-
Bug
-
Resolution: Unresolved
-
Minor
-
None
-
5.0, 5.1
Currently the capability check for showing the "question banks" overview page is being done wrong.
To reproduce:
- Enrol a user as student
- Create a question bank
- assign role "teacher" to this user on this question bank
- Expected: The student should see the "question banks" link in the course secondary navigation
- Also expected: The student can follow the link, see the overview page and is not being blocked by a capability exception caused by require_capability('moodle/course:manageactivities', ...)
There are two places where this has to be fixed:
- The code for showing the secondary navigation node seems to calculate the capabilities for showing the navigation link based on the availability of question bank plugins to the user. This however seems to be the old code, because below moodle 5.0 you would end up on the question bank edit page
where it makes totally sense to check if the user has access to the question bank plugins because they are contained in the tertiary nav. But they are not anymore. You now land on the question/banks.php page where you do not have access to the question bank plugins anyway yet.
- The page question/banks.php currently requires the capability moodle/course:manageactivities which should not be the case.
IMO both places should check if the current user has access to one of the question banks of the course (for example teacher role on course module context).
The current capability checks should be moved to question/banks.php to the point in the code where it is decided if the link to a specific question bank is being shown to the current user. It should behave analogously to the "Completions" node which only appears if the user can edit completions of at least one course module.
- is duplicated by
-
MDL-85430 Wrong capability check on question/banks.php
-
- Closed
-