Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-72384

require_login ignores section availability when evaluating cm unavailable error message

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Minor Minor
    • None
    • 3.11.2
    • Course, Restrict access
    • MOODLE_311_STABLE

      This was identified while triaging MDL-72319. The problem seems to be in the logic of the course_section_cm_unavailable_error_message() method, which doesn't take into account restricted parent sections when generating the unavailable error message for the cm.

      To reproduce the problem:

      1. Create two groups of users, Core (g.C) and Extended (g.E);
      2. Add all users to g.C
      3. Add some users to g.E
      4. Create two topics, Core (t.C) and Extended (t.E);
      5. Restrict access to t.E to members of g.E only (i.e. hidden from g.C users)
      6. Add some tasks to each topic, e.g. C1, C2, C3 to t.C, and E1, E2, E3 to t.E.
      7. Next, add a Restrict Access condition to E2 based on the score of E1 (e.g. E2 available if E1 score > 80%)
      8. Now, copy the URL of the activity E2 and store it somewhere
      9. Do the same for E1 (not specifically restricted, but restricted by the parent section's availability)
      10. As student, try to access the URL of E1. Notice the message is something like "This activity is hidden"
      11. Now, try to access the URL of E2.
        Expected:  You see "This activity is hidden" message because the entire section is unavailable to the user (just like with E1)
        Actual: You see a message detailing the specific restriction (grade > 80) of the activity

      This reveals more information than is desirable.

            Unassigned Unassigned
            jaked Jake Dallimore
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:

                Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.