                'factor_sms/weight',
-                new lang_string('settings:weight', 'tool_mfa'),
-                new lang_string('settings:weight_help', 'tool_mfa'),
-                100,
-                PARAM_INT,
-            ),
-        );
-        $settings->hide_if('factor_sms/weight', 'factor_sms/enabled');
-
-        $settings->add(
-            new admin_setting_configduration(
-                'factor_sms/duration',
-                new lang_string('settings:duration', 'tool_mfa'),
-                new lang_string('settings:duration_help', 'tool_mfa'),
-                30 * MINSECS,
-                MINSECS,
-            ),
-        );
-        $settings->hide_if('factor_sms/duration', 'factor_sms/enabled');
     } else {
-        $settings->add(
-            new admin_setting_description(
-                'factor_sms/setupdesc',
-                '',
-                new lang_string(
-                    'settings:setupdesc',
-                    'factor_sms',
-                    $smsconfigureurl,
-                ),
-            ),
+        $notify = new \core\output\notification(
+            get_string('settings:setupdesc', 'factor_sms', $smsconfigureurl),
+            \core\output\notification::NOTIFY_WARNING
         );
+        $settings->add(new admin_setting_heading('factor_sms/setupdesc', '', $OUTPUT->render($notify)));
     }
+
+    $settings->add(
+        new admin_setting_configselect(
+            'factor_sms/smsgateway',
+            new lang_string('settings:smsgateway', 'factor_sms'),
+            new lang_string('settings:smsgateway_help', 'factor_sms', $smsconfigureurl),
+            0,
+            $gateways,
+        ),
+    );
+
+    $enabled = new admin_setting_configcheckbox(
+        'factor_sms/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'),
+        0,
+    );
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action(
+            'sms',
+            get_config('factor_sms', 'enabled') ? 'enable' : 'disable',
+        );
+    });
+    $settings->add($enabled);
+
+    $settings->add(
+        new admin_setting_configtext(
+            'factor_sms/weight',
+            new lang_string('settings:weight', 'tool_mfa'),
+            new lang_string('settings:weight_help', 'tool_mfa'),
+            100,
+            PARAM_INT,
+        ),
+    );
+
+    $settings->add(
+        new admin_setting_configduration(
+            'factor_sms/duration',
+            new lang_string('settings:duration', 'tool_mfa'),
+            new lang_string('settings:duration_help', 'tool_mfa'),
+            30 * MINSECS,
+            MINSECS,
+        ),
+    );
 }

admin/tool/mfa/factor/sms/version.php

@@ -26,7 +26,7 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version      = 2024100700;      // The current plugin version (Date: YYYYMMDDXX).
+$plugin->version      = 2024100702;      // The current plugin version (Date: YYYYMMDDXX).
 $plugin->requires     = 2024100100;   // Requires this Moodle version.
 $plugin->component    = 'factor_sms';   // Full name of the plugin (used for diagnostics).
 $plugin->maturity     = MATURITY_STABLE;

admin/tool/mfa/factor/totp/lang/en/factor_totp.php

@@ -71,7 +71,7 @@ $string['setupfactor:instructionsverification'] = '3. Enter the verification cod
 $string['setupfactor:intro'] = 'To set up this method, you need to have a device with an authenticator app. If you don\'t have an app, you can download one. For example, <a href="https://2fas.com/" target="_blank">2FAS Auth</a>, <a href="https://freeotp.github.io/" target="_blank">FreeOTP</a>, Google Authenticator, Microsoft Authenticator or Twilio Authy.';
 $string['setupfactor:key'] = 'Secret key: ';
 $string['setupfactor:link'] = 'Or enter details manually.';
-$string['setupfactor:link_help'] = 'If you are on a mobile device and already have an authenticator app installed this link may work. Note that using TOTP on the same device as you login on can weaken the benefits of MFA.';
+$string['setupfactor:link_help'] = 'If you are on a mobile device and already have an authenticator app installed this link may work. Note that using TOTP on the same device as you log in on can weaken the benefits of MFA.';
 $string['setupfactor:linklabel'] = 'Open app already installed on this device';
 $string['setupfactor:mode'] = 'Mode:';
 $string['setupfactor:mode:timebased'] = 'Time-based';

admin/tool/mfa/factor/webauthn/classes/factor.php

@@ -115,6 +115,15 @@ class factor extends object_factor_base {
         return true;
     }
 
+    /**
+     * Returns true if an additional setup button should be shown on the preferences page.
+     *
+     * @return bool
+     */
+    public function show_additional_setup_button(): bool {
+        return true;
+    }
+
     /**
      * WebAuthn factor implementation.
      *
@@ -155,6 +164,15 @@ class factor extends object_factor_base {
         return get_string('setupfactorbutton', 'factor_webauthn');
     }
 
+    /**
+     * Gets the string for additional setup button on preferences page.
+     *
+     * @return string
+     */
+    public function get_additional_setup_string(): string {
+        return get_string('setupfactorbuttonadditional', 'factor_webauthn');
+    }
+
     /**
      * Gets the string for manage button on preferences page.
      *

admin/tool/mfa/factor/webauthn/lang/en/factor_webauthn.php

@@ -51,6 +51,7 @@ $string['settings:userverification'] = 'User verification';
 $string['settings:userverification_help'] = 'Serves to ensure the person authenticating is in fact who they say they are. User verification can take various forms, such as password, PIN, fingerprint, etc.';
 $string['setupfactor'] = 'Set up security key';
 $string['setupfactorbutton'] = 'Set up';
+$string['setupfactorbuttonadditional'] = 'Add security key';
 $string['setupfactor:instructionsregistersecuritykey'] = '2. Register a security key.';
 $string['setupfactor:instructionssecuritykeyname'] = '1. Give your key a name.';
 $string['setupfactor:intro'] = 'A security key is a physical device that you can use to authenticate yourself. Security keys can be USB tokens, Bluetooth devices, or event built-in fingerprint scanners on your phone or computer.';

admin/tool/mfa/guide.php

@@ -29,7 +29,7 @@ require_once(__DIR__ . '/../../../config.php');
 $PAGE->set_context(\context_system::instance());
 $PAGE->set_url(new moodle_url('/admin/tool/mfa/guide.php'));
 $PAGE->set_title(get_string('guidance', 'tool_mfa'));
-$PAGE->set_pagelayout('standard');
+$PAGE->set_pagelayout('secure');
 
 // If guidance page isn't enabled, just redir back to home.
 if (!get_config('tool_mfa', 'guidance')) {

admin/tool/mfa/lang/en/deprecated.txt

@@ -2,4 +2,3 @@ created,tool_mfa
 createdfromip,tool_mfa
 lastverified,tool_mfa
 revoke,tool_mfa
-setup,tool_mfa

admin/tool/mfa/lang/en/tool_mfa.php

@@ -150,7 +150,9 @@ $string['settings:redir_exclusions'] = 'URLS which should not redirect the MFA c
 $string['settings:redir_exclusions_help'] = 'Each new line is a relative URL from the siteroot for which the MFA check will not redirect from';
 $string['settings:weight'] = 'Factor weight';
 $string['settings:weight_help'] = 'The weight of this factor if passed. A user needs at least 100 points to log in.';
+$string['setup'] = 'Setup';
 $string['setupfactor'] = 'Set up factor';
+$string['setupfactorbuttonadditional'] = 'Add additional factor';
 $string['setuprequired'] = 'User setup';
 $string['state:fail'] = 'Fail';
 $string['state:locked'] = 'Locked';
@@ -179,4 +181,3 @@ $string['created'] = 'Created';
 $string['createdfromip'] = 'Created from IP';
 $string['lastverified'] = 'Last verified';
 $string['revoke'] = 'Revoke';
-$string['setup'] = 'Setup';

admin/tool/mfa/lib.php

@@ -126,8 +126,8 @@ function tool_mfa_bulk_user_actions(): array {
 /**
  * Serves any files for the guidance page.
  *
- * @param stdClass $course
- * @param stdClass $cm
+ * @param stdClass|null $course
+ * @param stdClass|null $cm
  * @param context $context
  * @param string $filearea
  * @param array $args
@@ -135,7 +135,7 @@ function tool_mfa_bulk_user_actions(): array {
  * @param array $options
  * @return bool
  */
-function tool_mfa_pluginfile(stdClass $course, stdClass $cm, context $context, string $filearea,
+function tool_mfa_pluginfile(stdClass|null $course, stdClass|null $cm, context $context, string $filearea,
     array $args, bool $forcedownload, array $options = []): bool {
     // Hardcode to only send guidance files from the top level.
     $fs = get_file_storage();

admin/tool/mfa/templates/guide_link.mustache

@@ -23,6 +23,6 @@
     {
     }
 }}
-<a href='{{config.wwwroot}}/admin/tool/mfa/guide.php'>
+<a href='{{config.wwwroot}}/admin/tool/mfa/guide.php' target='_blank'>
     {{#str}} guidance, tool_mfa {{/str}}
 </a>

admin/tool/mfa/tests/behat/tool_mfa_setup_and_manage_user_factors.feature

@@ -32,13 +32,23 @@ Feature: Set up and manage user factors
     And I click on "Cancel" "button"
     And I click on "Manage security key" "button"
     And I should see "Manage security key"
+    And I should see "Add security key"
 
   @javascript
   Scenario: I can revoke a factor only when there is more than one active factor
     Given the following config values are set as admin:
       | enabled | 1 | factor_webauthn |
+    And I navigate to "Plugins > SMS > Manage SMS gateways" in site administration
+    And I follow "Create new SMS gateway"
+    And I set the following fields to these values:
+      | SMS gateway provider | AWS           |
+      | Gateway name         | Dummy gateway |
+      | Access key           | key123        |
+      | Secret access key    | secret456     |
+    And I press "Save changes"
     And the following config values are set as admin:
       | enabled | 1 | factor_sms     |
+      | smsgateway | Dummy gateway (AWS) | factor_sms     |
     And the following "tool_mfa > User factors" exist:
     | username | factor   | label                |
     | admin    | sms      | +409111222           |
@@ -67,3 +77,15 @@ Feature: Set up and manage user factors
     And I click on "Replace" "button" in the "MacBook" "table_row"
     When I click on "Yes, replace" "button" in the "Replace 'MacBook' security key?" "dialogue"
     Then I should see "Replace security key"
+
+  Scenario: I can add a new factor instance on the manage factor page
+    Given the following config values are set as admin:
+      | enabled | 1 | factor_webauthn |
+    And the following "tool_mfa > User factors" exist:
+      | username | factor   | label    |
+      | admin    | webauthn | MacBook  |
+    And I follow "Preferences" in the user menu
+    And I click on "Multi-factor authentication preferences" "link"
+    And I click on "Manage security key" "button"
+    When I click on "Add security key" "button"
+    Then I should see "Set up security key"

admin/tool/mfa/tests/manager_test.php

@@ -241,11 +241,6 @@ final class manager_test extends \advanced_testcase {
         $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($badurl, false));
         $this->setUser($user);
 
-        // Enrolment.
-        $enrolurl = new \moodle_url('/enrol/index.php');
-        $this->assertEquals(\tool_mfa\manager::REDIRECT, \tool_mfa\manager::should_require_mfa($badurl, false));
-        $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($enrolurl, false));
-
         // Guest User.
         $this->assertEquals(\tool_mfa\manager::REDIRECT, \tool_mfa\manager::should_require_mfa($badurl, false));
         $this->setGuestUser();
@@ -266,6 +261,27 @@ final class manager_test extends \advanced_testcase {
         \core\session\manager::loginas($user2->id, $syscontext, false);
         $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($badurl, false));
         $this->setUser($user);
+
+        // Access logocompact via pluginfile.
+        $logourl = new \moodle_url('/pluginfile.php/1/core_admin/logocompact/');
+        $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($logourl, false));
+
+        // Access logo via pluginfile.
+        $logourl = new \moodle_url('/pluginfile.php/1/core_admin/logo/');
+        $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($logourl, false));
+
+        // Access favicon via pluginfile.
+        $logourl = new \moodle_url('/pluginfile.php/1/core_admin/favicon/');
+        $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($logourl, false));
+
+        // Access guidance files.
+        $guideurl = new \moodle_url('/pluginfile.php/1/tool_mfa/guidance/0/capybara.png');
+        $this->assertEquals(\tool_mfa\manager::NO_REDIRECT, \tool_mfa\manager::should_require_mfa($guideurl, false));
+
+        // Access private area.
+        $user3 = $this->getDataGenerator()->create_user();
+        $privateurl = new \moodle_url("/pluginfile.php/{$user3->id}/user/private/privatefile.png");
+        $this->assertEquals(\tool_mfa\manager::REDIRECT, \tool_mfa\manager::should_require_mfa($privateurl, false));
     }
 
     /**

admin/tool/mobile/classes/api.php

@@ -810,7 +810,7 @@ class api {
             $credentials[] = ['type' => 'airnotifieraccesskey', 'value' => $CFG->airnotifieraccesskey];
         }
         if (\core\hub\registration::is_registered()) {
-            $credentials[] = ['type' => 'siteid', 'value' => $CFG->siteidentifier];
+            $credentials[] = ['type' => 'siteid', 'value' => \core\hub\registration::get_secret()];
         }
         // Generate a hash key for validating that the request is coming from this site via WS.
         $key = complex_random_string(32);

admin/tool/mobile/classes/hook_callbacks.php

@@ -17,7 +17,10 @@
 namespace tool_mobile;
 
 use core\session\utility\cookie_helper;
+use core\hook\output\extend_url;
 use html_writer;
+use moodle_url;
+use tool_mobile\local\hooks\before_extend_ios_app_banner;
 
 /**
  * Allows plugins to add any elements to the footer.
@@ -36,22 +39,39 @@ class hook_callbacks {
         \core\hook\output\before_standard_head_html_generation $hook,
     ): void {
         global $CFG, $PAGE;
-        // Smart App Banners meta tag is only displayed if mobile services are enabled and configured.
-        if (!empty($CFG->enablemobilewebservice)) {
-            $mobilesettings = get_config('tool_mobile');
-            if (!empty($mobilesettings->enablesmartappbanners)) {
-                if (!empty($mobilesettings->iosappid)) {
-                    $hook->add_html(
-                        '<meta name="apple-itunes-app" content="app-id=' . s($mobilesettings->iosappid) . ', ' .
-                            'app-argument=' . $PAGE->url->out() . '"/>'
-                    );
-                }
+        // Only emit mobile app metadata when mobile services are enabled + configured.
+        if (empty($CFG->enablemobilewebservice)) {
+            return;
+        }
+        $mobilesettings = get_config('tool_mobile');
+        if (empty($mobilesettings->enablesmartappbanners)) {
+            return;
+        }
+        // IOS with hook-based app id and argument augmentation.
+        if (!empty($mobilesettings->iosappid)) {
+            $appid = (string)$mobilesettings->iosappid;
+            $appargument = $PAGE->url->out();
+            // Hook to allow modification of ios smart app banner fields.
+            $ioshook = new before_extend_ios_app_banner($appid, $appargument);
+            \core\di::get(\core\hook\manager::class)->dispatch($ioshook);
+            $appid = $ioshook->get_appid();
+            $appargument = $ioshook->get_appargument();
+            // Add the meta tag.
+            $hook->add_html(
+                '<meta name="apple-itunes-app" content="app-id=' . s($appid) .
+                ', app-argument=' . s($appargument) . '"/>'
+            );
+        }
 
-                if (!empty($mobilesettings->androidappid)) {
-                    $mobilemanifesturl = "$CFG->wwwroot/$CFG->admin/tool/mobile/mobile.webmanifest.php";
-                    $hook->add_html('<link rel="manifest" href="' . $mobilemanifesturl . '" />');
-                }
-            }
+        // Android with hook-based URL augmentation.
+        if (!empty($mobilesettings->androidappid)) {
+            $url = new moodle_url('/admin/tool/mobile/mobile.webmanifest.php');
+            $urlhook = new extend_url($url);
+            \core\di::get(\core\hook\manager::class)->dispatch($urlhook);
+            $url = $urlhook->get_url();
+
+            // Add the link tag.
+            $hook->add_html('<link rel="manifest" href="' . $url->out(false) . '" />');
         }
     }
 

admin/tool/mobile/classes/local/hooks/before_extend_ios_app_banner.php

@@ -0,0 +1,78 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_mobile\local\hooks;
+
+/**
+ * Allow adjustment of ios smart app banner fields.
+ *
+ * @package    tool_mobile
+ * @copyright  2025 Safat Shahin <safat.shahin@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+#[\core\attribute\label('Allow adjustment of ios smart app banner fields')]
+#[\core\attribute\tags('mobile')]
+final class before_extend_ios_app_banner {
+    /**
+     * Create a new instance of the hook.
+     *
+     * @param string $appid The app id for the ios smart banner
+     * @param string $appargument The app argument for the ios smart banner
+     */
+    public function __construct(
+        /** @var string $appid The app id for the ios smart banner */
+        private string $appid,
+        /** @var string $appargument The app argument for the ios smart banner */
+        private string $appargument,
+    ) {
+    }
+
+    /**
+     * Get the appid.
+     *
+     * @return string
+     */
+    public function get_appid(): string {
+        return $this->appid;
+    }
+
+    /**
+     * Set the appid.
+     *
+     * @param string $appid
+     */
+    public function set_appid(string $appid): void {
+        $this->appid = $appid;
+    }
+
+    /**
+     * Get the appargument.
+     *
+     * @return string
+     */
+    public function get_appargument(): string {
+        return $this->appargument;
+    }
+
+    /**
+     * Set the appargument.
+     *
+     * @param string $appargument
+     */
+    public function set_appargument(string $appargument): void {
+        $this->appargument = $appargument;
+    }
+}

admin/tool/mobile/mobile.webmanifest.php

@@ -28,10 +28,13 @@
  */
 
 define('NO_DEBUG_DISPLAY', true);
+define('NO_MOODLE_COOKIES', true);
 
 require_once(__DIR__ . '/../../../config.php');
 
 header('Content-Type: application/json; charset: utf-8');
+header('Cache-Control: public, max-age=' .  HOURSECS . ', no-transform');
+header('Expires: ' . gmdate('D, d M Y H:i:s', time() + HOURSECS) . ' GMT');
 
 $mobilesettings = get_config('tool_mobile');
 // Display manifest contents only if all the required conditions are met.

admin/tool/moodlenet/lang/en/tool_moodlenet.php

@@ -38,6 +38,9 @@ $string['defaultmoodlenet_desc'] = 'The URL of the MoodleNet instance available
 $string['defaultmoodlenetname'] = "MoodleNet instance name";
 $string['defaultmoodlenetnamevalue'] = 'MoodleNet Central';
 $string['defaultmoodlenetname_desc'] = 'The name of the MoodleNet instance available via the activity chooser.';
+$string['removalwarning_feature'] = 'If you need to continue using MoodleNet, contact your site administrator about setting up a self-hosted MoodleNet instance.';
+$string['removalwarning_service'] = 'After the date, you will no longer be able to browse or add content from MoodleNet Central.';
+$string['removalwarning_title'] = 'The MoodleNet service will be shut down on 20 April 2026.';
 $string['enablemoodlenet'] = 'Enable MoodleNet integration (inbound)';
 $string['enablemoodlenet_desc'] = 'If enabled, a user with the capability to create and manage activities can browse MoodleNet via the activity chooser and import MoodleNet resources into their course. In addition, a user with the capability to restore backups can select a backup file on MoodleNet and restore it into Moodle.';
 $string['errorduringdownload'] = 'An error occurred while downloading the file: {$a}';

admin/tool/moodlenet/templates/chooser_moodlenet.mustache

@@ -27,8 +27,16 @@
     <div class="content text-start mb-5 px-5 py-4" data-region="chooser-option-summary-content-container">
         <div data-region="moodle-net">
             <div class="overlay-icon-container z-index-1 d-none" data-region="spinner"></div>
-            <img class="w-25 mb-4" aria-hidden="true" src="{{{img}}}">
+            <img class="w-25 mb-4" alt="" aria-hidden="true" src="{{{img}}}">
             <p>{{#str}} instancedescription, tool_moodlenet {{/str}}</p>
+
+            {{! Removal warning - always visible when MoodleNet integration is enabled }}
+            <div class="alert alert-warning w-75 mx-auto mb-3" role="alert">
+                <strong>{{#str}}removalwarning_title, tool_moodlenet{{/str}}</strong>
+                <p class="mb-1">{{#str}}removalwarning_service, tool_moodlenet{{/str}}</p>
+                <p class="mb-0">{{#str}}removalwarning_feature, tool_moodlenet{{/str}}</p>
+            </div>
+
             <p class="w-75 mx-auto mb-1 mt-5">{{#str}} connectandbrowse, tool_moodlenet {{/str}}</p>
             <a class="btn btn-secondary d-block w-75 mx-auto mb-4"
                data-action="browse"

admin/tool/oauth2/classes/form/issuer.php

@@ -129,6 +129,7 @@ class issuer extends persistent {
             \core\oauth2\issuer::EVERYWHERE => get_string('issueruseineverywhere', 'tool_oauth2'),
             \core\oauth2\issuer::LOGINONLY => get_string('issueruseinloginonly', 'tool_oauth2'),
             \core\oauth2\issuer::SERVICEONLY => get_string('issueruseininternalonly', 'tool_oauth2'),
+            \core\oauth2\issuer::SMTPWITHXOAUTH2 => get_string('issueruseinsmtpwithoauth', 'tool_oauth2'),
         ];
         $mform->addElement('select', 'showonloginpage', get_string('issuerusein', 'tool_oauth2'), $options);
         $mform->addHelpButton('showonloginpage', 'issuerusein', 'tool_oauth2');
@@ -138,6 +139,13 @@ class issuer extends persistent {
         $mform->addRule('loginpagename', get_string('maximumchars', '', 255), 'maxlength', 255, 'client');
         $mform->addHelpButton('loginpagename', 'issuerloginpagename', 'tool_oauth2');
         $mform->hideIf('loginpagename', 'showonloginpage', 'eq', \core\oauth2\issuer::SERVICEONLY);
+        $mform->hideIf('loginpagename', 'showonloginpage', 'eq', \core\oauth2\issuer::SMTPWITHXOAUTH2);
+
+        // Connected email for XOAUTH2.
+        $mform->addElement('text', 'systememail', get_string('issuersmtpsystememail', 'tool_oauth2'));
+        $mform->setType('systememail', PARAM_EMAIL);
+        $mform->addHelpButton('systememail', 'issuersmtpsystememail', 'tool_oauth2');
+        $mform->hideIf('systememail', 'showonloginpage', 'ne', \core\oauth2\issuer::SMTPWITHXOAUTH2);
 
         // Login scopes.
         $mform->addElement('text', 'loginscopes', get_string('issuerloginscopes', 'tool_oauth2'));

admin/tool/oauth2/classes/output/renderer.php

@@ -86,7 +86,8 @@ class renderer extends plugin_renderer_base {
             $namecell->header = true;
 
             // Login issuer.
-            if ((int)$issuer->get('showonloginpage') == issuer::SERVICEONLY) {
+            if ((int)$issuer->get('showonloginpage') == issuer::SERVICEONLY ||
+                    (int)$issuer->get('showonloginpage') == issuer::SMTPWITHXOAUTH2) {
                 $loginissuer = $this->pix_icon('no', get_string('notloginissuer', 'tool_oauth2'), 'tool_oauth2');
                 $logindisplayas = '';
             } else {

admin/tool/oauth2/lang/en/tool_oauth2.php

@@ -89,13 +89,16 @@ $string['issuershowonloginpage'] = 'Show on login page';
 $string['issuerrequireconfirmation_help'] = 'Require that all users verify their email address before they can log in with OAuth. This applies to newly created accounts as part of the login process, or when an existing Moodle account is connected to an OAuth login via matching email addresses.';
 $string['issuerrequireconfirmation'] = 'Require email verification';
 $string['issuers'] = 'Issuers';
+$string['issuersmtpsystememail'] = 'SMTP email';
+$string['issuersmtpsystememail_help'] = 'If specified, this email will be used to connect a system account for sending email via SMTP. This is required for some OAuth 2 services (e.g. Microsoft). Please check the documentation for your OAuth 2 service to see if this is required.';
 $string['issuersservicesallow'] = 'Allow services';
 $string['issuersservicesnotallow'] = 'Do not allow services';
 $string['issuerusein'] = 'This service will be used';
-$string['issuerusein_help'] = 'OAuth 2 services can be used for internal services, on the login page, or both, if required.';
+$string['issuerusein_help'] = 'OAuth 2 services can be used for internal services, on the login page, SMTP with XOAUTH2, or both login page and internal services, if required.';
 $string['issueruseineverywhere'] = 'Login page and internal services';
 $string['issueruseininternalonly'] = 'Internal services only';
 $string['issueruseinloginonly'] = 'Login page only';
+$string['issueruseinsmtpwithoauth'] = 'SMTP with XOAUTH2 only';
 $string['issuerusedforlogin'] = 'Login';
 $string['issuerusedforinternal'] = 'Internal services';
 $string['linkedin_service'] = 'LinkedIn';

admin/tool/oauth2/tests/behat/basic_settings.feature

@@ -54,13 +54,17 @@ Feature: Basic OAuth2 functionality
     And I should see "Testing service"
     And "Allow login" "icon" should exist in the "Testing service" "table_row"
     And "Allow services" "icon" should exist in the "Testing service" "table_row"
-    And I should see "-" in the "Testing service" "table_row"
+    And "Service discovery successful" "icon" should exist in the "Testing service" "table_row"
     And I click on "Configure endpoints" "link" in the "Testing service" "table_row"
     And I should see "authorization_endpoint"
-    And I should not see "discovery_endpoint"
+    And I should see "discovery_endpoint"
+    And I should see "device_authorization_endpoint"
     And I navigate to "Server > OAuth 2 services" in site administration
     And I click on "Configure user field mappings" "link" in the "Testing service" "table_row"
-    And I should see "firstname" in the "givenName" "table_row"
+    And I should see "firstname" in the "givenname" "table_row"
+    And I should see "idnumber" in the "sub" "table_row"
+    And I should see "email" in the "email" "table_row"
+    And I should see "lang" in the "locale" "table_row"
     And I navigate to "Server > OAuth 2 services" in site administration
     And I click on "Edit" "link" in the "Testing service" "table_row"
     And I set the following fields to these values:

admin/tool/phpunit/cli/init.php

@@ -34,6 +34,10 @@ if (function_exists('opcache_reset')) {
 
 define('IGNORE_COMPONENT_CACHE', true);
 
+// It makes no sense to use BEHAT_CLI for this script (you cannot initialise PHPunit starting from
+// the Behat environment), so in case user has set tne environment variable, disable it.
+putenv('BEHAT_CLI=0');
+
 require_once(__DIR__.'/../../../../lib/clilib.php');
 require_once(__DIR__.'/../../../../lib/phpunit/bootstraplib.php');
 require_once(__DIR__.'/../../../../lib/testing/lib.php');

admin/tool/phpunit/cli/util.php

@@ -30,6 +30,10 @@ if (isset($_SERVER['REMOTE_ADDR'])) {
 
 define('IGNORE_COMPONENT_CACHE', true);
 
+// It makes no sense to use BEHAT_CLI for this script (you cannot initialise PHPunit starting from
+// the Behat environment), so in case user has set tne environment variable, disable it.
+putenv('BEHAT_CLI=0');
+
 require_once(__DIR__.'/../../../../lib/clilib.php');
 require_once(__DIR__.'/../../../../lib/phpunit/bootstraplib.php');
 require_once(__DIR__.'/../../../../lib/testing/lib.php');

admin/tool/policy/classes/api.php

@@ -590,6 +590,7 @@ class api {
             'subdirs' => false,
             'maxfiles' => -1,
             'context' => context_system::instance(),
+            'noclean' => true,
         ];
     }
 
@@ -606,6 +607,7 @@ class api {
             'subdirs' => false,
             'maxfiles' => -1,
             'context' => context_system::instance(),
+            'noclean' => true,
         ];
     }
 

admin/tool/policy/index.php

@@ -58,7 +58,7 @@ $agreedocs = array_values(array_unique($agreedocs));
 $declinedocs = array_values(array_unique($declinedocs));
 
 $PAGE->set_context(context_system::instance());
-$PAGE->set_pagelayout('standard');
+$PAGE->set_pagelayout('secure');
 $PAGE->set_url('/admin/tool/policy/index.php');
 $PAGE->set_popup_notification_allowed(false);
 

admin/tool/policy/lang/en/tool_policy.php

@@ -42,7 +42,7 @@ $string['activate'] = 'Set status to "Active"';
 $string['activating'] = 'Activating a policy';
 $string['activateconfirm'] = '<p>You are about to activate policy <em>\'{$a->name}\'</em> and make the version <em>\'{$a->revision}\'</em> the current one.</p><p>All users will be required to agree to this new policy version to be able to use the site.</p>';
 $string['activateconfirmyes'] = 'Activate';
-$string['agreepolicies'] = 'Please agree to the following policies';
+$string['agreepolicies'] = 'Please agree to the following policies:';
 $string['backtoprevious'] = 'Go back to previous page';
 $string['backtotop'] = 'Back to top';
 $string['cachedef_policy_optional'] = 'Cache of the optional/compulsory flag for policy versions';
@@ -74,8 +74,8 @@ $string['filterplaceholder'] = 'Search keyword or select filter';
 $string['filterpolicy'] = 'Policy: {$a}';
 $string['guestconsent:continue'] = 'Continue';
 $string['guestconsentmessage'] = 'If you continue browsing this website, you agree to our policies:';
-$string['iagree'] = 'I agree to the {$a}';
-$string['idontagree'] = 'No thanks, I decline {$a}';
+$string['iagree'] = 'I agree to the {$a}.';
+$string['idontagree'] = 'I don\'t agree to the {$a}.';
 $string['iagreetothepolicy'] = 'Give consent';
 $string['inactivate'] = 'Set status to "Inactive"';
 $string['inactivating'] = 'Inactivating a policy';
@@ -94,9 +94,9 @@ $string['newpolicy'] = 'New policy';
 $string['newversion'] = 'New version';
 $string['noactivepolicies'] = 'There are no policies with an active version.';
 $string['nofiltersapplied'] = 'No filters applied';
-$string['nopermissiontoagreedocs'] = 'No permission to agree to the policies';
+$string['nopermissiontoagreedocs'] = 'No permission to agree to the policies.';
 $string['nopermissiontoagreedocs_desc'] = 'Sorry, you do not have the required permissions to agree to the policies.<br />You will not be able to use this site until the following policies are agreed:';
-$string['nopermissiontoagreedocsbehalf'] = 'No permission to agree to the policies on behalf of this user';
+$string['nopermissiontoagreedocsbehalf'] = 'No permission to agree to the policies on behalf of this user.';
 $string['nopermissiontoagreedocsbehalf_desc'] = 'Sorry, you do not have the required permission to agree to the following policies on behalf of {$a}:';
 $string['nopermissiontoagreedocscontact'] = 'For more help:';
 $string['nopermissiontoviewpolicyversion'] = 'You do not have permissions to view this policy version.';

admin/tool/policy/tests/behat/acceptances.feature

@@ -34,13 +34,13 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     Then I should see "This site policy"
     And I should not see "Course overview"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
     And I press "Next"
     And I should see "Calendar"
     And I log out
     And I log in as "manager"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
     And I press "Next"
     And I navigate to "Users > Privacy and policies > User agreements" in site administration
     And "Accepted" "text" should exist in the "User One" "table_row"
@@ -53,7 +53,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
       | tool/policy:acceptbehalf | allow   |
     When I log in as "manager"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
     And I press "Next"
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "1 of 4 (25%)" "link" in the "This site policy" "table_row"
@@ -76,7 +76,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
       | tool/policy:acceptbehalf | allow   |
     When I log in as "manager"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
     And I press "Next"
     And I should see "Calendar"
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
@@ -104,16 +104,16 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     And I press "Next"
     And I should see "This privacy policy"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
     And I press "Next"
     And I should see "Calendar"
     And I log out
     And I log in as "manager"
     And I press "Next"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
     And I press "Next"
     And I navigate to "Users > Privacy and policies > User agreements" in site administration
     And "Accepted" "text" should exist in the "User One" "table_row"
@@ -142,8 +142,8 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     When I log in as "manager"
     And I press "Next"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
     And I press "Next"
     And I navigate to "Users > Privacy and policies > User agreements" in site administration
     And I click on "Accept This site policy" "link" in the "User One" "table_row"
@@ -176,8 +176,8 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     When I log in as "manager"
     And I press "Next"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
     And I press "Next"
     And I navigate to "Users > Privacy and policies > User agreements" in site administration
     And I click on "Accept This site policy" "link" in the "User One" "table_row"
@@ -198,7 +198,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
   Scenario: Policies and agreements profile link visible for current user
     Given I log in as "user1"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
     And I press "Next"
     When I follow "Profile" in the user menu
     # User can see his own agreements link in the profile.
@@ -217,7 +217,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
       | tool/policy:acceptbehalf | allow   |
     And I log in as "manager"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
     And I press "Next"
     # User can see agreements link in other user profiles because has the capability for accepting on behalf of them.
     When I am on "Course1" course homepage
@@ -231,7 +231,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
       | tool/policy:acceptbehalf | allow   |
     When I log in as "manager"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
     And I press "Next"
     And I log out
     And I am on the "manager" "user > profile" page logged in as "admin"
@@ -267,8 +267,8 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     When I log in as "manager"
     And I press "Next"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
     And I press "Next"
     And I navigate to "Users > Privacy and policies > User agreements" in site administration
     And I click on "Select" "checkbox" in the "User One" "table_row"
@@ -290,7 +290,7 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     And I should see "This site policy"
     And I should not see "Course overview"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
     And I press "Next"
     And I should see "Calendar"
     And I log out
@@ -304,3 +304,14 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     And I log out
     When I log in as "user1"
     Then I should see "Calendar"
+
+  Scenario: Policy acceptance is prioritised when MFA is enabled
+    Given the following config values are set as admin:
+      | enabled | 1 | tool_mfa |
+    And the following config values are set as admin:
+      | enabled | 1 | factor_email |
+    And I log in as "user1"
+    And I press "Next"
+    And I set the field "I agree to the This site policy" to "1"
+    When I press "Next"
+    Then I should see "2-step verification"

admin/tool/policy/tests/behat/consent.feature

@@ -4,7 +4,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
   As a user
   I need to be able to accept site policy during sign up
 
-  Scenario: Accept policy on sign up, no site policy
+  Scenario: Accept policy on sign up manage by plugin, no site policy
     Given the following config values are set as admin:
       | registerauth    | email |
       | passwordpolicy  | 0     |
@@ -16,13 +16,13 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I set the following fields to these values:
       | Username      | user1                 |
       | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com     |
+      | Email (again) | user1@example.com     |
       | First name    | User1                 |
       | Last name     | L1                    |
     And I press "Create my new account"
     And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
     And I confirm email for "user1"
     And I should see "Thanks, User1 L1"
     And I should see "Your registration has been confirmed"
@@ -50,13 +50,13 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I set the following fields to these values:
       | Username      | user1                 |
       | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
       | First name    | User1                 |
       | Last name     | L1                    |
     And I press "Create my new account"
     And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
     And I confirm email for "user1"
     And I should see "Thanks, User1 L1"
     And I should see "Your registration has been confirmed"
@@ -85,23 +85,23 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should see "short text2"
     And I should see "full text2"
     And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
     And I should see "This site policy" in the "region-main" "region"
     And I should see "short text2"
     And I should not see "full text2"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
     And I press "Next"
     And I should not see "I understand and agree"
     And I set the following fields to these values:
       | Username      | user1                 |
       | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
       | First name    | User1                 |
       | Last name     | L1                    |
     And I press "Create my new account"
     And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
     And I confirm email for "user1"
     And I should see "Thanks, User1 L1"
     And I should see "Your registration has been confirmed"
@@ -137,7 +137,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should see "short text3"
     And I should see "full text3"
     And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
     And I should see "This site policy" in the "region-main" "region"
     And I should see "short text2"
     And I should not see "full text2"
@@ -147,20 +147,20 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should not see "This guests policy" in the "region-main" "region"
     And I should not see "short text4"
     And I should not see "full text4"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
     And I press "Next"
     And I should not see "I understand and agree"
     And I set the following fields to these values:
       | Username      | user1                 |
       | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
       | First name    | User1                 |
       | Last name     | L1                    |
     And I press "Create my new account"
     And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
     And I confirm email for "user1"
     And I should see "Thanks, User1 L1"
     And I should see "Your registration has been confirmed"
@@ -197,23 +197,23 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should see "short text2"
     And I should see "full text2"
     And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
     And I should see "This site policy"
     And I should see "short text2"
     And I should not see "full text2"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
     And I press "Next"
     And I should not see "I understand and agree"
     And I set the following fields to these values:
       | Username      | user1                 |
       | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
       | First name    | User1                 |
       | Last name     | L1                    |
     And I press "Create my new account"
     And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
     And I confirm email for "user1"
     And I should see "Thanks, User1 L1"
     And I should see "Your registration has been confirmed"
@@ -244,19 +244,19 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I press "Next"
     And I should see "This privacy policy"
     And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
     And I should see "This site policy"
     And I should see "This privacy policy"
     # Confirm that a notification is displayed if none of the policies are accepted.
-    When I set the field "I agree to the This site policy" to "0"
-    And I set the field "I agree to the This privacy policy" to "0"
+    When I set the field "I agree to the This site policy." to "0"
+    And I set the field "I agree to the This privacy policy." to "0"
     And I press "Next"
-    Then I should see "Please agree to the following policies"
+    Then I should see "Please agree to the following policies:"
     And I should see "Before continuing you need to acknowledge all these policies."
     # Confirm that a notification is displayed if only some policies are accepted.
-    When I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "0"
-    Then I should see "Please agree to the following policies"
+    When I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "0"
+    Then I should see "Please agree to the following policies:"
     And I should see "Before continuing you need to acknowledge all these policies."
 
   Scenario: Accept policy on login, do not accept all policies
@@ -276,23 +276,20 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I press "Next"
     And I should see "This privacy policy"
     And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
     And I should see "This site policy"
     And I should see "This privacy policy"
     # Confirm that a notification is displayed if none of the policies are accepted.
-    When I set the field "I agree to the This site policy" to "0"
-    And I set the field "I agree to the This privacy policy" to "0"
+    When I set the field "I agree to the This site policy." to "0"
+    And I set the field "I agree to the This privacy policy." to "0"
     And I press "Next"
-    Then I should see "Please agree to the following policies"
+    Then I should see "Please agree to the following policies:"
     And I should see "Before continuing you need to acknowledge all these policies."
     # Confirm that a notification is displayed if only some policies are accepted.
-    When I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "0"
-    Then I should see "Please agree to the following policies"
+    When I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "0"
+    Then I should see "Please agree to the following policies:"
     And I should see "Before continuing you need to acknowledge all these policies."
-    # Confirm that user can not browse the site (edit their profile).
-    When I follow "Profile" in the user menu
-    Then I should see "Please agree to the following policies"
 
   Scenario: Accept policy on login, accept all policies
     Given the following config values are set as admin:
@@ -311,14 +308,14 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I press "Next"
     And I should see "This privacy policy"
     And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
     And I should see "This site policy"
     And I should see "This privacy policy"
     # User accepts all policies.
-    When I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    When I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
     And I press "Next"
-    Then I should not see "Please agree to the following policies"
+    Then I should not see "Please agree to the following policies:"
     And I should not see "Before continuing you need to acknowledge all these policies."
     # Confirm that user can login and browse the site (edit their profile).
     When I open my profile in edit mode
@@ -328,7 +325,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     When I log in as "user1"
     Then I should not see "This site policy"
     And I should not see "This privacy policy"
-    And I should not see "Please agree to the following policies"
+    And I should not see "Please agree to the following policies:"
     # Confirm that user can login and browse the site (edit their profile).
     When I open my profile in edit mode
     Then the field "First name" matches value "User"
@@ -350,14 +347,14 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I press "Next"
     And I should see "This privacy policy"
     And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
     And I should see "This site policy"
     And I should see "This privacy policy"
     # User accepts all policies.
-    When I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    When I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
     And I press "Next"
-    Then I should not see "Please agree to the following policies"
+    Then I should not see "Please agree to the following policies:"
     # Confirm that user can login and browse the site (edit their profile).
     When I open my profile in edit mode
     Then the field "First name" matches value "User"
@@ -385,7 +382,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should not see "This privacy policy"
     Then I should see "This third parties policy"
     And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
     And I should see "This third parties policy"
     And I set the field "This third parties policy" to "1"
     And I press "Next"
@@ -407,12 +404,12 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I log in as "user1"
     And I should see "This site policy"
     And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
     And I should see "This site policy"
     # User accepts policy.
-    When I set the field "I agree to the This site policy" to "1"
+    When I set the field "I agree to the This site policy." to "1"
     And I press "Next"
-    Then I should not see "Please agree to the following policies"
+    Then I should not see "Please agree to the following policies:"
     # Confirm that user can login and browse the site (edit their profile).
     When I open my profile in edit mode
     Then the field "First name" matches value "User"
@@ -437,13 +434,13 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should see "short text2 new version"
     And I should see "full text2 new version"
     When I press "Next"
-    Then I should see "Please agree to the following policies"
+    Then I should see "Please agree to the following policies:"
     And I should see "This site policy new version"
     And I should see "short text2 new version"
     # User accepts policy.
-    And I set the field "I agree to the This site policy new version" to "1"
+    And I set the field "I agree to the This site policy new version." to "1"
     When I press "Next"
-    Then I should not see "Please agree to the following policies"
+    Then I should not see "Please agree to the following policies:"
     # Confirm that user can login and browse the site (edit their profile).
     When I open my profile in edit mode
     Then the field "First name" matches value "User"
@@ -504,28 +501,28 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should see "short text3"
     And I should see "full text3"
     When I press "Next"
-    Then I should see "Please agree to the following policies"
+    Then I should see "Please agree to the following policies:"
     And I should see "This site policy" in the "region-main" "region"
     And I should see "short text2"
     And I should see "This privacy policy" in the "region-main" "region"
     And I should see "short text3"
     And I should not see "This guests policy" in the "region-main" "region"
     And I should not see "short text4"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
     When I press "Next"
     Then I should not see "I understand and agree"
     And I should see "New account"
     And I set the following fields to these values:
       | Username      | user1                 |
       | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
       | First name    | User1                 |
       | Last name     | L1                    |
     When I press "Create my new account"
     Then I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
     And I follow "Log in"
     When I click on "Create new account" "link"
     # Confirm that the user can view and accept policies when attempting to create another account.
@@ -537,7 +534,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should see "short text3"
     And I should see "full text3"
     When I press "Next"
-    Then I should see "Please agree to the following policies"
+    Then I should see "Please agree to the following policies:"
     And I should see "This site policy" in the "region-main" "region"
     And I should see "short text2"
     And I should not see "full text2"
@@ -547,8 +544,8 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should not see "This guests policy" in the "region-main" "region"
     And I should not see "short text4"
     And I should not see "full text4"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
     When I press "Next"
     Then I should not see "I understand and agree"
     And I should see "New account"
@@ -572,8 +569,8 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should see "Please read our This privacy policy"
     And I press "Next"
     And I should see "Viewing this page on behalf of User 1"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
     And I press "Next"
     And I log out
     And I log in as "user1"
@@ -599,15 +596,15 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     When I log in as "manager"
     And I press "Next"
     And I press "Next"
-    And I set the field "I agree to the This site policy" to "1"
-    And I set the field "I agree to the This privacy policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
+    And I set the field "I agree to the This privacy policy." to "1"
     And I press "Next"
     And I am on the "user1" "user > profile" page
     And I follow "Log in as"
     Then I should see "You are logged in as User 1"
     And I press "Continue"
     And I should see "Policies and agreements"
-    And I should see "No permission to agree to the policies on behalf of this user"
+    And I should see "No permission to agree to the policies on behalf of this user."
     And I should see "Sorry, you do not have the required permission to agree to the following policies on behalf of User 1"
 
   Scenario: Accept policy on sign up as a guest, one policy
@@ -631,23 +628,23 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should see "short text2"
     And I should see "full text2"
     And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
     And I should see "This site policy"
     And I should see "short text2"
     And I should not see "full text2"
-    And I set the field "I agree to the This site policy" to "1"
+    And I set the field "I agree to the This site policy." to "1"
     And I press "Next"
     And I should not see "I understand and agree"
     And I set the following fields to these values:
       | Username      | user1                 |
       | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
       | First name    | User1                 |
       | Last name     | L1                    |
     And I press "Create my new account"
     And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
     And I confirm email for "user1"
     And I should see "Thanks, User1 L1"
     And I should see "Your registration has been confirmed"
@@ -680,12 +677,12 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     Then I should see "Digital maturity declaration" in the "region-main" "region"
     And I should see "You declare be old enough"
     And I should see "Here goes content."
-    And I press "I agree to the Digital maturity declaration"
+    And I press "I agree to the Digital maturity declaration."
     # The second policy with the agreement style "on its own page" must be accepted now.
     And I should see "Terms of Service" in the "region-main" "region"
     And I should see "We teach, you learn"
     And I should see "Here goes content."
-    And I press "I agree to the Terms of Service"
+    And I press "I agree to the Terms of Service."
     # Only now we see the remaining consent page policies.
     And I should see "Policy 1 out of 2"
     And I should see "Privacy policy" in the "region-main" "region"
@@ -697,26 +694,26 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should see "We eat cookies, srsly"
     And I should see "Here goes content."
     And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
     And I should see "Privacy policy"
     And I should see "Cookies policy"
     And I should not see "Digital maturity declaration" in the "region-main" "region"
     And I should not see "Terms of Service" in the "region-main" "region"
     And I should not see "Here goes content."
-    And I set the field "I agree to the Privacy policy" to "1"
-    And I set the field "I agree to the Cookies policy" to "1"
+    And I set the field "I agree to the Privacy policy." to "1"
+    And I set the field "I agree to the Cookies policy." to "1"
     And I press "Next"
     And I should see "New account"
     And I set the following fields to these values:
       | Username      | user1                 |
       | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
       | First name    | User1                 |
       | Last name     | L1                    |
     And I press "Create my new account"
     And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
     And I confirm email for "user1"
     And I should see "Thanks, User1 L1"
     And I should see "Your registration has been confirmed"
@@ -751,7 +748,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     Then I should see "Digital maturity declaration" in the "region-main" "region"
     And I should see "You declare be old enough"
     And I should see "Here goes content."
-    And I press "I agree to the Digital maturity declaration"
+    And I press "I agree to the Digital maturity declaration."
     # The second policy with the agreement style "on its own page" must be accepted now.
     And I should see "Terms of Service" in the "region-main" "region"
     And I should see "We teach, you learn"
@@ -762,7 +759,7 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should see "Terms of Service" in the "region-main" "region"
     And I should see "We teach, you learn"
     And I should see "Here goes content."
-    And I press "I agree to the Terms of Service"
+    And I press "I agree to the Terms of Service."
     # Only now we see the remaining consent page policies.
     And I should see "Policy 1 out of 2"
     And I should see "Privacy policy" in the "region-main" "region"
@@ -774,14 +771,14 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     And I should see "We eat cookies, srsly"
     And I should see "Here goes content."
     And I press "Next"
-    And I should see "Please agree to the following policies"
+    And I should see "Please agree to the following policies:"
     And I should see "Privacy policy"
     And I should see "Cookies policy"
     And I should not see "Digital maturity declaration" in the "region-main" "region"
     And I should not see "Terms of Service" in the "region-main" "region"
     And I should not see "Here goes content."
-    And I set the field "I agree to the Privacy policy" to "1"
-    And I set the field "I agree to the Cookies policy" to "1"
+    And I set the field "I agree to the Privacy policy." to "1"
+    And I set the field "I agree to the Cookies policy." to "1"
     And I press "Next"
     And I follow "Profile" in the user menu
     # User can see his own agreements in the profile.
@@ -809,15 +806,15 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     Then I should see "Privacy policy" in the "region-main" "region"
     And I should see "We scan your thoughts"
     And I should see "Here goes content."
-    And I press "I agree to the Privacy policy"
+    And I press "I agree to the Privacy policy."
     And I should see "Digital maturity declaration" in the "region-main" "region"
     And I should see "You declare be old enough"
     And I should see "Here goes content."
-    And I press "I agree to the Digital maturity declaration"
+    And I press "I agree to the Digital maturity declaration."
     And I should see "Terms of Service" in the "region-main" "region"
     And I should see "We teach, you learn"
     And I should see "Here goes content."
-    And I press "I agree to the Terms of Service"
+    And I press "I agree to the Terms of Service."
     And I follow "Profile" in the user menu
     And I follow "Policies and agreements"
     And "Accepted" "text" should exist in the "Privacy policy" "table_row"
@@ -844,21 +841,21 @@ Feature: User must accept policy managed by this plugin when logging in and sign
     Then I should see "Digital maturity declaration" in the "region-main" "region"
     And I should see "You declare be old enough"
     And I should see "Here goes content."
-    And I press "I agree to the Digital maturity declaration"
+    And I press "I agree to the Digital maturity declaration."
     And I should see "Cookies policy" in the "region-main" "region"
     And I should see "We eat cookies, srsly"
-    And I press "I agree to the Cookies policy"
+    And I press "I agree to the Cookies policy."
     And I should see "New account"
     And I set the following fields to these values:
       | Username      | user1                 |
       | Password      | user1                 |
-      | Email address | user1@address.invalid |
-      | Email (again) | user1@address.invalid |
+      | Email address | user1@example.com |
+      | Email (again) | user1@example.com |
       | First name    | User1                 |
       | Last name     | L1                    |
     And I press "Create my new account"
     And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user1@address.invalid"
+    And I should see "An email should have been sent to your address at user1@example.com"
     And I confirm email for "user1"
     And I should see "Thanks, User1 L1"
     And I should see "Your registration has been confirmed"

admin/tool/policy/tests/behat/managepolicies.feature

@@ -61,7 +61,7 @@ Feature: Manage policies
       | Policy1    | v1       | full text2 | short text2 | active   |
     And I log in as "manager"
     And I press "Next"
-    And I set the field "I agree to the Policy1" to "1"
+    And I set the field "I agree to the Policy1." to "1"
     And I press "Next"
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "Edit" "link" in the "Policy1" "table_row"
@@ -83,7 +83,7 @@ Feature: Manage policies
       | Policy1    | v1       | full text2 | short text2 | active   |
     And I log in as "manager"
     And I press "Next"
-    And I set the field "I agree to the Policy1" to "1"
+    And I set the field "I agree to the Policy1." to "1"
     And I press "Next"
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "Edit" "link" in the "Policy1" "table_row"
@@ -101,7 +101,7 @@ Feature: Manage policies
       | Policy1    | v1       | full text2 | short text2 | active   |
     And I log in as "manager"
     And I press "Next"
-    And I set the field "I agree to the Policy1" to "1"
+    And I set the field "I agree to the Policy1." to "1"
     And I press "Next"
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "Edit" "link" in the "Policy1" "table_row"
@@ -180,7 +180,7 @@ Feature: Manage policies
       | Policy1    | v1       | full text2 | short text2 | active   |
     And I log in as "manager"
     And I press "Next"
-    And I set the field "I agree to the Policy1" to "1"
+    And I set the field "I agree to the Policy1." to "1"
     And I press "Next"
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "Set status to \"Inactive\"" "link" in the "Policy1" "table_row"
@@ -218,7 +218,7 @@ Feature: Manage policies
       | Policy1    | v1       | full text2 | short text2 | active   |
     And I log in as "manager"
     And I press "Next"
-    And I set the field "I agree to the Policy1" to "1"
+    And I set the field "I agree to the Policy1." to "1"
     And I press "Next"
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "Set status to \"Inactive\"" "link" in the "Policy1" "table_row"
@@ -247,7 +247,7 @@ Feature: Manage policies
       | Policy1    | v1       | full text2 | short text2 | active   |
     And I log in as "user1"
     And I press "Next"
-    And I set the field "I agree to the Policy1" to "1"
+    And I set the field "I agree to the Policy1." to "1"
     And I press "Next"
     And I follow "Preferences" in the user menu
     And I should see "Preferences"

admin/tool/policy/tests/behat/optional.feature

@@ -70,26 +70,26 @@ Feature: Optional policies
     And I should see "OwnPageCompulsory1" in the "region-main" "region"
     And I should see "short text4" in the "region-main" "region"
     And I should see "full text4" in the "region-main" "region"
-    And I press "I agree to the OwnPageCompulsory1"
+    And I press "I agree to the OwnPageCompulsory1."
     # Compulsory policies displayed on the consent page are shown next and must be agreed.
     And I should see "ConsentPageCompulsory1"
     And I should see "short text3" in the "region-main" "region"
     And I should see "full text3" in the "region-main" "region"
     And I press "Next"
-    And I should see "Please agree to the following policies"
-    And I set the field "I agree to the ConsentPageCompulsory1" to "1"
+    And I should see "Please agree to the following policies:"
+    And I set the field "I agree to the ConsentPageCompulsory1." to "1"
     And I press "Next"
     # The signup form can be submitted and a new account created.
     And I set the following fields to these values:
       | Username      | user3               |
       | Password      | user3                 |
-      | Email address | user3@address.invalid |
-      | Email (again) | user3@address.invalid |
+      | Email address | user3@example.com    |
+      | Email (again) | user3@example.com   |
       | First name    | User3                 |
       | Last name       | L3                    |
     And I press "Create my new account"
     And I should see "Confirm your account"
-    And I should see "An email should have been sent to your address at user3@address.invalid"
+    And I should see "An email should have been sent to your address at user3@example.com"
     And I confirm email for "user3"
     And I should see "Thanks, User3 L3"
     And I should see "Your registration has been confirmed"
@@ -99,7 +99,7 @@ Feature: Optional policies
     Then I should see "OwnPageOptional1"
     And I should see "short text5" in the "region-main" "region"
     And I should see "full text5" in the "region-main" "region"
-    And I press "No thanks, I decline OwnPageOptional1"
+    And I press "I don't agree to the OwnPageOptional1"
     # Then come policies displayed on the consent page.
     And I should see "ConsentPageOptional1" in the "region-main" "region"
     And I should see "short text1" in the "region-main" "region"
@@ -109,9 +109,9 @@ Feature: Optional policies
     And I should see "short text2" in the "region-main" "region"
     And I should see "full text2" in the "region-main" "region"
     And I press "Next"
-    And I should see "Please agree to the following policies"
-    And I set the field "I agree to the ConsentPageOptional1" to "1"
-    And I set the field "No thanks, I decline ConsentPageOptional2" to "0"
+    And I should see "Please agree to the following policies:"
+    And I set the field "I agree to the ConsentPageOptional1." to "1"
+    And I set the field "I don't agree to the ConsentPageOptional2" to "0"
     And I press "Next"
     # Accepted and declined policies are shown in the profile.
     And I follow "Profile" in the user menu
@@ -132,14 +132,14 @@ Feature: Optional policies
     Then I should see "OwnPageOptional1"
     And I should see "short text5" in the "region-main" "region"
     And I should see "full text5" in the "region-main" "region"
-    And I press "I agree to the OwnPageOptional1"
+    And I press "I agree to the OwnPageOptional1."
     # Then come policies displayed on the consent page.
     And I should see "ConsentPageOptional1" in the "region-main" "region"
     And I should see "short text1" in the "region-main" "region"
     And I should see "full text1" in the "region-main" "region"
     And I press "Next"
-    And I should see "Please agree to the following policies"
-    And I set the field "No thanks, I decline ConsentPageOptional1" to "0"
+    And I should see "Please agree to the following policies:"
+    And I set the field "I don't agree to the ConsentPageOptional1" to "0"
     And I press "Next"
     # Accepted and declined policies are shown in the profile.
     And I follow "Profile" in the user menu
@@ -152,7 +152,7 @@ Feature: Optional policies
       | Name                   | Content    | Summary     | Agreementstyle | Optional  |
       | OwnPageOptional1       | full text1 | short text1 | 1              | 1         |
     And I log in as "user1"
-    And I press "I agree to the OwnPageOptional1"
+    And I press "I agree to the OwnPageOptional1."
     And I follow "Profile" in the user menu
     And I follow "Policies and agreements"
     And "Accepted" "text" should exist in the "OwnPageOptional1" "table_row"
@@ -177,7 +177,7 @@ Feature: Optional policies
       | Name                   | Content    | Summary     | Agreementstyle | Optional  |
       | OwnPageOptional1       | full text1 | short text1 | 1              | 1         |
     And I log in as "user1"
-    And I press "I agree to the OwnPageOptional1"
+    And I press "I agree to the OwnPageOptional1."
     And I follow "Profile" in the user menu
     And I follow "Policies and agreements"
     And "Accepted" "text" should exist in the "OwnPageOptional1" "table_row"
@@ -202,12 +202,12 @@ Feature: Optional policies
       | OwnPageOptional1       | full text1 | short text1 | 1              | 1         |
       | OwnPageOptional2       | full text2 | short text2 | 1              | 1         |
     And I log in as "user1"
-    And I press "I agree to the OwnPageOptional1"
-    And I press "No thanks, I decline OwnPageOptional2"
+    And I press "I agree to the OwnPageOptional1."
+    And I press "I don't agree to the OwnPageOptional2"
     And I log out
     And I log in as "manager"
-    And I press "I agree to the OwnPageOptional1"
-    And I press "I agree to the OwnPageOptional2"
+    And I press "I agree to the OwnPageOptional1."
+    And I press "I agree to the OwnPageOptional2."
     When I navigate to "Users > Privacy and policies > User agreements" in site administration
     # User One has accepted just some policies.
     Then "Partially accepted" "text" should exist in the "User One" "table_row"
@@ -228,8 +228,8 @@ Feature: Optional policies
       | OwnPageOptional1       | full text1 | short text1 | 1              | 1         |
       | OwnPageOptional2       | full text2 | short text2 | 1              | 1         |
     And I log in as "user1"
-    And I press "I agree to the OwnPageOptional1"
-    And I press "No thanks, I decline OwnPageOptional2"
+    And I press "I agree to the OwnPageOptional1."
+    And I press "I don't agree to the OwnPageOptional2"
     And I log out
     And I log in as "admin"
     When I navigate to "Users > Privacy and policies > User agreements" in site administration

admin/tool/policy/view.php

@@ -47,7 +47,7 @@ $numpolicy = optional_param('numpolicy', null, PARAM_INT);
 $totalpolicies = optional_param('totalpolicies', null, PARAM_INT);
 
 $PAGE->set_context(context_system::instance());
-$PAGE->set_pagelayout('standard');
+$PAGE->set_pagelayout('secure');
 
 $viewpage = new page_viewdoc($policyid, $versionid, $returnurl, $behalfid, $manage, $numpolicy, $totalpolicies);
 

admin/tool/profiling/index.php

@@ -52,9 +52,9 @@ if ($listurl) {
 }
 
 // Add a new nav item to make $listurl clickable for the Boost theme.
-if (isset($script)) {
-    $lastrunnav = get_string('lastrun', 'tool_profiling');
-    $PAGE->navbar->add($lastrunnav);
+if (isset($script) || isset($runid)) {
+    $detailnav = get_string('detailview', 'tool_profiling');
+    $PAGE->navbar->add($detailnav);
 }
 
 // Header

admin/tool/profiling/lang/en/tool_profiling.php

@@ -31,6 +31,7 @@ $string['cannotfindanyrunforurl'] = 'Sorry, cannot find any profiling run for th
 $string['cannotfindanyrunforrunid'] = 'Sorry, cannot find the \'{$a}\' profiling run';
 $string['comment'] = 'Comment';
 $string['cputime'] = 'CPU time';
+$string['detailview'] = 'Summary of run';
 $string['differencesbetween2runsof'] = 'Differences between 2 runs of {$a}';
 $string['executiontime'] = 'Execution time';
 $string['export'] = 'Export';

admin/tool/recyclebin/classes/course_bin.php

@@ -254,7 +254,7 @@ class course_bin extends base_bin {
         // This hack will be removed once recycle bin switches to use its own backup mode, with
         // own preferences and 100% separate from MOODLE_AUTOMATED.
         // TODO: Remove this as part of MDL-65228.
-        $forcedrestoresettings = $CFG->forced_plugin_settings['restore'] ?? null;
+        $forcedrestoresettings = $CFG->forced_plugin_settings['restore'] ?? [];
         $CFG->forced_plugin_settings['restore']['restore_general_users'] = 1;
         $CFG->forced_plugin_settings['restore']['restore_general_groups'] = 1;
 

admin/tool/task/renderer.php

@@ -274,7 +274,7 @@ class tool_task_renderer extends plugin_renderer_base {
                 $nextruntime = $task->get_next_run_time();
                 $due = $nextruntime < $now;
                 if ($task->get_attempts_available() > 0) {
-                    $nextrun = $due ? userdate($nextruntime) : get_string('asap', 'tool_task');
+                    $nextrun = $due ? get_string('asap', 'tool_task') : userdate($nextruntime);
                 } else {
                     $nextrun = get_string('never', 'admin');
                 }

admin/tool/task/tests/behat/adhoc_tasks.feature

@@ -0,0 +1,23 @@
+@tool @tool_task @javascript
+Feature: Manage adhoc task
+  In order to manage adhoc tasks
+  As an admin
+  I need to be able to view adhoc tasks
+
+  Scenario Outline: View adhoc tasks next run time
+    Given the following "tool_task > adhoc tasks" exist:
+      | classname                            | seconds | hostname     | pid  | nextruntime   |
+      | \core\task\asynchronous_backup_task  | 0       | c69335460f7f | 1915 | <nextruntime> |
+    When I log in as "admin"
+    And I navigate to "Server > Tasks > Ad hoc tasks" in site administration
+    Then the following should exist in the "Ad hoc tasks" table:
+      | Component / Class name   | Next run         |
+      | asynchronous_backup_task | <nextruntimestr> |
+    And I click on "asynchronous_backup_task" "link" in the "Ad hoc tasks" "table"
+    And the following should exist in the "\core\task\asynchronous_backup_task Ad hoc tasks" table:
+      | Next run         |
+      | <nextruntimestr> |
+    Examples:
+      | nextruntime       | nextruntimestr                         |
+      | ##yesterday##     | ASAP                                   |
+      | ##tomorrow noon## | ##tomorrow noon##%A, %d %B %Y, %I:%M## |

admin/tool/task/tests/generator/lib.php

@@ -43,7 +43,7 @@ class tool_task_generator extends testing_module_generator {
         global $DB;
         $conditions = ['classname' => $data['classname']];
         $record = $DB->get_record('task_scheduled', $conditions, '*', MUST_EXIST);
-        $record->timestarted = time() - $data['seconds'];
+        $record->timestarted = $data['seconds'] > 0 ? time() - $data['seconds'] : 0;
         $record->hostname = $data['hostname'];
         $record->pid = $data['pid'];
         $DB->update_record('task_scheduled', $record);
@@ -59,8 +59,8 @@ class tool_task_generator extends testing_module_generator {
         global $DB;
         $adhoctask = (object)[
             'classname' => $data['classname'],
-            'nextruntime' => 0,
-            'timestarted' => time() - $data['seconds'],
+            'nextruntime' => $data['nextruntime'] ?? 0,
+            'timestarted' => $data['seconds'] > 0 ? time() - $data['seconds'] : 0,
             'hostname' => $data['hostname'],
             'pid' => $data['pid'],
         ];

admin/tool/uploadcourse/classes/course.php

@@ -1146,7 +1146,7 @@ class tool_uploadcourse_course {
 
                     // Now update values.
                     // Sort out plugin specific fields.
-                    $modifiedinstance = $plugin->update_enrol_plugin_data($course->id, $method, $instance);
+                    $modifiedinstance = $plugin->update_enrol_plugin_data($course->id, $method, clone $instance);
                     $plugin->update_instance($instance, $modifiedinstance);
                 } else {
                     foreach ($errors as $key => $message) {

admin/tool/uploadcourse/classes/helper.php

@@ -177,12 +177,7 @@ class tool_uploadcourse_helper {
      * @return enrol_plugin[]
      */
     public static function get_enrolment_plugins() {
-        $cache = cache::make('tool_uploadcourse', 'helper');
-        if (($enrol = $cache->get('enrol')) === false) {
-            $enrol = enrol_get_plugins(false);
-            $cache->set('enrol', $enrol);
-        }
-        return $enrol;
+        return enrol_get_plugins(false);
     }
 
     /**

admin/tool/uploadcourse/tests/behat/cohorts.feature

@@ -126,3 +126,19 @@ Feature: An admin can create courses with cohort enrolments using a CSV file
     And I press "Cancel"
     And I click on "Edit" "link" in the "Cohort 4" "table_row"
     And the field "Assign role" matches value "Non-editing teacher"
+
+  @javascript
+  Scenario: Uploading a cohort enrolment method with a non-default role applies only the specified role
+    Given the following "users" exist:
+      | username | firstname | lastname | email          |
+      | t1       | Teacher   | 1        | s1@example.com |
+    And the following "cohort members" exist:
+      | user | cohort |
+      | t1   | CV4    |
+    And I upload "admin/tool/uploadcourse/tests/fixtures/enrolment_cohort_multiple.csv" file to "File" filemanager
+    And I click on "Preview" "button"
+    And I click on "Upload courses" "button"
+    When I am on the "Course 1" "course" page
+    And I navigate to course participants
+    Then I should see "Non-editing teacher" in the "Teacher 1" "table_row"
+    And I should not see "Student" in the "Teacher 1" "table_row"

admin/tool/uploadcourse/tests/behat/enrolments.feature

@@ -25,7 +25,7 @@ Feature: An admin can update courses enrolments using a CSV file
     When I click on "Upload courses" "button"
     Then I should see "Course updated"
     And I am on the "Course 1" "enrolment methods" page
-    And "Disable" "icon" should exist in the "Guest access" "table_row"
+    And "Disable" "link" should exist in the "Guest access" "table_row"
 
   @javascript
   Scenario: Creating enrolment method by disabling it
@@ -42,7 +42,7 @@ Feature: An admin can update courses enrolments using a CSV file
     When I click on "Upload courses" "button"
     Then I should see "Course updated"
     And I am on the "Course 1" "enrolment methods" page
-    And "Enable" "icon" should exist in the "Guest access" "table_row"
+    And "Enable" "link" should exist in the "Guest access" "table_row"
 
   @javascript
   Scenario: Enabling enrolment method
@@ -55,13 +55,13 @@ Feature: An admin can update courses enrolments using a CSV file
     When I click on "Upload courses" "button"
     Then I should see "Course updated"
     And I am on the "Course 1" "enrolment methods" page
-    And "Disable" "icon" should exist in the "Guest access" "table_row"
+    And "Disable" "link" should exist in the "Guest access" "table_row"
 
   @javascript
   Scenario: Disable an enrolment method
     Given I am on the "Course 1" "enrolment methods" page
     And I click on "Enable" "link" in the "Guest access" "table_row"
-    And "Disable" "icon" should exist in the "Guest access" "table_row"
+    And "Disable" "link" should exist in the "Guest access" "table_row"
     And I navigate to "Courses > Upload courses" in site administration
     And I upload "admin/tool/uploadcourse/tests/fixtures/enrolment_disable.csv" file to "File" filemanager
     And I set the field "Upload mode" to "Only update existing courses"
@@ -71,7 +71,7 @@ Feature: An admin can update courses enrolments using a CSV file
     When I click on "Upload courses" "button"
     Then I should see "Course updated"
     And I am on the "Course 1" "enrolment methods" page
-    And "Enable" "icon" should exist in the "Guest access" "table_row"
+    And "Enable" "link" should exist in the "Guest access" "table_row"
 
   @javascript
   Scenario: Delete an enrolment method

admin/tool/uploaduser/classes/process.php

@@ -910,8 +910,8 @@ class process {
                 }
 
                 if ($this->get_bulk() == UU_BULK_UPDATED or $this->get_bulk() == UU_BULK_ALL) {
-                    if (!in_array($user->id, $SESSION->bulk_users)) {
-                        $SESSION->bulk_users[] = $user->id;
+                    if (!array_key_exists($user->id, $SESSION->bulk_users)) {
+                        $SESSION->bulk_users[$user->id] = $user->id;
                     }
                 }
 
@@ -924,8 +924,8 @@ class process {
                 $this->usersuptodate++;
 
                 if ($this->get_bulk() == UU_BULK_ALL) {
-                    if (!in_array($user->id, $SESSION->bulk_users)) {
-                        $SESSION->bulk_users[] = $user->id;
+                    if (!array_key_exists($user->id, $SESSION->bulk_users)) {
+                        $SESSION->bulk_users[$user->id] = $user->id;
                     }
                 }
             }
@@ -1059,8 +1059,8 @@ class process {
             \context_user::instance($user->id);
 
             if ($this->get_bulk() == UU_BULK_NEW or $this->get_bulk() == UU_BULK_ALL) {
-                if (!in_array($user->id, $SESSION->bulk_users)) {
-                    $SESSION->bulk_users[] = $user->id;
+                if (!array_key_exists($user->id, $SESSION->bulk_users)) {
+                    $SESSION->bulk_users[$user->id] = $user->id;
                 }
             }
         }

admin/tool/uploaduser/tests/behat/suspend_user_enrolment.feature

@@ -0,0 +1,41 @@
+@tool @tool_uploaduser @_file_upload
+Feature: Admin can suspend user course enrolment via CSV upload
+  In order to manage enrolments in bulk
+  As an administrator
+  I need to be able to enrol and suspend users using CSV upload
+
+  Background:
+    Given the following "courses" exist:
+      | fullname | shortname |
+      | Course 1 | C1        |
+      | Course 2 | C2        |
+      | Course 3 | C3        |
+
+  @javascript
+  Scenario: Admin uploads enrol and suspend CSVs and verifies enrolment status
+    Given I log in as "admin"
+    And I navigate to "Users > Accounts > Upload users" in site administration
+    When I upload "lib/tests/fixtures/QA_user_enrol.txt" file to "File" filemanager
+    And I press "Upload users"
+    And I press "Upload users"
+    And I press "Continue"
+    And I upload "lib/tests/fixtures/QA_user_suspend.txt" file to "File" filemanager
+    And I press "Upload users"
+    And I set the field "Upload type" to "Update existing users only"
+    And I press "Upload users"
+    And I press "Continue"
+    And I am on the "Course 1" "enrolled users" page
+    Then the following should exist in the "participants" table:
+      | First name  | Status |
+      | Learner One | Active |
+      | Learner Two | Active |
+    And I am on the "Course 2" "enrolled users" page
+    And the following should exist in the "participants" table:
+      | First name  | Status    |
+      | Learner One | Active    |
+      | Learner Two | Suspended |
+    And I am on the "Course 3" "enrolled users" page
+    And the following should exist in the "participants" table:
+      | First name  | Status    |
+      | Learner One | Suspended |
+      | Learner Two | Active    |

admin/tool/usertours/classes/helper.php

@@ -208,12 +208,11 @@ class helper {
      * @return  \moodle_url             The URL.
      */
     public static function get_duplicate_tour_link($tourid) {
-        $link = new \moodle_url('/admin/tool/usertours/configure.php', [
+        return new \moodle_url('/admin/tool/usertours/configure.php', [
             'action'    => manager::ACTION_DUPLICATETOUR,
             'id'        => $tourid,
+            'sesskey'   => sesskey(),
         ]);
-
-        return $link;
     }
 
     /**

admin/tool/usertours/classes/manager.php

@@ -503,8 +503,9 @@ class manager {
      * @param   int         $tourid     The ID of the tour to duplicate.
      */
     protected function duplicate_tour($tourid) {
-        $tour = helper::get_tour($tourid);
+        require_sesskey();
 
+        $tour = helper::get_tour($tourid);
         $export = $tour->to_record();
         // Remove the id.
         unset($export->id);