MDL-72972 tool_uploaduser: observe capability to delete users.

moodle · Mar 8, 2022 · c653a49 · c653a49
1 parent 15c282d
commit c653a49
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/admin/tool/uploaduser/classes/process.php b/admin/tool/uploaduser/classes/process.php
@@ -26,6 +26,7 @@
 
 defined('MOODLE_INTERNAL') || die();
 
+use context_system;
 use tool_uploaduser\local\field_value_validators;
 
 require_once($CFG->dirroot.'/user/profile/lib.php');
@@ -550,7 +551,8 @@ public function process_line(array $line) {
 
         // Delete user.
         if (!empty($user->deleted)) {
-            if (!$this->get_allow_deletes() or $remoteuser) {
+            if (!$this->get_allow_deletes() or $remoteuser or
+                    !has_capability('moodle/user:delete', context_system::instance())) {
                 $this->usersskipped++;
                 $this->upt->track('status', get_string('usernotdeletedoff', 'error'), 'warning');
                 return;

diff --git a/admin/tool/uploaduser/user_form.php b/admin/tool/uploaduser/user_form.php
@@ -147,6 +147,11 @@ function definition () {
 
         $mform->addElement('selectyesno', 'uuallowdeletes', get_string('allowdeletes', 'tool_uploaduser'));
         $mform->setDefault('uuallowdeletes', 0);
+        // Ensure user is able to perform user deletion.
+        if (!has_capability('moodle/user:delete', context_system::instance())) {
+            $mform->hardFreeze('uuallowdeletes');
+            $mform->setConstant('uuallowdeletes', 0);
+        }
         $mform->hideIf('uuallowdeletes', 'uutype', 'eq', UU_USER_ADDNEW);
         $mform->hideIf('uuallowdeletes', 'uutype', 'eq', UU_USER_ADDINC);