first commit

lib/ajax/ajaxlib.php

@@ -0,0 +1,86 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+
+/**
+ * Library functions to facilitate the use of ajax JavaScript in Moodle.
+ *
+ * @package   core
+ * @copyright 2009 Tim Hunt
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+/**
+ * You need to call this function if you wish to use the set_user_preference method in javascript_static.php, to white-list the
+ * preference you want to update from JavaScript, and to specify the type of cleaning you expect to be done on values.
+ *
+ * @package  core
+ * @category preference
+ * @param    string          $name      the name of the user_perference we should allow to be updated by remote calls.
+ * @param    integer         $paramtype one of the PARAM_{TYPE} constants, user to clean submitted values before set_user_preference is called.
+ * @return   null
+ *
+ * @deprecated since Moodle 4.3
+ */
+function user_preference_allow_ajax_update($name, $paramtype) {
+    global $USER, $PAGE;
+
+    debugging(__FUNCTION__ . '() is deprecated. Please use the "core_user/repository" module instead.', DEBUG_DEVELOPER);
+
+    // Record in the session that this user_preference is allowed to updated remotely.
+    $USER->ajax_updatable_user_prefs[$name] = $paramtype;
+}
+
+/**
+ * Starts capturing output whilst processing an AJAX request.
+ *
+ * This should be used in combination with ajax_check_captured_output to
+ * report any captured output to the user.
+ *
+ * @return Boolean Returns true on success or false on failure.
+ */
+function ajax_capture_output() {
+    // Start capturing output in case of broken plugins.
+    return ob_start();
+}
+
+/**
+ * Check captured output for content. If the site has a debug level of
+ * debugdeveloper set, and the content is non-empty, then throw a coding
+ * exception which can be captured by the Y.IO request and displayed to the
+ * user.
+ *
+ * @return Any output that was captured.
+ */
+function ajax_check_captured_output() {
+    global $CFG;
+
+    // Retrieve the output - there should be none.
+    $output = ob_get_contents();
+    ob_end_clean();
+
+    if (!empty($output)) {
+        $message = 'Unexpected output whilst processing AJAX request. ' .
+                'This could be caused by trailing whitespace. Output received: ' .
+                var_export($output, true);
+        if ($CFG->debugdeveloper && !empty($output)) {
+            // Only throw an error if the site is in debugdeveloper.
+            throw new coding_exception($message);
+        }
+        error_log('Potential coding error: ' . $message);
+    }
+    return $output;
+}

lib/ajax/blocks.php

@@ -0,0 +1,104 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Provide interface for blocks AJAX actions
+ *
+ * @copyright  2011 Lancaster University Network Services Limited
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @package core
+ */
+
+define('AJAX_SCRIPT', true);
+require_once(__DIR__ . '/../../config.php');
+
+// Initialise ALL common incoming parameters here, up front.
+$pagehash = required_param('pagehash', PARAM_RAW);
+$action = optional_param('action', '', PARAM_ALPHA);
+// Params for blocks-move actions.
+$buimoveid = optional_param('bui_moveid', 0, PARAM_INT);
+$buinewregion = optional_param('bui_newregion', '', PARAM_ALPHAEXT);
+$buibeforeid = optional_param('bui_beforeid', 0, PARAM_INT);
+
+$PAGE->set_url('/lib/ajax/blocks.php', ['pagehash' => $pagehash]);
+
+// Retrieve the edited page from the session hash.
+$page = moodle_page::retrieve_edited_page($pagehash, MUST_EXIST);
+
+// Verifying login and session.
+$cm = null;
+if (!is_null($page->cm)) {
+    $cm = get_coursemodule_from_id(null, $page->cm->id, $page->course->id, false, MUST_EXIST);
+}
+require_login($page->course, false, $cm);
+require_sesskey();
+$PAGE->set_context($page->context);
+
+if (!$page->user_can_edit_blocks() || !$page->user_is_editing()) {
+    throw new moodle_exception('nopermissions', '', $page->url->out(), get_string('editblock'));
+}
+
+// Send headers.
+echo $OUTPUT->header();
+
+switch ($action) {
+    case 'move':
+        // Loading blocks and instances for the region.
+        $page->blocks->load_blocks();
+        $instances = $page->blocks->get_blocks_for_region($buinewregion);
+
+        $buinewweight = null;
+        if ($buibeforeid == 0) {
+            if (count($instances) === 0) {
+                // Moving the block into an empty region. Give it the default weight.
+                $buinewweight = 0;
+            } else {
+                // Moving to very bottom.
+                $last = end($instances);
+                $buinewweight = $last->instance->weight + 1;
+            }
+        } else {
+            // Moving somewhere.
+            $lastweight = 0;
+            $lastblock = 0;
+            $first = reset($instances);
+            if ($first) {
+                $lastweight = $first->instance->weight - 2;
+            }
+
+            foreach ($instances as $instance) {
+                if ($instance->instance->id == $buibeforeid) {
+                    // Location found, just calculate weight like in block_manager->create_block_contents() and quit the loop.
+                    if ($lastblock == $buimoveid) {
+                        // Same block, same place - nothing to move.
+                        break;
+                    }
+                    $buinewweight = ($lastweight + $instance->instance->weight) / 2;
+                    break;
+                }
+                $lastweight = $instance->instance->weight;
+                $lastblock = $instance->instance->id;
+            }
+        }
+
+        // Move block if we need.
+        if (isset($buinewweight)) {
+            // Nasty hack.
+            $_POST['bui_newweight'] = $buinewweight;
+            $page->blocks->process_url_move();
+        }
+        break;
+}

lib/ajax/getnavbranch.php

@@ -0,0 +1,137 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * This file is used to deliver a branch from the navigation structure
+ * in XML format back to a page from an AJAX call
+ *
+ * @since Moodle 2.0
+ * @package core
+ * @copyright 2009 Sam Hemelryk
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+define('AJAX_SCRIPT', true);
+define('READ_ONLY_SESSION', true);
+
+/** Include config */
+require_once(__DIR__ . '/../../config.php');
+/** Include course lib for its functions */
+require_once($CFG->dirroot.'/course/lib.php');
+
+if (!empty($CFG->forcelogin)) {
+    require_login();
+}
+
+try {
+    // Start buffer capture so that we can `remove` any errors
+    ob_start();
+    // Require id This is the key for whatever branch we want to get.
+    // This accepts alphanum because the courses and my courses branches don't have numerical keys.
+    // For those branches we return the alphanum key, courses and mycourses.
+    $branchid = required_param('id', PARAM_ALPHANUM);
+    // This identifies the type of the branch we want to get
+    $branchtype = required_param('type', PARAM_INT);
+    // This identifies the block instance requesting AJAX extension
+    $instanceid = optional_param('instance', null, PARAM_INT);
+
+    $PAGE->set_context(context_system::instance());
+
+    // Create a global nav object
+    $navigation = new global_navigation_for_ajax($PAGE, $branchtype, $branchid);
+
+    $linkcategories = false;
+
+    if ($instanceid!==null) {
+        // Get the db record for the block instance
+        $blockrecord = $DB->get_record('block_instances', array('id'=>$instanceid,'blockname'=>'navigation'));
+        if ($blockrecord!=false) {
+
+            // Instantiate a block_instance object so we can access config
+            $block = block_instance('navigation', $blockrecord);
+
+            $trimmode = block_navigation::TRIM_RIGHT;
+            $trimlength = 50;
+
+            // Set the trim mode
+            if (!empty($block->config->trimmode)) {
+                $trimmode = (int)$block->config->trimmode;
+            }
+            // Set the trim length
+            if (!empty($block->config->trimlength)) {
+                $trimlength = (int)$block->config->trimlength;
+            }
+            if (!empty($block->config->linkcategories) && $block->config->linkcategories == 'yes') {
+                $linkcategories = true;
+            }
+        }
+    }
+
+    // Create a navigation object to use, we can't guarantee PAGE will be complete
+    if (!isloggedin()) {
+        $navigation->set_expansion_limit(navigation_node::TYPE_COURSE);
+    } else {
+        if (isset($block) && !empty($block->config->expansionlimit)) {
+            $navigation->set_expansion_limit($block->config->expansionlimit);
+        }
+    }
+    if (isset($block)) {
+        $block->trim($navigation, $trimmode, $trimlength, ceil($trimlength/2));
+    }
+    $converter = new navigation_json();
+
+    // Find the actual branch we are looking for
+    if ($branchtype != 0) {
+        $branch = $navigation->find($branchid, $branchtype);
+    } else if ($branchid === 'mycourses' || $branchid === 'courses') {
+        $branch = $navigation->find($branchid, navigation_node::TYPE_ROOTNODE);
+    } else {
+        throw new coding_exception('Invalid branch type/id passed to AJAX call to load branches.');
+    }
+
+    // Remove links to categories if required.
+    if (!$linkcategories) {
+        foreach ($branch->find_all_of_type(navigation_node::TYPE_CATEGORY) as $category) {
+            $category->action = null;
+        }
+        foreach ($branch->find_all_of_type(navigation_node::TYPE_MY_CATEGORY) as $category) {
+            $category->action = null;
+        }
+    }
+
+    // Stop buffering errors at this point
+    $html = ob_get_contents();
+    ob_end_clean();
+} catch (Exception $e) {
+    throw new coding_exception('Error: '.$e->getMessage());
+}
+
+// Check if the buffer contianed anything if it did ERROR!
+if (trim($html) !== '') {
+    throw new coding_exception('Errors were encountered while producing the navigation branch'."\n\n\n".$html);
+}
+// Check that branch isn't empty... if it is ERROR!
+if (empty($branch) || ($branch->nodetype !== navigation_node::NODETYPE_BRANCH && !$branch->isexpandable)) {
+    throw new coding_exception('No further information available for this branch');
+}
+
+// Prepare an XML converter for the branch
+$converter->set_expandable($navigation->get_expandable());
+// Set XML headers
+header('Content-type: text/plain; charset=utf-8');
+// Convert and output the branch as XML
+echo $converter->convert($branch);

lib/ajax/getsiteadminbranch.php

@@ -0,0 +1,53 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * This file is used to deliver a branch from the site administration
+ * in XML format back to a page from an AJAX call
+ *
+ * @since Moodle 2.6
+ * @package core
+ * @copyright 2013 Rajesh Taneja <rajesh@moodle.com>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+define('AJAX_SCRIPT', true);
+require_once(__DIR__ . '/../../config.php');
+
+// This should be accessed by only valid logged in user.
+require_login(null, false);
+
+// This identifies the type of the branch we want to get. Make sure it's SITE_ADMIN.
+$branchtype = required_param('type', PARAM_INT);
+if ($branchtype !== navigation_node::TYPE_SITE_ADMIN) {
+    throw new coding_exception('Incorrect node type passed');
+}
+
+// Start capturing output in case of broken plugins.
+ajax_capture_output();
+
+$PAGE->set_context(context_system::instance());
+$PAGE->set_url('/lib/ajax/getsiteadminbranch.php', array('type'=>$branchtype));
+
+$sitenavigation = new settings_navigation_ajax($PAGE);
+
+// Convert and output the branch as JSON.
+$converter = new navigation_json();
+$branch = $sitenavigation->get('root');
+
+ajax_check_captured_output();
+echo $converter->convert($branch);

lib/ajax/service-nologin.php

@@ -0,0 +1,33 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * This file is used to call any registered externallib function in Moodle.
+ *
+ * It will process more than one request and return more than one response if required.
+ * It is recommended to add webservice functions and re-use this script instead of
+ * writing any new custom ajax scripts.
+ *
+ * @since Moodle 2.9
+ * @package core
+ * @copyright 2015 Damyon Wiese
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+define('NO_MOODLE_COOKIES', true);
+define('ALLOW_GET_PARAMETERS', true);
+
+require_once('service.php');

lib/ajax/service.php

@@ -0,0 +1,118 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * This file is used to call any registered externallib function in Moodle.
+ *
+ * It will process more than one request and return more than one response if required.
+ * It is recommended to add webservice functions and re-use this script instead of
+ * writing any new custom ajax scripts.
+ *
+ * @since Moodle 2.9
+ * @package core
+ * @copyright 2015 Damyon Wiese
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+use core_external\external_api;
+use core_external\external_settings;
+
+define('AJAX_SCRIPT', true);
+// Services can declare 'readonlysession' in their config located in db/services.php, if not present will default to false.
+define('READ_ONLY_SESSION', true);
+
+if (!empty($_GET['nosessionupdate'])) {
+    define('NO_SESSION_UPDATE', true);
+}
+
+require_once(__DIR__ . '/../../config.php');
+
+define('PREFERRED_RENDERER_TARGET', RENDERER_TARGET_GENERAL);
+
+$arguments = '';
+$cacherequest = false;
+if (defined('ALLOW_GET_PARAMETERS')) {
+    $arguments = optional_param('args', '', PARAM_RAW);
+    $cachekey = optional_param('cachekey', '', PARAM_INT);
+    if ($cachekey && $cachekey > 0 && $cachekey <= time()) {
+        $cacherequest = true;
+    }
+}
+
+// Either we are not allowing GET parameters or we didn't use GET because
+// we did not pass a cache key or the URL was too long.
+if (empty($arguments)) {
+    $arguments = file_get_contents('php://input');
+}
+
+$requests = json_decode($arguments, true);
+
+if ($requests === null) {
+    $lasterror = json_last_error_msg();
+    throw new coding_exception('Invalid json in request: ' . $lasterror);
+}
+$responses = [];
+
+// Defines the external settings required for Ajax processing.
+$settings = external_settings::get_instance();
+$settings->set_file('pluginfile.php');
+$settings->set_fileurl(true);
+$settings->set_filter(true);
+$settings->set_raw(false);
+
+$haserror = false;
+foreach ($requests as $request) {
+    $response = [];
+    $methodname = clean_param($request['methodname'], PARAM_ALPHANUMEXT);
+    $index = clean_param($request['index'], PARAM_INT);
+    $args = $request['args'];
+
+    $response = external_api::call_external_function($methodname, $args, true);
+    $responses[$index] = $response;
+
+    if ($response['error']) {
+        $haserror = true;
+        if (!NO_MOODLE_COOKIES) {
+            // If there was an error, and this HTTP request includes a Moodle cookie (and therefore a login), reject all
+            // subsequent changes.
+            //
+            // The reason for this is that an earlier step may be performing a dependant action. Consider the following:
+            // 1) Backup a thing
+            // 2) Reset the thing to its initial state
+            // 3) Restore the thing from the backup made in step 1.
+            //
+            // In the above example you do not want steps 2 and 3 to happen if step 1 fails.
+            // Do not process the remaining requests.
+
+            // If the request came through service-nologin.php which does not allow any kind of login,
+            // then it is not possible to make changes to the DB, session, site, etc.
+            // For all other cases, we *MUST* stop processing subsequent requests.
+            break;
+        }
+    }
+}
+
+if ($cacherequest && !$haserror) {
+    // 90 days only - based on Moodle point release cadence being every 3 months.
+    $lifetime = 60 * 60 * 24 * 90;
+
+    header('Expires: ' . gmdate('D, d M Y H:i:s', time() + $lifetime) . ' GMT');
+    header('Pragma: ');
+    header('Cache-Control: public, max-age=' . $lifetime . ', immutable');
+    header('Accept-Ranges: none');
+}
+
+echo json_encode($responses);

lib/ajax/setuserpref.php

@@ -0,0 +1,53 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Code to update a user preference in response to an ajax call.
+ *
+ * You should not send requests to this script directly. Instead use the set_user_preference
+ * function in javascript_static.js.
+ *
+ * @package    core
+ * @category   preference
+ * @copyright  2008 Tim Hunt
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @deprecated since Moodle 4.3
+ */
+
+require_once(__DIR__ . '/../../config.php');
+
+// Check access.
+if (!confirm_sesskey()) {
+    throw new \moodle_exception('invalidsesskey');
+}
+
+// Get the name of the preference to update, and check it is allowed.
+$name = required_param('pref', PARAM_RAW);
+if (!isset($USER->ajax_updatable_user_prefs[$name])) {
+    throw new \moodle_exception('notallowedtoupdateprefremotely');
+}
+
+debugging('Use of setuserpref.php is deprecated. Please use the "core_user/repository" module instead.', DEBUG_DEVELOPER);
+
+// Get and the value.
+$value = required_param('value', $USER->ajax_updatable_user_prefs[$name]);
+
+// Update
+if (!set_user_preference($name, $value)) {
+    throw new \moodle_exception('errorsettinguserpref');
+}
+
+echo 'OK';