Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-63645

Allow downloading of course backups without granting 'restore:restorecourse'

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Open
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: 3.5.2
    • Fix Version/s: None
    • Component/s: Backup, Roles / Access
    • Labels:
    • Affected Branches:
      MOODLE_35_STABLE

      Description

      Given a course with an enrolled teacher who doesn't have permission to restore a course from a backup ('restore:restorecourse') but who is entitled to backup the course ('backup:*' permissions). 

      When performing a backup, after completing the backup the teacher is redirected to 'backup/restorefile.php'. Due to the missing permission 'restore:restorecourse' the user gets a permission error. The user cannot download the created backup. 

      Expected is a separation of permissions, so either: 

      • It is possible for the teacher to access 'backup/restorefile.php' without being granted 'restore:restorecourse' and he/she sees only the relevant sections/actions
      • There is a separate view for downloading backups

      This issue has already been mentioned but not solved in MDL-35429:

      @Sarah Oelker:

      I have a teacher, with the usual teacher role which includes moodle/backup:downloadfile set to "allow", who is backing up a course to try taking to another institution's moodle server. She has permissions to make backups but not permissions to restore, because we don't give teachers access to that for fear they'll blow away whole courses. I know not every school sets permissions that way, but I know a fair number of us do, for this reason. We're on 2.8.

      She can run the backup, and as soon as the backup completes she gets the "Sorry, but you do not currently have permissions to do that (Restore courses)" error, when it should otherwise display her the page where she can look at recent backup files created and download the one she just made. When I go in to do the same backup, I can see multiple backup copies have already been made of this course, as she tried and tried to do it; the backups were completing, but it was giving her an error message because without permission to Restore she can't view the page where she can retrieve the backup she had permission to make and should have access to as well. I see Chris reporting that you can get to them in "recent files" but that's very unintuitive.

      I just went ahead and made the backup for her and shared it with her via google drive, and I know I could give her restore permissions temporarily so she can get to the file herself, but I'd really like moodle/backup:downloadfile to actually allow the thing that you would think, from the name of the permission, that it allows. It would keep workload lower on our liaisons working with faculty, if making backup files can be fully self-service.

      @Jake Dallimore:

      This issue won't address the problem (mentioned in comments) in which a teacher backs up a course is then hit with an error based on the fact that they can't restore courses. The whole 'restorefile.php' page is currently controlled by the 'restore:restorecourse' capability. Improving this page so that users can see and download their backups irrespective of the restore capability is another issue.

       

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              stephan.bauer Stephan Bauer
              Participants:
              Component watchers:
              Adrian Greeve, Mihail Geshoski, Peter Dias, Amaia Anabitarte, Carlos Escobedo, Sara Arjona (@sarjona), Víctor Déniz Falcón
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated: