Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-62414

User selector should be only shown for user's children when making personal data requests (mydatarequests.php)

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 3.5
    • Fix Version/s: 3.5
    • Component/s: Privacy
    • Labels:
    • Testing Instructions:
      Hide
      Setup
      1. Login as an admin.
      2. Create users s1, s2, m1, m2, and p1.
      3. Create a Parent role, but also give it the "tool/dataprivacy:makedatarequestsforchildren" capability.
      4. Go to s1's profile page and open s1's "Preferences" page.
      5. Click "Assign roles relative to this user"
      6. Assign a user m2 as a parent of a student s2.
      7. Also, assign p1 as the parent of s1.
      8. Create a DPO role.
      9. Assign m1 and m2 to the DPO role.
      10. Go to "Site administration / Users / Privacy and policies / Privacy settings"
      11. Tick the DPO role for the "Data Protection Officer role mapping" field. Save changes
      Test - User who is a parent
      1. Login as p1.
      2. Go to your user profile
      3. Click Data requests
      4. Create a new data request
        • Confirm that you see a user picker where the only options are yourself and s1.
      Test - User who is a DPO and a parent
      1. Login as m2.
      2. Go to your user profile
      3. Click Data requests
      4. Create a new data request
        • Confirm that you see a user picker where the only options are yourself and s2.
      5. Go to "Site administration / Users / Privacy and policies / Data requests"
      6. Create a new data request
        • Confirm that you see a user picker with all of the users in the site.
      Test - User who is a DPO and doesn't have children
      1. Login as m1.
      2. Go to your user profile
      3. Click Data requests
      4. Create a new data request
        • Confirm that you DON'T see a user picker.
      5. Go to "Site administration / Users / Privacy and policies / Data requests"
      6. Create a new data request
        • Confirm that you see a user picker with all of the users in the site.
      7. Create a data request for another user (e.g. s2)
        • Confirm that you get a sensible notification that you have created a data request for s2.
      Show
      Setup Login as an admin. Create users s1, s2, m1, m2, and p1. Create a Parent role , but also give it the " tool/dataprivacy:makedatarequestsforchildren " capability. Go to s1's profile page and open s1's " Preferences " page. Click " Assign roles relative to this user " Assign a user m2 as a parent of a student s2. Also, assign p1 as the parent of s1. Create a DPO role . Assign m1 and m2 to the DPO role. Go to " Site administration / Users / Privacy and policies / Privacy settings " Tick the DPO role for the " Data Protection Officer role mapping " field. Save changes Test - User who is a parent Login as p1. Go to your user profile Click Data requests Create a new data request Confirm that you see a user picker where the only options are yourself and s1. Test - User who is a DPO and a parent Login as m2. Go to your user profile Click Data requests Create a new data request Confirm that you see a user picker where the only options are yourself and s2. Go to " Site administration / Users / Privacy and policies / Data requests " Create a new data request Confirm that you see a user picker with all of the users in the site. Test - User who is a DPO and doesn't have children Login as m1. Go to your user profile Click Data requests Create a new data request Confirm that you DON'T see a user picker. Go to " Site administration / Users / Privacy and policies / Data requests " Create a new data request Confirm that you see a user picker with all of the users in the site. Create a data request for another user (e.g. s2) Confirm that you get a sensible notification that you have created a data request for s2.
    • Affected Branches:
      MOODLE_35_STABLE
    • Fixed Branches:
      MOODLE_35_STABLE
    • Pull Master Branch:
      MDL-62414-master

      Description

      When a DPO is creating personal data requests (in mydatarequests.php), the user selector should only show users that the DPO is a parent of.

        Attachments

          Activity

            People

            • Assignee:
              jpataleta Jun Pataleta
              Reporter:
              jpataleta Jun Pataleta
              Peer reviewer:
              Mihail Geshoski
              Integrator:
              David Monllaó
              Tester:
              Bas Brands
              Participants:
              Component watchers:
              Andrew Nicols, Mathew May, Michael Hawkins, Shamim Rezaie, Simey Lameze
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:
                Fix Release Date:
                17/May/18