Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-40854

mod/xxxx:view capabilities do not prevent links appearing on the course page

    XMLWordPrintable

    Details

    • Testing Instructions:
      Hide

      We are interested in activities and resources that define the mod/...:view capability (which is most, but not quite all of them. Search the code for regex: mod/\w+:view.

      1. Create a course and add some of those activites.

      2. Enrol a user in the course, and arrange for them to have some, but not all, the relevant capabilities.

      3. Verify that they can only see links to the activities they are allowed to view (in the main course page, in the navigation, etc.)

      Show
      We are interested in activities and resources that define the mod/...:view capability (which is most, but not quite all of them. Search the code for regex: mod/\w+:view. 1. Create a course and add some of those activites. 2. Enrol a user in the course, and arrange for them to have some, but not all, the relevant capabilities. 3. Verify that they can only see links to the activities they are allowed to view (in the main course page, in the navigation, etc.)
    • Workaround:
      Hide

      You can use the "Restrict to group memebers only" experimental setting to work around this in some cases.

      Show
      You can use the "Restrict to group memebers only" experimental setting to work around this in some cases.
    • Affected Branches:
      MOODLE_24_STABLE, MOODLE_25_STABLE
    • Fixed Branches:
      MOODLE_24_STABLE, MOODLE_25_STABLE
    • Pull from Repository:
    • Pull Master Branch:

      Description

      At the moment, mod/...:view capabilities mostly work by having a require_once in the activities view.php file. Therefore, if you do not have that capability, but follow a link to the activity, then you will see an ugly error message.

      However, currently, mod/...:view capabilities do not control the visibility of the link to the activity on the course page.

      It is standard practice that we never show users links to things they are allowed to access, therefore, I think that if you don't have the mod/...:view capability, you should not see the link to that activity on the course page.

      POLICY question: Is the interpreation in the last paragraph correct?

      MDL-31519 has more background on this question.

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                1 Vote for this issue
                Watchers:
                10 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Fix Release Date:
                  9/Sep/13