Details
Bug
Closed
Minor
Description
We have a series of nested hidden categories and would like to give some teachers and possibly some students access to view them. Created a role called CanSeeHiddenCats that only has the moodle/category:visibility capability assigned.
Then, went to the category and assigned that role to the selected user, that user gets an error stating 'That is not currently available'.
Looking at /course/category.php, I see two sections of code that seem to control this:
Lines 42 - 57:
if (has_capability('moodle/course:create', $context)) {
if ($categoryedit !== -1) {
$USER->categoryediting = $categoryedit;
}
$navbaritem = update_category_button($category->id);
$creatorediting = !empty($USER->categoryediting);
$adminediting = (has_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM, SITEID)) and $creatorediting);
} else {
if (!$category->visible) {
print_error('notavailable', 'error');
}
$navbaritem = print_course_search("", true, "navbar");
$adminediting = false;
$creatorediting = false;
and lines 266-287:
/// Print out all the sub-categories
if ($subcategories = get_records("course_categories", "parent", $category->id, "sortorder ASC")) {
$firstentry = true;
foreach ($subcategories as $subcategory) {
if ($subcategory->visible or has_capability('moodle/course:create', $context)) {
$subcategorieswereshown = true;
if ($firstentry) {
echo '<table border="0" cellspacing="2" cellpadding="4" class="generalbox boxaligncenter">';
echo '<tr><th scope="col">'.get_string('subcategories').'</th></tr>';
echo '<tr><td style="white-space: nowrap">';
$firstentry = false;
}
$catlinkcss = $subcategory->visible ? "" : " class=\"dimmed\" ";
echo '<a '.$catlinkcss.' href="category.php?id='.$subcategory->id.'">'.
format_string($subcategory->name).'</a><br />';
}
}
if (!$firstentry) {
echo "</td></tr></table>";
echo "<br />";
}
}
In both of these two sections of code, we are dealing with category visibility, and yet the check is for moodle/course:create. I suggest that this be changed to moodle/category:visibility instead.
Making this change now allows those users with the CanSeeHiddenCats capability on the category level to actually see those hidden categories, by going to the URL we give them.
We would rather see the ability of allowing a user to see a hidden category at the root level and only those categories they have been given a role that allows them to see it. That way you can have a mix of hidden and visible categories at the root level and selectively assign users to see only those hidden categories they should have access to.