Merge branch 'master' of https://github.com/sakaiproject/sakai

CONTRIBUTING.md

@@ -119,6 +119,19 @@ You will often receive friendly advice to improve or fix the changes you propose
 
 * Make a comment on the existing PR to alert reviewers to your changes
 
+### Security Issues
+
+Security issues are typically handled differently than regular bugs to try to reduce visibility. To get a security fix into Sakai do the following.
+
+1. Get access to the security list and security jira work group https://confluence.sakaiproject.org/display/SECWG/Security+Policy by emailing the contact on that page
+2. Submit a jira with security issue indicated (it's a dropdown box) detailing the security issue
+3. When fixing the issue, either:
+   1. Request access to private gitlab repo https://gitlab.com/sakaiproject/sakai and submit a merge request. Merge requests are similar to pull requests above.  
+      * The merge request should only have the SAK/KNL/etc number, no additional comments about what was fixed 
+   2. If you are unable to submit a merge request, add a diff against the jira
+4. Merge requests and new issues are generally reviewed and merged at the next Security WG or Core Team meeting prior to the next minor release of Sakai. 
+5. For high priority issues email the security list directly
+
 ## Questions and support
 
 More documentation and notes can be found in the [Git Setup confluence page](https://confluence.sakaiproject.org/display/SAKDEV/Git+Setup).

admin-tools/src/java/org/sakaiproject/user/tool/UsersAction.java

@@ -577,6 +577,8 @@ private String buildEditContext(SessionState state, Context context)
 		// include the password fields?
 		context.put("incPw", state.getAttribute("include-password"));
 
+		context.put("providedUserType", isProvidedType(user.getType()));
+
 		// include type fields (not if single user)
 		boolean singleUser = ((Boolean) state.getAttribute("single-user")).booleanValue();
 		context.put("incType", Boolean.valueOf(!singleUser));

admin-tools/src/webapp/vm/user/chef_users_edit.vm

@@ -106,7 +106,7 @@ function removeOptionalAttributeBlock(elem) {
 				#if($user)$validator.escapeHtml($user.Email)#elseif($valueEmail)$validator.escapeHtml($valueEmail)#end
 			#end
 			</div>	
-#if ($incPw)
+#if ($incPw && !$providedUserType)
   #if(!$!superUser)
     #if ($service.allowUpdateUserName($user.Id) || $service.allowUpdateUserEmail($user.Id) || $service.allowUpdateUserPassword($user.Id) || !$user)
         <div class="shorttext">

assignment/api/src/java/org/sakaiproject/assignment/api/AssignmentService.java

@@ -87,6 +87,15 @@ public interface AssignmentService extends EntityProducer {
      */
     public boolean allowAddAssignment(String context);
 
+    /**
+     * Check permissions for updating an Assignment based on context.
+     *
+     * @param context -
+     *                Describes the portlet context - generated with DefaultId.getChannel().
+     * @return True if the current User is allowed to update assignments, false if not.
+     */
+    public boolean allowUpdateAssignmentInContext(String context);
+
     /**
      * Check if the user has permission to add a site-wide (not grouped) assignment.
      *
@@ -96,6 +105,15 @@ public interface AssignmentService extends EntityProducer {
      */
     boolean allowAddSiteAssignment(String context);
 
+    /**
+     * Check permissions for removing an Assignment.
+     *
+     * @param context -
+     *                Describes the portlet context - generated with DefaultId.getChannel().
+     * @return True if the current User is allowed to remove an Assignment, false if not.
+     */
+    public boolean allowRemoveAssignmentInContext(String context);
+
     /**
      * Check permissions for all.groups.
      *
@@ -123,6 +141,15 @@ public interface AssignmentService extends EntityProducer {
      */
     public Collection<Group> getGroupsAllowAddAssignment(String context);
 
+    /**
+     * Get the collection of Groups defined for the context of this site that the end user has update assignment permissions in.
+     *
+     * @param context -
+     *                Describes the portlet context - generated with DefaultId.getChannel().
+     * @return The Collection (Group) of groups defined for the context of this site that the end user has update assignment permissions in, empty if none.
+     */
+    public Collection<Group> getGroupsAllowUpdateAssignment(String context);
+
     /**
      * Get the collection of Groups defined for the context of this site that the end user has grade assignment permissions in.
      *
@@ -384,6 +411,15 @@ public interface AssignmentService extends EntityProducer {
      */
     public Collection<Assignment> getAssignmentsForContext(String context);
 
+    /**
+     * Access all the Assignments that are deleted
+     *
+     * @param context -
+     *                Describes the portlet context - generated with DefaultId.getChannel().
+     * @return List All the deleted assignments will be listed
+     */
+    public Collection<Assignment> getDeletedAssignmentsForContext(String context);
+
     /**
      * Retrieve a map of Assignments to a list of User IDs of those who
      * may submit each assignment. This map is filtered to only those
@@ -455,22 +491,14 @@ public interface AssignmentService extends EntityProducer {
     public List<User> getSortedGroupUsers(Group g);
 
     /**
-     * Get the number of submissions which has been submitted.
-     *
-     * @param assignmentRef -
-     *                      the reference of Assignment who's submission count you would like.
-     * @return int The total submissions for the specified assignment.
-     */
-    public int getSubmittedSubmissionsCount(String assignmentRef);
-
-    /**
-     * Get the number of submissions which has not been submitted and graded.
+     * Count the number of submissions for a given assignment.
      *
-     * @param assignmentRef -
-     *                      the reference of Assignment who's ungraded submission count you would like.
-     * @return int The total ungraded submissions for the specified assignment.
+     * @param assignmentRef the assignment reference of the submissions to count.
+     * @param graded count the number of submissions which have been submitted and are graded
+     *               respectively graded is true and ungraded is false or null for both.
+     * @return int count of submissions for the specified assignment.
      */
-    public int getUngradedSubmissionsCount(String assignmentRef);
+    public int countSubmissions(String assignmentRef, Boolean graded);
 
     /**
      * Access the grades spreadsheet for the reference, either for an assignment or all assignments in a context.

assignment/api/src/java/org/sakaiproject/assignment/api/persistence/AssignmentRepository.java

@@ -35,6 +35,8 @@ public interface AssignmentRepository extends SerializableRepository<Assignment,
 
     List<Assignment> findAssignmentsBySite(String siteId);
 
+    List<Assignment> findDeletedAssignmentsBySite(String siteId);
+
     List<String> findAllAssignmentIds();
 
     void newAssignment(Assignment assignment);
@@ -66,9 +68,16 @@ void newSubmission(Assignment assignment,
 
     void initializeAssignment(Assignment assignment);
 
-    long countSubmittedSubmissionsForAssignment(String assignmentId);
-
-    long countUngradedSubmittedSubmissionsForAssignment(String assignmentId);
+    /**
+     * Count submissions for a given assignment.
+     * If any of the parameters are null they are not included in the query.
+     * @param assignmentId the assignment id whose submissions should be counted
+     * @param graded if not null adds the requirement that the submission's graded field matches this value
+     * @param hasSubmissionDate if not null adds the requirement of whether the submitted date can be null or not
+     * @param userSubmission if not null adds the requirement that the submission's userSubmission field matches this value
+     * @return
+     */
+    long countAssignmentSubmissions(String assignmentId, Boolean graded, Boolean hasSubmissionDate, Boolean userSubmission);
 
     void resetAssignment(Assignment assignment);
 }

assignment/bundles/resources/assignment.properties

@@ -120,7 +120,7 @@ gen.groupassignment	= Group Submission
 gen.userassignment  = Individual Submission
 gen.section.info    = Section (do not use for group submissions)
 group.submission.not.found   = Submission's Group Not Found
-group.select.represent  = Select the group you are representing.
+group.select.represent  = You are representing the following group:
 group.user.multiple.warning = The following users are in more than one group eligible to submit to this assignment:
 group.must.member    = You must be a member of at least one group to submit!
 group.already.submitted = Group has already submitted!
@@ -518,7 +518,13 @@ youmust8 = You must upload an attachment
 list.show = Show
 list.itemsper = items...
 update = Update
+removedAssignmentList = Removed Assignments List
 removeSelected = Remove Selected
+selectAssignments = Select Assignments
+restoreSelected = Restore Selected
+hardRemoveSelected = Permanently Remove Selected
+restoreConfirmation = These items will be restored. Are you sure?
+hardRemoveConfirmation = These items will be permanently removed and cannot be recovered. Are you sure?
 subasstudent		= Submit as Student
 alert.globalNavi	= If you choose to exit without clicking any of the assignment submission navigation action buttons at the top or bottom of this page, you will lose your work. Please choose one of these buttons or navigate to your chosen page and abandon your work on this page.
 viewassign		= View Assignment