From 7868aab181eb24174a158141cce67f2ab8f43e18 Mon Sep 17 00:00:00 2001
From: Charles Fulton <fultonc@lafayette.edu>
Date: Tue, 8 Jan 2019 13:27:21 -0800
Subject: [PATCH] MDL-64528 core_completion: prevent toggling completion in
 frozen context

---
 completion/classes/external.php | 1 +
 course/renderer.php             | 2 +-
 course/togglecompletion.php     | 1 +
 lang/en/role.php                | 1 +
 lib/db/access.php               | 9 +++++++++
 5 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/completion/classes/external.php b/completion/classes/external.php
index d92fdaf15e2..4bbc12d92f4 100644
--- a/completion/classes/external.php
+++ b/completion/classes/external.php
@@ -75,6 +75,7 @@ class core_completion_external extends external_api {
 
         $context = context_module::instance($cmid);
         self::validate_context($context);
+        require_capability('moodle/course:togglecompletion', $context);
 
         list($course, $cm) = get_course_and_cm_from_cmid($cmid);
 
diff --git a/course/renderer.php b/course/renderer.php
index ad00ffb29ca..ff914fb18fa 100644
--- a/course/renderer.php
+++ b/course/renderer.php
@@ -468,7 +468,7 @@ class core_course_renderer extends plugin_renderer_base {
                 $imgalt = get_string('completion-alt-' . $completionicon, 'completion', $formattedname);
             }
 
-            if ($this->page->user_is_editing()) {
+            if ($this->page->user_is_editing() || !has_capability('moodle/course:togglecompletion', $mod->context)) {
                 // When editing, the icon is just an image.
                 $completionpixicon = new pix_icon('i/completion-'.$completionicon, $imgalt, '',
                         array('title' => $imgalt, 'class' => 'iconsmall'));
diff --git a/course/togglecompletion.php b/course/togglecompletion.php
index f0c77c96b9c..0bd267a1d77 100644
--- a/course/togglecompletion.php
+++ b/course/togglecompletion.php
@@ -139,6 +139,7 @@ $course = $DB->get_record('course', array('id'=>$cm->course), '*', MUST_EXIST);
 
 // Check user is logged in
 require_login($course, false, $cm);
+require_capability('moodle/course:togglecompletion', context_module::instance($cmid));
 
 if (isguestuser() or !confirm_sesskey()) {
     print_error('error');
diff --git a/lang/en/role.php b/lang/en/role.php
index 743bc48cce1..5cd81f74829 100644
--- a/lang/en/role.php
+++ b/lang/en/role.php
@@ -490,3 +490,4 @@ $string['privacy:metadata:role_capabilities:roleid'] = 'The ID of the role';
 $string['privacy:metadata:role_capabilities:tableexplanation'] = 'The capabilities and override capabilities for a particular role in a particular context';
 $string['privacy:metadata:role_capabilities:timemodified'] = 'The date when the capability was created or modified.';
 $string['privacy:metadata:role_cohortroles'] = 'Roles to cohort';
+$string['course:togglecompletion'] = 'Allow users to manually complete activities';
diff --git a/lib/db/access.php b/lib/db/access.php
index 0dbb72aabf8..b1f15eb19e4 100644
--- a/lib/db/access.php
+++ b/lib/db/access.php
@@ -2439,4 +2439,13 @@ $capabilities = array(
         'archetypes' => [
         ],
     ],
+
+    // Manual completion toggling.
+    'moodle/course:togglecompletion' => [
+        'captype' => 'write',
+        'contextlevel' => CONTEXT_MODULE,
+        'archetypes' => [
+            'user' => CAP_ALLOW,
+        ],
+    ],
 );