Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-81397

Missing capability checks hide section editing controls during AJAX reloads

XMLWordPrintable

    • MOODLE_403_STABLE, MOODLE_404_STABLE
    • MOODLE_403_STABLE, MOODLE_404_STABLE
    • MDL-81397-403
    • MDL-81397-404
    • Hide
      1. Log in as admin
      2. Navigate to Users > Permissions > Define roles in site administration
      3. Edit the Teacher role (or copy it to a new role), remove the following capabilities:
        • moodle/site:manageblocks
        • moodle/course:setcurrentsection
      4. Create a new user
      5. Create a course
      6. Enrol user in course as a teacher
      7. Log out
      8. Log in as test user
      9. Navigate to course
      10. Turn editing on
      11. Hide one of the sections
      12. Confirm the same section editing action menu is still present
      13. Show the same section
      14. Confirm the same section editing action menu is still present
      15. Edit course settings
        • Change course format to weekly
      16. Hide one of the sections
      17. Confirm the same section editing action menu is still present
      18. Show the same section
      19. Confirm the same section editing action menu is still present
      Show
      Log in as admin Navigate to Users > Permissions > Define roles in site administration Edit the Teacher role (or copy it to a new role), remove the following capabilities: moodle/site:manageblocks moodle/course:setcurrentsection Create a new user Create a course Enrol user in course as a teacher Log out Log in as test user Navigate to course Turn editing on Hide one of the sections Confirm the same section editing action menu is still present Show the same section Confirm the same section editing action menu is still present Edit course settings Change course format to weekly Hide one of the sections Confirm the same section editing action menu is still present Show the same section Confirm the same section editing action menu is still present
    • 5

      When on a course, the $PAGE->user_is_editing is called in various places and the way the capabilities are checked are different if it is a full page refresh or a single item refresh (for example a section) leading in a different layout (menu absent) when doing a partial refresh.

      This is working fine for teacher who have by default the following capabilities:

      • moodle/site:manageblocks
      • moodle/course:setcurrentsection

      This was revealed by the test created for MDL-81335.

      To reproduce:

      As admin create new role specialteacher with archetype teacher on course context and remove the following capabilities from the role:

      • moodle/site:manageblocks
      • moodle/course:setcurrentsection

      Then:

      • Create a new course with at least two sections and one activity
      • Enrol a user with role specialteacher
      • Log in as this user and open the course.
      • Enable Edit mode.
      • Hide a section
      • Show a section again
      • You will notice that the hamburger menu is missing in the section card
      • Reload the page
      • You will see that the hamburger menu is back

      This is, I believe because in the course/view.php we set the other capabilities and we do not do it in the AJAX/reactive routine.

            pholden Paul Holden
            laurent.david@moodle.com Laurent David
            Laurent David Laurent David
            Huong Nguyen Huong Nguyen
            Ron Carl Alfon Yu Ron Carl Alfon Yu
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved:

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 2 hours, 38 minutes
                2h 38m

                  Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.