Uploaded image for project: 'Plugins'
  1. Plugins
  2. CONTRIB-5634

Inconsistent capability check for accessing disabled views.

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Minor Minor
    • 2.8.5
    • 2.8.5
    • Set: Dataform
    • None
    • MOODLE_28_STABLE
    • MOODLE_28_STABLE

      Access to disabled views is checked in view_access against the viewaccesshidden capability but in view_manager::get_views_menu against the manageviews capability. The latter is undesired given that the capability may allow too much when granted. For instance, at times we may want to allow non-editing teachers access to disabled views, but they should not be able thereby to manage views. And at any rate there is a designated capability for such access.

      So, we are going to fix the condition in view_manager::get_views_menu and in addition adjust the capability name from viewaccesshidden to viewaccessdisabled to clearly express the actual target view mode.

      The viewaccesshidden will be deprecated and the new viewaccessdisabled will clone its permissions for backwards compatibility.

      The new viewaccessdisabled will omit non-editing teacher access which is allowed in the current viewaccesshidden.

      This will also require some adjustments of lang strings and of the phpunit access test.

            itamart Itamar Tzadok (Inactive)
            itamart Itamar Tzadok (Inactive)
            Itamar Tzadok Itamar Tzadok (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved:

                Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.