Skip to content

Commit

Permalink
MDL-62430 privacy: validate context when deleting all user data
Browse files Browse the repository at this point in the history
  • Loading branch information
@marinaglancy
marinaglancy committed May 14, 2018
1 parent ab65b87 commit 3960ad5
Show file tree
Hide file tree
Showing 10 changed files with 59 additions and 65 deletions.
4 changes: 3 additions & 1 deletion blocks/rss_client/classes/privacy/provider.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,9 @@ public static function export_user_data(approved_contextlist $contextlist) {
* @param context $context A user context.
*/
public static function delete_data_for_all_users_in_context(\context $context) {
static::delete_data($context->instanceid);
if ($context instanceof \context_user) {
static::delete_data($context->instanceid);
}
}

/**
Expand Down
10 changes: 6 additions & 4 deletions calendar/classes/privacy/provider.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -192,12 +192,14 @@ public static function delete_data_for_all_users_in_context(\context $context) {
}

// Delete all Calendar Events in the specified context in batches.
$eventids = array_keys(self::get_calendar_event_ids_by_context($context));
self::delete_batch_records('event', 'id', $eventids);
if ($eventids = array_keys(self::get_calendar_event_ids_by_context($context))) {
self::delete_batch_records('event', 'id', $eventids);
}

// Delete all Calendar Subscriptions in the specified context in batches.
$subscriptionids = array_keys(self::get_calendar_subscription_ids_by_context($context));
self::delete_batch_records('event_subscriptions', 'id', $subscriptionids);
if ($subscriptionids = array_keys(self::get_calendar_subscription_ids_by_context($context))) {
self::delete_batch_records('event_subscriptions', 'id', $subscriptionids);
}
}

/**
Expand Down
14 changes: 2 additions & 12 deletions mod/assign/classes/privacy/provider.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -246,18 +246,8 @@ public static function delete_data_for_all_users_in_context(\context $context) {
global $DB;

if ($context->contextlevel == CONTEXT_MODULE) {
// Apparently we can't trust anything that comes via the context.
// Go go mega query to find out it we have an assign context that matches an existing assignment.
$sql = "SELECT a.id
FROM {assign} a
JOIN {course_modules} cm ON a.id = cm.instance
JOIN {modules} m ON m.id = cm.module AND m.name = :modulename
JOIN {context} ctx ON ctx.instanceid = cm.id AND ctx.contextlevel = :contextmodule
WHERE ctx.id = :contextid";
$params = ['modulename' => 'assign', 'contextmodule' => CONTEXT_MODULE, 'contextid' => $context->id];
$count = $DB->get_field_sql($sql, $params);
// If we have a count over zero then we can proceed.
if ($count > 0) {
$cm = get_coursemodule_from_id('assign', $context->instanceid);
if ($cm) {
// Get the assignment related to this context.
$assign = new \assign($context, null, null);
// What to do first... Get sub plugins to delete their stuff.
Expand Down
9 changes: 3 additions & 6 deletions mod/choice/classes/privacy/provider.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -182,16 +182,13 @@ protected static function export_choice_data_for_user(array $choicedata, \contex
public static function delete_data_for_all_users_in_context(\context $context) {
global $DB;

if (empty($context)) {
return;
}

if (!$context instanceof \context_module) {
return;
}

$instanceid = $DB->get_field('course_modules', 'instance', ['id' => $context->instanceid], MUST_EXIST);
$DB->delete_records('choice_answers', ['choiceid' => $instanceid]);
if ($cm = get_coursemodule_from_id('choice', $context->instanceid)) {
$DB->delete_records('choice_answers', ['choiceid' => $cm->instance]);
}
}

/**
Expand Down
21 changes: 12 additions & 9 deletions mod/forum/classes/privacy/provider.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -754,32 +754,35 @@ public static function delete_data_for_all_users_in_context(\context $context) {
}

// Get the course module.
$cm = $DB->get_record('course_modules', ['id' => $context->instanceid]);
$forum = $DB->get_record('forum', ['id' => $cm->instance]);
if (!$cm = get_coursemodule_from_id('forum', $context->instanceid)) {
return;
}

$forumid = $cm->instance;

$DB->delete_records('forum_track_prefs', ['forumid' => $forum->id]);
$DB->delete_records('forum_subscriptions', ['forum' => $forum->id]);
$DB->delete_records('forum_read', ['forumid' => $forum->id]);
$DB->delete_records('forum_track_prefs', ['forumid' => $forumid]);
$DB->delete_records('forum_subscriptions', ['forum' => $forumid]);
$DB->delete_records('forum_read', ['forumid' => $forumid]);

// Delete all discussion items.
$DB->delete_records_select(
'forum_queue',
"discussionid IN (SELECT id FROM {forum_discussions} WHERE forum = :forum)",
[
'forum' => $forum->id,
'forum' => $forumid,
]
);

$DB->delete_records_select(
'forum_posts',
"discussion IN (SELECT id FROM {forum_discussions} WHERE forum = :forum)",
[
'forum' => $forum->id,
'forum' => $forumid,
]
);

$DB->delete_records('forum_discussion_subs', ['forum' => $forum->id]);
$DB->delete_records('forum_discussions', ['forum' => $forum->id]);
$DB->delete_records('forum_discussion_subs', ['forum' => $forumid]);
$DB->delete_records('forum_discussions', ['forum' => $forumid]);

// Delete all files from the posts.
$fs = get_file_storage();
Expand Down
48 changes: 22 additions & 26 deletions mod/glossary/classes/privacy/provider.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -248,39 +248,36 @@ public static function delete_data_for_all_users_in_context(\context $context) {
return;
}

$instanceid = $DB->get_field('course_modules', 'instance', ['id' => $context->instanceid], MUST_EXIST);
$DB->record_exists('glossary', ['id' => $context->instanceid]);
$DB->delete_records('glossary_entries', ['glossaryid' => $instanceid]);
if (!$cm = get_coursemodule_from_id('glossary', $context->instanceid)) {
return;
}

if ($context->contextlevel == CONTEXT_MODULE) {
$instanceid = $DB->get_field('course_modules', 'instance', ['id' => $context->instanceid], MUST_EXIST);
$DB->record_exists('glossary', ['id' => $context->instanceid]);
$instanceid = $cm->instance;

$entries = $DB->get_records('glossary_entries', ['glossaryid' => $instanceid]);
foreach ($entries as $entry) {
// Delete related entry categories.
$DB->delete_records('glossary_entries_categories', ['entryid' => $entry->id]);
$entries = $DB->get_records('glossary_entries', ['glossaryid' => $instanceid]);
foreach ($entries as $entry) {
// Delete related entry categories.
$DB->delete_records('glossary_entries_categories', ['entryid' => $entry->id]);

// Delete related entry aliases.
$DB->delete_records('glossary_alias', ['entryid' => $entry->id]);
}
// Delete related entry aliases.
$DB->delete_records('glossary_alias', ['entryid' => $entry->id]);
}

// Delete entry and attachment files.
get_file_storage()->delete_area_files($context->id, 'mod_glossary', 'entry');
get_file_storage()->delete_area_files($context->id, 'mod_glossary', 'attachment');
// Delete entry and attachment files.
get_file_storage()->delete_area_files($context->id, 'mod_glossary', 'entry');
get_file_storage()->delete_area_files($context->id, 'mod_glossary', 'attachment');

// Delete related ratings.
\core_rating\privacy\provider::delete_ratings($context, 'mod_glossary', 'entry');
// Delete related ratings.
\core_rating\privacy\provider::delete_ratings($context, 'mod_glossary', 'entry');

// Delete comments.
\core_comment\privacy\provider::delete_comments_for_all_users($context, 'mod_glossary', 'glossary_entry');
// Delete comments.
\core_comment\privacy\provider::delete_comments_for_all_users($context, 'mod_glossary', 'glossary_entry');

// Delete tags.
\core_tag\privacy\provider::delete_item_tags($context, 'mod_glossary', 'glossary_entries');
// Delete tags.
\core_tag\privacy\provider::delete_item_tags($context, 'mod_glossary', 'glossary_entries');

// Now delete all user related entries.
$DB->delete_records('glossary_entries', ['glossaryid' => $instanceid]);
}
// Now delete all user related entries.
$DB->delete_records('glossary_entries', ['glossaryid' => $instanceid]);
}

/**
Expand All @@ -300,7 +297,6 @@ public static function delete_data_for_user(approved_contextlist $contextlist) {
if ($context->contextlevel == CONTEXT_MODULE) {

$instanceid = $DB->get_field('course_modules', 'instance', ['id' => $context->instanceid], MUST_EXIST);
$DB->record_exists('glossary', ['id' => $context->instanceid]);

$entries = $DB->get_records('glossary_entries', ['glossaryid' => $instanceid, 'userid' => $userid]);
foreach ($entries as $entry) {
Expand Down
4 changes: 3 additions & 1 deletion mod/lesson/classes/privacy/provider.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -382,7 +382,9 @@ public static function delete_data_for_all_users_in_context(context $context) {
return;
}

$lessonid = static::get_lesson_id_from_context($context);
if (!$lessonid = static::get_lesson_id_from_context($context)) {
return;
}

$DB->delete_records('lesson_attempts', ['lessonid' => $lessonid]);
$DB->delete_records('lesson_branch', ['lessonid' => $lessonid]);
Expand Down
5 changes: 3 additions & 2 deletions mod/lti/classes/privacy/provider.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -163,8 +163,9 @@ public static function delete_data_for_all_users_in_context(\context $context) {
return;
}

$instanceid = $DB->get_field('course_modules', 'instance', ['id' => $context->instanceid], MUST_EXIST);
$DB->delete_records('lti_submission', ['ltiid' => $instanceid]);
if ($cm = get_coursemodule_from_id('lti', $context->instanceid)) {
$DB->delete_records('lti_submission', ['ltiid' => key($ltiidstocmids)]);
}
}

/**
Expand Down
7 changes: 4 additions & 3 deletions mod/survey/classes/privacy/provider.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -229,9 +229,10 @@ public static function delete_data_for_all_users_in_context(context $context) {
return;
}

$surveyid = static::get_survey_id_from_context($context);
$DB->delete_records('survey_answers', ['survey' => $surveyid]);
$DB->delete_records('survey_analysis', ['survey' => $surveyid]);
if ($surveyid = static::get_survey_id_from_context($context)) {
$DB->delete_records('survey_answers', ['survey' => $surveyid]);
$DB->delete_records('survey_analysis', ['survey' => $surveyid]);
}
}

/**
Expand Down
2 changes: 1 addition & 1 deletion notes/classes/privacy/provider.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -184,7 +184,7 @@ public static function export_user_data(approved_contextlist $contextlist) {
public static function delete_data_for_all_users_in_context(\context $context) {
global $DB;

if (empty($context)) {
if ($context->contextlevel != CONTEXT_COURSE) {
return;
}

Expand Down

0 comments on commit 3960ad5

Please sign in to comment.