Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-58340

Bailout callback should use $cm->uservisible, not $cm->visible

    XMLWordPrintable

    Details

    • Type: Task
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 3.3
    • Fix Version/s: None
    • Component/s: Calendar
    • Labels:
    • Testing Instructions:
      Hide
      1. Create a course and enrol a teacher and a student.
      2. Create an assign activity with a due date.
      3. View your dashboard as a student and confirm it is shown there.
      4. View your dashboard as a teacher and confirm it is shown there.
      5. For the activity activity edit the permissions and set the capability 'mod/assign:view' for the student role to 'Prohibit'.
      6. Confirm the assignment is no longer shown on the dashboard for the student.
      7. Confirm the assignment still shows on the dashboard for the teacher.
      Show
      Create a course and enrol a teacher and a student. Create an assign activity with a due date. View your dashboard as a student and confirm it is shown there. View your dashboard as a teacher and confirm it is shown there. For the activity activity edit the permissions and set the capability 'mod/assign:view' for the student role to 'Prohibit'. Confirm the assignment is no longer shown on the dashboard for the student. Confirm the assignment still shows on the dashboard for the teacher.
    • Affected Branches:
      MOODLE_33_STABLE
    • Pull from Repository:
    • Pull Master Branch:
      MDL-58340_master

      Description

      If you override the 'view' capability for a module to prevent a user from viewing it it is possible for it to still be shown in the dashboard (but won't for the calendar). This is because the modinfo cache performs the call to is_user_access_restricted_by_capability() which checks if the capability 'mod/xyz:view' is present in the module, and if so performs a has_capability check on it. The course module attribute 'uservisible' contains this logic, where as 'visible' doesn't.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              markn Mark Nelson
              Reporter:
              markn Mark Nelson
              Peer reviewer:
              Jun Pataleta
              Participants:
              Component watchers:
              Andrew Nicols, Jun Pataleta, Michael Hawkins, Shamim Rezaie, Simey Lameze
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: