New Web Service mod_glossary_delete_entry

As admin, enable "Mobile services": Site administration ► Mobile app ► Mobile settings Create a new course and enrol one user as student (student1) Create a new user and enrol it (student2) Create a new Glossary activity Log-in as the student1 into the course Create a couple of glossary entries, copy somewhere the ids of the glossary entries you created (to get the id of the entry, you can click on the cog that is displayed when browsing the entry below to the right, and from the URL copy the value of the id parameter) Log.in again as admin into the site Create a Token in the mobile app service for the student1 and student2 users in the site Click on Site administration ► Plugins ► Web services ► Manage tokens Open the console an execute this new curl request, replacing wstoken with the student1 token and the site url with yours. Replace the "id" value with any of the entry values you previously copied curl 'http://localhost/m/stable_master/webservice/rest/server.php?moodlewsrestformat=json' --data 'wsfunction=mod_glossary_get_entry_by_id&wstoken=3af67232a7596ceb658df4db329e5ad6&id=7' --compressed | python -m "json.tool" Confirm that: In the curl request response you see a "permissions->candelete" field that is set to true Repeat the previous curl request but using the student2 token Confirm that Now the "permissions -> candelete" field is set to false Now, execute the following curl request, replacing again the url and token and using the student2 wstoken and the same entry id you used in the previous request curl 'http://localhost/m/stable_master/webservice/rest/server.php?moodlewsrestformat=json' --data 'wsfunction=mod_glossary_delete_entry&wstoken=3af67232a7596ceb658df4db329e5ad6&entryid=5' --compressed Confirm that: You see an exception/error message indicating that you don't have permissions to delete the entry id Repeat the previous curl request but using the student1 token and confirm that You see as the response of the curl request a result value set to true If you go to the web interface and log-in as the student1 you don't see anymore the entry you just deleted via the curl request Now, in the web interface, log-in as student 1 and copy the link the delete icon is pointing to In the web interface, log-in as student2 in a different browser or session, and visit the link you copied in the previous step confirm that: You see an error indicating that you can't delete other users entries Now, log-in as student 1, go to the entry, click the delete button and confirm that You are able to delete your own user entry The entry is properly deleted, you don't see any errors/warnings