From c653a49fe3549e2e767a807f85ce4125ed803245 Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Thu, 13 Jan 2022 23:00:57 +0000
Subject: [PATCH] MDL-72972 tool_uploaduser: observe capability to delete
 users.

---
 admin/tool/uploaduser/classes/process.php | 4 +++-
 admin/tool/uploaduser/user_form.php       | 5 +++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/admin/tool/uploaduser/classes/process.php b/admin/tool/uploaduser/classes/process.php
index 300f5e754b2d4..82f05910d3409 100644
--- a/admin/tool/uploaduser/classes/process.php
+++ b/admin/tool/uploaduser/classes/process.php
@@ -26,6 +26,7 @@
 
 defined('MOODLE_INTERNAL') || die();
 
+use context_system;
 use tool_uploaduser\local\field_value_validators;
 
 require_once($CFG->dirroot.'/user/profile/lib.php');
@@ -550,7 +551,8 @@ public function process_line(array $line) {
 
         // Delete user.
         if (!empty($user->deleted)) {
-            if (!$this->get_allow_deletes() or $remoteuser) {
+            if (!$this->get_allow_deletes() or $remoteuser or
+                    !has_capability('moodle/user:delete', context_system::instance())) {
                 $this->usersskipped++;
                 $this->upt->track('status', get_string('usernotdeletedoff', 'error'), 'warning');
                 return;
diff --git a/admin/tool/uploaduser/user_form.php b/admin/tool/uploaduser/user_form.php
index 8dcf4ce76a2c2..66e2e819d166a 100644
--- a/admin/tool/uploaduser/user_form.php
+++ b/admin/tool/uploaduser/user_form.php
@@ -147,6 +147,11 @@ function definition () {
 
         $mform->addElement('selectyesno', 'uuallowdeletes', get_string('allowdeletes', 'tool_uploaduser'));
         $mform->setDefault('uuallowdeletes', 0);
+        // Ensure user is able to perform user deletion.
+        if (!has_capability('moodle/user:delete', context_system::instance())) {
+            $mform->hardFreeze('uuallowdeletes');
+            $mform->setConstant('uuallowdeletes', 0);
+        }
         $mform->hideIf('uuallowdeletes', 'uutype', 'eq', UU_USER_ADDNEW);
         $mform->hideIf('uuallowdeletes', 'uutype', 'eq', UU_USER_ADDINC);