MDL-46227 Fix XSS in scheduled tasks
[moodle.git] / notes / index.php
blobd831b4b18976e059877962937b7e4e1e4e71caa0
1 <?php
3 /**
4 * file index.php
5 * index page to view notes.
6 * if a course id is specified then the entries from that course are shown
7 * if a user id is specified only notes related to that user are shown
8 */
9 require_once('../config.php');
10 require_once('lib.php');
12 /// retrieve parameters
13 $courseid = optional_param('course', SITEID, PARAM_INT);
14 $userid = optional_param('user', 0, PARAM_INT);
15 $filtertype = optional_param('filtertype', '', PARAM_ALPHA);
16 $filterselect = optional_param('filterselect', 0, PARAM_INT);
18 if (empty($CFG->enablenotes)) {
19 print_error('notesdisabled', 'notes');
22 $url = new moodle_url('/notes/index.php');
23 if ($courseid != SITEID) {
24 $url->param('course', $courseid);
26 if ($userid !== 0) {
27 $url->param('user', $userid);
29 $PAGE->set_url($url);
31 /// tabs compatibility
32 switch($filtertype) {
33 case 'course':
34 $courseid = $filterselect;
35 break;
36 case 'site':
37 $courseid = SITEID;
38 break;
41 if (empty($courseid)) {
42 $courseid = SITEID;
45 /// locate course information
46 $course = $DB->get_record('course', array('id'=>$courseid), '*', MUST_EXIST);
48 /// locate user information
49 if ($userid) {
50 $user = $DB->get_record('user', array('id'=>$userid), '*', MUST_EXIST);
51 $filtertype = 'user';
52 $filterselect = $user->id;
54 if ($user->deleted) {
55 echo $OUTPUT->header();
56 echo $OUTPUT->heading(get_string('userdeleted'));
57 echo $OUTPUT->footer();
58 die;
61 } else {
62 $filtertype = 'course';
63 $filterselect = $course->id;
66 /// require login to access notes
67 require_login($course);
68 /// output HTML
69 if ($course->id == SITEID) {
70 $coursecontext = context_system::instance(); // SYSTEM context
71 } else {
72 $coursecontext = context_course::instance($course->id); // Course context
74 require_capability('moodle/notes:view', $coursecontext);
75 $systemcontext = context_system::instance(); // SYSTEM context
77 // Trigger event.
78 $event = \core\event\notes_viewed::create(array(
79 'relateduserid' => $userid,
80 'context' => $coursecontext
81 ));
82 $event->trigger();
84 $strnotes = get_string('notes', 'notes');
85 if ($userid) {
86 $PAGE->set_context(context_user::instance($user->id));
87 $PAGE->navigation->extend_for_user($user);
88 } else {
89 $link = null;
90 if (has_capability('moodle/course:viewparticipants', $coursecontext) || has_capability('moodle/site:viewparticipants', $systemcontext)) {
91 $link = new moodle_url('/user/index.php',array('id'=>$course->id));
95 $PAGE->set_pagelayout('course');
96 $PAGE->set_title($course->shortname . ': ' . $strnotes);
97 $PAGE->set_heading($course->fullname);
99 echo $OUTPUT->header();
100 if ($userid) {
101 echo $OUTPUT->heading(fullname($user).': '.$strnotes);
102 } else {
103 echo $OUTPUT->heading(format_string($course->shortname, true, array('context' => $coursecontext)).': '.$strnotes);
106 $strsitenotes = get_string('sitenotes', 'notes');
107 $strcoursenotes = get_string('coursenotes', 'notes');
108 $strpersonalnotes = get_string('personalnotes', 'notes');
109 $straddnewnote = get_string('addnewnote', 'notes');
111 echo $OUTPUT->box_start();
113 if ($courseid != SITEID) {
114 //echo '<a href="#sitenotes">' . $strsitenotes . '</a> | <a href="#coursenotes">' . $strcoursenotes . '</a> | <a href="#personalnotes">' . $strpersonalnotes . '</a>';
115 $context = context_course::instance($courseid);
116 $addid = has_capability('moodle/notes:manage', $context) ? $courseid : 0;
117 $view = has_capability('moodle/notes:view', $context);
118 $fullname = format_string($course->fullname, true, array('context' => $context));
119 note_print_notes('<a name="sitenotes"></a>' . $strsitenotes, $addid, $view, 0, $userid, NOTES_STATE_SITE, 0);
120 note_print_notes('<a name="coursenotes"></a>' . $strcoursenotes. ' ('.$fullname.')', $addid, $view, $courseid, $userid, NOTES_STATE_PUBLIC, 0);
121 note_print_notes('<a name="personalnotes"></a>' . $strpersonalnotes, $addid, $view, $courseid, $userid, NOTES_STATE_DRAFT, $USER->id);
123 } else { // Normal course
124 //echo '<a href="#sitenotes">' . $strsitenotes . '</a> | <a href="#coursenotes">' . $strcoursenotes . '</a>';
125 $view = has_capability('moodle/notes:view', context_system::instance());
126 note_print_notes('<a name="sitenotes"></a>' . $strsitenotes, 0, $view, 0, $userid, NOTES_STATE_SITE, 0);
127 echo '<a name="coursenotes"></a>';
129 if (!empty($userid)) {
130 $courses = enrol_get_users_courses($userid);
131 foreach($courses as $c) {
132 $ccontext = context_course::instance($c->id);
133 $cfullname = format_string($c->fullname, true, array('context' => $ccontext));
134 $header = '<a href="' . $CFG->wwwroot . '/course/view.php?id=' . $c->id . '">' . $cfullname . '</a>';
135 if (has_capability('moodle/notes:manage', context_course::instance($c->id))) {
136 $addid = $c->id;
137 } else {
138 $addid = 0;
140 note_print_notes($header, $addid, $view, $c->id, $userid, NOTES_STATE_PUBLIC, 0);
145 echo $OUTPUT->box_end();
147 echo $OUTPUT->footer();