Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-28488

Import requires is too integrated with backup/restore permissions

XMLWordPrintable

    • Icon: Improvement Improvement
    • Resolution: Fixed
    • Icon: Minor Minor
    • 2.0.5, 2.1.2
    • 2.0.3, 2.1, 2.2
    • Backup
    • Any
    • MOODLE_20_STABLE, MOODLE_21_STABLE, MOODLE_22_STABLE
    • MOODLE_20_STABLE, MOODLE_21_STABLE
    • Hide

      Ideally, test this issue under 21_STABLE

      There are various things to test here (each one corresponds to a separate commit so should be easy to revert partially if necessary. I hope it won't be necessary). The commit hash is the master one in the instructions below.

      Important note: You may get one warning about "uasort" (in textlib) when executing any backup/restore/import operation. Ignore it, has been addressed as MDL-29319) and does not affect testing this.

      TESTING 8645a28f:

      1. Create 2 courses, "source" and "target" with some activities.
      2. Logged as (editing) teacher, go to "source" course and enable edition.
      3. TEST: The teacher must see the "x2" icon on each activity. Pick one and verify the activity becomes duplicated ok.
      4. In other browser, as admin, prevent 'moodle/backup:backuptargetimport' capability to the (editing) teacher in that course.
      5. TEST: The teacher cannot see the "x2" icon anymore, hence cannot duplicate activities.

      TESTING 77c2ca69:

      1. TEST: In the "source" course page, the teacher gets, in the settings block access to "backup", "restore" and "import". Try one operation of each type and check it ends ok.
      2. As admin, prevent any of the 'moodle/backup:backupcourse' and/or 'moodle/restore:restorecourse' capabilities to the (editing) teacher in that course.
      3. TEST: In the "source" course page, the teacher doesn't get anymore the "backup" and "restore" options. Only "import" remains. Try one import and check it ends ok.
      4. As admin, prevent and/or 'moodle/restore:restoretargetimport' capability to the (editing) teacher in that course.
      5. TEST: In the "source" course page, the teacher doesn't get the "import" option anymore.
      6. TEST: Go to "target" course as teacher. Pick import. In the list of courses you should see the "target" course itself but not the "source" course (because we have prevented it to be used as source for import).

      TESTING 9530e1ed:

      1. As admin, go to admin -> courses -> backup -> general backup defaults: Annotate the "include users" and "include logs" help strings.
      2. admin -> courses -> backup -> automated backup setup
      3. TEST: Verify that the help strings for those 2 settings are 100% the same. It was using different/old strings before.

      TESTING 2a4ba40f:

      1. As admin, prevent the 'moodle/backup:configure' and 'moodle/restore:configure' capabilities to the (editing) teacher in the "target" course.
      2. As (editing) teacher, try one import operation in the "target" course picking the same "target" course as source.
      3. TEST: The teacher sees the "import activities/blocks/filters" settings after picking the course.
      4. TEST: The teacher sees the list of sections and activities to select / unselect them
      5. TEST: The import operation finishes ok.

      TESTING 59fc0cbd:

      1. As admin, go to admin -> courses -> backup -> general backup defaults. Check and lock this setting: "include users" and uncheck and lock this setting: "include blocks".
      2. As (editing teacher) try any import operation.
      3. TEST: No error happens (it used to cause one backup exception after picking the source course)
      4. TEST: The "include blocks" setting is shown checked and unlocked (you can uncheck it) by default.
      5. TEST: The import operation ends ok.
      1. TEST: Run "backup" unit tests. 0 failures expected.
      Show
      Ideally, test this issue under 21_STABLE There are various things to test here (each one corresponds to a separate commit so should be easy to revert partially if necessary. I hope it won't be necessary). The commit hash is the master one in the instructions below. Important note: You may get one warning about "uasort" (in textlib) when executing any backup/restore/import operation. Ignore it, has been addressed as MDL-29319 ) and does not affect testing this. TESTING 8645a28f: Create 2 courses, "source" and "target" with some activities. Logged as (editing) teacher, go to "source" course and enable edition. TEST: The teacher must see the "x2" icon on each activity. Pick one and verify the activity becomes duplicated ok. In other browser, as admin, prevent 'moodle/backup:backuptargetimport' capability to the (editing) teacher in that course. TEST: The teacher cannot see the "x2" icon anymore, hence cannot duplicate activities. TESTING 77c2ca69: TEST: In the "source" course page, the teacher gets, in the settings block access to "backup", "restore" and "import". Try one operation of each type and check it ends ok. As admin, prevent any of the 'moodle/backup:backupcourse' and/or 'moodle/restore:restorecourse' capabilities to the (editing) teacher in that course. TEST: In the "source" course page, the teacher doesn't get anymore the "backup" and "restore" options. Only "import" remains. Try one import and check it ends ok. As admin, prevent and/or 'moodle/restore:restoretargetimport' capability to the (editing) teacher in that course. TEST: In the "source" course page, the teacher doesn't get the "import" option anymore. TEST: Go to "target" course as teacher. Pick import. In the list of courses you should see the "target" course itself but not the "source" course (because we have prevented it to be used as source for import). TESTING 9530e1ed: As admin, go to admin -> courses -> backup -> general backup defaults: Annotate the "include users" and "include logs" help strings. admin -> courses -> backup -> automated backup setup TEST: Verify that the help strings for those 2 settings are 100% the same. It was using different/old strings before. TESTING 2a4ba40f: As admin, prevent the 'moodle/backup:configure' and 'moodle/restore:configure' capabilities to the (editing) teacher in the "target" course. As (editing) teacher, try one import operation in the "target" course picking the same "target" course as source. TEST: The teacher sees the "import activities/blocks/filters" settings after picking the course. TEST: The teacher sees the list of sections and activities to select / unselect them TEST: The import operation finishes ok. TESTING 59fc0cbd: As admin, go to admin -> courses -> backup -> general backup defaults. Check and lock this setting: "include users" and uncheck and lock this setting: "include blocks". As (editing teacher) try any import operation. TEST: No error happens (it used to cause one backup exception after picking the source course) TEST: The "include blocks" setting is shown checked and unlocked (you can uncheck it) by default. TEST: The import operation ends ok. TEST: Run "backup" unit tests. 0 failures expected.

      Currently a user could see the Import link in their course, but if they aren't given full backupcourse and restorecourse capabilities they can't take activities from their CourseA to their CourseB. In our setup, we don't want our teachers to do full course backup and restores, but transferring their own course activities from one course to another should be allowed. In 1.9 this worked, but now a user must have full backup/restore permissions to do Imports.

      Other improvements that need to be made:
      Select all, Deselect all in the import area. If a user is importing a few activities from a full course they must manually uncheck all the things they don't want.

      Best case scenario:
      Have a course:import capability that allows users to Import to and from courses where they have that capability or maybe use manageactivities capability?. They do not need backupcourse or restorecourse capabilities.

            stronk7 Eloy Lafuente (stronk7)
            syxton Matthew Davidson
            Sam Hemelryk Sam Hemelryk
            Andrew Davis Andrew Davis
            Votes:
            8 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved:

                Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.