dirname() is a slow function compared with __DIR__ and using
'/../'. Moodle has a large number of legacy files that are included
each time a page loads and is not able to use an autoloader as it is
functional code. This allows those required includes to perform as
best as possible in this situation.
This also clarified that developers can decide to force filters
to be ignored when using external_format_text, though they cannot
force filters to be turned on as the clients should be able to
opt-out from filtering should they want to.
Fix:
$PAGE->context must be reset when calling validate_context
Improve:
Provide wrapper for calling an external function
The wrapper correctly checks the function parameters and return type against
the description of the external function, and stores the PAGE and COURSE global
state variables, restoring them before the function returns.
Fix: buggy unit tests.
These tests are expecting debugging from a bug that was fixed, and calling web
service functions with no user or session.
Now the db/service.php array can contain these extra keys to provide information
on how a webservice may be called:
'ajax' => true (Default is false)
Replaces the xx_is_allowed_from_ajax callback.
'loginrequired' => false (Default is true)
Means that this webservice can be called through lib/ajax/service-nosession.php
which sets NO_MOODLE_COOKIES to true (faster). This is only safe for webservices returning
static public data (e.g. get_string).
Some webservice functions need to be available without a login, e.g.
fetching strings and templates.
External functions must call validate_context if they require a valid login etc.
Added a new parameter to services.php: "loginrequired". Default is true.
This needs to be done before we can expose any webservices that
change state, or return private info to ajax (to prevent CSRF).
Currently there are no webservices exposed to ajax that meet these
criteria - so this issue is to prevent future security issues.
This is a new script that can call any function in the built-in AJAX webservice. This is
a new system service that is added at install time (like the mobile webservice). It has no
protocols added to it, but it accessible by a new ajax script /lib/ajax/service.php.
Requests and responses to the script are required to be in json format, and multiple functions can
be called in a single request.
