Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-40854

mod/xxxx:view capabilities do not prevent links appearing on the course page

XMLWordPrintable

    • MOODLE_24_STABLE, MOODLE_25_STABLE
    • MOODLE_24_STABLE, MOODLE_25_STABLE
    • Hide

      You can use the "Restrict to group memebers only" experimental setting to work around this in some cases.

      Show
      You can use the "Restrict to group memebers only" experimental setting to work around this in some cases.
    • Hide

      We are interested in activities and resources that define the mod/...:view capability (which is most, but not quite all of them. Search the code for regex: mod/\w+:view.

      1. Create a course and add some of those activites.

      2. Enrol a user in the course, and arrange for them to have some, but not all, the relevant capabilities.

      3. Verify that they can only see links to the activities they are allowed to view (in the main course page, in the navigation, etc.)

      Show
      We are interested in activities and resources that define the mod/...:view capability (which is most, but not quite all of them. Search the code for regex: mod/\w+:view. 1. Create a course and add some of those activites. 2. Enrol a user in the course, and arrange for them to have some, but not all, the relevant capabilities. 3. Verify that they can only see links to the activities they are allowed to view (in the main course page, in the navigation, etc.)

      At the moment, mod/...:view capabilities mostly work by having a require_once in the activities view.php file. Therefore, if you do not have that capability, but follow a link to the activity, then you will see an ugly error message.

      However, currently, mod/...:view capabilities do not control the visibility of the link to the activity on the course page.

      It is standard practice that we never show users links to things they are allowed to access, therefore, I think that if you don't have the mod/...:view capability, you should not see the link to that activity on the course page.

      POLICY question: Is the interpreation in the last paragraph correct?

      MDL-31519 has more background on this question.

            timhunt Tim Hunt
            timhunt Tim Hunt
            Dan Poltawski Dan Poltawski
            Sam Hemelryk Sam Hemelryk
            Rossiani Wijaya Rossiani Wijaya
            Votes:
            1 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved:

                Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.