-
Bug
-
Resolution: Fixed
-
Major
-
3.1, 3.1.1, 3.1.2
-
MOODLE_31_STABLE
-
MOODLE_31_STABLE
-
MDL-56285-master -
While testing around with learning plan templates, we manage to come across a bug concerning the capability "templatemanage". it seems that Moodle checks the capability at the system level :
Competency/api.php
|
/** |
* Move the template competency up or down in the display list.
|
*
|
* Requires moodle/competency:templatemanage capability at the system context.
|
*
|
* @param int $templateid The template id
|
* @param int $competencyidfrom The id of the competency we are moving.
|
* @param int $competencyidto The id of the competency we are moving to.
|
* @return boolean
|
*/
|
public static function reorder_template_competency($templateid, $competencyidfrom, $competencyidto) { |
static::require_enabled(); |
// First we do a permissions check. |
$context = context_system::instance();
|
|
require_capability('moodle/competency:templatemanage', $context); |
Moodle should check the context of the template instead :
/** |
* Move the template competency up or down in the display list.
|
*
|
* Requires moodle/competency:templatemanage capability at the system context.
|
*
|
* @param int $templateid The template id
|
* @param int $competencyidfrom The id of the competency we are moving.
|
* @param int $competencyidto The id of the competency we are moving to.
|
* @return boolean
|
*/
|
public static function reorder_template_competency($templateid, $competencyidfrom, $competencyidto) { |
static::require_enabled(); |
|
// First we do a permissions check. |
$template = new template($templateid); |
if (!$template->can_manage()) { |
throw new required_capability_exception($template->get_context(), 'moodle/competency:templatemanage','nopermissions', ''); |
}
|
Otherwise, a user within a category context will get a "no permission" error every time he/she tries to move a competency in his learning plan templates.
