MDL-8840 Loginas cleanup; merged from MOODLE_18_STABLE

+ merging perflib toys from moodlelib.php

diff --git a/course/loginas.php b/course/loginas.php
index 7fd8e2f135aac11404373619f98ddb510c5b16a7..173121c34ea6991a1390935090352c108a35cc84 100644 (file)
--- a/course/loginas.php
+++ b/course/loginas.php
@@ -1,13 +1,17 @@
 <?php // $Id$
       // Allows a teacher/admin to login as another user (in stealth mode)
 
-    require_once("../config.php");
-    require_once("lib.php");
+    require_once('../config.php');
+    require_once('lib.php');
 
 /// Reset user back to their real self if needed
-    $return   = optional_param('return', 0, PARAM_BOOL);   // return to the page we came from
+    $return = optional_param('return', 0, PARAM_BOOL);   // return to the page we came from
 
     if (!empty($USER->realuser)) {
+        if (!confirm_sesskey()) {
+            print_error('confirmsesskeybad');
+        }
+        
         $USER = get_complete_user_data('id', $USER->realuser);
         load_all_capabilities();   // load all this user's normal capabilities
 
@@ -27,42 +31,43 @@
         }
     }
 
-
 ///-------------------------------------
 /// We are trying to log in as this user in the first place
 
-    $id       = required_param('id', PARAM_INT);           // course id
-    $userid   = required_param('user', PARAM_INT);         // login as this user
+    $id     = optional_param('id', SITEID, PARAM_INT);   // course id
+    $userid = required_param('user', PARAM_INT);         // login as this user
 
-    if (!$site = get_site()) {
-        error("Site isn't defined!");
+    if (!confirm_sesskey()) {
+        print_error('confirmsesskeybad');
     }
-
-    if (! $course = get_record("course", "id", $id)) {
+    
+    if (! $course = get_record('course', 'id', $id)) {
         error("Course ID was incorrect");
     }
 
 /// User must be logged in
 
-    if ($course->id == SITEID) {
-        require_login();
-        $context = get_context_instance(CONTEXT_SYSTEM, SITEID);
-    } else {
-        require_login($course->id);
-        $context = get_context_instance(CONTEXT_COURSE, $course->id);
-        if (!has_capability('moodle/course:view', $context, $userid, false)) {
+    $systemcontext = get_context_instance(CONTEXT_SYSTEM);
+    $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
+
+    require_login();
+
+    if (has_capability('moodle/user:loginas', $systemcontext)) {
+        if (has_capability('moodle/site:doanything', $systemcontext, $userid, false)) {
+            print_error('nologinas');
+        }
+        $context = $systemcontext;
+    } else if (has_capability('moodle/user:loginas', $coursecontext)) {
+        require_login($course);
+        if (!has_capability('moodle/course:view', $coursecontext, $userid, false)) {
             error('This user is not in this course!');
         }
-        if (has_capability('moodle/site:doanything', $context, $userid, false)) {
+        if (has_capability('moodle/site:doanything', $coursecontext, $userid, false)) {
             print_error('nologinas');
         }
+        $context = $coursecontext;
     }
 
-/// User must have permissions
-
-    require_capability('moodle/user:loginas', $context);
-
-
 /// Remember current timeaccess settings for later
 
     if (isset($USER->timeaccess)) {
@@ -74,10 +79,11 @@
     $oldfullname = fullname($USER, true);
     $olduserid   = $USER->id;
 
-    $USER = get_complete_user_data('id', $userid);    // Create the new USER object with all details
+/// Create the new USER object with all details and reload needed capabilitites
+    $USER = get_complete_user_data('id', $userid);
     $USER->realuser = $olduserid;
-
-    load_user_capability('', $context); // load this user's capabilities for this context only
+    $USER->loginascontext = $context;
+    load_all_capabilities();   // reload capabilities
 
     if (isset($SESSION->currentgroup)) {    // Remember current cache setting for later
         $SESSION->oldcurrentgroup = $SESSION->currentgroup;

diff --git a/lang/en_utf8/error.php b/lang/en_utf8/error.php
index 9425c8d511bd2f15424a9f16951ea9893a7536a0..84f95655bce574901b99432a1de8742281e1a3b8 100644 (file)
--- a/lang/en_utf8/error.php
+++ b/lang/en_utf8/error.php
@@ -39,6 +39,7 @@ $string['invalidfiletype'] = '\"$a\" is not a valid file type';
 $string['invalidmd5'] = 'Invalid md5';
 $string['invalidrole'] = 'Invalid role';
 $string['invalidxmlfile'] = '\"$a\" is not a valid XML file';
+$string['loginascourseredir'] = 'You can not enter this course.<br /> You have to terminate the \"Login as\" session before entering any other course.';
 $string['missingfield'] = 'Field \"$a\" is missing';
 $string['missingrequiredfield'] = 'Some required field is missing';
 $string['modulemissingcode'] = 'Module $a is missing the code needed to perform this function';

diff --git a/lib/accesslib.php b/lib/accesslib.php
index 021458ca5a34ae6afeaa066fdad77799bbb3a8e9..c35c5b5475e6a2266828d8e4ea4e7b91382e492a 100755 (executable)
--- a/lib/accesslib.php
+++ b/lib/accesslib.php
@@ -1118,7 +1118,16 @@ function load_all_capabilities() {
             $defcaps = load_defaultuser_role(true);
         }
 
-        load_user_capability();
+        if (empty($USER->realuser)) {
+            load_user_capability();
+        } else {
+            if ($USER->loginascontext->contextlevel != CONTEXT_SYSTEM) {
+                // load only course caqpabilitites - it may not always work as expected
+                load_user_capability('', $USER->loginascontext);
+            } else {
+                load_user_capability();
+            }
+        }
 
         if (!empty($USER->switchrole)) {
 

diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index 1e97ed01af4b4da3e300643b1bbe293ddf1e2f98..e28728935eb67abb29a9ba43a0632e65e99b7c66 100644 (file)
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -1658,6 +1658,16 @@ function require_login($courseorid=0, $autologinguest=true, $cm=null) {
         exit;
     }
 
+/// loginas as redirection if needed
+    if ($COURSE->id != SITEID and !empty($USER->realuser)) {
+        if ($USER->loginascontext->contextlevel == CONTEXT_COURSE) {
+            if ($USER->loginascontext->instanceid != $COURSE->id) {
+                print_error('loginascourseredir', '', $CFG->wwwroot.'/course/view.php?id='.$USER->loginascontext->instanceid);
+            } 
+        }
+    }
+
+
 /// check whether the user should be changing password (but only if it is REALLY them)
     $userauth = get_auth_plugin($USER->auth);
     if (get_user_preferences('auth_forcepasswordchange') && empty($USER->realuser)) {
@@ -6548,6 +6558,12 @@ function get_performance_info() {
         $info['html'] .= '<span class="logwrites">Log writes '.$info['logwrites'].'</span> ';
         $info['txt'] .= 'logwrites: '.$info['logwrites'].' ';
     }
+    
+    if (!empty($PERF->profiling)) {
+        require_once($CFG->dirroot .'/lib/profilerlib.php');
+        $profiler = new Profiler();
+        $info['html'] .= '<span class="profilinginfo">'.$profiler->get_profiling().'</span>';
+    }
 
     if (function_exists('posix_times')) {
         $ptimes = posix_times();
@@ -6591,6 +6607,9 @@ function get_performance_info() {
     return $info;
 }
 
+function apd_get_profiling() {
+    return shell_exec('pprofp -u ' . ini_get('apd.dumpdir') . '/pprof.' . getmypid() . '.*');
+}
 
 function remove_dir($dir, $content_only=false) {
     // if content_only=true then delete all but

diff --git a/lib/weblib.php b/lib/weblib.php
index 2ffe33b06923c91fdb3a2c512c855f2509c79e8a..4ad2020243e5e351845b07745063c4cf04bbc132 100644 (file)
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -2742,11 +2742,11 @@ function user_login_string($course=NULL, $user=NULL) {
         $course = $SITE;
     }
 
-    if (isset($user->realuser)) {
+    if (!empty($user->realuser)) {
         if ($realuser = get_record('user', 'id', $user->realuser)) {
             $fullname = fullname($realuser, true);
             $realuserinfo = " [<a $CFG->frametarget
-            href=\"$CFG->wwwroot/course/loginas.php?id=$course->id&amp;return=1\">$fullname</a>] ";
+            href=\"$CFG->wwwroot/course/loginas.php?id=$course->id&amp;return=1&amp;sesskey=".sesskey()."\">$fullname</a>] ";
         }
     } else {
         $realuserinfo = '';
@@ -2761,7 +2761,7 @@ function user_login_string($course=NULL, $user=NULL) {
     if (empty($course->id)) {
         // $course->id is not defined during installation
         return '';
-    } else if (isset($user->id) and $user->id) {
+    } else if (!empty($user->id)) {
         $context = get_context_instance(CONTEXT_COURSE, $course->id);
 
         $fullname = fullname($user, true);
@@ -3354,9 +3354,9 @@ has_capability('moodle/course:viewhiddenuserfields', $context)) {
     if (has_capability('moodle/role:assign', $context, NULL)) {  // Includes admins
         $output .= '<a href="'. $CFG->wwwroot .'/course/unenrol.php?id='. $course->id .'&amp;user='. $user->id .'">'. $string->unenrol .'</a><br />';
     }
-    if ($USER->id != $user->id && has_capability('moodle/user:loginas', $context) &&
+    if ($USER->id != $user->id && empty($USER->realuser) && has_capability('moodle/user:loginas', $context) &&
                                  ! has_capability('moodle/site:doanything', $context, $user->id, false)) {
-        $output .= '<a href="'. $CFG->wwwroot .'/course/loginas.php?id='. $course->id .'&amp;user='. $user->id .'">'. $string->loginas .'</a><br />';
+        $output .= '<a href="'. $CFG->wwwroot .'/course/loginas.php?id='. $course->id .'&amp;user='. $user->id .'&amp;sesskey='. sesskey() .'">'. $string->loginas .'</a><br />';
     }
     $output .= '<a href="'. $CFG->wwwroot .'/user/view.php?id='. $user->id .'&amp;course='. $course->id .'">'. $string->fullprofile .'...</a>';
 

diff --git a/user/view.php b/user/view.php
index f3db2b96e20adb38cb79fb41c6133baede042506..69a1075a776fae0522343885936c730d5e7ae2d2 100644 (file)
--- a/user/view.php
+++ b/user/view.php
@@ -399,12 +399,13 @@
         }
     }
 
-    if ($USER->id != $user->id  && has_capability('moodle/user:loginas', $coursecontext) &&
+    if ($USER->id != $user->id  && empty($USER->realuser) && has_capability('moodle/user:loginas', $coursecontext) &&
                                  ! has_capability('moodle/site:doanything', $coursecontext, $user->id, false)) {
         echo '<form action="'.$CFG->wwwroot.'/course/loginas.php" method="get">';
         echo "<div>";
         echo '<input type="hidden" name="id" value="'.$course->id.'" />';
         echo '<input type="hidden" name="user" value="'.$user->id.'" />';
+        echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
         echo '<input type="submit" value="'.get_string('loginas').'" />';
         echo "</div>";
         echo '</form>';