weekly release 5.0.6+

Only when the submission has been truncated should we show the
"View more" link, otherwise it appears to not do anything for already
short text.

.github/workflows/onebyone.yml

@@ -51,7 +51,7 @@ jobs:
                   chunk=$(((($count % $chunks)) + 1))
                   echo "$testname $testfile" >> ./chunk_$chunk.txt
               done < <(grep "function test_" "${testfile}" | sed -r "s/^.*function (test_[a-zA-Z0-9_]+).*/\1/")
-          done < <(find . -name "*_test.php")
+          done < <(find . -name "*_test.php" -not -path "*/fixtures/*")
           # Generate the matrix to run tests.
           echo "matrix=$(ls -1 chunk_*.txt | jq -R -s -c 'split("\n")[:-1]')" >> $GITHUB_OUTPUT
           echo "$count individual tests collected in $chunks files"

.github/workflows/push.yml

@@ -56,6 +56,14 @@ jobs:
         image: redis
         ports:
           - 6379:6379
+      postgres:
+        image: ${{ matrix.db == 'pgsql' && 'postgres:14' || '' }}
+        env:
+          POSTGRES_DB: test
+          POSTGRES_USER: test
+          POSTGRES_PASSWORD: test
+        ports:
+          - 5432:5432
     strategy:
       fail-fast: false
       matrix:
@@ -71,27 +79,20 @@ jobs:
             db: pgsql
 
     steps:
-      - name: Setting up DB mysql
+      - name: Run MySQL Server
         if: ${{ matrix.db == 'mysqli' }}
-        uses: moodlehq/mysql-action@v1
-        with:
-          collation server: utf8mb4_bin
-          mysql version: 8.4
-          mysql database: test
-          mysql user: test
-          mysql password: test
-          use tmpfs: true
-          tmpfs size: '1024M'
-          extra conf: --skip-log-bin
-
-      - name: Setting up DB pgsql
-        if: ${{ matrix.db == 'pgsql' }}
-        uses: m4nu56/postgresql-action@v1
-        with:
-          postgresql version: 14
-          postgresql db: test
-          postgresql user: test
-          postgresql password: test
+        run: |
+          docker run --rm \
+            -e MYSQL_DATABASE=test \
+            -e MYSQL_USER=test \
+            -e MYSQL_PASSWORD=test \
+            -e MYSQL_ROOT_PASSWORD=test \
+            -p 3306:3306 \
+            -d \
+            --tmpfs /var/lib/mysql:rw,noexec,nosuid,size=1024M \
+            mysql:8.4 \
+              --skip-log-bin \
+              --collation-server=utf8mb4_bin
 
       - name: Configuring git vars
         uses: rlespinasse/github-slug-action@v4

.grunt/notes/src/create.mjs

@@ -18,7 +18,7 @@ import inquirer from 'inquirer';
 import chalk from 'chalk';
 
 import { createNote } from './note.mjs';
-import { getInitialValues } from './helpers.mjs';
+import { getInitialValues, getIssueNumberFromBranchName } from './helpers.mjs';
 import * as Prompts from './prompts.mjs';
 import logger from './logger.mjs';
 
@@ -29,7 +29,7 @@ export default async (options) => {
     // Fetch information.
     const messages = [];
     const { issueNumber } = await inquirer.prompt([
-        Prompts.getIssuePrompt(),
+        Prompts.getIssuePrompt(getIssueNumberFromBranchName()),
     ], initialValues);
 
     let selection = {};

.grunt/notes/src/helpers.mjs

@@ -14,6 +14,7 @@
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
 import chalk from 'chalk';
+import branchName from 'current-git-branch';
 import { isStandardComponent, isCommunityComponent, rewritePlugintypeAsSubsystem } from './components.mjs';
 import { isValidNoteName } from './noteTypes.mjs';
 import logger from './logger.mjs';
@@ -59,6 +60,19 @@ export const formatIssueNumber = (input) => {
     return input;
 };
 
+/**
+ * Get the issue number, based off current git branch name
+ *
+ * @returns {string|null}
+ */
+export const getIssueNumberFromBranchName = () => {
+    const issueNumber = String(branchName()).match(/^[a-zA-Z]*-\d+/);
+    if (issueNumber) {
+        return formatIssueNumber(issueNumber[0]);
+    }
+    return null;
+};
+
 /**
  * Validate a component.
  *

.grunt/tasks/watch.js

@@ -49,6 +49,10 @@ module.exports = grunt => {
 
                     // Spawn the task in a child process so that it doesn't kill this one
                     // if it failed.
+                    var args = [task, filesOption];
+                    if (grunt.option('force')) {
+                        args.push('--force');
+                    }
                     grunt.util.spawn(
                         {
                             // Spawn with the grunt bin.
@@ -58,7 +62,7 @@ module.exports = grunt => {
                                 cwd: grunt.moodleEnv.fullRunDir,
                                 stdio: 'inherit'
                             },
-                            args: [task, filesOption]
+                            args: args
                         },
                         function(err, res, code) {
                             if (code !== 0) {

.upgradenotes/MDL-51152-2026010707012914.yml

@@ -0,0 +1,7 @@
+issueNumber: MDL-51152
+notes:
+  enrol_manual:
+    - message: >-
+        The unused parameter 'roleid' has been removed from the external
+        function `unenrol_users()`
+      type: removed

.upgradenotes/MDL-75067-2026030210543707.yml

@@ -0,0 +1,8 @@
+issueNumber: MDL-75067
+notes:
+  tool_behat:
+    - message: >-
+        The `behat_session_trait::ensure_element_[does_not_]exists(...)` methods
+        now accept optional `$container` parameter to define the parent node to
+        look within
+      type: improved

.upgradenotes/MDL-85322-2026012001565471.yml

@@ -0,0 +1,8 @@
+issueNumber: MDL-85322
+notes:
+  block_html:
+    - message: >-
+        Treat Dashboard (pagetype 'my-index') as trusted in web services so
+        get_content_for_external preserves embedded HTML (e.g. iframes) on user
+        Dashboard.
+      type: changed

.upgradenotes/MDL-86524-2025120211115999.yml

@@ -0,0 +1,12 @@
+issueNumber: MDL-86524
+notes:
+  core_question:
+    - message: >-
+        During restore of a question_set_reference, mapping of IDs in the
+        filtercondition is now delegated to qbank plugins.
+        If your qbank plugin defines a filter condition that uses database
+        IDs, add an override of `restore_filtercondition()` to the `condition`
+        class, which checks the condition's data and replaces the IDs with
+        mapped values if required. See 
+        `qbank_managecategories\category_condition` for an example.
+      type: improved

.upgradenotes/MDL-86839-2026031306053508.yml

@@ -0,0 +1,10 @@
+issueNumber: MDL-86839
+notes:
+  core:
+    - message: >
+        "grunt watch" now accepts a force flag. Run "grunt watch -f" or "grunt
+        watch --force" to prevent grunt from cancelling builds when errors
+        occur. This is especially useful during development, because js build
+        files will be built even if, for example, jslint errors are still
+        present in the files.
+      type: improved

.upgradenotes/MDL-87100-2025110410180882.yml

@@ -0,0 +1,7 @@
+issueNumber: MDL-87100
+notes:
+  core:
+    - message: >-
+        When creating upgrade notes, the issue number will be inferred from the
+        current Git branch name by default
+      type: improved

.upgradenotes/MDL-87443-2025121117305654.yml

@@ -0,0 +1,7 @@
+issueNumber: MDL-87443
+notes:
+  core:
+    - message: >-
+        There is a new Behat `toast_message` named selector to more easily
+        assert the presence of Toast messages on the page
+      type: improved

.upgradenotes/MDL-87795-2026021809474024.yml

@@ -0,0 +1,7 @@
+issueNumber: MDL-87795
+notes:
+  core_user:
+    - message: >-
+        Added new optional parameter `userid` to the `user_remove_user_device`
+        function.
+      type: improved

.upgradenotes/MDL-87993-2026022007035360.yml

@@ -0,0 +1,8 @@
+issueNumber: MDL-87993
+notes:
+  core:
+    - message: >-
+        The `core/toast` JS module now accepts a `visuallyHidden` configuration
+        parameter to render visually hidden toast messages for screen reader
+        users.
+      type: improved

README.md

@@ -32,7 +32,7 @@ Moodle also offers hosting through both [MoodleCloud][11], and our [partner netw
 
 ## License
 
-Moodle is provided freely as open source software, under version 3 of the GNU General Public License. For more information on our license see
+Moodle is provided freely as open source software, under version 3 of the GNU General Public License. See our [license page][12] for more information.
 
 [1]: https://moodle.org
 [2]: https://moodle.com

UPGRADING.md

@@ -6,6 +6,84 @@ More detailed information on key changes can be found in the [Developer update n
 
 The format of this change log follows the advice given at [Keep a CHANGELOG](https://keepachangelog.com).
 
+## 5.0.6+
+
+### core
+
+#### Added
+
+- "grunt watch" now accepts a force flag. Run "grunt watch -f" or "grunt watch --force" to prevent grunt from cancelling builds when errors occur. This is especially useful during development, because js build files will be built even if, for example, jslint errors are still present in the files.
+
+  For more information see [MDL-86839](https://tracker.moodle.org/browse/MDL-86839)
+- When creating upgrade notes, the issue number will be inferred from the current Git branch name by default
+
+  For more information see [MDL-87100](https://tracker.moodle.org/browse/MDL-87100)
+- There is a new Behat `toast_message` named selector to more easily assert the presence of Toast messages on the page
+
+  For more information see [MDL-87443](https://tracker.moodle.org/browse/MDL-87443)
+- The `core/toast` JS module now accepts a `visuallyHidden` configuration parameter to render visually hidden toast messages for screen reader users.
+
+  For more information see [MDL-87993](https://tracker.moodle.org/browse/MDL-87993)
+
+### core_question
+
+#### Added
+
+- During restore of a question_set_reference, mapping of IDs in the filtercondition is now delegated to qbank plugins. If your qbank plugin defines a filter condition that uses database IDs, add an override of `restore_filtercondition()` to the `condition` class, which checks the condition's data and replaces the IDs with mapped values if required. See  `qbank_managecategories\category_condition` for an example.
+
+  For more information see [MDL-86524](https://tracker.moodle.org/browse/MDL-86524)
+
+### core_user
+
+#### Added
+
+- Added new optional parameter `userid` to the `user_remove_user_device` function.
+
+  For more information see [MDL-87795](https://tracker.moodle.org/browse/MDL-87795)
+
+### block_html
+
+#### Changed
+
+- Treat Dashboard (pagetype 'my-index') as trusted in web services so get_content_for_external preserves embedded HTML (e.g. iframes) on user Dashboard.
+
+  For more information see [MDL-85322](https://tracker.moodle.org/browse/MDL-85322)
+
+### enrol_manual
+
+#### Removed
+
+- The unused parameter 'roleid' has been removed from the external function `unenrol_users()`
+
+  For more information see [MDL-51152](https://tracker.moodle.org/browse/MDL-51152)
+
+### tool_behat
+
+#### Added
+
+- The `behat_session_trait::ensure_element_[does_not_]exists(...)` methods now accept optional `$container` parameter to define the parent node to look within
+
+  For more information see [MDL-75067](https://tracker.moodle.org/browse/MDL-75067)
+
+## 5.0.5
+
+### core
+
+#### Changed
+
+- `\core\output\core_renderer::confirm()`'s `$displayoptions` parameter now also accepts a `headinglevel` option that developers can use to specify the heading level of the confirmation's heading. If not specified, the confirmation heading will be rendered in an `h4` tag.
+
+  For more information see [MDL-87694](https://tracker.moodle.org/browse/MDL-87694)
+
+### core_question
+
+#### Fixed
+
+- In order to prevent re-use of question version numbers after a version is deleted, the `nextversion` column was added to `question_bank_entries`. This serves as a counter incremented each time a version is created.
+  Do not query this field directly. Instead use `core_question\versions::get_next_version()` to read the value, which will initialise it based on the existing versions if it is not set yet. By default, it will increment the version number automatically, unless you pass `increment: false`. Because of this, it is advisable to call it inside a transaction, that is only committed after the version number is used in a `question_versions` record.
+
+  For more information see [MDL-86798](https://tracker.moodle.org/browse/MDL-86798)
+
 ## 5.0.4
 
 ### core

admin/category.php

@@ -119,8 +119,8 @@ foreach ($settingspage->children as $childpage) {
                 $outputhtml .= html_writer::tag('div', '<!-- -->', array('class' => 'clearer'));
                 $outputhtml .= $setting->output_html($data);
                 if ($childpage->has_dependencies()) {
-                    $opts = ['dependencies' => $childpage->get_dependencies_for_javascript()];
-                    $PAGE->requires->js_call_amd('core/showhidesettings', 'init', [$opts]);
+                    $context = ['dependencies' => json_encode($childpage->get_dependencies_for_javascript())];
+                    echo $OUTPUT->render_from_template('core_admin/settings_showhide', $context);
                 }
             }
             $outputhtml .= html_writer::end_tag('fieldset');

admin/classes/admin/admin_setting_notification.php

@@ -0,0 +1,74 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace core_admin\admin;
+
+use admin_setting;
+
+/**
+ * Render a notification as part of other admin settings.
+ *
+ * @package    core_admin
+ * @subpackage admin
+ * @copyright  2025 Matt Porritt <matt.porritt@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class admin_setting_notification extends admin_setting {
+    /**
+     * Constructor.
+     *
+     * @param string $name The name of the setting.
+     * @param string $notification The notification to display.
+     * @param string $type The type of notification.
+     * @param bool $cancelable Whether the notification can be canceled.
+     */
+    public function __construct(
+        string $name,
+        /** @var string The notification to display. */
+        protected string $notification,
+        /** @var string The type of notification. */
+        protected string $type = 'info',
+        /** @var bool Whether the notification can be canceled. */
+        protected bool $cancelable = false
+    ) {
+        $this->nosave = true;
+
+        parent::__construct($name, '', '', '');
+    }
+
+    #[\Override]
+    public function get_setting(): bool {
+        return true;
+    }
+
+    #[\Override]
+    public function get_defaultsetting(): bool {
+        return true;
+    }
+
+    #[\Override]
+    public function write_setting($data): string {
+        // Do not write any setting.
+        return '';
+    }
+
+    #[\Override]
+    public function output_html($data, $query = ''): string {
+        global $OUTPUT;
+
+        return $OUTPUT->notification($this->notification, $this->type, $this->cancelable);
+    }
+}

admin/cli/scheduled_task.php

@@ -125,11 +125,6 @@ if ($options['list']) {
     exit(0);
 }
 
-if (moodle_needs_upgrading()) {
-    mtrace("Moodle upgrade pending, cannot manage tasks.");
-    exit(1);
-}
-
 if ($disable = $options['disable']) {
     if (!$task = \core\task\manager::get_scheduled_task($disable)) {
         mtrace("Task '$disable' not found");
@@ -157,6 +152,11 @@ if ($disable = $options['disable']) {
         exit(1);
     }
 } else if ($execute = $options['execute']) {
+    if (moodle_needs_upgrading()) {
+        mtrace("Moodle upgrade pending, cannot execute tasks.");
+        exit(1);
+    }
+
     if (!$task = \core\task\manager::get_scheduled_task($execute)) {
         mtrace("Task '$execute' not found");
         exit(1);

admin/index.php

@@ -941,9 +941,27 @@ admin_externalpage_setup('adminnotifications');
 
 $output = $PAGE->get_renderer('core', 'admin');
 
-echo $output->admin_notifications_page($maturity, $insecuredataroot, $errorsdisplayed, $cronoverdue, $dbproblems,
-                                       $maintenancemode, $availableupdates, $availableupdatesfetch, $buggyiconvnomb,
-                                       $registered, $cachewarnings, $eventshandlers, $themedesignermode, $devlibdir,
-                                       $mobileconfigured, $overridetossl, $invalidforgottenpasswordurl, $croninfrequent,
-                                       $showcampaigncontent, $showfeedbackencouragement, $servicesandsupportcontent,
-                                       $xmlrpcwarning);
+echo $output->admin_notifications_page(
+    $maturity,
+    $insecuredataroot,
+    $errorsdisplayed,
+    $cronoverdue,
+    $dbproblems,
+    $maintenancemode,
+    $availableupdates,
+    $availableupdatesfetch,
+    $buggyiconvnomb,
+    $registered,
+    $cachewarnings,
+    $eventshandlers,
+    $themedesignermode,
+    $devlibdir,
+    $mobileconfigured,
+    $overridetossl,
+    $invalidforgottenpasswordurl,
+    $croninfrequent,
+    $showcampaigncontent,
+    $showfeedbackencouragement,
+    $servicesandsupportcontent,
+    $xmlrpcwarning
+);

admin/renderer.php

@@ -282,13 +282,30 @@ class core_admin_renderer extends plugin_renderer_base {
      *
      * @return string HTML to output.
      */
-    public function admin_notifications_page($maturity, $insecuredataroot, $errorsdisplayed,
-            $cronoverdue, $dbproblems, $maintenancemode, $availableupdates, $availableupdatesfetch,
-            $buggyiconvnomb, $registered, array $cachewarnings = array(), $eventshandlers = 0,
-            $themedesignermode = false, $devlibdir = false, $mobileconfigured = false,
-            $overridetossl = false, $invalidforgottenpasswordurl = false, $croninfrequent = false,
-            $showcampaigncontent = false, bool $showfeedbackencouragement = false, bool $showservicesandsupport = false,
-            $xmlrpcwarning = '') {
+    public function admin_notifications_page(
+        $maturity,
+        $insecuredataroot,
+        $errorsdisplayed,
+        $cronoverdue,
+        $dbproblems,
+        $maintenancemode,
+        $availableupdates,
+        $availableupdatesfetch,
+        $buggyiconvnomb,
+        $registered,
+        array $cachewarnings = [],
+        $eventshandlers = 0,
+        $themedesignermode = false,
+        $devlibdir = false,
+        $mobileconfigured = false,
+        $overridetossl = false,
+        $invalidforgottenpasswordurl = false,
+        $croninfrequent = false,
+        $showcampaigncontent = false,
+        bool $showfeedbackencouragement = false,
+        bool $showservicesandsupport = false,
+        $xmlrpcwarning = ''
+    ) {
 
         global $CFG;
         $output = '';
@@ -313,6 +330,8 @@ class core_admin_renderer extends plugin_renderer_base {
         $output .= $this->mobile_configuration_warning($mobileconfigured);
         $output .= $this->forgotten_password_url_warning($invalidforgottenpasswordurl);
         $output .= $this->mnet_deprecation_warning($xmlrpcwarning);
+        $output .= $this->moodlenet_removal_warning();
+        $output .= $this->marketplace_integration_notice();
         $output .= $this->userfeedback_encouragement($showfeedbackencouragement);
         $output .= $this->services_and_support_content($showservicesandsupport);
         $output .= $this->campaign_content($showcampaigncontent);
@@ -2326,6 +2345,33 @@ class core_admin_renderer extends plugin_renderer_base {
         return $this->warning($xmlrpcwarning);
     }
 
+    /**
+     * Display a warning about the removal of MoodleNet integration.
+     *
+     * @return string HTML to output.
+     */
+    protected function moodlenet_removal_warning(): string {
+        $moodlenetenabled = get_config('tool_moodlenet', 'enablemoodlenet');
+        if (!empty($moodlenetenabled)) {
+            $moodlenetwarning = get_string('moodlenetremovalwarning', 'admin');
+            return $this->warning($moodlenetwarning);
+        }
+
+        return '';
+    }
+
+    /**
+     * Display a notice about Moodle Marketplace integration.
+     *
+     * @return string HTML to output.
+     */
+    protected function marketplace_integration_notice(): string {
+        $installer = tool_installaddon_installer::instance();
+        $url = $installer->get_marketplace_url();
+        $notice = get_string('marketplaceavailablenotice', 'admin', $url->out());
+        return $this->warning($notice, 'info');
+    }
+
     /**
      * Renders the theme selector list.
      *

admin/search.php

@@ -32,7 +32,6 @@ $adminroot = admin_get_root(); // need all settings here
 $adminroot->search = $query; // So we can reference it in search boxes later in this invocation
 $statusmsg = '';
 $errormsg  = '';
-$focus = '';
 
 // now we'll deal with the case that the admin has submitted the form with changed settings
 if ($data = data_submitted() and confirm_sesskey() and isset($data->action) and $data->action == 'save-settings') {
@@ -41,7 +40,7 @@ if ($data = data_submitted() and confirm_sesskey() and isset($data->action) and
     if (!empty($adminroot->errors)) {
         $errormsg = get_string('errorwithsettings', 'admin');
         $firsterror = reset($adminroot->errors);
-        $focus = $firsterror->id;
+        $PAGE->set_focuscontrol($firsterror->id);
     } else {
         // No errors. Did we change any setting? If so, then redirect with success.
         if ($count) {
@@ -55,7 +54,7 @@ $PAGE->set_primary_active_tab('siteadminnode');
 
 // and finally, if we get here, then there are matching settings and we have to print a form
 // to modify them
-echo $OUTPUT->header($focus);
+echo $OUTPUT->header();
 
 // Display a warning if site is not registered.
 if (empty($query)) {

admin/settings.php

@@ -72,6 +72,7 @@ if ($data = data_submitted() and confirm_sesskey() and isset($data->action) and
     } else {
         $errormsg = get_string('errorwithsettings', 'admin');
         $firsterror = reset($adminroot->errors);
+        $PAGE->set_focuscontrol($firsterror->id);
     }
     $settingspage = $adminroot->locate($section, true);
 }
@@ -165,10 +166,8 @@ if (empty($SITE->fullname)) {
 $PAGE->requires->js_call_amd('core_form/changechecker', 'watchFormById', ['adminsettings']);
 
 if ($settingspage->has_dependencies()) {
-    $opts = [
-        'dependencies' => $settingspage->get_dependencies_for_javascript()
-    ];
-    $PAGE->requires->js_call_amd('core/showhidesettings', 'init', [$opts]);
+    $context = ['dependencies' => json_encode($settingspage->get_dependencies_for_javascript())];
+    echo $OUTPUT->render_from_template('core_admin/settings_showhide', $context);
 }
 
 echo $OUTPUT->footer();

admin/settings/ai.php

@@ -32,19 +32,29 @@ if ($hassiteconfig) {
     $providers->add(new admin_setting_heading('availableproviders',
         get_string('availableproviders', 'core_ai'),
         get_string('availableproviders_desc', 'core_ai')));
-    // Add call to action to add a new provider.
-    $providers->add(new \core_admin\admin\admin_setting_template_render(
-        name: 'addnewprovider',
-        templatename: 'core_ai/admin_add_provider',
-        context: ['addnewproviderurl' => new moodle_url('/ai/configure.php')]
-    ));
 
-    $providers->add(new \core_ai\admin\admin_setting_provider_manager(
+    if (!empty(core_plugin_manager::instance()->get_plugins_of_type("aiprovider"))) {
+        // Add call to action to add a new provider.
+        $providers->add(new \core_admin\admin\admin_setting_template_render(
+            name: 'addnewprovider',
+            templatename: 'core_ai/admin_add_provider',
+            context: ['addnewproviderurl' => new moodle_url('/ai/configure.php')]
+        ));
+
+        $providers->add(new \core_ai\admin\admin_setting_provider_manager(
             'aiprovider',
             \core_ai\table\aiprovider_management_table::class,
             'manageaiproviders',
             new lang_string('manageaiproviders', 'core_ai'),
-    ));
+        ));
+    } else {
+        $providers->add(new \core_admin\admin\admin_setting_notification(
+            name:'noproviderplugins',
+            notification: get_string('noproviderplugins', 'core_ai'),
+            type: 'danger'
+        ));
+    }
+
     $ADMIN->add('ai', $providers);
 
     // Add settings page for AI placement settings.

admin/templates/settings_showhide.mustache

@@ -0,0 +1,51 @@
+{{!
+    This file is part of Moodle - http://moodle.org/
+
+    Moodle is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    Moodle is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+}}
+{{!
+    @template core_admin/settings_showhide
+
+    Passes the necessary data to show/hide dependant settings.
+
+    Context variables required for this template:
+    * dependencies - JSON-serialized data structure describing the dependencies between settings
+
+    Example context (json):
+    {
+        "dependencies": {
+            "s__setting1":{
+                "eq":[
+                    [
+                        "s__setting0"
+                    ]
+                ]
+            },
+            "s__setting2":{
+                "eq":[
+                    [
+                        "s__setting1"
+                    ]
+                ]
+            }
+        }
+    }
+}}
+<span id="settings-showhide-{{uniqid}}" data-dependencies="{{dependencies}}"></span>
+
+{{#js}}
+    require(['core/showhidesettings'], function(ShowHideSettings) {
+        ShowHideSettings.init("settings-showhide-{{uniqid}}");
+    });
+{{/js}}

admin/tool/behat/UPGRADING.md

@@ -1,5 +1,13 @@
 # tool_behat Upgrade notes
 
+## 5.0.6+
+
+### Added
+
+- The `behat_session_trait::ensure_element_[does_not_]exists(...)` methods now accept optional `$container` parameter to define the parent node to look within
+
+  For more information see [MDL-75067](https://tracker.moodle.org/browse/MDL-75067)
+
 ## 5.0
 
 ### Added

admin/tool/behat/cli/run.php

@@ -224,6 +224,11 @@ if (empty($parallelrun)) {
     $cmds['singlerun'] = $runtestscommand;
 
     echo "Running single behat site:" . PHP_EOL;
+    // The inner PHP process is not marked as having an interactive terminal even if it's passed
+    // through from this one which does, so we need to pass it through as an environment variable.
+    if (function_exists('posix_isatty') && posix_isatty(STDOUT)) {
+        putenv('MOODLE_BEHAT_RUNNING_IN_TTY=1');
+    }
     passthru("php $runtestscommand", $status);
     $exitcodes['singlerun'] = $status;
     chdir($cwd);
@@ -525,4 +530,3 @@ function get_status_lines_from_run_op(Symfony\Component\Process\Process $process
 
     return $statusstr;
 }
-

admin/tool/dataprivacy/tests/behat/user_data_request.feature

@@ -0,0 +1,100 @@
+@tool @tool_dataprivacy
+Feature: Authorized users can request others personal data
+  In order to export or access another users data
+  As a designated role
+  I need the correct permissions
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email                |
+      | user1    | User1     | One      | user1@example.com    |
+      | user2    | User2     | Two      | user2@example.com    |
+      | officer1 | Officer1  | One      | officer1@example.com |
+    # Create Privacy Officer Role.
+    And the following "role" exists:
+      | shortname                                    | privacyofficer  |
+      | name                                         | Privacy Officer |
+      | context_system                               | 1               |
+      | tool/dataprivacy:managedataregistry          | allow           |
+      | tool/dataprivacy:managedatarequests          | allow           |
+      | tool/dataprivacy:makedatarequestsforchildren | allow           |
+      | moodle/site:configview                       | allow           |
+      | moodle/category:viewhiddencategories         | allow           |
+      | moodle/course:viewhiddencourses              | allow           |
+      | moodle/course:viewhiddenactivities           | allow           |
+      | moodle/course:view                           | allow           |
+    # Create Parent Role.
+    And the following "role" exists:
+      | shortname                                    | parentrole  |
+      | name                                         | Parent Role |
+      | context_user                                 | 1           |
+      | moodle/user:viewdetails                      | allow       |
+      | moodle/user:viewalldetails                   | allow       |
+      | moodle/user:readuserblogs                    | allow       |
+      | moodle/user:readuserposts                    | allow       |
+      | moodle/user:viewuseractivitiesreport         | allow       |
+      | moodle/user:editprofile                      | allow       |
+      | tool/policy:acceptbehalf                     | allow       |
+      | tool/dataprivacy:makedatarequestsforchildren | allow       |
+    # Add permission to allow parent to make requests on behalf of child user.
+    And the following config values are set as admin:
+      | contactdataprotectionofficer | 1 | tool_dataprivacy |
+    And I log in as "admin"
+
+  @javascript
+  Scenario: Privacy officer can request for other user's personal data
+    Given I navigate to "Users > Permissions > Assign system roles" in site administration
+    # Assign Privacy Officer role to officer1.
+    And I follow "Privacy Officer"
+    And I set the field "addselect_searchtext" to "Officer1"
+    And I set the field "addselect" to "Officer1 One (officer1@example.com)"
+    And I press "Add"
+    # Navigate to home in order to navigate properly to Privacy settings.
+    And I am on site homepage
+    # Select Privacy officer in the Orivacy officer role mapping setting.
+    And I navigate to "Users > Privacy and policies > Privacy settings" in site administration
+    And I click on "Privacy Officer" "checkbox"
+    And I press "Save changes"
+    And I log in as "officer1"
+    And I navigate to "Users > Privacy and policies > Data requests" in site administration
+    # Create a new request as the designated privacy officer.
+    When I follow "New request"
+    And I set the field "User" to "User1 One"
+    And I set the field "Comment" to "User One data"
+    And I press "Save changes"
+    # Confirm that the new data request is successfully created for selected user with status "Awaiting approval".
+    Then the following should exist in the "generaltable" table:
+      | Type   | User      | Requested by | Status            | Message       |
+      | Export | User1 One | Officer1 One | Awaiting approval | User One data |
+
+  @javascript
+  Scenario: Parent user can request data on behalf of child user
+    Given I navigate to "Users > Accounts > Browse list of users" in site administration
+    And I follow "User1 One"
+    And I click on "Preferences" "link" in the ".profile_tree" "css_element"
+    # Assign user2 as parent for user1.
+    And I follow "Assign roles relative to this user"
+    And I follow "Parent"
+    And I set the field "Potential users" to "User2 Two (user2@example.com)"
+    And I click on "Add" "button" in the "#page-content" "css_element"
+    And I log in as "user2"
+    And I follow "Profile" in the user menu
+    And I follow "Data requests"
+    # As parent, create a data request for a child user.
+    And I follow "New request"
+    And I click on "User" "field"
+    When I type "User1 One"
+    # Confirm that only the parent's child users can be searched and selected.
+    Then I should see "User1 One"
+    And I type "User2 Two"
+    And I should see "No suggestions"
+    And I type "Officer1 One"
+    And I should see "No suggestions"
+    And I set the field "Search" to "User1"
+    And I set the field "Comment" to "This is a comment"
+    And I press "Save changes"
+    # Confirm that data request was successfully made by parent on behalf of child user.
+    And I should see "Your request has been submitted to the privacy officer"
+    And the following should exist in the "generaltable" table:
+      | Type                                       | Requested by | Status            | Message           |
+      | Export all of my personal data (User1 One) | User2 Two    | Awaiting approval | This is a comment |

admin/tool/installaddon/amd/build/footer.min.js

@@ -0,0 +1,10 @@
+define("tool_installaddon/footer",["exports","jquery","core_course/local/activitychooser/selectors"],(function(_exports,_jquery,_selectors){function _interopRequireDefault(obj){return obj&&obj.__esModule?obj:{default:obj}}
+/**
+   * Activity chooser footer handlers for tool_installaddon.
+   *
+   * @module     tool_installaddon/footer
+   * @copyright  2026 Safat Shahin <safat.shahin@moodle.com>
+   * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+   */Object.defineProperty(_exports,"__esModule",{value:!0}),_exports.footerClickListener=void 0,_jquery=_interopRequireDefault(_jquery),_selectors=_interopRequireDefault(_selectors);_exports.footerClickListener=(e,footerData,modal)=>{const closeOption=e.target.closest(_selectors.default.actions.closeOption);if(!closeOption)return;const moduleName=closeOption.dataset.modname;if(!moduleName)return;const carousel=(0,_jquery.default)(modal.getBody()[0].querySelector(_selectors.default.regions.carousel));carousel.carousel("prev"),modal.setFooter(footerData.customfootertemplate),carousel.one("slid.bs.carousel",(()=>{const caller=modal.getBody()[0].querySelector(_selectors.default.regions.modules).querySelector(_selectors.default.regions.getModuleSelector(moduleName));caller&&caller.focus()}))}}));
+
+//# sourceMappingURL=footer.min.js.map

admin/tool/installaddon/amd/build/footer.min.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"footer.min.js","sources":["../src/footer.js"],"sourcesContent":["// This file is part of Moodle - http://moodle.org/\n//\n// Moodle is free software: you can redistribute it and/or modify\n// it under the terms of the GNU General Public License as published by\n// the Free Software Foundation, either version 3 of the License, or\n// (at your option) any later version.\n//\n// Moodle is distributed in the hope that it will be useful,\n// but WITHOUT ANY WARRANTY; without even the implied warranty of\n// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n// GNU General Public License for more details.\n//\n// You should have received a copy of the GNU General Public License\n// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.\n\n/**\n * Activity chooser footer handlers for tool_installaddon.\n *\n * @module     tool_installaddon/footer\n * @copyright  2026 Safat Shahin <safat.shahin@moodle.com>\n * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later\n */\n\nimport $ from 'jquery';\nimport selectors from 'core_course/local/activitychooser/selectors';\n\n/**\n * Handle clicks in the chooser footer when installaddon is the active footer plugin.\n *\n * @param {Event} e The event being triggered\n * @param {Object} footerData The footer data generated for the chooser\n * @param {Object} modal The chooser modal\n */\nexport const footerClickListener = (e, footerData, modal) => {\n    const closeOption = e.target.closest(selectors.actions.closeOption);\n\n    if (!closeOption) {\n        return;\n    }\n\n    const moduleName = closeOption.dataset.modname;\n\n    if (!moduleName) {\n        return;\n    }\n\n    const carousel = $(modal.getBody()[0].querySelector(selectors.regions.carousel));\n\n    // Trigger the transition between 'pages'.\n    carousel.carousel('prev');\n    modal.setFooter(footerData.customfootertemplate);\n    carousel.one('slid.bs.carousel', () => {\n        const allModules = modal.getBody()[0].querySelector(selectors.regions.modules);\n        const caller = allModules.querySelector(selectors.regions.getModuleSelector(moduleName));\n        if (caller) {\n            caller.focus();\n        }\n    });\n};\n"],"names":["e","footerData","modal","closeOption","target","closest","selectors","actions","moduleName","dataset","modname","carousel","getBody","querySelector","regions","setFooter","customfootertemplate","one","caller","modules","getModuleSelector","focus"],"mappings":";;;;;;;oNAiCmC,CAACA,EAAGC,WAAYC,eACzCC,YAAcH,EAAEI,OAAOC,QAAQC,mBAAUC,QAAQJ,iBAElDA,yBAICK,WAAaL,YAAYM,QAAQC,YAElCF,wBAICG,UAAW,mBAAET,MAAMU,UAAU,GAAGC,cAAcP,mBAAUQ,QAAQH,WAGtEA,SAASA,SAAS,QAClBT,MAAMa,UAAUd,WAAWe,sBAC3BL,SAASM,IAAI,oBAAoB,WAEvBC,OADahB,MAAMU,UAAU,GAAGC,cAAcP,mBAAUQ,QAAQK,SAC5CN,cAAcP,mBAAUQ,QAAQM,kBAAkBZ,aACxEU,QACAA,OAAOG"}

admin/tool/installaddon/amd/src/footer.js

@@ -0,0 +1,59 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Activity chooser footer handlers for tool_installaddon.
+ *
+ * @module     tool_installaddon/footer
+ * @copyright  2026 Safat Shahin <safat.shahin@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+import $ from 'jquery';
+import selectors from 'core_course/local/activitychooser/selectors';
+
+/**
+ * Handle clicks in the chooser footer when installaddon is the active footer plugin.
+ *
+ * @param {Event} e The event being triggered
+ * @param {Object} footerData The footer data generated for the chooser
+ * @param {Object} modal The chooser modal
+ */
+export const footerClickListener = (e, footerData, modal) => {
+    const closeOption = e.target.closest(selectors.actions.closeOption);
+
+    if (!closeOption) {
+        return;
+    }
+
+    const moduleName = closeOption.dataset.modname;
+
+    if (!moduleName) {
+        return;
+    }
+
+    const carousel = $(modal.getBody()[0].querySelector(selectors.regions.carousel));
+
+    // Trigger the transition between 'pages'.
+    carousel.carousel('prev');
+    modal.setFooter(footerData.customfootertemplate);
+    carousel.one('slid.bs.carousel', () => {
+        const allModules = modal.getBody()[0].querySelector(selectors.regions.modules);
+        const caller = allModules.querySelector(selectors.regions.getModuleSelector(moduleName));
+        if (caller) {
+            caller.focus();
+        }
+    });
+};

admin/tool/installaddon/classes/installer.php

@@ -70,6 +70,25 @@ class tool_installaddon_installer {
             $url = 'https://moodle.org/plugins/get.php';
         }
 
+        return $this->get_external_service_url($url);
+    }
+
+    /**
+     * Returns URL to Moodle Marketplace.
+     *
+     * @return moodle_url
+     */
+    public function get_marketplace_url(): moodle_url {
+        return $this->get_external_service_url('https://marketplace.moodle.com/');
+    }
+
+    /**
+     * Returns URL to external service with optional encoded site information.
+     *
+     * @param string $url The external service base URL.
+     * @return moodle_url
+     */
+    protected function get_external_service_url(string $url): moodle_url {
         if (!$this->should_send_site_info()) {
             return new moodle_url($url);
         }

admin/tool/installaddon/classes/task/post_install.php

@@ -16,20 +16,23 @@
 
 declare(strict_types=1);
 
-namespace tool_moodlenet\task;
+namespace tool_installaddon\task;
 
 /**
  * Ad-hoc task to perform post install tasks.
- * We use this to set the active activity chooser footer plugin to tool_moodlenet.
+ * We use this to set the active activity chooser footer plugin to tool_installaddon.
  * We couldn't do this directly in install.php, because there is an admin_apply_default_settings() call after all plugins are
  * installed and that would reset whatever value we had set earlier to 'hidden'.
  *
- * @package   tool_moodlenet
- * @copyright 2022 Shamim Rezaie <shamim@moodle.com>
+ * @package   tool_installaddon
+ * @copyright 2026 Safat Shahin <safat.shahin@moodle.com>
  * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 class post_install extends \core\task\adhoc_task {
-    public function execute() {
-        set_config('activitychooseractivefooter', 'tool_moodlenet');
+    /**
+     * Sets the active activity chooser footer plugin after install defaults are applied.
+     */
+    public function execute(): void {
+        set_config('activitychooseractivefooter', 'tool_installaddon');
     }
 }

admin/tool/installaddon/db/install.php

@@ -0,0 +1,37 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Install script for tool_installaddon.
+ *
+ * @package   tool_installaddon
+ * @copyright 2026 Safat Shahin <safat.shahin@moodle.com>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+/**
+ * Perform the post-install procedures.
+ */
+function xmldb_tool_installaddon_install(): void {
+    // Use an ad-hoc task to set the active activity chooser footer plugin to tool_installaddon.
+    // We couldn't do this in admin/settings/courses.php for 2 reasons:
+    // - First, because it would be a breach of component communications principles to do so there.
+    // - Second, because we can't call get_plugins_with_function() during install and upgrade (or it will return []).
+    // We couldn't do this directly here either, because there is an admin_apply_default_settings() call after all plugins are
+    // installed and that would reset whatever value we set here to 'hidden'.
+    $postinstall = new tool_installaddon\task\post_install();
+    core\task\manager::queue_adhoc_task($postinstall);
+}

admin/tool/installaddon/db/upgrade.php

@@ -0,0 +1,41 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Upgrade script for tool_installaddon.
+ *
+ * @package    tool_installaddon
+ * @copyright  2026 Safat Shahin <safat.shahin@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+/**
+ * Upgrade the plugin.
+ *
+ * @param int $oldversion
+ * @return bool always true
+ */
+function xmldb_tool_installaddon_upgrade(int $oldversion): bool {
+    if ($oldversion < 2025041401) {
+        // Set the activity chooser active footer to include marketplace regardless of the previous setting.
+        // We are deliberately setting this to increase awareness of marketplace.
+        set_config('activitychooseractivefooter', 'tool_installaddon');
+
+        upgrade_plugin_savepoint(true, 2025041401, 'tool', 'installaddon');
+    }
+
+    return true;
+}

admin/tool/installaddon/lang/en/tool_installaddon.php

@@ -28,6 +28,7 @@ defined('MOODLE_INTERNAL') || die();
 
 $string['acknowledgement'] = 'Acknowledgement';
 $string['acknowledgementtext'] = 'I understand that it is my responsibility to have full backups of this site prior to installing additional plugins. I accept and understand that plugins (especially but not only those originating in unofficial sources) may contain security holes, can make the site unavailable, or cause private data leaks or loss.';
+$string['activitychooserfootertext'] = 'Browse more activities on';
 $string['featuredisabled'] = 'The plugin installer is disabled on this site.';
 $string['installaddon'] = 'Install plugin!';
 $string['installaddons'] = 'Install plugins';
@@ -44,6 +45,8 @@ $string['installfromzipsubmit'] = 'Install plugin from the ZIP file';
 $string['installfromziptype'] = 'Plugin type';
 $string['installfromziptype_help'] = 'For plugins that correctly declare their component name, the installer is able to detect the plugin type automatically. If the auto-detection fails, choose the correct type of plugin manually. Warning: The installation procedure can fail badly if an incorrect plugin type is specified.';
 $string['installfromziptype_link'] = 'Development:Plugins';
+$string['marketplaceadminlinktext'] = 'Browse new plugins';
+$string['marketplacelink'] = 'Moodle Marketplace';
 $string['permcheck'] = 'Make sure the plugin type root location is writable by the web server process.';
 $string['permcheckerror'] = 'Error while checking for write permission';
 $string['permcheckprogress'] = 'Checking for write permission ...';

admin/tool/installaddon/lib.php

@@ -0,0 +1,48 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Public API for tool_installaddon.
+ *
+ * @package     tool_installaddon
+ * @copyright   2026 Safat Shahin <safat.shahin@moodle.com>
+ * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+use core_course\local\entity\activity_chooser_footer;
+
+/**
+ * Build activity chooser footer content for Marketplace.
+ *
+ * @param int $courseid The selected course id.
+ * @param int $sectionid The selected section id.
+ * @return activity_chooser_footer
+ */
+function tool_installaddon_custom_chooser_footer(int $courseid, int $sectionid): activity_chooser_footer {
+    global $OUTPUT;
+
+    $installer = tool_installaddon_installer::instance();
+    $marketplaceurl = $installer->get_marketplace_url();
+
+    $renderedfooter = $OUTPUT->render_from_template('tool_installaddon/chooser_footer', [
+        'url' => $marketplaceurl->out(false),
+    ]);
+
+    return new activity_chooser_footer(
+        'tool_installaddon/footer',
+        $renderedfooter
+    );
+}

admin/tool/installaddon/settings.php

@@ -26,6 +26,12 @@
 defined('MOODLE_INTERNAL') || die();
 
 if ($hassiteconfig and empty($CFG->disableupdateautodeploy)) {
+    $installer = tool_installaddon_installer::instance();
+    $ADMIN->add('modules', new admin_externalpage(
+        'tool_installaddon_marketplace',
+        get_string('marketplaceadminlinktext', 'tool_installaddon'),
+        $installer->get_marketplace_url()->out(false)
+    ), 'modsettings');
 
     $ADMIN->add('modules', new admin_externalpage('tool_installaddon_index',
         get_string('installaddons', 'tool_installaddon'),

admin/tool/installaddon/templates/chooser_footer.mustache

@@ -0,0 +1,30 @@
+{{!
+    This file is part of Moodle - http://moodle.org/
+
+    Moodle is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    Moodle is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+}}
+{{!
+    @template tool_installaddon/chooser_footer
+
+    Activity chooser footer link to Marketplace.
+
+    Example context (json):
+    {
+        "url": "https://marketplace.moodle.com/?site=hash"
+    }
+}}
+<div class="w-100 d-flex px-2">
+    <span class="my-auto me-1">{{#str}} activitychooserfootertext, tool_installaddon {{/str}}</span>
+    {{> tool_installaddon/marketplace_link }}
+</div>

admin/tool/installaddon/templates/marketplace_link.mustache

@@ -0,0 +1,36 @@
+{{!
+    This file is part of Moodle - http://moodle.org/
+
+    Moodle is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    Moodle is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+}}
+{{!
+    @template tool_installaddon/marketplace_link
+
+    Reusable link to Moodle Marketplace.
+
+    Example context (json):
+    {
+        "url": "https://marketplace.moodle.com/?site=hash"
+    }
+}}
+<a class="d-inline my-auto" href="{{url}}" target="_blank" rel="noopener noreferrer">
+    {{#str}} marketplacelink, tool_installaddon {{/str}}
+    <i
+    class="fa fa-external-link"
+    role="img"
+    aria-label="{{#str}} opensinnewwindow, core {{/str}}"
+    title="{{#str}} opensinnewwindow, core {{/str}}"
+    >
+    </i>
+</a>

admin/tool/installaddon/tests/behat/activity_chooser_footer.feature

@@ -0,0 +1,37 @@
+@tool @tool_installaddon @javascript
+Feature: Marketplace activity chooser footer
+  In order to browse plugins from the activity chooser
+  As a teacher
+  I need to see the Marketplace footer link when installaddon is the active footer plugin
+
+  Background:
+    Given the following config values are set as admin:
+      | activitychooseractivefooter | tool_installaddon |
+    And the following "users" exist:
+      | username | firstname | lastname | email |
+      | teacher1 | Teacher | 1 | teacher1@example.com |
+    And the following "courses" exist:
+      | fullname | shortname | category | format |
+      | Course 1 | C1 | 0 | topics |
+    And the following "course enrolments" exist:
+      | user | course | role |
+      | teacher1 | C1 | editingteacher |
+
+  Scenario: Activity chooser footer includes Marketplace link
+    Given I log in as "teacher1"
+    When I am on "Course 1" course homepage with editing mode on
+    And I open the activity chooser
+    Then "Browse more activities on" "text" should exist in the "Add an activity or resource" "dialogue"
+    And "Marketplace" "link" should exist in the "Add an activity or resource" "dialogue"
+
+  Scenario: Back button works from activity help when the Marketplace footer is active
+    Given I log in as "teacher1"
+    When I am on "Course 1" course homepage with editing mode on
+    And I open the activity chooser
+    And I click on "Information about the Assignment activity" "button" in the "Add an activity or resource" "dialogue"
+    Then "help" "core_course > Activity chooser screen" should be visible
+    When I click on "Back" "button" in the "Add an activity or resource" "dialogue"
+    Then "modules" "core_course > Activity chooser screen" should be visible
+    And "help" "core_course > Activity chooser screen" should not be visible
+    And "Marketplace" "link" should exist in the "Add an activity or resource" "dialogue"
+    And "Back" "button" should not exist in the "Add an activity or resource" "dialogue"

admin/tool/installaddon/tests/fixtures/testable_installer_without_site_info.php

@@ -0,0 +1,46 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Provides a mock testable_tool_installaddon_installer_without_site_info class.
+ *
+ * @package     tool_installaddon
+ * @subpackage  fixtures
+ * @category    test
+ * @copyright   2026 Safat Shahin <safat.shahin@moodle.com>
+ * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+require_once(__DIR__ . '/testable_installer.php');
+
+/**
+ * Testable subclass with site-info sharing disabled.
+ *
+ * @copyright 2026 Safat Shahin <safat.shahin@moodle.com>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class testable_tool_installaddon_installer_without_site_info extends testable_tool_installaddon_installer {
+    /**
+     * Disable site info sharing.
+     *
+     * @return bool
+     */
+    protected function should_send_site_info() {
+        return false;
+    }
+}

admin/tool/installaddon/tests/installer_test.php

@@ -18,12 +18,14 @@
 namespace tool_installaddon;
 
 use testable_tool_installaddon_installer;
+use testable_tool_installaddon_installer_without_site_info;
 use tool_installaddon_installer;
 
 defined('MOODLE_INTERNAL') || die();
 
 global $CFG;
-require_once(__DIR__.'/fixtures/testable_installer.php');
+require_once(__DIR__ . '/fixtures/testable_installer.php');
+require_once(__DIR__ . '/fixtures/testable_installer_without_site_info.php');
 
 /**
  * Unit tests for the {@link tool_installaddon_installer} class
@@ -32,16 +34,14 @@ require_once(__DIR__.'/fixtures/testable_installer.php');
  * @category    test
  * @copyright 2013 David Mudrak <david@moodle.com>
  * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers \tool_installaddon_installer
  */
 final class installer_test extends \advanced_testcase {
 
     public function test_get_addons_repository_url(): void {
         $installer = testable_tool_installaddon_installer::instance();
         $url = $installer->get_addons_repository_url();
-        $query = parse_url($url, PHP_URL_QUERY);
-        $this->assertEquals(1, preg_match('~^site=(.+)$~', $query, $matches));
-        $site = rawurldecode($matches[1]);
-        $site = json_decode(base64_decode($site), true);
+        $site = $this->decode_site_info_from_url($url);
         $this->assertIsArray($site);
         $this->assertEquals(3, count($site));
         $this->assertSame('Nasty site', $site['fullname']);
@@ -49,6 +49,34 @@ final class installer_test extends \advanced_testcase {
         $this->assertSame("2.5'; DROP TABLE mdl_user; --", $site['majorversion']);
     }
 
+    /**
+     * Tests that marketplace URL includes expected host, scheme and site payload.
+     */
+    public function test_get_marketplace_url(): void {
+        $installer = testable_tool_installaddon_installer::instance();
+        $addonsurl = $installer->get_addons_repository_url();
+        $marketplaceurl = $installer->get_marketplace_url();
+
+        $this->assertSame('marketplace.moodle.com', parse_url($marketplaceurl, PHP_URL_HOST));
+        $this->assertSame('https', parse_url($marketplaceurl, PHP_URL_SCHEME));
+        $this->assertSame(
+            $this->decode_site_info_from_url($addonsurl),
+            $this->decode_site_info_from_url($marketplaceurl),
+        );
+    }
+
+    /**
+     * Tests that marketplace URL has no query string when site info is unavailable.
+     */
+    public function test_get_marketplace_url_without_site_info(): void {
+        $installer = testable_tool_installaddon_installer_without_site_info::instance();
+        $marketplaceurl = $installer->get_marketplace_url();
+
+        $this->assertSame('marketplace.moodle.com', parse_url($marketplaceurl, PHP_URL_HOST));
+        $this->assertSame('https', parse_url($marketplaceurl, PHP_URL_SCHEME));
+        $this->assertEmpty(parse_url($marketplaceurl, PHP_URL_QUERY));
+    }
+
     public function test_decode_remote_request(): void {
         $installer = testable_tool_installaddon_installer::instance();
 
@@ -132,7 +160,7 @@ $plugin->version  = 2014121300;
         $versionphp = file_get_contents($fixtures.'/github/moodle-repository_mahara-master/version.php');
         $this->assertEquals('repository_mahara', $installer->testable_detect_plugin_component_from_versionphp($versionphp));
 
-        $versionphp = file_get_contents($fixtures.'/nocomponent/baz/version.php');
+        $versionphp = file_get_contents($fixtures . '/nocomponent/baz/version.php');
         $this->assertFalse($installer->testable_detect_plugin_component_from_versionphp($versionphp));
     }
 
@@ -143,15 +171,28 @@ $plugin->version  = 2014121300;
         $storage1 = $installer->make_installfromzip_storage();
         $this->assertTrue(is_dir($storage1));
         $this->assertTrue(is_writable($storage1));
-        file_put_contents($storage1.'/hello.txt', 'Find me if you can!');
+        file_put_contents($storage1 . '/hello.txt', 'Find me if you can!');
 
         // Check we get unique directory on each call.
         $storage2 = $installer->make_installfromzip_storage();
         $this->assertTrue(is_dir($storage2));
         $this->assertTrue(is_writable($storage2));
-        $this->assertFalse(file_exists($storage2.'/hello.txt'));
+        $this->assertFalse(file_exists($storage2 . '/hello.txt'));
 
         // Check both are in the same parent directory.
         $this->assertEquals(dirname($storage1), dirname($storage2));
     }
+
+    /**
+     * Decodes the encoded 'site' URL query parameter.
+     *
+     * @param moodle_url $url
+     * @return array
+     */
+    private function decode_site_info_from_url(\moodle_url $url): array {
+        $query = parse_url($url, PHP_URL_QUERY);
+        $this->assertEquals(1, preg_match('~^site=(.+)$~', $query, $matches));
+        $site = rawurldecode($matches[1]);
+        return json_decode(base64_decode($site), true);
+    }
 }

admin/tool/installaddon/tests/lib_test.php

@@ -0,0 +1,53 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Unit tests for tool_installaddon lib.
+ *
+ * @package    tool_installaddon
+ * @copyright  2026 Safat Shahin <safat.shahin@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace tool_installaddon;
+
+use core_course\local\entity\activity_chooser_footer;
+
+defined('MOODLE_INTERNAL') || die();
+
+global $CFG;
+require_once($CFG->dirroot . '/admin/tool/installaddon/lib.php');
+
+/**
+ * Test installaddon lib functions.
+ */
+final class lib_test extends \advanced_testcase {
+    /**
+     * Tests chooser footer generation for marketplace link content.
+     *
+     * @covers ::tool_installaddon_custom_chooser_footer
+     */
+    public function test_tool_installaddon_custom_chooser_footer(): void {
+        $this->resetAfterTest();
+
+        $footer = \tool_installaddon_custom_chooser_footer(1, 1);
+
+        $this->assertInstanceOf(activity_chooser_footer::class, $footer);
+        $this->assertSame('tool_installaddon/footer', $footer->get_footer_js_file());
+        $this->assertStringContainsString('https://marketplace.moodle.com/', $footer->get_footer_template());
+        $this->assertStringContainsString('site=', $footer->get_footer_template());
+    }
+}

admin/tool/installaddon/tests/task/post_install_test.php

@@ -0,0 +1,47 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+declare(strict_types=1);
+
+namespace tool_installaddon\task;
+
+/**
+ * Unit tests for the post install task.
+ *
+ * @package   tool_installaddon
+ * @category  test
+ * @copyright 2026 Safat Shahin <safat.shahin@moodle.com>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers    \tool_installaddon\task\post_install
+ */
+final class post_install_test extends \advanced_testcase {
+    /**
+     * Tests that the task sets the activity chooser footer plugin to tool_installaddon.
+     */
+    public function test_execute_sets_activitychooseractivefooter_config(): void {
+        $this->resetAfterTest();
+
+        set_config('activitychooseractivefooter', 'hidden');
+
+        $task = new post_install();
+        $task->execute();
+
+        $this->assertSame(
+            'tool_installaddon',
+            get_config('core', 'activitychooseractivefooter'),
+        );
+    }
+}

admin/tool/installaddon/version.php

@@ -24,6 +24,6 @@
 defined('MOODLE_INTERNAL') || die();
 
 $plugin->component  = 'tool_installaddon';
-$plugin->version    = 2025041400;
+$plugin->version    = 2025041401;
 $plugin->requires   = 2025040800;
 $plugin->maturity   = MATURITY_STABLE;

admin/tool/mfa/classes/manager.php

@@ -598,6 +598,10 @@ class manager {
         $urls = [
             new \moodle_url('/login/logout.php'),
             new \moodle_url('/admin/tool/mfa/guide.php'),
+            // Allow email self-registration confirmation to complete so that
+            // auth_email can restore wantsurl from the auth_email_wantsurl user
+            // preference before MFA intercepts on the next request.
+            new \moodle_url('/login/confirm.php'),
         ];
         foreach ($factors as $factor) {
             $urls = array_merge($urls, $factor->get_no_redirect_urls());
@@ -605,8 +609,9 @@ class manager {
 
         // Allow forced redirection exclusions.
         if ($exclusions = get_config('tool_mfa', 'redir_exclusions')) {
-            foreach (explode("\n", $exclusions) as $exclusion) {
-                $urls[] = new \moodle_url($exclusion);
+            $exclusions = preg_split('/\n|\r/', $exclusions, -1, PREG_SPLIT_NO_EMPTY);
+            foreach ($exclusions as $exclusion) {
+                $urls[] = new \moodle_url(trim($exclusion));
             }
         }
 

admin/tool/mfa/styles.css

@@ -38,3 +38,8 @@ input.tool-mfa-verification-code,
 .mfa-verify-form .form-group.fitem > span > input {
     width: 100%;
 }
+
+#mfalist .icon-circle .icon {
+    width: 64px;
+    height: 64px;
+}

admin/tool/mfa/tests/manager_test.php

@@ -20,6 +20,7 @@ namespace tool_mfa;
  * Tests for MFA manager class.
  *
  * @package     tool_mfa
+ * @covers      \tool_mfa\manager
  * @author      Peter Burnett <peterburnett@catalyst-au.net>
  * @copyright   Catalyst IT
  * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
@@ -30,9 +31,6 @@ final class manager_test extends \advanced_testcase {
 
     /**
      * Tests getting the factor total weight
-     *
-     * @covers ::get_total_weight
-     * @covers ::setup_user_factor
      */
     public function test_get_total_weight(): void {
         $this->resetAfterTest(true);
@@ -76,8 +74,6 @@ final class manager_test extends \advanced_testcase {
 
     /**
      * Tests getting the factor status
-     *
-     * @covers ::get_status
      */
     public function test_get_status(): void {
         $this->resetAfterTest(true);
@@ -117,8 +113,6 @@ final class manager_test extends \advanced_testcase {
 
     /**
      * Tests checking if passed enough factors
-     *
-     * @covers ::passed_enough_factors
      */
     public function test_passed_enough_factors(): void {
         $this->resetAfterTest(true);
@@ -151,6 +145,30 @@ final class manager_test extends \advanced_testcase {
         $this->assertEquals(true, \tool_mfa\manager::passed_enough_factors());
     }
 
+    /**
+     * Test reading no redirect URLs configuration
+     */
+    public function test_get_no_redirect_urls(): void {
+        $this->resetAfterTest();
+        $this->setAdminUser();
+
+        // Ensure all EOL markers are covered.
+        $config = "/user/profile.php\r" .
+            "/course/index.php\n" .
+            "/admin/settings.php\r\n" .
+            "/mod/bar/view.php ";
+
+        set_config('redir_exclusions', $config, 'tool_mfa');
+
+        // Cast URLs to string for simpler comparison.
+        $noredirecturls = array_map(fn(\moodle_url $url) => (string) $url, manager::get_no_redirect_urls());
+
+        $this->assertContains((string) (new \moodle_url('/user/profile.php')), $noredirecturls);
+        $this->assertContains((string) (new \moodle_url('/course/index.php')), $noredirecturls);
+        $this->assertContains((string) (new \moodle_url('/admin/settings.php')), $noredirecturls);
+        $this->assertContains((string) (new \moodle_url('/mod/bar/view.php')), $noredirecturls);
+    }
+
     /**
      * The data provider for whether urls should be redirected or not
      *
@@ -178,7 +196,6 @@ final class manager_test extends \advanced_testcase {
     /**
      * Tests whether it should require mfa
      *
-     * @covers ::should_require_mfa
      * @param string $urlstring
      * @param string $webroot
      * @param bool $status
@@ -197,8 +214,6 @@ final class manager_test extends \advanced_testcase {
 
     /**
      * Tests whether it should require the mfa checks
-     *
-     * @covers ::should_require_mfa
      */
     public function test_should_require_mfa_checks(): void {
         // Setup test and user.
@@ -285,8 +300,6 @@ final class manager_test extends \advanced_testcase {
 
     /**
      * Tests should require the mfa redirection loop
-     *
-     * @covers ::should_require_mfa
      */
     public function test_should_require_mfa_redirection_loop(): void {
         // Setup test and user.
@@ -341,9 +354,6 @@ final class manager_test extends \advanced_testcase {
 
     /**
      * Tests checking for possible setup factor
-     *
-     * @covers ::possible_factor_setup
-     * @covers ::setup_user_factor
      */
     public function test_possible_factor_setup(): void {
         // Setup test and user.
@@ -377,8 +387,6 @@ final class manager_test extends \advanced_testcase {
 
     /**
      * Tests checking if a factor is ready
-     *
-     * @covers ::is_ready
      */
     public function test_is_ready(): void {
         // Setup test and user.
@@ -419,9 +427,6 @@ final class manager_test extends \advanced_testcase {
 
     /**
      * Tests core hooks
-     *
-     * @covers ::mfa_config_hook_test
-     * @covers ::mfa_login_hook_test
      */
     public function test_core_hooks(): void {
         // Setup test and user.
@@ -438,9 +443,31 @@ final class manager_test extends \advanced_testcase {
     }
 
     /**
-     * Tests circular redirect auth
+     * Tests that /login/confirm.php is excluded from MFA redirection.
+     *
+     * When a user follows an email self-registration confirmation link, MFA must
+     * not intercept the request before auth_email::user_confirm() has had a chance
+     * to restore the wantsurl from the auth_email_wantsurl user preference.
      *
      * @covers ::should_require_mfa
+     * @covers ::get_no_redirect_urls
+     */
+    public function test_confirm_url_no_redirect(): void {
+        $this->resetAfterTest(true);
+        $user = $this->getDataGenerator()->create_user();
+        $this->setUser($user);
+
+        $confirmurl = new \moodle_url('/login/confirm.php');
+        $this->assertEquals(
+            \tool_mfa\manager::NO_REDIRECT,
+            \tool_mfa\manager::should_require_mfa($confirmurl, false),
+            '/login/confirm.php must not trigger an MFA redirect so that auth_email can ' .
+            'restore wantsurl from the auth_email_wantsurl user preference first.'
+        );
+    }
+
+    /**
+     * Tests circular redirect auth
      */
     public function test_circular_redirect_auth(): void {
         // Setup test and user.

admin/tool/moodlenet/db/install.php

@@ -28,12 +28,5 @@ declare(strict_types=1);
  * Perform the post-install procedures.
  */
 function xmldb_tool_moodlenet_install() {
-    // Use an ad-hoc task to set the active activity chooser footer plugin to tool_moodlenet.
-    // We couldn't do this in admin/settings/courses.php for 2 reasons:
-    // - First, because it would be a breach of component communications principles to do so there.
-    // - Second, because we can't call get_plugins_with_function() during install and upgrade (or it will return []).
-    // We couldn't do this directly here either, because there is an admin_apply_default_settings() call after all plugins are
-    // installed and that would reset whatever value we set here to 'hidden'.
-    $postinstall = new tool_moodlenet\task\post_install();
-    core\task\manager::queue_adhoc_task($postinstall);
+
 }

admin/tool/moodlenet/lang/en/tool_moodlenet.php

@@ -38,6 +38,9 @@ $string['defaultmoodlenet_desc'] = 'The URL of the MoodleNet instance available
 $string['defaultmoodlenetname'] = "MoodleNet instance name";
 $string['defaultmoodlenetnamevalue'] = 'MoodleNet Central';
 $string['defaultmoodlenetname_desc'] = 'The name of the MoodleNet instance available via the activity chooser.';
+$string['removalwarning_feature'] = 'If you need to continue using MoodleNet, contact your site administrator about setting up a self-hosted MoodleNet instance.';
+$string['removalwarning_service'] = 'After the date, you will no longer be able to browse or add content from MoodleNet Central.';
+$string['removalwarning_title'] = 'The MoodleNet service will be shut down on 20 April 2026.';
 $string['enablemoodlenet'] = 'Enable MoodleNet integration (inbound)';
 $string['enablemoodlenet_desc'] = 'If enabled, a user with the capability to create and manage activities can browse MoodleNet via the activity chooser and import MoodleNet resources into their course. In addition, a user with the capability to restore backups can select a backup file on MoodleNet and restore it into Moodle.';
 $string['errorduringdownload'] = 'An error occurred while downloading the file: {$a}';

admin/tool/moodlenet/templates/chooser_moodlenet.mustache

@@ -27,8 +27,16 @@
     <div class="content text-start mb-5 px-5 py-4" data-region="chooser-option-summary-content-container">
         <div data-region="moodle-net">
             <div class="overlay-icon-container z-index-1 d-none" data-region="spinner"></div>
-            <img class="w-25 mb-4" aria-hidden="true" src="{{{img}}}">
+            <img class="w-25 mb-4" alt="" aria-hidden="true" src="{{{img}}}">
             <p>{{#str}} instancedescription, tool_moodlenet {{/str}}</p>
+
+            {{! Removal warning - always visible when MoodleNet integration is enabled }}
+            <div class="alert alert-warning w-75 mx-auto mb-3" role="alert">
+                <strong>{{#str}}removalwarning_title, tool_moodlenet{{/str}}</strong>
+                <p class="mb-1">{{#str}}removalwarning_service, tool_moodlenet{{/str}}</p>
+                <p class="mb-0">{{#str}}removalwarning_feature, tool_moodlenet{{/str}}</p>
+            </div>
+
             <p class="w-75 mx-auto mb-1 mt-5">{{#str}} connectandbrowse, tool_moodlenet {{/str}}</p>
             <a class="btn btn-secondary d-block w-75 mx-auto mb-4"
                data-action="browse"

admin/tool/oauth2/tests/behat/basic_settings.feature

@@ -61,7 +61,8 @@ Feature: Basic OAuth2 functionality
     And I should see "device_authorization_endpoint"
     And I navigate to "Server > OAuth 2 services" in site administration
     And I click on "Configure user field mappings" "link" in the "Testing service" "table_row"
-    And I should see "firstname" in the "givenname" "table_row"
+    And I should see "firstname" in the "given_name" "table_row"
+    And I should see "lastname" in the "family_name" "table_row"
     And I should see "idnumber" in the "sub" "table_row"
     And I should see "email" in the "email" "table_row"
     And I should see "lang" in the "locale" "table_row"

admin/tool/task/lib.php

@@ -49,7 +49,7 @@ function tool_task_mtrace_wrapper(string $message, string $eol = ''): void {
 
     // We autolink urls and emails here but can't use format_text as it does
     // more than we need and has side effects which are not useful in this context.
-    $urlpattern = '/(http|https|ftp|ftps)\:\/\/[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,3}(\/\S*)?/';
+    $urlpattern = '~\b(?:https?|ftps?)://[a-z0-9-]+(?:\.[a-z0-9-]+)*(?::\d+)?(?:/[^\s<]*)?~i';
     $message = preg_replace_callback($urlpattern, function($matches) {
         $url = $matches[0];
         return html_writer::link($url, $url, ['target' => '_blank']);

admin/tool/task/renderer.php

@@ -58,7 +58,7 @@ class tool_task_renderer extends plugin_renderer_base {
             get_string('nextruntime', 'tool_task'),
         ];
 
-        $table->attributes['class'] = 'admintable generaltable table table-hover';
+        $table->attributes['class'] = 'admintable generaltable table table-striped table-hover';
         $table->colclasses = [];
 
         // For each task entry (row) show action buttons/logs link depending on the user permissions.
@@ -388,7 +388,7 @@ class tool_task_renderer extends plugin_renderer_base {
             get_string('default', 'tool_task'),
         ];
 
-        $table->attributes['class'] = 'admintable generaltable table table-hover';
+        $table->attributes['class'] = 'admintable generaltable table table-striped table-hover';
         $table->colclasses = [];
 
         if (!$showloglink) {

admin/tool/task/tests/lib_test.php

@@ -0,0 +1,82 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_task;
+
+/**
+ * Test for the lib class.
+ *
+ * @package    tool_task
+ * @copyright  2026 Brendan Heywood <brendan@catalyst-au.net>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+final class lib_test extends \advanced_testcase {
+    /**
+     * Data provider for mtrace
+     *
+     * @return array
+     */
+    public static function tool_task_mtrace_wrapper_provider(): array {
+        return [
+            [
+                'A url http://moodle.com',
+                'A url <a target="_blank" href="http://moodle.com">http://moodle.com</a>',
+            ],
+            [
+                'A url https://moodle.com',
+                'A url <a target="_blank" href="https://moodle.com">https://moodle.com</a>',
+            ],
+            [
+                'A url https://moodle.com post text',
+                'A url <a target="_blank" href="https://moodle.com">https://moodle.com</a> post text',
+            ],
+            [
+                'A url https://moodle.com. In a paragraph',
+                'A url <a target="_blank" href="https://moodle.com">https://moodle.com</a>. In a paragraph',
+            ],
+            [
+                'A url https://localhost post text',
+                'A url <a target="_blank" href="https://localhost">https://localhost</a> post text',
+            ],
+            [
+                'A url https://main.localhost post text',
+                'A url <a target="_blank" href="https://main.localhost">https://main.localhost</a> post text',
+            ],
+            [
+                'email info@moodle.com after',
+                'email <a href="mailto:info@moodle.com">info@moodle.com</a> after',
+            ],
+            [
+                'A sentence that ends in info@moodle.com. With another sentence.',
+                'A sentence that ends in <a href="mailto:info@moodle.com">info@moodle.com</a>. With another sentence.',
+            ],
+        ];
+    }
+    /**
+     * Test validations for minute field.
+     * @dataProvider tool_task_mtrace_wrapper_provider
+     * @param string $output task output
+     * @param string $expected html
+     * @covers ::tool_task_mtrace_wrapper
+     */
+    public function test_tool_task_mtrace_wrapper(string $output, string $expected): void {
+        global $CFG;
+        require_once("{$CFG->dirroot}/{$CFG->admin}/tool/task/lib.php");
+
+        $this->expectOutputString($expected);
+        $result = tool_task_mtrace_wrapper($output);
+    }
+}

admin/tool/uploaduser/tests/behat/suspend_user_enrolment.feature

@@ -0,0 +1,41 @@
+@tool @tool_uploaduser @_file_upload
+Feature: Admin can suspend user course enrolment via CSV upload
+  In order to manage enrolments in bulk
+  As an administrator
+  I need to be able to enrol and suspend users using CSV upload
+
+  Background:
+    Given the following "courses" exist:
+      | fullname | shortname |
+      | Course 1 | C1        |
+      | Course 2 | C2        |
+      | Course 3 | C3        |
+
+  @javascript
+  Scenario: Admin uploads enrol and suspend CSVs and verifies enrolment status
+    Given I log in as "admin"
+    And I navigate to "Users > Accounts > Upload users" in site administration
+    When I upload "lib/tests/fixtures/QA_user_enrol.txt" file to "File" filemanager
+    And I press "Upload users"
+    And I press "Upload users"
+    And I press "Continue"
+    And I upload "lib/tests/fixtures/QA_user_suspend.txt" file to "File" filemanager
+    And I press "Upload users"
+    And I set the field "Upload type" to "Update existing users only"
+    And I press "Upload users"
+    And I press "Continue"
+    And I am on the "Course 1" "enrolled users" page
+    Then the following should exist in the "participants" table:
+      | First name  | Status |
+      | Learner One | Active |
+      | Learner Two | Active |
+    And I am on the "Course 2" "enrolled users" page
+    And the following should exist in the "participants" table:
+      | First name  | Status    |
+      | Learner One | Active    |
+      | Learner Two | Suspended |
+    And I am on the "Course 3" "enrolled users" page
+    And the following should exist in the "participants" table:
+      | First name  | Status    |
+      | Learner One | Suspended |
+      | Learner Two | Active    |

admin/upgradesettings.php

@@ -35,8 +35,6 @@ if (isset($newsettings['frontpagesettings'])) {
 $newsettingshtml = implode($newsettings);
 unset($newsettings);
 
-$focus = '';
-
 if (empty($adminroot->errors) and $newsettingshtml === '') {
     // there must be either redirect without message or continue button or else upgrade would be sometimes broken
     if ($return == 'site') {
@@ -48,12 +46,12 @@ if (empty($adminroot->errors) and $newsettingshtml === '') {
 
 if (!empty($adminroot->errors)) {
     $firsterror = reset($adminroot->errors);
-    $focus = $firsterror->id;
+    $PAGE->set_focuscontrol($firsterror->id);
 }
 
 // and finally, if we get here, then there are new settings and we have to print a form
 // to modify them
-echo $OUTPUT->header($focus);
+echo $OUTPUT->header();
 
 if (!empty($SITE->fullname) and !empty($SITE->shortname)) {
     echo $OUTPUT->box(get_string('upgradesettingsintro','admin'), 'generalbox');

admin/webservice/forms.php

@@ -196,8 +196,12 @@ class external_service_functions_form extends moodleform {
         //we add the descriptions to the functions
         foreach ($functions as $functionid => $functionname) {
             //retrieve full function information (including the description)
-            $function = \core_external\external_api::external_function_info($functionname);
-            if (empty($function->deprecated)) {
+            try {
+                $function = \core_external\external_api::external_function_info($functionname);
+            } catch (Throwable $exception) {
+                $function = null;
+            }
+            if ($function !== null && empty($function->deprecated)) {
                 $functions[$functionid] = $function->name . ':' . $function->description;
             } else {
                 // Exclude the deprecated ones.

ai/configure.php

@@ -72,6 +72,12 @@ $PAGE->set_pagelayout('admin');
 $PAGE->set_title($title);
 $PAGE->set_heading($title);
 
+// Explode if there are no provider plugins installed.
+$plugins = core_plugin_manager::instance()->get_plugins_of_type('aiprovider');
+if (empty($plugins)) {
+    throw new moodle_exception('noproviderplugins', 'core_ai');
+}
+
 // Provider instance form processing.
 $mform = new \core_ai\form\ai_provider_form(customdata: $data);
 if ($mform->is_cancelled()) {

ai/provider/ollama/classes/abstract_processor.php

@@ -152,7 +152,7 @@ abstract class abstract_processor extends process_base {
             $responsearr['errormessage'] = $response->getReasonPhrase();
         } else {
             $bodyobj = json_decode($response->getBody()->getContents());
-            $responsearr['errormessage'] = $bodyobj->error->message;
+            $responsearr['errormessage'] = $bodyobj->error;
         }
 
         return $responsearr;

ai/provider/ollama/classes/provider.php

@@ -55,7 +55,7 @@ class provider extends \core_ai\provider {
 
     #[\Override]
     public function add_authentication_headers(RequestInterface $request): RequestInterface {
-        if (empty($this->config['basicauthenabled'])) {
+        if (empty($this->config['enablebasicauth'])) {
             return $request;
         } else {
             // Add the Authorization header for basic auth.

ai/provider/ollama/tests/process_explain_text_test.php

@@ -151,12 +151,21 @@ final class process_explain_text_test extends \advanced_testcase {
         $responses = [
             500 => new Response(500, ['Content-Type' => 'application/json']),
             503 => new Response(503, ['Content-Type' => 'application/json']),
-            401 => new Response(401, ['Content-Type' => 'application/json'],
-                '{"error": {"message": "Invalid Authentication"}}'),
-            404 => new Response(404, ['Content-Type' => 'application/json'],
-                '{"error": {"message": "You must be a member of an organization to use the API"}}'),
-            429 => new Response(429, ['Content-Type' => 'application/json'],
-                '{"error": {"message": "Rate limit reached for requests"}}'),
+            401 => new Response(
+                401,
+                ['Content-Type' => 'application/json'],
+                json_encode(['error' => 'Invalid Authentication']),
+            ),
+            404 => new Response(
+                404,
+                ['Content-Type' => 'application/json'],
+                json_encode(['error' => 'You must be a member of an organization to use the API']),
+            ),
+            429 => new Response(
+                429,
+                ['Content-Type' => 'application/json'],
+                json_encode(['error' => 'Rate limit reached for requests']),
+            ),
         ];
 
         $processor = new process_explain_text($this->provider, $this->action);
@@ -316,7 +325,7 @@ final class process_explain_text_test extends \advanced_testcase {
         $mock->append(new Response(
             401,
             ['Content-Type' => 'application/json'],
-            json_encode(['error' => ['message' => 'Invalid Authentication']]),
+            json_encode(['error' => 'Invalid Authentication']),
         ));
 
         $processor = new process_explain_text($this->provider, $this->action);

ai/provider/ollama/tests/process_generate_text_test.php

@@ -153,17 +153,17 @@ final class process_generate_text_test extends \advanced_testcase {
             401 => new Response(
                 401,
                 ['Content-Type' => 'application/json'],
-                json_encode(['error' => ['message' => 'Invalid Authentication']]),
+                json_encode(['error' => 'Invalid Authentication']),
             ),
             404 => new Response(
                 404,
                 ['Content-Type' => 'application/json'],
-                json_encode(['error' => ['message' => 'You must be a member of an organization to use the API']]),
+                json_encode(['error' => 'You must be a member of an organization to use the API']),
             ),
             429 => new Response(
                 429,
                 ['Content-Type' => 'application/json'],
-                json_encode(['error' => ['message' => 'Rate limit reached for requests']]),
+                json_encode(['error' => 'Rate limit reached for requests']),
             ),
         ];
 
@@ -325,7 +325,7 @@ final class process_generate_text_test extends \advanced_testcase {
         $mock->append(new Response(
             401,
             ['Content-Type' => 'application/json'],
-            json_encode(['error' => ['message' => 'Invalid Authentication']]),
+            json_encode(['error' => 'Invalid Authentication']),
         ));
 
         $processor = new process_generate_text($this->provider, $this->action);

ai/provider/ollama/tests/process_summarise_text_test.php

@@ -151,12 +151,21 @@ final class process_summarise_text_test extends \advanced_testcase {
         $responses = [
             500 => new Response(500, ['Content-Type' => 'application/json']),
             503 => new Response(503, ['Content-Type' => 'application/json']),
-            401 => new Response(401, ['Content-Type' => 'application/json'],
-                '{"error": {"message": "Invalid Authentication"}}'),
-            404 => new Response(404, ['Content-Type' => 'application/json'],
-                '{"error": {"message": "You must be a member of an organization to use the API"}}'),
-            429 => new Response(429, ['Content-Type' => 'application/json'],
-                '{"error": {"message": "Rate limit reached for requests"}}'),
+            401 => new Response(
+                401,
+                ['Content-Type' => 'application/json'],
+                json_encode(['error' => 'Invalid Authentication']),
+            ),
+            404 => new Response(
+                404,
+                ['Content-Type' => 'application/json'],
+                json_encode(['error' => 'You must be a member of an organization to use the API']),
+            ),
+            429 => new Response(
+                429,
+                ['Content-Type' => 'application/json'],
+                json_encode(['error' => 'Rate limit reached for requests']),
+            ),
         ];
 
         $processor = new process_summarise_text($this->provider, $this->action);
@@ -316,7 +325,7 @@ final class process_summarise_text_test extends \advanced_testcase {
         $mock->append(new Response(
             401,
             ['Content-Type' => 'application/json'],
-            json_encode(['error' => ['message' => 'Invalid Authentication']]),
+            json_encode(['error' => 'Invalid Authentication']),
         ));
 
         $processor = new process_summarise_text($this->provider, $this->action);

auth/email/auth.php

@@ -171,7 +171,7 @@ class auth_plugin_email extends auth_plugin_base {
      * @param string $confirmsecret
      */
     function user_confirm($username, $confirmsecret) {
-        global $DB, $SESSION;
+        global $DB;
         $user = get_complete_user_data('username', $username);
 
         if (!empty($user)) {
@@ -179,17 +179,15 @@ class auth_plugin_email extends auth_plugin_base {
                 return AUTH_CONFIRM_ERROR;
 
             } else if ($user->secret === $confirmsecret && $user->confirmed) {
+                // Clean up stale wantsurl preference if user clicks confirmation link again.
+                unset_user_preference('auth_email_wantsurl', $user);
                 return AUTH_CONFIRM_ALREADY;
 
             } else if ($user->secret === $confirmsecret) {   // They have provided the secret key to get in
                 $DB->set_field("user", "confirmed", 1, array("id"=>$user->id));
-
-                if ($wantsurl = get_user_preferences('auth_email_wantsurl', false, $user)) {
-                    // Ensure user gets returned to page they were trying to access before signing up.
-                    $SESSION->wantsurl = $wantsurl;
-                    unset_user_preference('auth_email_wantsurl', $user);
-                }
-
+                // Clean up the wantsurl preference regardless of how confirmation was triggered
+                // (e.g. /login/confirm.php, admin single confirm, bulk confirm, web service).
+                unset_user_preference('auth_email_wantsurl', $user);
                 return AUTH_CONFIRM_OK;
             }
         } else {

auth/email/tests/auth_test.php

@@ -0,0 +1,96 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_email;
+
+/**
+ * Tests for email authentication plugin.
+ *
+ * @package     auth_email
+ * @copyright   2026 Moodle Pty Ltd
+ * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers      \auth_plugin_email
+ */
+final class auth_test extends \advanced_testcase {
+    /**
+     * Test that user_confirm() cleans up the auth_email_wantsurl preference
+     * when confirming a user for the first time (AUTH_CONFIRM_OK).
+     */
+    public function test_user_confirm_cleans_up_wantsurl_preference(): void {
+        global $DB;
+        $this->resetAfterTest(true);
+
+        // Create an unconfirmed user with the email auth method.
+        $user = $this->getDataGenerator()->create_user([
+            'auth' => 'email',
+            'confirmed' => 0,
+        ]);
+        $secret = random_string(15);
+        $DB->set_field('user', 'secret', $secret, ['id' => $user->id]);
+
+        // Simulate the wantsurl preference saved at signup time.
+        set_user_preference('auth_email_wantsurl', 'https://example.com/course/view.php?id=42', $user);
+        $this->assertTrue(
+            $DB->record_exists('user_preferences', ['userid' => $user->id, 'name' => 'auth_email_wantsurl']),
+            'Preference should exist in DB before confirmation.'
+        );
+
+        $auth = get_auth_plugin('email');
+        $result = $auth->user_confirm($user->username, $secret);
+
+        $this->assertEquals(AUTH_CONFIRM_OK, $result);
+        $this->assertFalse(
+            $DB->record_exists('user_preferences', ['userid' => $user->id, 'name' => 'auth_email_wantsurl']),
+            'auth_email_wantsurl preference must be removed from DB after successful confirmation.'
+        );
+    }
+
+    /**
+     * Test that user_confirm() cleans up the auth_email_wantsurl preference
+     * even when the user is already confirmed (AUTH_CONFIRM_ALREADY).
+     *
+     * This covers the edge case where a user clicks the confirmation link
+     * a second time — the stale preference should still be cleaned up.
+     */
+    public function test_user_confirm_already_confirmed_cleans_up_wantsurl_preference(): void {
+        global $DB;
+        $this->resetAfterTest(true);
+
+        // Create an already-confirmed user with the email auth method.
+        $user = $this->getDataGenerator()->create_user([
+            'auth' => 'email',
+            'confirmed' => 1,
+        ]);
+        $secret = random_string(15);
+        $DB->set_field('user', 'secret', $secret, ['id' => $user->id]);
+
+        // Simulate a stale wantsurl preference left over from signup.
+        set_user_preference('auth_email_wantsurl', 'https://example.com/course/view.php?id=42', $user);
+        $this->assertTrue(
+            $DB->record_exists('user_preferences', ['userid' => $user->id, 'name' => 'auth_email_wantsurl']),
+            'Preference should exist in DB before re-confirmation.'
+        );
+
+        $auth = get_auth_plugin('email');
+        $result = $auth->user_confirm($user->username, $secret);
+
+        $this->assertEquals(AUTH_CONFIRM_ALREADY, $result);
+        $this->assertFalse(
+            $DB->record_exists('user_preferences', ['userid' => $user->id, 'name' => 'auth_email_wantsurl']),
+            'auth_email_wantsurl preference must be removed from DB even when user is already confirmed.'
+        );
+    }
+}

auth/oauth2/classes/api.php

@@ -197,9 +197,7 @@ class api {
 
         $data->link = $confirmationurl->out(false);
         $message = get_string('confirmlinkedloginemail', 'auth_oauth2', $data);
-
-        $data->link = $confirmationurl->out();
-        $messagehtml = text_to_html(get_string('confirmlinkedloginemail', 'auth_oauth2', $data), false, false, true);
+        $messagehtml = text_to_html(get_string('confirmlinkedloginemail', 'auth_oauth2', $data), false, false);
 
         $user->mailformat = 1;  // Always send HTML version as well.
 
@@ -339,9 +337,7 @@ class api {
 
         $data->link = $confirmationurl->out(false);
         $message = get_string('confirmaccountemail', 'auth_oauth2', $data);
-
-        $data->link = $confirmationurl->out();
-        $messagehtml = text_to_html(get_string('confirmaccountemail', 'auth_oauth2', $data), false, false, true);
+        $messagehtml = text_to_html(get_string('confirmaccountemail', 'auth_oauth2', $data), false, false);
 
         $user->mailformat = 1;  // Always send HTML version as well.
 

auth/oauth2/classes/auth.php

@@ -467,18 +467,31 @@ class auth extends \auth_plugin_base {
             $mappeduser = get_complete_user_data('id', $linkedlogin->get('userid'));
 
             if ($mappeduser && $mappeduser->suspended) {
-                $failurereason = AUTH_LOGIN_SUSPENDED;
-                $event = \core\event\user_login_failed::create([
-                    'userid' => $mappeduser->id,
-                    'other' => [
-                        'username' => $userinfo['username'],
-                        'reason' => $failurereason
-                    ]
-                ]);
-                $event->trigger();
-                $SESSION->loginerrormsg = get_string('invalidlogin');
-                $client->log_out();
-                redirect(new moodle_url('/login/index.php'));
+                // Check if there's another user with the same email that is not suspended.
+                $moodleuser = \core_user::get_user_by_email($userinfo['email'], '*', null, IGNORE_MULTIPLE);
+                if ($moodleuser->id == $mappeduser->id) {
+                    $failurereason = AUTH_LOGIN_SUSPENDED;
+                    $event = \core\event\user_login_failed::create([
+                        'userid' => $mappeduser->id,
+                        'other' => [
+                            'username' => $userinfo['username'],
+                            'reason' => $failurereason,
+                        ],
+                    ]);
+                    $event->trigger();
+                    $SESSION->loginerrormsg = get_string('invalidlogin');
+                    $client->log_out();
+                    redirect(new moodle_url('/login/index.php'));
+                } else if ($moodleuser && !$moodleuser->suspended) {
+                    // Update the OAuth2 linked login to point to the active user account.
+                    $linkedlogin->set('userid', $moodleuser->id);
+                    $linkedlogin->set('timemodified', time());
+                    $linkedlogin->update();
+
+                    // Update user fields and continue with login.
+                    $userinfo = $this->update_user($userinfo, $moodleuser);
+                    $userwasmapped = true;
+                }
             } else if ($mappeduser && ($mappeduser->confirmed || !$issuer->get('requireconfirmation'))) {
                 // Update user fields.
                 $userinfo = $this->update_user($userinfo, $mappeduser);
@@ -508,7 +521,6 @@ class auth extends \auth_plugin_base {
             redirect(new moodle_url('/login/index.php'));
         }
 
-
         if (!$issuer->is_valid_login_domain($oauthemail)) {
             // Trigger login failed event.
             $failurereason = AUTH_LOGIN_UNAUTHORISED;
@@ -524,8 +536,24 @@ class auth extends \auth_plugin_base {
 
         if (!$userwasmapped) {
             // No defined mapping - we need to see if there is an existing account with the same email.
+            $moodleuser = \core_user::get_user_by_email($userinfo['email'], '*', null, IGNORE_MULTIPLE);
+
+            // Ensure we don't link a login for a suspended user.
+            if (!empty($moodleuser) && $moodleuser->suspended) {
+                $failurereason = AUTH_LOGIN_SUSPENDED;
+                $event = \core\event\user_login_failed::create([
+                    'userid' => $moodleuser->id,
+                    'other' => [
+                        'username' => $userinfo['email'],
+                        'reason' => $failurereason,
+                    ],
+                ]);
+                $event->trigger();
+                $SESSION->loginerrormsg = get_string('invalidlogin');
+                $client->log_out();
+                redirect(new moodle_url('/login/index.php'));
+            }
 
-            $moodleuser = \core_user::get_user_by_email($userinfo['email']);
             if (!empty($moodleuser)) {
                 if ($issuer->get('requireconfirmation')) {
                     $PAGE->set_url('/auth/oauth2/confirm-link-login.php');

auth/oauth2/lang/en/auth_oauth2.php

@@ -27,19 +27,14 @@ $string['auth_oauth2description'] = 'OAuth 2 standards based authentication';
 $string['auth_oauth2settings'] = 'OAuth 2 authentication settings.';
 $string['confirmaccountemail'] = 'Hi {$a->firstname},
 
-A new account has been requested at \'{$a->sitename}\'
-using your email address.
+A new account has been requested at \'{$a->sitename}\' using your email address.
 
-To confirm your new account, please go to this web address:
+To confirm your new account, please click the link below:
 
-{$a->link}
+<a href="{$a->link}">Confirm your account</a>
 
-In most mail programs, this should appear as a blue link
-which you can just click on.  If that doesn\'t work,
-then cut and paste the address into the address
-line at the top of your web browser window.
 
-If you need help, please contact the site administrator,
+If you need help, please contact the site administrator.
 {$a->admin}
 
 If you did not do this, someone else could be trying to compromise your account.
@@ -53,16 +48,12 @@ A request has been made to link the {$a->issuername} login
 {$a->linkedemail} to your account at \'{$a->sitename}\'
 using your email address.
 
-To confirm this request and link these logins, please go to this web address:
+To confirm this request and link these logins, please click the link below:
 
-{$a->link}
+<a href="{$a->link}">Link your accounts</a>
 
-In most mail programs, this should appear as a blue link
-which you can just click on.  If that doesn\'t work,
-then cut and paste the address into the address
-line at the top of your web browser window.
 
-If you need help, please contact the site administrator,
+If you need help, please contact the site administrator.
 {$a->admin}
 
 If you did not do this, someone else could be trying to compromise your account.

auth/tests/behat/loginform.feature

@@ -34,11 +34,13 @@ Feature: Test if the login form provides the correct feedback
   Scenario: Set logo for loginpage
     Given I log in as "admin"
     And I navigate to "Appearance > Logos" in site administration
-    And I upload "course/tests/fixtures/image.jpg" file to "Logo" filemanager
+    And I upload "lib/tests/fixtures/1.jpg" file to "Logo" filemanager
+    And I upload "lib/tests/fixtures/2.jpg" file to "Favicon" filemanager
     And I press "Save changes"
     And I log out
     And I follow "Log in"
-    Then "//img[@id='logoimage']" "xpath_element" should exist
+    Then "//img[@id='logoimage' and contains(@src, '/1.jpg')]" "xpath_element" should exist
+    And "//link[@rel='shortcut icon' and contains(@href, '/2.jpg')]" "xpath_element" should exist
 
   Scenario: Add a custom welcome message
     Given the following config values are set as admin:

availability/condition/completion/tests/behat/availability_completion_previous.feature

@@ -32,7 +32,7 @@ Feature: Confirm that availability_completion works with previous activity setti
     And I expand all fieldsets
     And I click on "Add restriction..." "button"
     And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
-    And I click on "Displayed if student doesn't meet this condition • Click to hide" "link"
+    And I click on "Item name displayed with access restriction information if student doesn't meet this condition • Click to hide" "link"
     And I set the field "Activity or resource" to "Previous activity with completion"
     And I press "Save and return to course"
     Then I should see "Not available unless: The previous activity with completion" in the "region-main" "region"
@@ -58,7 +58,7 @@ Feature: Confirm that availability_completion works with previous activity setti
     And I expand all fieldsets
     And I click on "Add restriction..." "button"
     And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
-    And I click on "Displayed if student doesn't meet this condition • Click to hide" "link"
+    And I click on "Item name displayed with access restriction information if student doesn't meet this condition • Click to hide" "link"
     And I set the field "Activity or resource" to "Previous activity with completion"
     And I press "Save and return to course"
     Then I should see "Not available unless: The previous activity with completion" in the "region-main" "region"
@@ -83,7 +83,7 @@ Feature: Confirm that availability_completion works with previous activity setti
     And I expand all fieldsets
     And I click on "Add restriction..." "button"
     And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
-    And I click on "Displayed if student doesn't meet this condition • Click to hide" "link"
+    And I click on "Item name displayed with access restriction information if student doesn't meet this condition • Click to hide" "link"
     And I set the field "Activity or resource" to "Previous activity with completion"
     And I press "Save and return to course"
     Then I should see "Not available unless: The previous activity with completion" in the "region-main" "region"
@@ -112,7 +112,7 @@ Feature: Confirm that availability_completion works with previous activity setti
     And I expand all fieldsets
     And I click on "Add restriction..." "button"
     And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
-    And I click on "Displayed if student doesn't meet this condition • Click to hide" "link"
+    And I click on "Item name displayed with access restriction information if student doesn't meet this condition • Click to hide" "link"
     And I set the field "Activity or resource" to "Previous activity with completion"
     And I press "Save changes"
     Then I should see "Not available unless: The previous activity with completion" in the "region-main" "region"
@@ -138,7 +138,7 @@ Feature: Confirm that availability_completion works with previous activity setti
     And I expand all fieldsets
     And I click on "Add restriction..." "button"
     And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
-    And I click on "Displayed if student doesn't meet this condition • Click to hide" "link"
+    And I click on "Item name displayed with access restriction information if student doesn't meet this condition • Click to hide" "link"
     Then the "Activity or resource" select box should not contain "Previous activity with completion"
 
     # Set Page2 restriction to Previous Activity with completion and delete Page1.
@@ -148,7 +148,7 @@ Feature: Confirm that availability_completion works with previous activity setti
     And I expand all fieldsets
     And I click on "Add restriction..." "button"
     And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
-    And I click on "Displayed if student doesn't meet this condition • Click to hide" "link"
+    And I click on "Item name displayed with access restriction information if student doesn't meet this condition • Click to hide" "link"
     And I set the field "Activity or resource" to "Previous activity with completion"
     And I press "Save and return to course"
     Then I should see "Not available unless: The previous activity with completion" in the "region-main" "region"
@@ -170,7 +170,7 @@ Feature: Confirm that availability_completion works with previous activity setti
     And I expand all fieldsets
     And I click on "Add restriction..." "button"
     And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
-    And I click on "Displayed if student doesn't meet this condition • Click to hide" "link"
+    And I click on "Item name displayed with access restriction information if student doesn't meet this condition • Click to hide" "link"
     And I set the field "Activity or resource" to "Previous activity with completion"
     And I press "Save changes"
     Then I should see "Not available unless: The previous activity with completion" in the "region-main" "region"
@@ -184,7 +184,7 @@ Feature: Confirm that availability_completion works with previous activity setti
     And I expand all fieldsets
     And I click on "Add restriction..." "button"
     And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
-    And I click on "Displayed if student doesn't meet this condition • Click to hide" "link"
+    And I click on "Item name displayed with access restriction information if student doesn't meet this condition • Click to hide" "link"
     And I set the field "Activity or resource" to "Previous activity with completion"
     And I press "Save changes"
     And I should see "Not available unless: The previous activity with completion" in the "region-main" "region"

availability/tests/behat/display_availability.feature

@@ -180,4 +180,4 @@ Feature: Display availability for activities and sections
     And I should not see "Date" in the "Restrict access" "fieldset"
     And I press "Add restriction..."
     And I click on "Grade" "button" in the "Add restriction..." "dialogue"
-    And the "alt" attribute of ".availability-item .availability-eye img" "css_element" should contain "Displayed if student"
+    And the "alt" attribute of ".availability-item .availability-eye img" "css_element" should contain "Item name displayed"

availability/tests/behat/edit_availability.feature

@@ -89,13 +89,13 @@ Feature: edit_availability
     And I should see "Date" in the "Restrict access" "fieldset"
     And ".availability-item .availability-eye img" "css_element" should be visible
     And ".availability-item .availability-delete img" "css_element" should be visible
-    And the "alt" attribute of ".availability-item .availability-eye img" "css_element" should contain "Displayed if student"
+    And the "alt" attribute of ".availability-item .availability-eye img" "css_element" should contain "Item name displayed"
 
     # Toggle the eye icon.
     When I click on ".availability-item .availability-eye img" "css_element"
     Then the "alt" attribute of ".availability-item .availability-eye img" "css_element" should contain "Hidden entirely"
     When I click on ".availability-item .availability-eye img" "css_element"
-    Then the "alt" attribute of ".availability-item .availability-eye img" "css_element" should contain "Displayed if student"
+    Then the "alt" attribute of ".availability-item .availability-eye img" "css_element" should contain "Item name displayed"
 
     # Click the delete button.
     When I click on ".availability-item .availability-delete img" "css_element"

backup/moodle2/backup_stepslib.php

@@ -2645,6 +2645,7 @@ class backup_questions_structure_step extends backup_structure_step {
                 'questioncategoryid',
                 'idnumber',
                 'ownerid',
+                'nextversion',
             ]);
 
         $questionversions = new backup_nested_element('question_version');
@@ -2721,7 +2722,7 @@ class backup_questions_structure_step extends backup_structure_step {
              WHERE bi.backupid = ?
                AND bi.itemname = 'question_categoryfinal'", [backup::VAR_BACKUPID]);
 
-        // Add all question bank entries from "complete" categories, plus annotated question bank entires
+        // Add all question bank entries from "complete" categories, plus annotated question bank entires and their children
         // from "partial" categories.
         $questionbankentry->set_source_sql(
             "
@@ -2733,8 +2734,11 @@ class backup_questions_structure_step extends backup_structure_step {
                 UNION
                 SELECT qbe.*
                  FROM {question_bank_entries} qbe
+                 JOIN {question_versions} qv ON qv.questionbankentryid = qbe.id
+                 JOIN {question} q ON q.id = qv.questionid
+                 LEFT JOIN {question_versions} parentqv ON parentqv.questionid = q.parent
                  JOIN {question_category_partial_temp} qcp ON qcp.itemid = qbe.questioncategoryid
-                 JOIN {backup_ids_temp} biq ON biq.itemid = qbe.id
+                 JOIN {backup_ids_temp} biq ON biq.itemid = qbe.id OR biq.itemid = parentqv.questionbankentryid
                 WHERE qcp.itemid = ?
                       AND qcp.backupid = ?
                       AND biq.backupid = ?

backup/moodle2/restore_root_task.class.php

@@ -78,6 +78,9 @@ class restore_root_task extends restore_task {
         // Unconditionally, load create all the needed outcomes
         $this->add_step(new restore_outcomes_structure_step('create_scales', 'outcomes.xml'));
 
+        // If we haven't preloaded information, load all the question banks to temp_ids_table.
+        $this->add_step(new \core\backup\restore_load_questionbanks('load_questionbanks'));
+
         // If we haven't preloaded information, load all the needed categories and questions (reduced) to temp_ids_table
         $this->add_step(new restore_load_categories_and_questions('load_categories_and_questions'));
 

backup/moodle2/restore_stepslib.php

@@ -27,6 +27,9 @@
 
 defined('MOODLE_INTERNAL') || die();
 
+use core_question\local\bank\question_version_status;
+use core_question\versions;
+
 /**
  * delete old directories and conditionally create backup_temp_ids table
  */
@@ -5289,6 +5292,15 @@ class restore_create_categories_and_questions extends restore_structure_step {
                 $this->set_mapping('question_bank_entry', $this->latestqbe->oldid, $this->latestqbe->newid);
             }
 
+            if (
+                ($data->qtype === 'random')
+                && ($this->latestversion->status == \core_question\local\bank\question_version_status::QUESTION_STATUS_HIDDEN)
+            ) {
+                // Ensure that this newly created question is considered by
+                // \qtype_random\task\remove_unused_questions.
+                $this->latestversion->status = \core_question\local\bank\question_version_status::QUESTION_STATUS_DRAFT;
+            }
+
             // Now store the question.
             $newitemid = $DB->insert_record('question', $data);
             $this->set_mapping('question', $oldid, $newitemid);
@@ -5301,9 +5313,55 @@ class restore_create_categories_and_questions extends restore_structure_step {
             $oldqvid = $this->latestversion->id;
             $this->latestversion->questionbankentryid = $this->latestqbe->newid;
             $this->latestversion->questionid = $newitemid;
+            // In case the backed up version was deleted and a new one created in its place, increase the version numbers of
+            // conflicting versions to make room for this one.
+            $transaction = $DB->start_delegated_transaction();
+            if (
+                $DB->record_exists(
+                    'question_versions',
+                    [
+                        'questionbankentryid' => $this->latestversion->questionbankentryid,
+                        'version' => $this->latestversion->version,
+                    ],
+                )
+            ) {
+                // We'll update each higher version and any references one-at-a-time, starting with the highest, to avoid
+                // creating a duplicate questionbankentryid-version combination in question_versions.
+                $moveversions = $DB->get_records_select(
+                    'question_versions',
+                    'questionbankentryid = :questionbankentryid AND version >= :oldversion',
+                    [
+                        'questionbankentryid' => $this->latestversion->questionbankentryid,
+                        'oldversion' => $this->latestversion->version,
+                    ],
+                    'version DESC',
+                );
+                foreach ($moveversions as $moveversion) {
+                    $DB->set_field(
+                        'question_versions',
+                        'version',
+                        $moveversion->version + 1,
+                        [
+                            'questionbankentryid' => $moveversion->questionbankentryid,
+                            'version' => $moveversion->version,
+                        ]
+                    );
+                    $DB->set_field(
+                        'question_references',
+                        'version',
+                        $moveversion->version + 1,
+                        [
+                            'questionbankentryid' => $moveversion->questionbankentryid,
+                            'version' => $moveversion->version,
+                        ]
+                    );
+                }
+                // Ensure the nextversion value has been initialised, and increment it to account for the additional version.
+                versions::get_next_version($this->latestversion->questionbankentryid);
+            }
             $newqvid = $DB->insert_record('question_versions', $this->latestversion);
             $this->set_mapping('question_versions', $oldqvid, $newqvid);
-
+            $transaction->allow_commit();
         } else {
             // By performing this set_mapping() we make get_old/new_parentid() to work for all the
             // children elements of the 'question' one (so qtype plugins will know the question they belong to).
@@ -5311,6 +5369,18 @@ class restore_create_categories_and_questions extends restore_structure_step {
 
             // Also create the question_bank_entry and version mappings, if required.
             $newquestionversion = $DB->get_record('question_versions', ['questionid' => $questionmapping->newitemid]);
+            // Restore the version to ready state if it has been hidden.
+            if (
+                $newquestionversion->status == question_version_status::QUESTION_STATUS_HIDDEN
+                && $this->latestversion->status == question_version_status::QUESTION_STATUS_READY
+            ) {
+                $DB->set_field(
+                    'question_versions',
+                    'status',
+                    question_version_status::QUESTION_STATUS_READY,
+                    ['questionid' => $questionmapping->newitemid],
+                );
+            }
             $this->set_mapping('question_versions', $this->latestversion->id, $newquestionversion->id);
             if (empty($this->latestqbe->newid)) {
                 $this->latestqbe->oldid = $this->latestqbe->id;
@@ -5402,12 +5472,18 @@ class restore_create_categories_and_questions extends restore_structure_step {
             }
             $tagcontextid = $this->cachedcategory->contextid;
             // Add the tag to the question.
-            core_tag_tag::add_item_tag('core_question',
+            $taginstanceid = core_tag_tag::add_item_tag(
+                'core_question',
                 'question',
                 $newquestion,
                 context::instance_by_id($tagcontextid),
-                $tagname
+                $tagname,
             );
+            $tagid = $DB->get_field('tag_instance', 'tagid', ['id' => $taginstanceid]);
+            if ($tagid != $data->id) {
+                // The tag didn't exist already, map the new ID.
+                $this->set_mapping('tag', $data->id, $tagid);
+            }
         }
     }
 
@@ -5485,7 +5561,11 @@ class restore_move_module_questions_categories extends restore_execution_step {
                 // but if that context still exists on the site and the user has access then point question references
                 // to the originals.
                 $originalcontext = context::instance_by_id($contextid, IGNORE_MISSING);
-                if ($originalcontext && has_capability('mod/qbank:view', $originalcontext)) {
+                if (
+                    $this->task->is_samesite()
+                    && $originalcontext
+                    && has_capability('mod/qbank:view', $originalcontext)
+                ) {
                     $originalquestions = get_questions_category(question_get_top_category($contextid), false);
                     $targetcoursecontext = context_course::instance($this->get_courseid());
                     foreach ($originalquestions as $originalquestion) {
@@ -5608,13 +5688,19 @@ class restore_move_module_questions_categories extends restore_execution_step {
                 // We need to check all the question_set_references belonging to this context_module.
                 $references = $DB->get_records('question_set_references', ['usingcontextid' => $newcontext->newitemid]);
                 foreach ($references as $reference) {
-                    $filtercondition = json_decode($reference->filtercondition);
-                    if (!empty($filtercondition->questioncategoryid) &&
-                            in_array($filtercondition->questioncategoryid, $categoryids)) {
-                        // This is one of ours, update the questionscontextid.
-                        $DB->set_field('question_set_references',
-                            'questionscontextid', $newcontext->newitemid,
-                            ['id' => $reference->id]);
+                    $filtercondition = json_decode($reference->filtercondition, true);
+                    if (!array_key_exists('filter', $filtercondition)) {
+                        $filtercondition = \core_question\question_reference_manager::convert_legacy_set_reference_filter_condition(
+                            $filtercondition,
+                        );
+                    }
+                    $questioncategoryid = $filtercondition['filter']['category']['values'][0];
+                    if (in_array($questioncategoryid, $categoryids)) {
+                        // This is one of ours, update the questionscontextid and filtercondition fields.
+                        $reference->questionscontextid = $newcontext->newitemid;
+                        $filtercondition['cat'] = "{$questioncategoryid},{$newcontext->newitemid}";
+                        $reference->filtercondition = json_encode($filtercondition);
+                        $DB->update_record('question_set_references', $reference);
                     }
                 }
             }
@@ -5629,20 +5715,20 @@ class restore_move_module_questions_categories extends restore_execution_step {
                 );
             }
         }
-        // Remove any remaining course-level question categories from the restored course.
+        // Remove any remaining course-level question categories and their questions from the restored course.
         $coursecatsql = "
-            SELECT qc.id AS categoryid
+            SELECT qc.id AS id, qc.contextid AS contextid
               FROM {question_categories} qc
               JOIN {context} c ON c.id = qc.contextid
              WHERE c.contextlevel = :courselevel AND c.instanceid = :courseid
         ";
-        $DB->delete_records_subquery(
-            'question_categories',
-            'id',
-            'categoryid',
+        $categories = $DB->get_records_sql(
             $coursecatsql,
-            ['courselevel' => context_course::LEVEL, 'courseid' => $this->task->get_courseid()]
+            ['courselevel' => context_course::LEVEL, 'courseid' => $this->task->get_courseid()],
         );
+        foreach ($categories as $category) {
+            question_category_delete_safe($category);
+        }
     }
 }
 
@@ -6421,50 +6507,47 @@ trait restore_question_set_reference_data_trait {
     public function process_question_set_reference($data) {
         global $DB;
         $data = (object) $data;
-        $owncontext = $data->usingcontextid == $data->questionscontextid;
         $data->usingcontextid = $this->get_mappingid('context', $data->usingcontextid);
         $data->itemid = $this->get_new_parentid('quiz_question_instance');
+
+        $originalbankinbackup = (bool) restore_dbops::get_backup_ids_record(
+            $this->get_restoreid(),
+            'questionbank',
+            $data->questionscontextid,
+        );
+
+        if ($context = $this->get_mappingid('context', $data->questionscontextid)) {
+            $data->questionscontextid = $context;
+        } else {
+            $this->log(
+                "question_set_reference with old id {$data->id} referenced question context "
+                . "{$data->questionscontextid} which was not included in the backup. Therefore, this has been "
+                . "restored with the old questionscontextid.",
+                backup::LOG_WARNING,
+            );
+        }
+
         $filtercondition = json_decode($data->filtercondition, true);
 
         if (!isset($filtercondition['filter'])) {
             // Pre-4.3, convert the old filtercondition format to the new format.
+            // Don't map tags to new IDs, the plugin will do that below.
             $filtercondition = \core_question\question_reference_manager::convert_legacy_set_reference_filter_condition(
-                    $filtercondition);
+                $filtercondition,
+                false,
+            );
         }
 
-        // Map category id used for category filter condition and corresponding context id.
-        $oldcategoryid = $filtercondition['filter']['category']['values'][0];
-        // Decide if we're going to refer back to the original category, or to the new category.
-        // Are we restoring to a different site?
-        // Has the original context or category been deleted?
-        // Did the old category belong to the same context as the original set reference?
-        // Are we allowed to use its questions?
-        $questionscontext = context::instance_by_id($data->questionscontextid, IGNORE_MISSING);
-        if (
-            !$this->get_task()->is_samesite()
-            || !$questionscontext
-            || !$DB->record_exists('question_categories', ['id' => $oldcategoryid])
-            || $owncontext
-            || !has_capability('moodle/question:useall', $questionscontext)
-        ) {
-            $newcategoryid = $this->get_mappingid('question_category', $oldcategoryid);
-            $filtercondition['filter']['category']['values'][0] = $newcategoryid;
+        $qbankfeatureclasses = \core\component::get_plugin_list_with_class('qbank', 'plugin_feature');
 
-            if ($context = $this->get_mappingid('context', $data->questionscontextid)) {
-                $data->questionscontextid = $context;
-            } else {
-                $this->log('question_set_reference with old id ' . $data->id .
-                    ' referenced question context ' . $data->questionscontextid .
-                    ' which was not included in the backup. Therefore, this has been ' .
-                    ' restored with the old questionscontextid.', backup::LOG_WARNING);
+        foreach ($qbankfeatureclasses as $qbankfeatureclass) {
+            $qbankfeature = new $qbankfeatureclass();
+            $filters = $qbankfeature->get_question_filters();
+            foreach ($filters as $filter) {
+                $filtercondition = $filter->restore_filtercondition($filtercondition, $data, $this, $originalbankinbackup);
             }
         }
 
-        $filtercondition['cat'] = implode(',', [
-            $filtercondition['filter']['category']['values'][0],
-            $data->questionscontextid,
-        ]);
-
         $data->filtercondition = json_encode($filtercondition);
 
         $DB->insert_record('question_set_references', $data);

backup/tests/async_backup_test.php

@@ -107,17 +107,12 @@ final class async_backup_test extends \advanced_testcase {
         $asynctask = new \core\task\asynchronous_backup_task();
         $asynctask->set_custom_data(['backupid' => $backupid]);
         $asynctask->set_userid($USER->id);
-        \core\task\manager::queue_adhoc_task($asynctask);
 
         // We are expecting trace output during this test.
         $this->expectOutputRegex("/$backupid/");
 
         // Execute adhoc task.
-        $now = time();
-        $task = \core\task\manager::get_next_adhoc_task($now);
-        $this->assertInstanceOf('\\core\\task\\asynchronous_backup_task', $task);
-        $task->execute();
-        \core\task\manager::adhoc_task_complete($task);
+        $asynctask->execute();
 
         $postbackuprec = $DB->get_record('backup_controllers', ['backupid' => $backupid]);
 
@@ -151,13 +146,9 @@ final class async_backup_test extends \advanced_testcase {
         // Create the adhoc task.
         $asynctask = new \core\task\asynchronous_backup_task();
         $asynctask->set_custom_data(['backupid' => $backupid]);
-        \core\task\manager::queue_adhoc_task($asynctask);
 
         // Execute adhoc task.
-        $now = time();
-        $task = \core\task\manager::get_next_adhoc_task($now);
-        $task->execute();
-        \core\task\manager::adhoc_task_complete($task);
+        $asynctask->execute();
 
         $postbackuprec = $DB->get_record('backup_controllers', ['backupid' => $backupid]);
 
@@ -241,19 +232,11 @@ final class async_backup_test extends \advanced_testcase {
         // Now queue an adhoc task and check it handles and completes gracefully.
         $asynctask = new \core\task\asynchronous_backup_task();
         $asynctask->set_custom_data(array('backupid' => $backupid));
-        \core\task\manager::queue_adhoc_task($asynctask);
 
         // We are expecting a specific message output during this test.
         $this->expectOutputRegex('/invalid controller/');
 
         // Execute adhoc task.
-        $now = time();
-        $task = \core\task\manager::get_next_adhoc_task($now);
-        $this->assertInstanceOf('\\core\\task\\asynchronous_backup_task', $task);
-        $task->execute();
-        \core\task\manager::adhoc_task_complete($task);
-
-        // Check the task record is removed.
-        $this->assertEquals(0, $DB->count_records('task_adhoc'));
+        $asynctask->execute();
     }
 }

backup/tests/async_restore_test.php

@@ -223,20 +223,12 @@ final class async_restore_test extends \advanced_testcase {
         // Create the adhoc task.
         $asynctask = new \core\task\asynchronous_restore_task();
         $asynctask->set_custom_data(['backupid' => $restoreid]);
-        \core\task\manager::queue_adhoc_task($asynctask);
 
         // We are expecting a specific message output during this test.
         $this->expectOutputRegex('/invalid controller/');
 
         // Execute adhoc task.
-        $now = time();
-        $task = \core\task\manager::get_next_adhoc_task($now);
-        $this->assertInstanceOf('\\core\\task\\asynchronous_restore_task', $task);
-        $task->execute();
-        \core\task\manager::adhoc_task_complete($task);
-
-        // Check the task record is removed.
-        $this->assertEquals(0, $DB->count_records('task_adhoc'));
+        $asynctask->execute();
 
         // Now delete the record and confirm an entirely missing controller is handled.
         $DB->delete_records('backup_controllers');
@@ -244,19 +236,11 @@ final class async_restore_test extends \advanced_testcase {
         // Create the adhoc task.
         $asynctask = new \core\task\asynchronous_restore_task();
         $asynctask->set_custom_data(['backupid' => $restoreid]);
-        \core\task\manager::queue_adhoc_task($asynctask);
 
         // We are expecting a specific message output during this test.
         $this->expectOutputRegex('/Unable to find restore controller/');
 
         // Execute adhoc task.
-        $now = time();
-        $task = \core\task\manager::get_next_adhoc_task($now);
-        $this->assertInstanceOf('\\core\\task\\asynchronous_restore_task', $task);
-        $task->execute();
-        \core\task\manager::adhoc_task_complete($task);
-
-        // Check the task record is removed.
-        $this->assertEquals(0, $DB->count_records('task_adhoc'));
+        $asynctask->execute();
     }
 }

backup/tests/hook/copy_course_hook_test.php

@@ -32,6 +32,14 @@ use core_backup\hook\fixtures\copy_course_hook_callbacks;
  * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 final class copy_course_hook_test extends advanced_testcase {
+    /**
+     * Load required test libraries
+     */
+    public static function setUpBeforeClass(): void {
+        global $CFG;
+        require_once("{$CFG->dirroot}/backup/util/includes/backup_includes.php");
+        parent::setUpBeforeClass();
+    }
 
     /**
      * Test the hook.

backup/util/dbops/restore_dbops.class.php

@@ -464,6 +464,39 @@ abstract class restore_dbops {
         $xmlparser->process();
     }
 
+    /**
+     * Store ids associated with any activity in the backup that supports FEATURE_PUBLISHES_QUESTIONS.
+     *
+     * @param string $restoreid The restore ID.
+     * @param string $activitiespath The path to the `activities` folder in the backup being restored.
+     */
+    public static function load_questionbanks_to_tempids(string $restoreid, string $activitiespath): void {
+        if (!is_dir($activitiespath)) {
+            return;
+        }
+        // Get modules that publish questions.
+        $qmodules = array_filter(
+            array_keys(core\component::get_all_plugins_list('mod')),
+            fn($module) => plugin_supports('mod', $module, FEATURE_PUBLISHES_QUESTIONS),
+        );
+        foreach (scandir($activitiespath) as $activitydir) {
+            [$modname] = explode('_', $activitydir);
+            if (!in_array($modname, $qmodules)) {
+                continue;
+            }
+            $activityfile = "{$activitiespath}/{$activitydir}/{$modname}.xml";
+            if (!file_exists($activityfile)) { // Shouldn't happen ever, but...
+                throw new backup_helper_exception('missing_moodle_backup_xml_file', $activityfile);
+            }
+            // Parse each activity's file, storing the relevant data in the database.
+            $xmlparser = new progressive_parser();
+            $xmlparser->set_file($activityfile);
+            $xmlprocessor = new restore_questionbanks_parser_processor($restoreid);
+            $xmlparser->set_processor($xmlprocessor);
+            $xmlparser->process();
+        }
+    }
+
     /**
      * Check all the included categories and questions, deciding the action to perform
      * for each one (mapping / creation) and returning one array of problems in case
@@ -609,9 +642,18 @@ abstract class restore_dbops {
             $topcats = 0;
             // get categories in context (bank)
             $categories = self::restore_get_question_categories($restoreid, $contextid, $contextlevel);
-
-            // cache permissions if $targetcontext is found
-            if ($targetcontext = self::restore_find_best_target_context($categories, $courseid, $contextlevel)) {
+            if (
+                $contextlevel == \core\context\module::LEVEL
+                && self::get_backup_ids_record($restoreid, 'questionbank', $contextid)
+            ) {
+                // Don't look for an existing module context, we have the original context in the backup,
+                // so we'll put the categories in the course context for now and move them once the activity is restored.
+                $targetcontext = core\context\course::instance($courseid);
+            } else {
+                $targetcontext = self::restore_find_best_target_context($categories, $courseid, $contextlevel);
+            }
+            if ($targetcontext) {
+                // Cache permissions if $targetcontext is found.
                 $canmanagecategory = has_capability('moodle/question:managecategory', $targetcontext, $userid);
                 $canadd = has_capability('moodle/question:add', $targetcontext, $userid);
             }

backup/util/helper/backup_helper.class.php

@@ -411,7 +411,7 @@ abstract class backup_helper {
 
             }
 
-            $selectmenu = new \core\output\select_menu('coursereusetype', $menuarray, $activeurl);
+            $selectmenu = new \core\output\select_menu('coursereusetype', $menuarray, $activeurl, true);
             $selectmenu->set_label(get_string('coursereusenavigationmenu'), ['class' => 'visually-hidden']);
             $options = \html_writer::tag(
                 'div',

backup/util/helper/restore_prechecks_helper.class.php

@@ -173,6 +173,7 @@ abstract class restore_prechecks_helper {
         $progress->progress($majorstep++);
 
         // Check we are able to restore and the categories and questions
+        restore_dbops::load_questionbanks_to_tempids($restoreid, $controller->get_plan()->get_basepath() . '/activities');
         $file = $controller->get_plan()->get_basepath() . '/questions.xml';
         restore_dbops::load_categories_and_questions_to_tempids($restoreid, $file);
         if ($problems = restore_dbops::precheck_categories_and_questions($restoreid, $courseid, $userid, $samesite)) {

backup/util/helper/restore_questionbanks_parser_processor.php

@@ -0,0 +1,59 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+defined('MOODLE_INTERNAL' || die());
+
+require_once($CFG->dirroot . '/backup/util/xml/parser/processors/grouped_parser_processor.class.php');
+
+/**
+ * Parse and store activity data for activities that publish questions.
+ *
+ * @package   core_backup
+ * @copyright 2025 onwards Catalyst IT EU {@link https://catalyst-eu.net}
+ * @author    Mark Johnson <mark.johnson@catalyst-eu.net>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class restore_questionbanks_parser_processor extends grouped_parser_processor {
+    /**
+     * Store the restore ID and register paths.
+     *
+     * @param string $restoreid ID of the backup being restored.
+     */
+    public function __construct(
+        /** @var string ID of the backup being restored */
+        protected string $restoreid,
+    ) {
+        parent::__construct();
+        $this->add_path('/activity');
+    }
+
+    #[\Override]
+    protected function dispatch_chunk($data): void {
+        // Recieved one chunk, store the context ID as that's what we will match question categories against.
+        $itemid = $data['tags']['contextid'];
+        restore_dbops::set_backup_ids_record($this->restoreid, 'questionbank', $itemid);
+    }
+
+    #[\Override]
+    protected function notify_path_start($path) {
+        // Nothing to do.
+    }
+
+    #[\Override]
+    protected function notify_path_end($path) {
+        // Nothing to do.
+    }
+}

backup/util/includes/restore_includes.php

@@ -39,6 +39,7 @@ require_once($CFG->dirroot . '/backup/util/helper/backup_anonymizer_helper.class
 require_once($CFG->dirroot . '/backup/util/helper/backup_file_manager.class.php');
 require_once($CFG->dirroot . '/backup/util/helper/copy_helper.class.php');
 require_once($CFG->dirroot . '/backup/util/helper/restore_prechecks_helper.class.php');
+require_once($CFG->dirroot . '/backup/util/helper/restore_questionbanks_parser_processor.php');
 require_once($CFG->dirroot . '/backup/util/helper/restore_moodlexml_parser_processor.class.php');
 require_once($CFG->dirroot . '/backup/util/helper/restore_inforef_parser_processor.class.php');
 require_once($CFG->dirroot . '/backup/util/helper/restore_users_parser_processor.class.php');

badges/award.php

@@ -217,7 +217,7 @@ if ($award && data_submitted() && has_capability('moodle/badges:awardbadge', $co
     $users = $existingselector->get_selected_users();
 
     foreach ($users as $user) {
-        if (!process_manual_revoke($user->id, $USER->id, $issuerrole->roleid, $badgeid)) {
+        if (!process_manual_revoke($user->id, 0, $issuerrole->roleid, $badgeid)) {
             echo $OUTPUT->error_text(get_string('error:cannotrevokebadge', 'badges'));
         }
     }

badges/criteria/award_criteria_course.php

@@ -234,7 +234,7 @@ class award_criteria_course extends award_criteria {
         $params['courseid'] = $this->courseid;
 
         // Add by date parameter.
-        if (isset($param['bydate'])) {
+        if (isset($coursecriteria['bydate'])) {
             $where .= ' AND cc.timecompleted <= :completebydate';
             $params['completebydate'] = $coursecriteria['bydate'];
         }

badges/criteria/award_criteria_courseset.php

@@ -211,7 +211,10 @@ class award_criteria_courseset extends award_criteria {
                 $check_grade = ($grade->grade >= $param['grade']);
             }
 
-            if (!$filtered && isset($param['bydate'])) {
+            // When the user list is not filtered, or the aggregation method is ANY,
+            // ensure the course completion date is before the bydate (if set).
+            $comparedates = !$filtered || $this->method == BADGE_CRITERIA_AGGREGATION_ANY;
+            if ($comparedates && isset($param['bydate'])) {
                 $cparams = array(
                         'userid' => $userid,
                         'course' => $course->id,
@@ -254,9 +257,16 @@ class award_criteria_courseset extends award_criteria {
         $params = array();
 
         if ($this->method == BADGE_CRITERIA_AGGREGATION_ANY) {
+            $coursedata = [];
             foreach ($this->params as $param) {
-                $coursedata[] = " cc.course = :completedcourse{$param['course']} ";
+                $conditionsql = " cc.course = :completedcourse{$param['course']} ";
                 $params["completedcourse{$param['course']}"] = $param['course'];
+
+                if (isset($param['bydate'])) {
+                    $conditionsql .= " AND cc.timecompleted <= :completedbydate{$param['course']} ";
+                    $params["completedbydate{$param['course']}"] = $param['bydate'];
+                }
+                $coursedata[] = "({$conditionsql})";
             }
             if (!empty($coursedata)) {
                 $extraon = implode(' OR ', $coursedata);
@@ -272,6 +282,11 @@ class award_criteria_courseset extends award_criteria {
                           cc{$param['course']}.timecompleted > 0 ";
                 $where .= " AND cc{$param['course']}.course IS NOT NULL ";
                 $params["completedcourse{$param['course']}"] = $param['course'];
+
+                if (isset($param['bydate'])) {
+                    $where .= " AND cc{$param['course']}.timecompleted <= :completedbydate{$param['course']} ";
+                    $params["completedbydate{$param['course']}"] = $param['bydate'];
+                }
             }
             return array($join, $where, $params);
         }

badges/lib/awardlib.php

@@ -290,27 +290,27 @@ function process_manual_award($recipientid, $issuerid, $issuerrole, $badgeid) {
 /**
  * Manually revoke awarded badges.
  *
- * @param int $recipientid
- * @param int $issuerid
- * @param int $issuerrole
- * @param int $badgeid
+ * @param int $recipientid User ID of the recipient
+ * @param int $issuerid User ID of the issuer (if 0, issuer will be ignored)
+ * @param int $issuerrole Role of the issuer
+ * @param int $badgeid ID of the badge
  * @return bool
  */
 function process_manual_revoke($recipientid, $issuerid, $issuerrole, $badgeid) {
     global $DB;
-    $params = array(
-                'badgeid' => $badgeid,
-                'issuerid' => $issuerid,
-                'issuerrole' => $issuerrole,
-                'recipientid' => $recipientid
-            );
+    $params = [
+        'badgeid' => $badgeid,
+        'issuerrole' => $issuerrole,
+        'recipientid' => $recipientid,
+    ];
+    if (!empty($issuerid)) {
+        $params['issuerid'] = $issuerid;
+    }
     if ($DB->record_exists('badge_manual_award', $params)) {
-        if ($DB->delete_records('badge_manual_award', array('badgeid' => $badgeid,
-                                                            'issuerid' => $issuerid,
-                                                            'recipientid' => $recipientid))
-            && $DB->delete_records('badge_issued', array('badgeid' => $badgeid,
-                                                      'userid' => $recipientid))) {
-
+        if (
+            $DB->delete_records('badge_manual_award', $params) &&
+            $DB->delete_records('badge_issued', ['badgeid' => $badgeid, 'userid' => $recipientid])
+        ) {
             // Trigger event, badge revoked.
             $badge = new \badge($badgeid);
             $eventparams = array(

badges/tests/behat/award_badge.feature

@@ -11,11 +11,13 @@ Feature: Award badges
     And the following "users" exist:
       | username | firstname | lastname | email                |
       | teacher1 | Teacher   | 1        | teacher1@example.com |
+      | teacher2 | Teacher   | 2        | teacher2@example.com |
       | student1 | Student   | 1        | student1@example.com |
       | student2 | Student   | 2        | student2@example.com |
     And the following "course enrolments" exist:
       | user     | course | role           |
       | teacher1 | C1     | editingteacher |
+      | teacher2 | C1     | editingteacher |
       | student1 | C1     | student        |
       | student2 | C1     | student        |
     And the following "activity" exists:
@@ -371,14 +373,24 @@ Feature: Award badges
     And I am on "Course 1" course homepage
     And I navigate to "Badges" in current page administration
     And I follow "Course Badge"
-    Then I should see "Recipients (2)"
     And I select "Recipients (2)" from the "jump" singleselect
     And I press "Award badge"
     And I set the field "existingrecipients[]" to "Student 2 (student2@example.com)"
     And I press "Revoke badge"
-    And I set the field "existingrecipients[]" to "Student 1 (student1@example.com)"
-    When I press "Revoke badge"
     And I am on "Course 1" course homepage
     And I navigate to "Badges" in current page administration
     And I follow "Course Badge"
-    Then I should see "Recipients (0)"
+    Then I should see "Recipients (1)"
+    And I log out
+    # Now attempt to revoke a badge as another teacher.
+    And I am on the "Course 1" "course" page logged in as "teacher2"
+    And I navigate to "Badges" in current page administration
+    And I follow "Course Badge"
+    And I select "Recipients (1)" from the "jump" singleselect
+    And I press "Award badge"
+    And I set the field "existingrecipients[]" to "Student 1 (student1@example.com)"
+    And I press "Revoke badge"
+    And I am on "Course 1" course homepage
+    And I navigate to "Badges" in current page administration
+    And I follow "Course Badge"
+    And I should see "Recipients (0)"

badges/tests/behat/award_badge_with_completion.feature

@@ -0,0 +1,149 @@
+@mod @mod_quiz @core_badges @core_completion @javascript
+
+Feature: Award badges based on course completion
+  In order to ensure a student has learned the required material
+  As a teacher
+  I need a badge to be awarded only when the student completes the course or a set of courses.
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email                |
+      | student1 | Student   | 1        | student1@example.com |
+      | student2 | Student   | 2        | student2@example.com |
+      | teacher1 | Teacher   | 1        | teacher1@example.com |
+    And the following "courses" exist:
+      | fullname | shortname | category | enablecompletion |
+      | Course 1 | C1        | 0        | 1                |
+      | Course 2 | C2        | 0        | 1                |
+    And the following "course enrolments" exist:
+      | user     | course | role           |
+      | teacher1 | C1     | editingteacher |
+      | student1 | C1     | student        |
+      | student2 | C1     | student        |
+      | teacher1 | C2     | editingteacher |
+      | student1 | C2     | student        |
+      | student2 | C2     | student        |
+    And the following "question categories" exist:
+      | contextlevel | reference | name           |
+      | Course       | C1        | Test questions |
+      | Course       | C2        | Test questions |
+    And the following "questions" exist:
+      | questioncategory | qtype     | name           | questiontext              |
+      | Test questions   | truefalse | First question | Answer the first question |
+    And the following "activities" exist:
+      | activity | name             | course | idnumber | attempts | gradepass | completion | completionpassgrade | completionusegrade |
+      | quiz     | Test quiz name C1 | C1     | quiz1    | 2        | 5.00      | 2          | 1                   | 1                  |
+      | quiz     | Test quiz name C2 | C2     | quiz1    | 2        | 5.00      | 2          | 1                   | 1                  |
+    And quiz "Test quiz name C1" contains the following questions:
+      | question       | page |
+      | First question | 1    |
+    And quiz "Test quiz name C2" contains the following questions:
+      | question       | page |
+      | First question | 1    |
+    And the following "blocks" exist:
+      | blockname        | contextlevel | reference | pagetypepattern | defaultregion |
+      | completionstatus | Course       | C1        | course-view-*   | side-pre      |
+      | completionstatus | Course       | C2        | course-view-*   | side-pre      |
+    And I am on the "Course 1" course page logged in as teacher1
+    And I navigate to "Course completion" in current page administration
+    And I expand all fieldsets
+    And I set the field "Test quiz name C1" to "1"
+    And I press "Save changes"
+    And I am on the "Course 2" course page logged in as teacher1
+    And I navigate to "Course completion" in current page administration
+    And I expand all fieldsets
+    And I set the field "Test quiz name C2" to "1"
+    And I press "Save changes"
+
+  Scenario Outline: Badge awarded depending on the course completion by-date
+    Given I am on the "Course 1" course page
+    And the following "core_badges > Badge" exists:
+      | name        | Course Badge 1               |
+      | status      | 0                            |
+      | type        | 2                            |
+      | course      | C1                           |
+      | description | Course badge 1 description   |
+      | image       | badges/tests/behat/badge.png |
+    And I navigate to "Badges" in current page administration
+    And I click on "Course Badge 1" "link"
+    And I select "Criteria" from the "jump" singleselect
+    And I set the field "type" to "Course completion"
+    And I set the field "Enable" to "1"
+    And I set the field "Day" to "1"
+    And I set the field "Month" to "January"
+    And I set the field "Year" to "<year>"
+    And I press "Save"
+    And I press "Enable access"
+    And I click on "Enable" "button" in the "Confirm" "dialogue"
+    And user "student1" has attempted "Test quiz name C1" with responses:
+      | slot | response |
+      | 1    | True     |
+    # Completion cron won't mark the whole course completed unless the
+    # individual criteria was marked completed more than a second ago. So
+    # run it twice, first to mark the criteria and second for the course.
+    And I run the scheduled task "core\task\completion_regular_task"
+    And I wait "1" seconds
+    And I run the scheduled task "core\task\completion_regular_task"
+    When I run the scheduled task "core\task\badges_cron_task"
+    And I run all adhoc tasks
+    And I navigate to "Badges" in current page administration
+    And I click on "Course Badge 1" "link"
+    Then I should see "Recipients (<count>)"
+    And I select "Recipients (<count>)" from the "jump" singleselect
+    And I <student1_visibility> see "Student 1"
+    And I should not see "Student 2"
+
+    Examples:
+      | year                | count | student1_visibility |
+      | ## +1 year ## %Y ## | 1     | should              |
+      | ## -1 year ## %Y ## | 0     | should not          |
+
+  Scenario Outline: Badge awarded depending on the courseset completion by-date
+    Given I am logged in as "admin"
+    And the following "core_badges > Badge" exists:
+      | name        | Site Badge                   |
+      | status      | 0                            |
+      | description | Site badge description       |
+      | image       | badges/tests/behat/badge.png |
+    And I navigate to "Badges > Manage badges" in site administration
+    And I press "Edit" action in the "Site Badge" report row
+    And I select "Criteria" from the "jump" singleselect
+    And I set the field "type" to "Completing a set of courses"
+    And I set the field "courses" to "Course 1, Course 2"
+    And I press "Add courses"
+    And I expand all fieldsets
+    # Set a very high grade requirement to ensure that the course completion criteria won't be marked completed just by passing the quiz.
+    And I set the field with xpath "(//input[contains(@name, 'grade')])[1]" to "200"
+    And I set the field with xpath "(//input[contains(@name, 'enabled')])[2]" to "1"
+    And I set the field with xpath "(//select[contains(@name, 'day')])[2]" to "1"
+    And I set the field with xpath "(//select[contains(@name, 'month')])[2]" to "January"
+    And I set the field with xpath "(//select[contains(@name, 'year')])[2]" to "<year>"
+    And I click on "Any of the selected courses is complete" "radio"
+    And I press "Save"
+    And I press "Enable access"
+    And I click on "Enable" "button" in the "Confirm" "dialogue"
+    And user "student1" has attempted "Test quiz name C1" with responses:
+      | slot | response |
+      | 1    | True     |
+    And user "student1" has attempted "Test quiz name C2" with responses:
+      | slot | response |
+      | 1    | True     |
+    # Completion cron won't mark the whole course completed unless the
+    # individual criteria was marked completed more than a second ago. So
+    # run it twice, first to mark the criteria and second for the course.
+    And I run the scheduled task "core\task\completion_regular_task"
+    And I wait "1" seconds
+    And I run the scheduled task "core\task\completion_regular_task"
+    When I run the scheduled task "core\task\badges_cron_task"
+    And I run all adhoc tasks
+    And I navigate to "Badges > Manage badges" in site administration
+    And I follow "Site Badge"
+    Then I should see "Recipients (<count>)"
+    And I select "Recipients (<count>)" from the "jump" singleselect
+    And I <student1_visibility> see "Student 1"
+    And I should not see "Student 2"
+
+    Examples:
+      | year                | count | student1_visibility |
+      | ## +1 year ## %Y ## | 1     | should              |
+      | ## -1 year ## %Y ## | 0     | should not          |

blocks/completionstatus/block_completionstatus.php

@@ -104,6 +104,9 @@ class block_completionstatus extends block_base {
             // Flag to set if current completion data is inconsistent with what is stored in the database.
             $pending_update = false;
 
+            // Get activities visible to the user that have completion enabled.
+            $visibleactivities = $info->get_user_activities_with_completion($USER->id);
+
             // Loop through course criteria.
             foreach ($completions as $completion) {
                 $criteria = $completion->get_criteria();
@@ -115,6 +118,11 @@ class block_completionstatus extends block_base {
 
                 // Activities are a special case, so cache them and leave them till last.
                 if ($criteria->criteriatype == COMPLETION_CRITERIA_TYPE_ACTIVITY) {
+                    // Only include activities that are visible to the user.
+                    if (!isset($visibleactivities[$criteria->moduleinstance])) {
+                        continue;
+                    }
+
                     $activities[$criteria->moduleinstance] = $complete;
 
                     if ($complete) {

blocks/completionstatus/details.php

@@ -119,10 +119,21 @@ $pendingupdate = false;
 // Load criteria to display.
 $completions = $info->get_completions($user->id);
 
+// Get activities visible to the user that have completion enabled.
+$visibleactivities = $info->get_user_activities_with_completion($user->id);
+
 // Loop through course criteria.
 foreach ($completions as $completion) {
     $criteria = $completion->get_criteria();
 
+    // Skip display of activity completion criteria for activities the user cannot see.
+    if (
+        $criteria->criteriatype == COMPLETION_CRITERIA_TYPE_ACTIVITY &&
+        !isset($visibleactivities[$criteria->moduleinstance])
+    ) {
+        continue;
+    }
+
     if (!$pendingupdate && $criteria->is_pending($completion)) {
         $pendingupdate = true;
     }

blocks/completionstatus/tests/behat/block_completionstatus_activity_completion.feature

@@ -6,9 +6,10 @@ Feature: Enable Block Completion in a course using activity completion
 
   Background:
     Given the following "users" exist:
-      | username | firstname | lastname | email | idnumber |
-      | teacher1 | Teacher | 1 | teacher1@example.com | T1 |
-      | student1 | Student | 1 | student1@example.com | S1 |
+      | username | firstname | lastname | email                | idnumber |
+      | teacher1 | Teacher   | 1        | teacher1@example.com | T1       |
+      | student1 | Student   | 1        | student1@example.com | S1       |
+      | student2 | Student   | 2        | student2@example.com | S2       |
     And the following "courses" exist:
       | fullname | shortname | category | enablecompletion |
       | Course 1 | C1        | 0        | 1                |
@@ -16,6 +17,7 @@ Feature: Enable Block Completion in a course using activity completion
       | user     | course | role           |
       | teacher1 | C1     | editingteacher |
       | student1 | C1     | student        |
+      | student2 | C1     | student        |
     And the following "activities" exist:
       | activity   | course | idnumber   | name             | gradepass | completion   | completionview | completionusegrade | completionpassgrade |
       | page       | C1     | page1      | Test page name   |           | 2            | 1              | 0                  | 0                   |
@@ -23,10 +25,12 @@ Feature: Enable Block Completion in a course using activity completion
     And the following "blocks" exist:
       | blockname        | contextlevel | reference | pagetypepattern | defaultregion |
       | completionstatus | Course       | C1        | course-view-*   | side-pre      |
+    And I am on the "Course 1" course page logged in as teacher1
+    And I change window size to "large"
+    And I turn editing mode on
 
   Scenario: Completion status block when student has not started any activities
-    Given I am on the "Course 1" course page logged in as teacher1
-    And I navigate to "Course completion" in current page administration
+    Given I navigate to "Course completion" in current page administration
     And I expand all fieldsets
     And I set the following fields to these values:
       | Test page name | 1 |
@@ -36,8 +40,7 @@ Feature: Enable Block Completion in a course using activity completion
     And I should see "0 of 1" in the "Activity completion" "table_row"
 
   Scenario: Completion status block when student has completed a page
-    Given I am on the "Course 1" course page logged in as teacher1
-    And I navigate to "Course completion" in current page administration
+    Given I navigate to "Course completion" in current page administration
     And I expand all fieldsets
     And I set the following fields to these values:
       | Test page name | 1 |
@@ -50,8 +53,7 @@ Feature: Enable Block Completion in a course using activity completion
     And I should see "Yes" in the "Activity completion" "table_row"
 
   Scenario: Completion status block with items with passing grade
-    Given I am on the "Course 1" course page logged in as teacher1
-    And I navigate to "Course completion" in current page administration
+    Given I navigate to "Course completion" in current page administration
     And I expand all fieldsets
     And I set the following fields to these values:
       | Test assign name | 1 |
@@ -69,8 +71,7 @@ Feature: Enable Block Completion in a course using activity completion
     And I should see "Yes" in the "Activity completion" "table_row"
 
   Scenario: Completion status block with items with failing grade
-    Given I am on the "Course 1" course page logged in as teacher1
-    And the following "grade grades" exist:
+    Given the following "grade grades" exist:
       | gradeitem           | user     | grade |
       | Test assign name    | student1 | 49    |
     And I navigate to "Course completion" in current page administration
@@ -86,3 +87,265 @@ Feature: Enable Block Completion in a course using activity completion
     And I follow "More details"
     And I should see "Achieving grade, Achieving passing grade" in the "Activity completion" "table_row"
     And I should see "No" in the "Activity completion" "table_row"
+
+  @javascript
+  Scenario: Student visibility respects combined activity and section restrictions with progressive completion
+    Given the following "activities" exist:
+      | activity | name   | intro                  | course | idnumber | section | visible | completion | completionview |
+      | page     | task A | page description       | C1     | page1    | 0       | 1       | 2          | 1              |
+      | page     | task B | page description       | C1     | page2    | 1       | 1       | 2          | 1              |
+      | assign   | task C | assignment description | C1     | assign1  | 1       | 1       | 2          | 1              |
+    And I navigate to "Course completion" in current page administration
+    And I expand all fieldsets
+    And I set the following fields to these values:
+      | Page - task A       | 1 |
+      | Page - task B       | 1 |
+      | Assignment - task C | 1 |
+    And I press "Save changes"
+    # Add conditionally visible restriction (open eye) to section 1 requiring task A completion.
+    And I turn editing mode on
+    And I edit the section "1"
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Activity or resource" to "task A"
+    And I press "Save changes"
+    # Add conditionally hidden restriction (closed eye) to task C requiring task A completion.
+    And I am on the "task C" "assign activity editing" page
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
+    And I click on "Item name displayed with access restriction information if student doesn't meet this condition • Click to hide" "link"
+    And I set the field "Activity or resource" to "task A"
+    And I press "Save and return to course"
+    And I log out
+    # Initial state: Only unrestricted visible activities appear.
+    When I am on the "Course 1" course page logged in as student1
+    Then I should see "Status: Not yet started"
+    And I should see "0 of 1" in the "Activity completion" "table_row"
+    And I follow "More details"
+    And I should see "task A" in the "criteriastatus" "table"
+    And I should not see "task B" in the "criteriastatus" "table"
+    And I should not see "task C" in the "criteriastatus" "table"
+    # After completing task A: Section 2 activities become visible.
+    And I click on "task A" "link"
+    And I am on the "Course 1" course page logged in as student1
+    And I should see "Status: In progress"
+    And I should see "1 of 3" in the "Activity completion" "table_row"
+    And I follow "More details"
+    And I should see "task A" in the "criteriastatus" "table"
+    And I should see "task B" in the "criteriastatus" "table"
+    And I should see "task C" in the "criteriastatus" "table"
+
+  @javascript
+  Scenario: Student completion view shows only accessible activities considering all activity restrictions
+    Given the following "activities" exist:
+      | activity | name   | intro                  | course | idnumber | section | visible | completion | completionview |
+      | page     | task A | page description       | C1     | page1    | 0       | 1       | 2          | 1              |
+      | page     | task B | page  description      | C1     | assign1  | 1       | 1       | 2          | 1              |
+      | assign   | task C | assignment description | C1     | assign2  | 1       | 1       | 2          | 1              |
+    And I navigate to "Course completion" in current page administration
+    And I expand all fieldsets
+    # Set completion of the activities.
+    And I set the following fields to these values:
+      | Page - task A       | 1 |
+      | Page - task B       | 1 |
+      | Assignment - task C | 1 |
+    And I press "Save changes"
+    # Add conditionally visible restriction (open eye) to "task B".
+    And I am on the "task B" "page activity editing" page
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Activity or resource" to "task A"
+    And I press "Save and return to course"
+    # Add conditionally hidden restriction (closed eye) to "task C".
+    And I am on the "task C" "assign activity editing" page
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
+    And I click on "Item name displayed with access restriction information if student doesn't meet this condition • Click to hide" "link"
+    And I set the field "Activity or resource" to "task A"
+    And I press "Save and return to course"
+    When I am on the "Course 1" course page logged in as student1
+    And I should see "Status: Not yet started"
+    And I should see "0 of 2" in the "Activity completion" "table_row"
+    And I follow "More details"
+    Then I should see "task A" in the "criteriastatus" "table"
+    And I should see "task B" in the "criteriastatus" "table"
+    And I should not see "task C" in the "criteriastatus" "table"
+    And I click on "task A" "link"
+    # Complete task A to make task C visible.
+    And I am on the "Course 1" course page logged in as student1
+    And I should see "Status: In progress"
+    And I should see "1 of 3" in the "Activity completion" "table_row"
+    And I follow "More details"
+    And I should see "task A" in the "criteriastatus" "table"
+    And I should see "task B" in the "criteriastatus" "table"
+    And I should see "task C" in the "criteriastatus" "table"
+
+  @javascript
+  Scenario: Hidden activities do not appear in the completion status block
+    Given the following "activities" exist:
+      | activity | name   | intro            | course | idnumber    | section | visible | completion | completionview |
+      | page     | task A | page description | C1     | page1       | 0       | 1       | 2          | 1              |
+      | page     | task B | page description | C1     | page2       | 0       | 0       | 2          | 1              |
+    And I navigate to "Course completion" in current page administration
+    And I expand all fieldsets
+    # Set completion of the activities.
+    And I set the following fields to these values:
+      | Page - task A | 1 |
+      | Page - task B | 1 |
+    And I press "Save changes"
+    When I am on the "Course 1" course page logged in as student1
+    And I should see "Status: Not yet started"
+    And I should see "0 of 1" in the "Activity completion" "table_row"
+    And I follow "More details"
+    And I should see "task A" in the "criteriastatus" "table"
+    Then I should not see "task B" in the "criteriastatus" "table"
+
+  @javascript
+  Scenario: Activities in the hidden section do not appear in the completion status block
+    Given the following "activities" exist:
+      | activity | name   | intro            | course | idnumber | section | visible | completion | completionview |
+      | page     | task A | page description | C1     | page1    | 0       | 1       | 2          | 1              |
+      | page     | task B | page description | C1     | page2    | 1       | 1       | 2          | 1              |
+      | assign   | task C | page description | C1     | page3    | 2       | 1       | 2          | 1              |
+      | assign   | task D | page description | C1     | page4    | 3       | 1       | 2          | 1              |
+    And I navigate to "Course completion" in current page administration
+    And I expand all fieldsets
+    # Set completion of the activities.
+    And I set the following fields to these values:
+      | Page - task A       | 1 |
+      | Page - task B       | 1 |
+      | Assignment - task C | 1 |
+      | Assignment - task D | 1 |
+    And I press "Save changes"
+    # Hide section 1 to make sure book activities are not visible to the student.
+    And I hide section "1"
+    # Add conditionally visible restriction to section 2.
+    And I edit the section "2"
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Activity or resource" to "task A"
+    And I press "Save changes"
+    # Add conditionally hidden restriction to section 3.
+    And I am on the "Course 1" course page
+    And I edit the section "3"
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Activity or resource" to "task A"
+    And I click on "Item name displayed with access restriction information if student doesn't meet this condition • Click to hide" "link"
+    And I press "Save changes"
+    And I log out
+    When I am on the "Course 1" course page logged in as student1
+    And I should see "Status: Not yet started"
+    And I should see "0 of 1" in the "Activity completion" "table_row"
+    And I follow "More details"
+    Then I should see "task A" in the "criteriastatus" "table"
+    And I should not see "task B" in the "criteriastatus" "table"
+    And I should not see "task C" in the "criteriastatus" "table"
+    And I should not see "task D" in the "criteriastatus" "table"
+    # Complete task A to make other activities visible.
+    And I click on "task A" "link"
+    And I am on the "Course 1" course page logged in as student1
+    And I should see "Status: In progress"
+    And I should see "1 of 3" in the "Activity completion" "table_row"
+    And I follow "More details"
+    And I should see "task A" in the "criteriastatus" "table"
+    And I should not see "task B" in the "criteriastatus" "table"
+    And I should see "task C" in the "criteriastatus" "table"
+    And I should see "task D" in the "criteriastatus" "table"
+
+  @javascript
+  Scenario: Activities with disabled completion tracking are omitted from the completion view
+    Given the following "activities" exist:
+      | activity | name   | intro            | course | idnumber | section | visible | completion | completionview |
+      | page     | task A | page description | C1     | page1    | 0       | 1       | 2          | 1              |
+      | page     | task B | page description | C1     | page2    | 1       | 1       | 2          | 1              |
+    And I navigate to "Course completion" in current page administration
+    And I expand all fieldsets
+    # Set completion of the activities.
+    And I set the following fields to these values:
+      | Page - task A | 1 |
+      | Page - task B | 1 |
+    And I press "Save changes"
+    # Disable completion tracking for "task A".
+    And I am on the "task A" "page activity editing" page
+    And I expand all fieldsets
+    And I set the following fields to these values:
+      | completion | 0 |
+    And I press "Save and return to course"
+    When I am on the "Course 1" course page logged in as student1
+    And I should see "Status: Not yet started"
+    And I should see "0 of 1" in the "Activity completion" "table_row"
+    And I follow "More details"
+    Then I should not see "task A" in the "criteriastatus" "table"
+    And I should see "task B" in the "criteriastatus" "table"
+
+  @javascript
+  Scenario: Activities with group or grouping restrictions are omitted from the completion view
+    Given the following "activities" exist:
+      | activity | name   | intro            | course | idnumber | section | visible | completion | completionview |
+      | page     | task A | page description | C1     | page1    | 0       | 1       | 2          | 1              |
+      | page     | task B | page description | C1     | page2    | 1       | 1       | 2          | 1              |
+      | page     | task C | page description | C1     | page3    | 2       | 1       | 2          | 1              |
+    And I navigate to "Course completion" in current page administration
+    And I expand all fieldsets
+    # Set completion of the activities.
+    And I set the following fields to these values:
+      | Page - task A | 1 |
+      | Page - task B | 1 |
+      | Page - task C | 1 |
+    And I press "Save changes"
+    # Add groups and groupings.
+    And the following "groups" exist:
+      | name     | course | idnumber |
+      | G1       | C1     | GI1      |
+      | G2       | C1     | GI2      |
+    And the following "groupings" exist:
+      | name       | course | idnumber |
+      | Grouping 1 | C1     | GG1      |
+      | Grouping 2 | C1     | GG2      |
+    And the following "grouping groups" exist:
+      | grouping | group |
+      | GG1      | GI1    |
+      | GG2      | GI2    |
+    # Add students to groups.
+    And the following "group members" exist:
+      | user     | group |
+      | student1 | GI1   |
+      | student2 | GI2   |
+    # Add group restriction to "task B".
+    And I am on the "task B" "page activity editing" page
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And I click on "Group" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Group" to "G1"
+    And I click on "Save and return to course" "button"
+    # Add Grouping and 'Activity or resource' restriction to "task C".
+    And I am on the "task C" "page activity editing" page
+    And I expand all fieldsets
+    And I click on "Add restriction..." "button"
+    And I click on "Grouping" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Grouping" to "Grouping 2"
+    And I click on "Add restriction..." "button"
+    And I click on "Activity completion" "button" in the "Add restriction..." "dialogue"
+    And I set the field "Activity or resource" to "task A"
+    And I click on "Save and return to course" "button"
+    When I am on the "Course 1" course page logged in as student1
+    And I should see "Status: Not yet started"
+    And I should see "0 of 2" in the "Activity completion" "table_row"
+    And I follow "More details"
+    Then I should see "task A" in the "criteriastatus" "table"
+    And I should see "task B" in the "criteriastatus" "table"
+    And I should not see "task C" in the "criteriastatus" "table"
+    And I am on the "Course 1" course page logged in as student2
+    And I should see "Status: Not yet started"
+    And I should see "0 of 2" in the "Activity completion" "table_row"
+    And I follow "More details"
+    And I should see "task A" in the "criteriastatus" "table"
+    And I should not see "task B" in the "criteriastatus" "table"
+    And I should see "task C" in the "criteriastatus" "table"

blocks/html/UPGRADING.md

@@ -0,0 +1,9 @@
+# block_html Upgrade notes
+
+## 5.0.6+
+
+### Changed
+
+- Treat Dashboard (pagetype 'my-index') as trusted in web services so get_content_for_external preserves embedded HTML (e.g. iframes) on user Dashboard.
+
+  For more information see [MDL-85322](https://tracker.moodle.org/browse/MDL-85322)

blocks/html/block_html.php

@@ -165,14 +165,24 @@ class block_html extends block_base {
     }
 
     function content_is_trusted() {
-        global $SCRIPT;
-
+        global $SCRIPT, $USER;
         if (!$context = context::instance_by_id($this->instance->parentcontextid, IGNORE_MISSING)) {
             return false;
         }
         //find out if this block is on the profile page
         if ($context->contextlevel == CONTEXT_USER) {
-            if ($SCRIPT === '/my/index.php') {
+            $usersubpage = my_get_page($USER->id);
+            $usersubpage = $usersubpage->id ?? null;
+            if (
+                $SCRIPT === '/my/index.php' ||
+                (
+                    defined('WS_SERVER') &&
+                    WS_SERVER &&
+                    !empty($this->page) &&
+                    $this->page->pagetype === 'my-index' &&
+                    $this->page->subpage === $usersubpage
+                )
+            ) {
                 // this is exception - page is completely private, nobody else may see content there
                 // that is why we allow JS here
                 return true;

blocks/moodleblock.class.php

@@ -240,9 +240,8 @@ class block_base {
             $bc->title = $this->title;
         }
 
-        if (empty($bc->title)) {
-            $bc->arialabel = new lang_string('pluginname', get_class($this));
-            $this->arialabel = $bc->arialabel;
+        if ((string) $bc->title === '') {
+            $this->arialabel = $bc->arialabel = get_string('pluginname', get_class($this));
         }
 
         if ($this->page->user_is_editing() && $this->instance_can_be_edited()) {

blocks/myoverview/templates/main.mustache

@@ -23,7 +23,7 @@
     {}
 }}
 
-<div id="block-myoverview-{{uniqid}}" class="block-myoverview block-cards" data-region="myoverview" role="navigation">
+<div id="block-myoverview-{{uniqid}}" class="block-myoverview block-cards" data-region="myoverview">
     <div role="search" data-region="filter" class="d-flex align-items-center my-2" aria-label="{{#str}} aria:controls, block_myoverview {{/str}}">
         <div class="d-flex flex-wrap gap-1 align-items-center w-100">
             {{> block_myoverview/nav-grouping-selector }}

blocks/myoverview/templates/zero-state.mustache

@@ -44,14 +44,14 @@
     }
 }}
 
-<div class="block-myoverview block-cards" data-region="myoverview" role="navigation">
+<div class="block-myoverview block-cards" data-region="myoverview">
     <div class="container-fluid p-0">
         <div class="text-xs-center text-center mt-3" data-region="empty-message">
             <img class="empty-placeholder-image-lg mt-1"
                     src="{{nocoursesimg}}"
                     alt=""
             >
-            <h5 class="h5 mt-3 mb-0">{{{ title }}}</h5>
+            <h4 class="h4 mt-3 mb-0">{{{ title }}}</h4>
             <p class="mt-3 mb-0">{{{ intro }}}</p>
 
             <div class="mt-5 mb-0 whitebutton" id="action_bar">

blocks/myoverview/tests/behat/block_myoverview_dashboard.feature

@@ -314,6 +314,6 @@ Feature: The my overview block allows users to easily access their courses
     Then I should not see "Category 1" in the "Course overview" "block"
 
   @accessibility
-  Scenario: The dashboard page must have sufficient colour contrast
+  Scenario: The My courses page must meet accessibility standards
     When I am on the "My courses" page logged in as "student1"
-    Then the page should meet "wcag143" accessibility standards
+    Then the page should meet accessibility standards with "best-practice" extra tests