MDL-64528 core_completion: prevent toggling completion in frozen context

moodle · Jan 12, 2019 · 7868aab · 7868aab
1 parent 38a1b4f
commit 7868aab
Show file tree

Hide file tree

Showing 5 changed files with 13 additions and 1 deletion.
diff --git a/completion/classes/external.php b/completion/classes/external.php
@@ -75,6 +75,7 @@ public static function update_activity_completion_status_manually($cmid,  $compl
 
         $context = context_module::instance($cmid);
         self::validate_context($context);
+        require_capability('moodle/course:togglecompletion', $context);
 
         list($course, $cm) = get_course_and_cm_from_cmid($cmid);
 

diff --git a/course/renderer.php b/course/renderer.php
@@ -468,7 +468,7 @@ public function course_section_cm_completion($course, &$completioninfo, cm_info
                 $imgalt = get_string('completion-alt-' . $completionicon, 'completion', $formattedname);
             }
 
-            if ($this->page->user_is_editing()) {
+            if ($this->page->user_is_editing() || !has_capability('moodle/course:togglecompletion', $mod->context)) {
                 // When editing, the icon is just an image.
                 $completionpixicon = new pix_icon('i/completion-'.$completionicon, $imgalt, '',
                         array('title' => $imgalt, 'class' => 'iconsmall'));

diff --git a/course/togglecompletion.php b/course/togglecompletion.php
@@ -139,6 +139,7 @@
 
 // Check user is logged in
 require_login($course, false, $cm);
+require_capability('moodle/course:togglecompletion', context_module::instance($cmid));
 
 if (isguestuser() or !confirm_sesskey()) {
     print_error('error');

diff --git a/lang/en/role.php b/lang/en/role.php
@@ -490,3 +490,4 @@
 $string['privacy:metadata:role_capabilities:tableexplanation'] = 'The capabilities and override capabilities for a particular role in a particular context';
 $string['privacy:metadata:role_capabilities:timemodified'] = 'The date when the capability was created or modified.';
 $string['privacy:metadata:role_cohortroles'] = 'Roles to cohort';
+$string['course:togglecompletion'] = 'Allow users to manually complete activities';
diff --git a/lib/db/access.php b/lib/db/access.php
@@ -2439,4 +2439,13 @@
         'archetypes' => [
         ],
     ],
+
+    // Manual completion toggling.
+    'moodle/course:togglecompletion' => [
+        'captype' => 'write',
+        'contextlevel' => CONTEXT_MODULE,
+        'archetypes' => [
+            'user' => CAP_ALLOW,
+        ],
+    ],
 );