Details
-
Type:
Bug
-
Status:
Closed
-
Priority:
Minor
-
Resolution: Fixed
-
Affects Version/s: 1.8
-
Fix Version/s: None
-
Component/s: Roles / Access
-
Labels:None
-
Environment:HideSay you want a teacher to be able to view student's view of a course, but you don't want a teacher to assing the student role to any user on your site (supose you are using external enrolment, for example)
Grant [moodle/role:switchroles] to the Teacher role, without granting [moodle/role:assign] to that roleShowSay you want a teacher to be able to view student's view of a course, but you don't want a teacher to assing the student role to any user on your site (supose you are using external enrolment, for example) Grant [moodle/role:switchroles] to the Teacher role, without granting [moodle/role:assign] to that role
-
Database:Any
-
Affected Branches:MOODLE_18_STABLE
Description
If you grant [moodle/role:switchroles] to any role, without granting [moodle/role:assign] to that role, the "Change rol to..." combo does not appear, even if you grant the necesary assignments in the "allow role assignments" or "allow role overrides" tabs.
In my opinion, both permissions relate to very different "capabilities" in a semantic way, although internally I understand that Moodle does a temporal "role assignment" when you "switch roles".
But, it's very common, mostly using external enrolment on a database, that someone could want any role to be able to switch to a lower role (usually "student"), but don't want to be able to assing that role to users (since they come from the external enrolment database).
Anyway, if those options are related (ie., you need to grant one for the other to work), it should at least be forced internally, or unified in one option, or at least documented 
Issue Links
| This issue will be resolved by: | ||||
| MDL-11313 | Removing [moodle/role:assign] as Requisite for Switch Roles |
|
|
|
For security, you can only switch to roles that you are allowed to assign, i.e. you are not allowed to switch to admin roles, etc. So instead of making another allow_switch setting for this, we are using role:assign and allow_assign settings.
I have put down some notes in
http://docs.moodle.org/en/Capabilities/moodle/role:switchroles
Cheers,
Yu