Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-62815

mod_lti capabilities to control adding from preconfigured

    XMLWordPrintable

    Details

    • Testing Instructions:
      Hide

      Initial setup
      1. Log in as administrator
      2. Site Administration > Plugins > Activity modules > External tool > Manage tools
      3. Click 'configure a tool manually'.
      4. Set the following and then click 'Save changes':

      • name: Preconfigured tool 1
      • URL: http://www.example.com/1
      • Tool configuration usage: Show in activity chooser as a preconfigured tool

      5. Repeat to create a second tool called 'Preconfigured tool 2' (url: http://www.example.com/2)
      6. Create a new course
      7. Add an (editing) Teacher to the course
      8. Add an activity of type 'External tool', name it 'Manual tool 1' (url: http://www.example.com/3)
      9. Add an activity of type 'Preconfigured tool 1', naming it 'From preconfigured tool 1'

      Testing capability 'mod/lti:addmanualinstance'
      10. Remove capability 'mod/lti:addmanualinstance' from the 'editingteacher' role and make sure 'mod/lti:addpreconfiguredinstance' is enabled (Site admin > Users > Permissions > Define roles)
      11. Log in as the teacher
      12. Visit the course
      13. Turn editing on
      14. Click 'Add activity or resource'
      15. Confirm 'External tool' not listed
      16. Confirm 'Preconfigured tool 1' and 'Preconfigured tool 2' are listed
      17. Select 'Preconfigured tool 2'
      18. Confirm this can be created, as expected.
      17. Edit 'Manual tool 1'
      18. Confirm the 'preconfigured tool' setting is not shown (this user is not allowed to add or configure a 'Manual tool', so they should not be able to change it to a preconfigured tool, as they would be unable to change it back)
      19. Confirm the 'Tool URL' setting is not shown
      20. Save the form
      21. Edit 'From preconfigured tool 1'
      22. Confirm 'Preconfigured tool' can be changed to 'Preconfigured tool 2', saved, restored to 'Preconfigured tool 1', saved again.
      23. As an admin, confirm that in the activity 'Manual tool 1', the 'preconfigured tool' and 'Tool URL' settings have not been changed.

      Testing capability 'mod/lti:addpreconfiguredinstance'
      24. (As admin) add capability 'mod/lti:addmanualinstance' from the 'editingteacher' role and remove 'mod/lti:addpreconfiguredinstance' (Site admin > Users > Permissions > Define roles)
      25. Log in as the teacher
      26. Visit the course
      27. Turn editing on
      28. Click 'Add activity or resource'
      29. Confirm 'External tool' is listed
      30. Confirm 'Preconfigured tool 1' and 'Preconfigured tool 2' are not listed
      31. Select 'External tool'
      32. Confirm 'Preconfigured tool' only allows the selection 'Automatic, based on tool URL'
      33. Enter the name 'Manual tool 2' + Tool URL: http://www.example.com/4
      34. Save changes
      35. Edit 'Manual tool 2'
      36. Confirm the settings were saved, as expected
      37. Edit 'Manual tool 1'
      38. Confirm the 'preconfigured tool' setting is not shown
      39. Confirm the 'Tool URL' is shown
      40. Update the 'Tool URL' to http://www.example.com/5
      41. Save the form, then re-open it and confirm that the new URL has been saved.

      Testing both capabilities disabled
      42. (As admin) remove capabilities 'mod/lti:addmanualinstance' and 'mod/lti:addpreconfiguredinstance' from the 'editingteacher' role (Site admin > Users > Permissions > Define roles)
      43. Log in as the teacher
      44. Visit the course
      45. Turn editing on
      46. Click 'Add activity or resource'
      47. Confirm 'External tool' not listed
      48. Confirm 'Preconfigured tool 1' and 'Preconfigured tool 2' are not listed
      49. Edit 'Manual tool 1'
      50. Confirm the 'preconfigured tool' setting is not shown
      51. Confirm the 'Tool URL' setting is not shown
      52. Save the form
      53. Edit 'From preconfigured tool 1'
      54. Confirm the 'preconfigured tool' setting is not shown
      55. Confirm the 'Tool URL' setting is not shown
      56. Save the form
      57) As admin, verify that "manual tool 1 "shows the "tool url" field and has not changed.
      58) As admin, verify that the "from preconfigured tool 1" shows the "preconfigured tool" and it has not changed.

      Show
      Initial setup 1. Log in as administrator 2. Site Administration > Plugins > Activity modules > External tool > Manage tools 3. Click 'configure a tool manually'. 4. Set the following and then click 'Save changes': name: Preconfigured tool 1 URL: http://www.example.com/1 Tool configuration usage: Show in activity chooser as a preconfigured tool 5. Repeat to create a second tool called 'Preconfigured tool 2' (url: http://www.example.com/2 ) 6. Create a new course 7. Add an (editing) Teacher to the course 8. Add an activity of type 'External tool', name it 'Manual tool 1' (url: http://www.example.com/3 ) 9. Add an activity of type 'Preconfigured tool 1', naming it 'From preconfigured tool 1' Testing capability 'mod/lti:addmanualinstance' 10. Remove capability 'mod/lti:addmanualinstance' from the 'editingteacher' role and make sure 'mod/lti:addpreconfiguredinstance' is enabled (Site admin > Users > Permissions > Define roles) 11. Log in as the teacher 12. Visit the course 13. Turn editing on 14. Click 'Add activity or resource' 15. Confirm 'External tool' not listed 16. Confirm 'Preconfigured tool 1' and 'Preconfigured tool 2' are listed 17. Select 'Preconfigured tool 2' 18. Confirm this can be created, as expected. 17. Edit 'Manual tool 1' 18. Confirm the 'preconfigured tool' setting is not shown (this user is not allowed to add or configure a 'Manual tool', so they should not be able to change it to a preconfigured tool, as they would be unable to change it back) 19. Confirm the 'Tool URL' setting is not shown 20. Save the form 21. Edit 'From preconfigured tool 1' 22. Confirm 'Preconfigured tool' can be changed to 'Preconfigured tool 2', saved, restored to 'Preconfigured tool 1', saved again. 23. As an admin, confirm that in the activity 'Manual tool 1', the 'preconfigured tool' and 'Tool URL' settings have not been changed. Testing capability 'mod/lti:addpreconfiguredinstance' 24. (As admin) add capability 'mod/lti:addmanualinstance' from the 'editingteacher' role and remove 'mod/lti:addpreconfiguredinstance' (Site admin > Users > Permissions > Define roles) 25. Log in as the teacher 26. Visit the course 27. Turn editing on 28. Click 'Add activity or resource' 29. Confirm 'External tool' is listed 30. Confirm 'Preconfigured tool 1' and 'Preconfigured tool 2' are not listed 31. Select 'External tool' 32. Confirm 'Preconfigured tool' only allows the selection 'Automatic, based on tool URL' 33. Enter the name 'Manual tool 2' + Tool URL: http://www.example.com/4 34. Save changes 35. Edit 'Manual tool 2' 36. Confirm the settings were saved, as expected 37. Edit 'Manual tool 1' 38. Confirm the 'preconfigured tool' setting is not shown 39. Confirm the 'Tool URL' is shown 40. Update the 'Tool URL' to http://www.example.com/5 41. Save the form, then re-open it and confirm that the new URL has been saved. Testing both capabilities disabled 42. (As admin) remove capabilities 'mod/lti:addmanualinstance' and 'mod/lti:addpreconfiguredinstance' from the 'editingteacher' role (Site admin > Users > Permissions > Define roles) 43. Log in as the teacher 44. Visit the course 45. Turn editing on 46. Click 'Add activity or resource' 47. Confirm 'External tool' not listed 48. Confirm 'Preconfigured tool 1' and 'Preconfigured tool 2' are not listed 49. Edit 'Manual tool 1' 50. Confirm the 'preconfigured tool' setting is not shown 51. Confirm the 'Tool URL' setting is not shown 52. Save the form 53. Edit 'From preconfigured tool 1' 54. Confirm the 'preconfigured tool' setting is not shown 55. Confirm the 'Tool URL' setting is not shown 56. Save the form 57) As admin, verify that "manual tool 1 "shows the "tool url" field and has not changed. 58) As admin, verify that the "from preconfigured tool 1" shows the "preconfigured tool" and it has not changed.
    • Affected Branches:
      MOODLE_34_STABLE, MOODLE_35_STABLE, MOODLE_36_STABLE, MOODLE_37_STABLE, MOODLE_38_STABLE
    • Pull Master Branch:
      MDL-62815_mod_lti

      Description

      One of our partner universities found a major data protection problem with Moodle in connection to LTI.

      They want to prevent the creation of unsanctioned external services through the external tools LTI.

      When a tool is pre-configured globally it is possible to define whether it appears separately (from the standard external tool activity) as a selectable activity on the activity selector when editing a course.

      Currently, access to preconfigured "external activities" cannot be restricted to specific roles with course editing capability. If this were possible, data security for all activities would be under the control of the administrators.

      Therefore, the restriction needs to be applied to "editing" tutor roles, who can already manage activities on courses.

      As of now, only mod/lti:addcoursetool and mod/lti:addinstance are used to control adding the tool, if both are allowed, the user can add any type of tool to the course.

      A possible solution to this problem would be:

      • The ability to add an instance of the external tool to their courses BUT only if a tool is configured globally to be shown in the activity chooser
      • Not have the ability to configure a new pre-configured tool OR re-configure a tool instance when they have added an External tool activity to a course

      We have provided a patch for this solution, which we would like to contribute.

        Attachments

        1. add_has_both.png
          add_has_both.png
          85 kB
        2. add_has_default_only.png
          add_has_default_only.png
          83 kB
        3. add_has_global_only.png
          add_has_global_only.png
          84 kB
        4. add_has_neither.png
          add_has_neither.png
          82 kB
        5. edit_has_both.png
          edit_has_both.png
          65 kB
        6. edit_has_default_only.png
          edit_has_default_only.png
          42 kB
        7. edit_has_global_only.png
          edit_has_global_only.png
          49 kB
        8. edit_has_neither.png
          edit_has_neither.png
          38 kB
        9. global_preconfigured.png
          global_preconfigured.png
          92 kB
        10. image-2019-06-13-10-12-55-063.png
          image-2019-06-13-10-12-55-063.png
          50 kB
        11. MDL-62815.jpg
          MDL-62815.jpg
          47 kB
        12. MDL-62815 (2).jpg
          MDL-62815 (2).jpg
          42 kB
        13. MDL-62815 (3).jpg
          MDL-62815 (3).jpg
          49 kB
        14. tool_configure.png
          tool_configure.png
          42 kB

          Activity

            People

            • Votes:
              32 Vote for this issue
              Watchers:
              27 Start watching this issue

              Dates

              • Created:
                Updated:

                Time Tracking

                Estimated:
                Original Estimate - 0 minutes
                0m
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 1 day, 26 minutes
                1d 26m