Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-78797

External tool: Course preconfigured tools are listed erroneously when creating a manual instance





      The capabilities 'mod/lti:addmanualinstance' and 'mod/lti:addpreconfiguredinstance' were added in MDL-62815, but I think a bug slipped through there unnoticed.

      In that issue:
      a) There was a comment from Eloy essentially noting that the USE of preconfigured tools (whether site or course) was supposed to be controlled by 'mod/lti:addpreconfiguredinstance'. https://tracker.moodle.org/browse/MDL-62815?focusedCommentId=662714&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-662714
      b) The manual testing didn't cover the case where there was a preconfigured COURSE tool. It only tested with preconfigured SITE tools.
      c) Subsequently, the part of the testing that covered the 'mod/lti:addmanualinstance' capability failed to see what I think is a bug in the 'lti_get_lti_types_by_course()' method.

      The bug:
      When the user ONLY has 'mod/lti:addmanualinstance' capability, they aren't supposed to see anything other than 'automatic, based on tool URL' in the preconfigured tool select (per the testing instructions). If there's a course tool present, however, they'll also see that. Given a course tool is supposed to be considered a 'preconfigured' tool (per Eloy's comment and per my understanding too), this entry should not be present when the user doesn't have permissions 'mod/lti:addpreconfiguredinstance'. I don't think the intention was to treat course tools as a special case. Certainly there's no testing covering that.

      Furthermore, if the user were to select that course-level tool when creating the instance, subsequent edits would not permit the user to change it in any way. They'll see Tool URL and can then set that, overriding the course tool they were able to set when creating the instance.

      To reproduce:

      1. Login as the admin
      2. Go to "Site admin > Plugins > Activities > External tool > Manage tools"
      3. Click "Configure a tool manually"
      4. Enter the name "Site tool" and enter the URL "https://moodle.org"
      5. Save the tool
      6. Create a course
      7. Click to add an activity/resource, selecting "External tool" from the activity chooser
      8. Next to the "Preconfigured tools" select, click the "+" icon to add a course tool
      9. Name it "Course tool" and set the URL to "http://example.com"
      10. Save changes and when the tab closes, just cancel out of the activity instance form (we don't need an instance, we just need the course tool to be created).
      11. Enrol an editing teacher in the course
      12. Go to "Participants > Permissions" and select the "Editing teacher" role from the "Advanced role override" select
      13. filter using 'mod/lti' to make it easier to see the relevant caps
      14. Set the following cap values:
        • "mod/lti:addmanualinstance" to "Inhert (Allow)"
        • "mod/lti:addpreconfiguredinstance" to "Prohibit"
      15. Save the overrides.
      16. Log out
      17. Log in as the teacher
      18. Go to the course
      19. Click to add an activity/resource, selecting "External tool" from the activity chooser
      20. Look at the options in the "Preconfigured tools" select:
        Expected: You only see the "Automatic, based on tool URL" option
        Actual: You see the above option as well as the "Course tool" course preconfigured tool.
      21. Select "Course tool" and save
      22. Edit the instance you just created
      23. Note you cannot change the preconfigured tool now
      24. Log out
      25. Log in as the admin
      26. Go to the course and edit the activity
      27. Note that you do see the preconfigured tool listed as "Course tool" here.

      Changing this code to match the expectations above (no preconfigured tools listed, whether they be course or site) won't break any existing phpunit or behat tests.


        Issue Links



              jaked Jake Dallimore
              jaked Jake Dallimore
              0 Vote for this issue
              1 Start watching this issue




                  Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.