Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-62414

User selector should be only shown for user's children when making personal data requests (mydatarequests.php)

    XMLWordPrintable

Details

    • Bug
    • Status: Closed
    • Minor
    • Resolution: Fixed
    • 3.5
    • 3.5
    • Privacy
    • MOODLE_35_STABLE
    • MOODLE_35_STABLE
    • MDL-62414-master
    • Hide
      Setup
      1. Login as an admin.
      2. Create users s1, s2, m1, m2, and p1.
      3. Create a Parent role, but also give it the "tool/dataprivacy:makedatarequestsforchildren" capability.
      4. Go to s1's profile page and open s1's "Preferences" page.
      5. Click "Assign roles relative to this user"
      6. Assign a user m2 as a parent of a student s2.
      7. Also, assign p1 as the parent of s1.
      8. Create a DPO role.
      9. Assign m1 and m2 to the DPO role.
      10. Go to "Site administration / Users / Privacy and policies / Privacy settings"
      11. Tick the DPO role for the "Data Protection Officer role mapping" field. Save changes
      Test - User who is a parent
      1. Login as p1.
      2. Go to your user profile
      3. Click Data requests
      4. Create a new data request
        • Confirm that you see a user picker where the only options are yourself and s1.
      Test - User who is a DPO and a parent
      1. Login as m2.
      2. Go to your user profile
      3. Click Data requests
      4. Create a new data request
        • Confirm that you see a user picker where the only options are yourself and s2.
      5. Go to "Site administration / Users / Privacy and policies / Data requests"
      6. Create a new data request
        • Confirm that you see a user picker with all of the users in the site.
      Test - User who is a DPO and doesn't have children
      1. Login as m1.
      2. Go to your user profile
      3. Click Data requests
      4. Create a new data request
        • Confirm that you DON'T see a user picker.
      5. Go to "Site administration / Users / Privacy and policies / Data requests"
      6. Create a new data request
        • Confirm that you see a user picker with all of the users in the site.
      7. Create a data request for another user (e.g. s2)
        • Confirm that you get a sensible notification that you have created a data request for s2.
      Show
      Setup Login as an admin. Create users s1, s2, m1, m2, and p1. Create a Parent role , but also give it the " tool/dataprivacy:makedatarequestsforchildren " capability. Go to s1's profile page and open s1's " Preferences " page. Click " Assign roles relative to this user " Assign a user m2 as a parent of a student s2. Also, assign p1 as the parent of s1. Create a DPO role . Assign m1 and m2 to the DPO role. Go to " Site administration / Users / Privacy and policies / Privacy settings " Tick the DPO role for the " Data Protection Officer role mapping " field. Save changes Test - User who is a parent Login as p1. Go to your user profile Click Data requests Create a new data request Confirm that you see a user picker where the only options are yourself and s1. Test - User who is a DPO and a parent Login as m2. Go to your user profile Click Data requests Create a new data request Confirm that you see a user picker where the only options are yourself and s2. Go to " Site administration / Users / Privacy and policies / Data requests " Create a new data request Confirm that you see a user picker with all of the users in the site. Test - User who is a DPO and doesn't have children Login as m1. Go to your user profile Click Data requests Create a new data request Confirm that you DON'T see a user picker. Go to " Site administration / Users / Privacy and policies / Data requests " Create a new data request Confirm that you see a user picker with all of the users in the site. Create a data request for another user (e.g. s2) Confirm that you get a sensible notification that you have created a data request for s2.

    Description

      When a DPO is creating personal data requests (in mydatarequests.php), the user selector should only show users that the DPO is a parent of.

      Attachments

        Activity

          People

            jpataleta Jun Pataleta
            jpataleta Jun Pataleta
            Mihail Geshoski Mihail Geshoski
            David Monllaó David Monllaó
            Bas Brands Bas Brands
            Andrew Lyons, Adrian Greeve, David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:
              17/May/18