mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-04-21 00:12:56 +02:00
Code Issues Projects Releases Wiki Activity

MDL-52811 course: prevent setting of 'lang' without permission

Browse Source
This commit is contained in:
Davo Smith 2017-12-22 09:49:37 +00:00
parent ecce451878
commit 1433a07881
4 changed files with 36 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
admin/tool/uploadcourse/classes/course.php
View File

@ -592,6 +592,23 @@ class tool_uploadcourse_course {
$coursedata['enddate'] = strtotime($coursedata['enddate']);
}
// If lang is specified, check the user is allowed to set that field.
if (!empty($coursedata['lang'])) {
if ($exists) {
$courseid = $DB->get_field('course', 'id', ['shortname' => $this->shortname]);
if (!has_capability('moodle/course:setforcedlanguage', context_course::instance($courseid))) {
$this->error('cannotforcelang', new lang_string('cannotforcelang', 'tool_uploadcourse'));
return false;
}
} else {
$catcontext = context_coursecat::instance($coursedata['category']);
if (!guess_if_creator_will_have_course_capability('moodle/course:setforcedlanguage', $catcontext)) {
$this->error('cannotforcelang', new lang_string('cannotforcelang', 'tool_uploadcourse'));
return false;
}
}
}
// Ultimate check mode vs. existence.
switch ($mode) {
case tool_uploadcourse_processor::MODE_CREATE_NEW:

1
admin/tool/uploadcourse/lang/en/tool_uploadcourse.php
View File

@ -30,6 +30,7 @@ $string['allowresets'] = 'Allow resets';
$string['allowresets_help'] = 'Whether the reset field is accepted or not.';
$string['cachedef_helper'] = 'Helper caching';
$string['cannotdeletecoursenotexist'] = 'Cannot delete a course that does not exist';
$string['cannotforcelang'] = 'No permission to force language for this course';
$string['cannotgenerateshortnameupdatemode'] = 'Cannot generate a shortname when updates are allowed';
$string['cannotreadbackupfile'] = 'Cannot read the backup file';
$string['cannotrenamecoursenotexist'] = 'Cannot rename a course that does not exist';

6
backup/moodle2/restore_stepslib.php
View File

@ -1827,6 +1827,7 @@ class restore_course_structure_step extends restore_structure_step {
// When restoring to a new course we can set all the things except for the ID number.
$canchangeidnumber = $isnewcourse || has_capability('moodle/course:changeidnumber', $context, $userid);
$canchangesummary = $isnewcourse || has_capability('moodle/course:changesummary', $context, $userid);
$canforcelanguage = has_capability('moodle/course:setforcedlanguage', $context);
$data = (object)$data;
$data->id = $this->get_courseid();
@ -1851,6 +1852,11 @@ class restore_course_structure_step extends restore_structure_step {
unset($data->summaryformat);
}
// Unset lang if user can't change it.
if (!$canforcelanguage) {
unset($data->lang);
}
// Only allow the idnumber to be set if the user has permission and the idnumber is not already in use by
// another course on this site.
if (!empty($data->idnumber) && $canchangeidnumber && $this->task->is_samesite()

16
course/externallib.php
View File

@ -713,8 +713,13 @@ class core_course_external extends external_api {
require_capability('moodle/course:create', $context);
// Make sure lang is valid
if (array_key_exists('lang', $course) and empty($availablelangs[$course['lang']])) {
throw new moodle_exception('errorinvalidparam', 'webservice', '', 'lang');
if (array_key_exists('lang', $course)) {
if (empty($availablelangs[$course['lang']])) {
throw new moodle_exception('errorinvalidparam', 'webservice', '', 'lang');
}
if (!has_capability('moodle/course:setforcedlanguage', $context)) {
unset($course['lang']);
}
}
// Make sure theme is valid
@ -911,8 +916,11 @@ class core_course_external extends external_api {
}
// Make sure lang is valid.
if (array_key_exists('lang', $course) && empty($availablelangs[$course['lang']])) {
throw new moodle_exception('errorinvalidparam', 'webservice', '', 'lang');
if (array_key_exists('lang', $course) && ($oldcourse->lang != $course['lang'])) {
require_capability('moodle/course:setforcedlanguage', $context);
if (empty($availablelangs[$course['lang']])) {
throw new moodle_exception('errorinvalidparam', 'webservice', '', 'lang');
}
}
// Make sure theme is valid.