Create a capability to update H5P content-type libraries
Description
Testing Instructions
Setup
Upload the test-h5p.html file to the $CFG->wwwroot.
Login as admin.
Create a student (s1).
Create a teacher (t1).
Create a course "Course 1".
Access to the course.
Enrol s1 and t1 to the course.
Create a "Forum". Set the "Maximum attachment size" in the "Attachments and word count" section to "Site upload límit".
Send a post to the forum. Add the course-presentation-updated.h5p file as an attachment.
Logout.
Login as t1.
Access to the course.
Reply to the existing post in the forum. Add the course-presentation.h5p file and the arithmetic-quiz.h5p file as attachments.
Logout.
Login as s1.
Access to the course.
Reply to the existing post in the forum. Add the course-presentation-updated.h5p file as an attachment.
Testing scenario 1. Files uploaded by STUDENTS are not displayed
Login as admin.
Go to the "Forum" in the "Course 1" and open the existing post.
Copy the URL for the course-presentation-updated.h5p file uploaded by s1.
Open $CFG->wwwroot/test-h5p.html in a new tab.
Paste the previous URL into the "H5P file URL" form field.
Click the Display button.
Check the following error is displayed: "This file can't be displayed because it has been uploaded by a user without the required capability to deploy H5P content."
Logout.
Login as s1.
Reload the H5P page (the one opened in a new tab in step #4).
Check the following error is still displayed: "This file can't be displayed because it has been uploaded by a user without the required capability to deploy H5P content."
Testing scenario 2. Files uploaded by TEACHERS are not displayed if the libraries don't exist
Login as admin.
Go to the "Forum" in the "Course 1" and open the existing post.
Copy the URL for the course-presentation.h5p file uploaded by t1.
Open $CFG->wwwroot/test-h5p.html in a new tab.
Paste the previous URL into the "H5P file URL" form field.
Click the Display button.
Check the following errors are displayed:
"This file can't be displayed because it has been uploaded by a user without the capability to update H5P content types. Please contact your administrator to ask for the content type to be installed."
Several "missing-required-library : Missing required library XXXXX".
Logout.
Login as t1.
Reload the H5P page (the one opened in a new tab in step #4).
Check the following errors are displayed:
"Note that the libraries may exist in the file you uploaded, but you're not allowed to upload new libraries. Contact the site administrator about this."
Several "missing-required-library : Missing required library XXXXX".
Testing scenario 3. Files uploaded by ADMINS are deployed/displayed
Login as t1.
Go to the "Forum" in the "Course 1" and open the existing post.
Copy the URL for the course-presentation-updated.h5p file uploaded by s1.
Open $CFG->wwwroot/test-h5p.html in a new tab.
Paste the previous URL into the "H5P file URL" form field.
Click the Display button.
Check the following error is displayed: "This file can't be displayed because it has been uploaded by a user without the required capability to deploy H5P content."
Come back to the other tab, where the forum is open.
Copy the URL for the course-presentation-updated.h5p file uploaded by admin.
Open $CFG->wwwroot/test-h5p.html in a new tab.
Paste the previous URL into the "H5P file URL" form field.
Click the Display button.
Check the H5P content is displayed and working as expected.
Testing scenario 4. Teachers can deploy files if the libraries exist (even if they are newer than the required)
Login as t1.
Go to the "Forum" in the "Course 1" and open the existing post.
Copy the URL for the course-presentation.h5p file uploaded by t1.
Open $CFG->wwwroot/test-h5p.html in a new tab.
Paste the previous URL into the "H5P file URL" form field.
Click the Display button.
Check the following errors are displayed above the H5P content:
The version of the H5P library H5P.Blanks used in this content is not valid. Content contains H5P.Blanks 1.11, but it should be H5P.Blanks 1.12.
The version of the H5P library H5P.MultiChoice used in this content is not valid. Content contains H5P.MultiChoice 1.13, but it should be H5P.MultiChoice 1.14.
Check the H5P content is displayed and working as expected.
Reload the page.
Check the H5P content is displayed and working as expected. No error should be displayed now.
Testing scenario 5. Teachers can also update libraries if the capability is assigned
Login as admin.
Go to the "Forum" in the "Course 1" and open the existing post.
Copy the URL for the arithmetic-quiz.h5p file uploaded by t1.
Open $CFG->wwwroot/test-h5p.html in a new tab.
Paste the previous URL into the "H5P file URL" form field.
Click the Display button.
Check the following errors are displayed:
"This file can't be displayed because it has been uploaded by a user without the capability to update H5P content types. Please contact your administrator to ask for the content type to be installed."
missing-required-library : Missing required library H5P.ArithmeticQuiz 1.1
missing-required-library : Missing required library Odometer 1.0
Check the H5P content is NOT displayed.
Come back to the forum tab.
Edit the "Forum" permissions.
Add the "Teacher" to the Roles with permission for the "Allow to update H5P content-type libraries" capability.
Come back to the second tab (the one where the H5P content should be displayed).
Reload the page.
Check the H5P content now is displayed and working as expected.
Automated test results
Pre-check results
Workaround
Attachments
blocks
Activity
Thanks for this improvement which is now covered by the QA test https://moodle.atlassian.net/browse/MDLQA-14116#icft=MDLQA-14116.
Thanks for your contributions! This change is now available from the main moodle.git repository and will shortly be available on download.moodle.org.
Closing as fixed!
@Andrew Lyons thanks a lot for your help (and also for fixing the issue with other issues!) :-*
Confirmed and verified on master.
Test passed
Adrian pulled this in already
Details
Details
Priority
Affects versions
Components
Labels
Assignee
Reporter
Peer reviewer
Integrator
Fix versions
Tester
Participants
Pull from Repository
Pull Main Branch
Clockify
Start / Stop
Clockify

Whilst reviewing the H5P integration (https://moodle.atlassian.net/browse/MDL-66609#icft=MDL-66609) an issue has been raised to control who can install/update the content-type libraries.
There are 2 different approaches, one taking the libraries always from the H5P hub (api.h5p.org) or similar and another adding a capability to admin and managers (h5p:uploadlibraries) to let them upload/deploy the libraries in the .h5p file.
The first looks nicer but, as for now the H5P hub is only returning the latest content-type libraries, we'll go for the second one for now (and will try to go for the first in the future).
Requirements:
Create a new capability: h5p:updatelibraries
This capability would be enabled by default for managers and admins, but not for teachers
To write/overwrite a new content type library, a user would need the new h5p:updatelibraries capability
Users with h5p:deploy capability but without h5p:updatelibraries capability will be able to upload new H5P content that uses existing libraries in the site. In case any of the libraries they are trying to use in the uploaded content is not available, they would get an error asking them to contact their admin to make that library available, because they don't have h5p:updatelibraries permission