Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-66683

Reinstate the default role for course creators (revert logic changes from MDL-66181)

    XMLWordPrintable

    Details

    • Testing Instructions:
      Hide
      1. Go to "Site administration / Users / Permissions / Define roles"
      2. Press "Add a new role"
      3. On the "Adding a new role" page, make sure that "Use role or archetype" is set to "No role"
      4. Give the role a short name and custom full name.
      5. In "Context types where this role may be assigned" select System to be able to assign this role in the system context.
      6. Set the following settings:
        Context types where this role may be assigned System
        Capabilities moodle/course:create
        moodle/course:manageactivities
        moodle/course:viewparticipants
      1. Create the role.
      2. Go to "Site administration / Users / Permissions / Assign system roles"
      3. Click on the new role that you created.
      4. Assign a user to that role.
      5. On another browser session, log in as that user
      6. Create a course (you can add a new course via the "Site home" with editing mode turned on.
      7. View the participants page
        1. Expected result: Confirm that you are listed
        2. Expected result: Confirm that you are given the teacher role
      8. Back on the admin's window, edit the new role that you created.
      9. For the new role created, set the "Allow role assignments" field to "Teacher"
      10. Save the changes.
      11. Go back to the user's window and create another course
      12. View the participants page
        1. Expected result: Confirm that you are listed
        2. Expected result: Confirm that you are given the teacher role
      13. Back on the admin's window, edit the new role that you created.
      14. Set the capability 'moodle/role:assign' to allow.
      15. Back on the user's window, create another course
      16. View the participants page
        1. Expected result: Confirm that you are listed
        2. Expected result: Confirm that you are given the teacher role
      Show
      Go to " Site administration / Users / Permissions / Define roles " Press " Add a new role " On the " Adding a new role " page, make sure that "Use role or archetype" is set to " No role " Give the role a short name and custom full name. In "Context types where this role may be assigned" select System to be able to assign this role in the system context. Set the following settings: Context types where this role may be assigned System Capabilities moodle/course:create moodle/course:manageactivities moodle/course:viewparticipants Create the role. Go to " Site administration / Users / Permissions / Assign system roles" Click on the new role that you created. Assign a user to that role. On another browser session, log in as that user Create a course (you can add a new course via the " Site home " with editing mode turned on. View the participants page Expected result: Confirm that you are listed Expected result: Confirm that you are given the teacher role Back on the admin's window, edit the new role that you created. For the new role created, set the " Allow role assignments " field to " Teacher " Save the changes. Go back to the user's window and create another course View the participants page Expected result: Confirm that you are listed Expected result: Confirm that you are given the teacher role Back on the admin's window, edit the new role that you created. Set the capability 'moodle/role:assign' to allow. Back on the user's window, create another course View the participants page Expected result: Confirm that you are listed Expected result: Confirm that you are given the teacher role
    • Affected Branches:
      MOODLE_35_STABLE, MOODLE_36_STABLE, MOODLE_37_STABLE, MOODLE_38_STABLE
    • Fixed Branches:
      MOODLE_35_STABLE, MOODLE_36_STABLE, MOODLE_37_STABLE
    • Pull 3.5 Branch:
    • Pull 3.7 Branch:
    • Pull Master Branch:
      MDL-66683-master

      Description

      We fixed a bug with course creation whereby the default course role was given regardless of whether it should be.

      Essentially, in order to assign a role, you need two things:
      1) The moodle/role:assign capability; and
      2) The ability to assign the specified role (Site administration -> Users -> Define role -> Allow role assignments)

      Unfortunately the default "Course creator" role has neither of these.

      We may need to consider adding this to stables in an upgrade step, but this is unusual for stables. I suspect we should accept such a change in our next minor release and grant the assign to the coursecreator archetype for the current default role only.

      Needs:

      1. the moodle/role:assign capability; and
      2. the ability to assign the specified role.

      The coursecreator role as neither of these

      https://moodle.org/mod/forum/discuss.php?d=390792#p1576261

      Further information relating to this from Jari Vilkman:

      Hello,

      It seems that

      https://tracker.moodle.org/browse/MDL-66181
      https://moodle.org/mod/forum/discuss.php?d=391031

      is badly implemented since I didn't find any documentation concerning this change in moodle documentation.

      Suddenly making this scope of a change should be better documented in Moodle documentation and also you should inform moodle administratos if this scope of a change is going to happen (one forum post doesn't really cut it).

      To get it working again you now have to give coursecreator moodle/role:assign before they can get teacher role on the courses they create.

      Also moodle/role:assign is concerned as a XSS-risk, risk of gaining other users information and users can spam other useers.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              cescobedo Carlos Escobedo
              Reporter:
              dobedobedoh Andrew Nicols
              Peer reviewer:
              Michael Hawkins
              Integrator:
              Sara Arjona (@sarjona)
              Tester:
              Janelle Barcega
              Participants:
              Component watchers:
              Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Sara Arjona (@sarjona)
              Votes:
              19 Vote for this issue
              Watchers:
              28 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Fix Release Date:
                11/Nov/19

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 4 hours, 57 minutes
                  4h 57m