admin/roles/override.php

   1 <?php  //$Id$
   2
   3     require_once('../../config.php');
   4
   5     $contextid = required_param('contextid', PARAM_INT);   // context id
   6     $roleid    = optional_param('roleid', 0, PARAM_INT);   // requested role id
   7     $userid    = optional_param('userid', 0, PARAM_INT);   // needed for user tabs
   8     $courseid  = optional_param('courseid', 0, PARAM_INT); // needed for user tabs
   9     $cancel    = optional_param('cancel', 0, PARAM_BOOL);
  10
  11     if (!$context = get_record('context', 'id', $contextid)) {
  12         error('Bad context ID');
  13     }
  14
  15     if (!$sitecontext = get_context_instance(CONTEXT_SYSTEM)) {
  16         error('No site ID');
  17     }
  18
  19     if ($context->id == $sitecontext->id) {
  20         error('Can not override base role capabilities');
  21     }
  22
  23     $canoverride = has_capability('moodle/role:override', $context);
  24
  25     if (!$canoverride and !has_capability('moodle/role:safeoverride', $context)) {
  26         error('You do not have permission to change overrides in this context!');
  27     }
  28
  29     if ($courseid) {
  30         if (!$course = get_record('course', 'id', $courseid)) {
  31             error('Bad course ID');
  32         }
  33     } else {
  34         $course = clone($SITE);
  35         $courseid = SITEID;
  36     }
  37
  38     require_login($course);
  39
  40     $baseurl = 'override.php?contextid='.$context->id;
  41     if (!empty($userid)) {
  42         $baseurl .= '&amp;userid='.$userid;
  43     }
  44     if ($courseid != SITEID) {
  45         $baseurl .= '&amp;courseid='.$courseid;
  46     }
  47
  48     if ($cancel) {
  49         redirect($baseurl);
  50     }
  51
  52 /// needed for tabs.php
  53     $overridableroles = get_overridable_roles($context, 'name', ROLENAME_BOTH);
  54     $assignableroles  = get_assignable_roles($context, 'name', ROLENAME_BOTH);
  55
  56 /// Get some language strings
  57
  58     $strroletooverride = get_string('roletooverride', 'role');
  59     $straction         = get_string('overrideroles', 'role');
  60     $strcurrentrole    = get_string('currentrole', 'role');
  61     $strparticipants   = get_string('participants');
  62
  63 /// Make sure this user can override that role
  64
  65     if ($roleid) {
  66         if (!isset($overridableroles[$roleid])) {
  67             error ('you can not override this role in this context');
  68         }
  69     }
  70
  71     if ($userid) {
  72         $user = get_record('user', 'id', $userid);
  73         $fullname = fullname($user, has_capability('moodle/site:viewfullnames', $context));
  74     }
  75
  76 /// get all cababilities
  77     $safeoverridenotice = false;
  78     if ($roleid) {
  79         if ($capabilities = fetch_context_capabilities($context)) {
  80             // find out if we need to lock some capabilities
  81             foreach ($capabilities as $capname=>$capability) {
  82                 $capabilities[$capname]->locked = false;
  83                 if ($canoverride) {
  84                     //ok no locking at all
  85                     continue;
  86                 }
  87                 //only limited safe overrides - spam only allowed
  88                 if ((RISK_DATALOSS & (int)$capability->riskbitmask)
  89                  or (RISK_MANAGETRUST & (int)$capability->riskbitmask)
  90                  or (RISK_CONFIG & (int)$capability->riskbitmask)
  91                  or (RISK_XSS & (int)$capability->riskbitmask)
  92                  or (RISK_PERSONAL & (int)$capability->riskbitmask)) {
  93                     $capabilities[$capname]->locked = true;
  94                     $safeoverridenotice = true;
  95                 }
  96             }
  97         }
  98     } else {
  99         $capabilities = null;
 100     }
 101
 102 /// Process incoming role override
 103     if ($data = data_submitted() and $roleid and confirm_sesskey()) {
 104         $allowed_values = array(CAP_INHERIT, CAP_ALLOW, CAP_PREVENT, CAP_PROHIBIT);
 105
 106         $localoverrides = get_records_select('role_capabilities', "roleid = $roleid AND contextid = $context->id",
 107                                              '', 'capability, permission, id');
 108
 109         foreach ($capabilities as $cap) {
 110             if ($cap->locked) {
 111                 //user not allowed to change this cap
 112                 continue;
 113             }
 114
 115             if (!isset($data->{$cap->name})) {
 116                 //cap not specified in form
 117                 continue;
 118             }
 119
 120             if (islegacy($data->{$cap->name})) {
 121                 continue;
 122             }
 123
 124             $capname = $cap->name;
 125             $value = clean_param($data->{$cap->name}, PARAM_INT);
 126             if (!in_array($value, $allowed_values)) {
 127                  continue;
 128             }
 129
 130             if (isset($localoverrides[$capname])) {
 131                 // Something exists, so update it
 132                 assign_capability($capname, $value, $roleid, $context->id, true);
 133             } else { // insert a record
 134                 if ($value != CAP_INHERIT) {    // Ignore inherits
 135                     assign_capability($capname, $value, $roleid, $context->id);
 136                 }
 137             }
 138         }
 139
 140         // force accessinfo refresh for users visiting this context...
 141         mark_context_dirty($context->path);
 142         $rolename = get_field('role', 'name', 'id', $roleid);
 143         add_to_log($course->id, 'role', 'override', 'admin/roles/override.php?contextid='.$context->id.'&roleid='.$roleid, $rolename, '', $USER->id);
 144         redirect($baseurl);
 145     }
 146
 147
 148 /// Print the header and tabs
 149
 150     if ($context->contextlevel == CONTEXT_USER) {
 151         $navlinks = array();
 152         /// course header
 153         if ($course->id != SITEID) {
 154             if (has_capability('moodle/course:viewparticipants', get_context_instance(CONTEXT_COURSE, $course->id))) {
 155                 $navlinks[] = array('name' => $strparticipants, 'link' => "$CFG->wwwroot/user/index.php?id=$course->id", 'type' => 'misc');
 156             }
 157             $navlinks[] = array('name' => $fullname, 'link' => "$CFG->wwwroot/user/view.php?id=$userid&amp;course=$courseid", 'type' => 'misc');
 158             $navlinks[] = array('name' => $straction, 'link' => null, 'type' => 'misc');
 159             $navigation = build_navigation($navlinks);
 160             print_header("$fullname", "$fullname", $navigation, "", "", true, "&nbsp;", navmenu($course));
 161
 162         /// site header
 163         } else {
 164             $navlinks[] = array('name' => $fullname, 'link' => "$CFG->wwwroot/user/view.php?id=$userid&amp;course=$courseid", 'type' => 'misc');
 165             $navlinks[] = array('name' => $straction, 'link' => null, 'type' => 'misc');
 166             $navigation = build_navigation($navlinks);
 167             print_header("$course->fullname: $fullname", $course->fullname, $navigation, "", "", true, "&nbsp;", navmenu($course));
 168         }
 169         $showroles = 1;
 170         $currenttab = 'override';
 171         include_once($CFG->dirroot.'/user/tabs.php');
 172     } else if ($context->contextlevel==CONTEXT_COURSE and $context->instanceid == SITEID) {
 173         require_once($CFG->libdir.'/adminlib.php');
 174         admin_externalpage_setup('frontpageroles');
 175         admin_externalpage_print_header();
 176         $currenttab = 'override';
 177         include_once('tabs.php');
 178     } else {
 179         $currenttab = 'override';
 180         include_once('tabs.php');
 181     }
 182
 183     print_heading_with_help(get_string('overridepermissionsin', 'role', print_context_name($context)), 'overrides');
 184
 185     if ($roleid) {
 186     /// prints a form to swap roles
 187         echo '<div class="selector">';
 188         $overridableroles = array('0'=>get_string('listallroles', 'role').'...') + $overridableroles;
 189         popup_form("$CFG->wwwroot/$CFG->admin/roles/override.php?userid=$userid&amp;courseid=$courseid&amp;contextid=$contextid&amp;roleid=",
 190             $overridableroles, 'switchrole', $roleid, '', '', '', false, 'self', $strroletooverride);
 191         echo '</div>';
 192
 193         $parentcontexts = get_parent_contexts($context);
 194         if (!empty($parentcontexts)) {
 195             $parentcontext = array_shift($parentcontexts);
 196             $parentcontext = get_context_instance_by_id($parentcontext);
 197         } else {
 198             $parentcontext = $context; // site level in override??
 199         }
 200
 201         $r_caps = role_context_capabilities($roleid, $parentcontext);
 202
 203         $localoverrides = get_records_select('role_capabilities', "roleid = $roleid AND contextid = $context->id",
 204                                              '', 'capability, permission, id');
 205
 206         $lang = str_replace('_utf8', '', current_language());
 207
 208         if (!empty($capabilities)) {
 209             // Print the capabilities overrideable in this context
 210             print_simple_box_start('center');
 211             include('override.html');
 212             print_simple_box_end();
 213
 214         } else {
 215             notice(get_string('nocapabilitiesincontext', 'role'),
 216                     $CFG->wwwroot.'/'.$CFG->admin.'/roles/'.$baseurl);
 217         }
 218
 219     } else {   // Print overview table
 220
 221         $table->tablealign = 'center';
 222         $table->cellpadding = 5;
 223         $table->cellspacing = 0;
 224         $table->width = '60%';
 225         $table->head = array(get_string('roles', 'role'), get_string('description'), get_string('overrides', 'role'));
 226         $table->wrap = array('nowrap', '', 'nowrap');
 227         $table->align = array('right', 'left', 'center');
 228
 229         foreach ($overridableroles as $roleid => $rolename) {
 230             $countusers = 0;
 231             $overridecount = count_records_select('role_capabilities', "roleid = $roleid AND contextid = $context->id");
 232             $description = format_string(get_field('role', 'description', 'id', $roleid));
 233             $table->data[] = array('<a href="'.$baseurl.'&amp;roleid='.$roleid.'">'.$rolename.'</a>', $description, $overridecount);
 234         }
 235
 236         print_table($table);
 237     }
 238
 239     print_footer($course);
 240
 241 ?>