webservice MDL-24541 change wsdoc.php external authentication into a …

…normal moodle page with require_login(), no form, documentation directly related to the token and display from the user security keys page (see MDL for more information)

admin/settings/plugins.php

@@ -331,9 +331,9 @@
     if (empty($CFG->enablewebservices)) {
         $temp->add(new admin_setting_heading('webservicesaredisabled', '', get_string('disabledwarning', 'webservice')));
     }
-    $url = new moodle_url('/webservice/wsdoc.php');
-    $atag =html_writer::start_tag('a', array('href' => $url)).get_string('documentation', 'webservice').html_writer::end_tag('a');
-    $temp->add(new admin_setting_configcheckbox('enablewsdocumentation', get_string('enablewsdocumentation', 'admin'), get_string('configenablewsdocumentation', 'admin', $atag), false));
+    $wsdoclink = $OUTPUT->doc_link('How_to_get_a_security_key');
+    $temp->add(new admin_setting_configcheckbox('enablewsdocumentation', get_string('enablewsdocumentation',
+                        'admin'), get_string('configenablewsdocumentation', 'admin', $wsdoclink), false));
     $ADMIN->add('webservicesettings', $temp);
     /// links to protocol pages
     $webservices_available = get_plugin_list('webservice');

admin/webservice/forms.php

@@ -66,6 +66,7 @@ function definition() {
         $mform->addElement('advcheckbox', 'enabled', get_string('enabled', 'webservice'));
         $mform->addElement('advcheckbox', 'restrictedusers',
                 get_string('restrictedusers', 'webservice'));
+        $mform->addHelpButton('restrictedusers', 'restrictedusers', 'webservice');
 
         /// needed to select automatically the 'No required capability" option
         $currentcapabilityexist = false;

lang/en/admin.php

@@ -203,7 +203,7 @@
 $string['configenablestats'] = 'If you choose \'yes\' here, Moodle\'s cronjob will process the logs and gather some statistics.  Depending on the amount of traffic on your site, this can take awhile. If you enable this, you will be able to see some interesting graphs and statistics about each of your courses, or on a sitewide basis.';
 $string['configenabletrusttext'] = 'By default Moodle will always thoroughly clean text that comes from users to remove any possible bad scripts, media etc that could be a security risk.  The Trusted Content system is a way of giving particular users that you trust the ability to include these advanced features in their content without interference.  To enable this system, you need to first enable this setting, and then grant the Trusted Content permission to a specific Moodle role.  Texts created or uploaded by such users will be marked as trusted and will not be cleaned before display.';
 $string['configenablewebservices'] = 'Web services enable other systems to log in to this Moodle and perform operations.  For extra security this feature should be disabled unless you are really using it.';
-$string['configenablewsdocumentation'] = 'Enable auto-generation of web services documentation. A web service user can access to his own {$a} without login into Moodle. It display the documentation for the enabled protocols only.';
+$string['configenablewsdocumentation'] = 'Enable auto-generation of web services documentation. A user can access to his own documentation on his security keys page {$a}. It displays the documentation for the enabled protocols only.';
 $string['configerrorlevel'] = 'Choose the amount of PHP warnings that you want to be displayed.  Normal is usually the best choice.';
 $string['configexcludeoldflashclients'] = 'Some versions of the Adobe Flash plugin are known to be vulnerable to attacks from malicious Flash content.  You can specify a minimum supported version here, and Moodle will not show Flash files to users with lower versions. Instead they will see an alternate Flash file telling them how to upgrade. Leave this empty to disable all checks.';
 $string['configexperimentalsplitrestore'] = 'If enabled, course backup files will be checked for XML errors and split into smaller parts for use in the restore process. This will result in improvements to restore robustness and execution times, particularly for medium to large course backups.';

lang/en/webservice.php

@@ -57,6 +57,8 @@
 $string['deleteserviceconfirm'] = 'Deleting a service will also delete the tokens related to this service. Do you really want to delete external service "{$a}"?';
 $string['deletetokenconfirm'] = 'Do you really want to delete this web service token for <strong>{$a->user}</strong> on the service <strong>{$a->service}</strong>?';
 $string['disabledwarning'] = 'All web service protocols are disabled.  The "Enable web services" setting can be found in Advanced features.';
+$string['doc'] = 'Documentation';
+$string['docaccessrefused'] = 'You are not allowed to see the documentation for this token';
 $string['documentation'] = 'web service documentation';
 $string['editaservice'] = 'Edit service';
 $string['editservice'] = 'Edit the service: {$a->name} (id: {$a->id})';
@@ -111,7 +113,7 @@
 $string['managetokens'] = 'Manage tokens';
 $string['missingcaps'] = 'Missing capabilities.';
 $string['missingcaps_help'] = 'List of capabilities that the service functions require but that the user hasn\'t. You need to add these capabilities to this user in order to use the service.
-<br/><br/>Note: in rare case some of these "required" capabilities could depend of a function use case. For example \'moodle_role_get_enrolled_users\' function requires \'moodle/site:viewparticipants\' capability only for a site-wide request.';
+Note: in some cases, some of these "required" capabilities could depend of a use case. For example: moodle_role_get_enrolled_users() function requires \'moodle/site:viewparticipants\' capability only for a site-wide request.';
 $string['missingpassword'] = 'Missing password';
 $string['missingusername'] = 'Missing username';
 $string['nofunctions'] = 'This service has no functions.';
@@ -142,6 +144,8 @@
 $string['restexception'] = 'REST';
 $string['restparam'] = 'REST (POST parameters)';
 $string['restrictedusers'] = 'Authorised users only';
+$string['restrictedusers_help'] = 'If this settings is disabled, any users with the \'moodle/webservice:createtoken\' capability will be able to generate a token for this service in their \'Security keys\' page.
+If this settings is enabled, you will choose which users can access this service. These users still need the \'moodle/webservice:createtoken\' capability to generate their own token in their \'Security keys\' page.';
 $string['securitykey'] = 'Security key (token)';
 $string['securitykeys'] = 'Security keys';
 $string['selectauthorisedusers'] = 'Select authorised users';
@@ -188,7 +192,7 @@
 $string['wsclientdoc'] = 'Moodle web service client documentation';
 $string['wsdocumentation'] = 'Web service documentation';
 $string['wsdocumentationdisable'] = 'Web service documentation is disabled.';
-$string['wsdocumentationintro'] = 'Following is a listing of web service functions available for the username <b>{$a->username}</b>.<br/>To create a client we advise you to read the {$a->doclink}';
+$string['wsdocumentationintro'] = 'To create a client we advise you to read the {$a->doclink}';
 $string['wsdocumentationlogin'] = 'or enter your web service username and password:';
 $string['wspassword'] = 'Web service password';
 $string['wsusername'] = 'Web service username';

user/managetoken.php

@@ -35,14 +35,13 @@
 $PAGE->set_url('/user/managetoken.php');
 $PAGE->set_title(get_string('securitykeys', 'webservice'));
 $PAGE->set_heading(get_string('securitykeys', 'webservice'));
-$PAGE->set_context(get_system_context());
 $PAGE->set_pagelayout('standard');
 
 $rsstokenboxhtml = $webservicetokenboxhtml = '';
 /// Manage user web service tokens
 if ( !is_siteadmin($USER->id)
     && !empty($CFG->enablewebservices)
-    && has_capability('moodle/webservice:createtoken', get_system_context() )) {
+    && has_capability('moodle/webservice:createtoken', $usercontext )) {
     require($CFG->dirroot.'/webservice/lib.php');
 
     $action  = optional_param('action', '', PARAM_ACTION);
@@ -67,7 +66,8 @@
     if (empty($resetconfirmation)) {
         $webservice->generate_user_ws_tokens($USER->id); //generate all token that need to be generated
         $tokens = $webservice->get_user_ws_tokens($USER->id);
-        $webservicetokenboxhtml =  $wsrenderer->user_webservice_tokens_box($tokens, $USER->id); //display the box for web service token
+        $webservicetokenboxhtml =  $wsrenderer->user_webservice_tokens_box($tokens, $USER->id, 
+                $CFG->enablewsdocumentation); //display the box for web service token
     }
 }
 

webservice/lib.php

@@ -213,6 +213,16 @@ public function get_created_by_user_ws_token($userid, $tokenid) {
         return $token;
     }
 
+    /**
+     * Return a token for a given id
+     * @param integer $tokenid
+     * @return object token
+     */
+    public function get_token_by_id($tokenid) {
+        global $DB;
+        return $DB->get_record('external_tokens', array('id' => $tokenid));
+    }
+
     /**
      * Delete a user token
      * @param int $tokenid

webservice/renderer.php

@@ -174,7 +174,7 @@ public function admin_delete_token_confirmation($token) {
                         get_string('cancel'), 'get');
         return $this->output->confirm(get_string('deletetokenconfirm', 'webservice',
                         (object) array('user' => $token->firstname . " "
-                    . $token->lastname, 'service' => $token->name)),
+                            . $token->lastname, 'service' => $token->name)),
                 $formcontinue, $formcancel);
     }
 
@@ -257,7 +257,7 @@ public function user_reset_token_confirmation($token) {
                         get_string('cancel'), 'get');
         $html = $this->output->confirm(get_string('resettokenconfirm', 'webservice',
                                 (object) array('user' => $token->firstname . " " .
-                            $token->lastname, 'service' => $token->name)),
+                                    $token->lastname, 'service' => $token->name)),
                         $formcontinue, $formcancel);
         return $html;
     }
@@ -268,7 +268,7 @@ public function user_reset_token_confirmation($token) {
      * @param int $userid
      * @return string html code
      */
-    public function user_webservice_tokens_box($tokens, $userid) {
+    public function user_webservice_tokens_box($tokens, $userid, $documentation = false) {
         global $CFG;
 
         // display strings
@@ -290,17 +290,21 @@ public function user_webservice_tokens_box($tokens, $userid) {
         $table->width = '100%';
         $table->data = array();
 
+        if ($documentation) {
+            $table->head[] = get_string('doc', 'webservice');
+            $table->align[] = 'center';
+        }
+
         if (!empty($tokens)) {
             foreach ($tokens as $token) {
-                //TODO: retrieve context
 
                 if ($token->creatorid == $userid) {
                     $reset = "<a href=\"" . $CFG->wwwroot . "/user/managetoken.php?sesskey="
                             . sesskey() . "&amp;action=resetwstoken&amp;tokenid=" . $token->id . "\">";
                     $reset .= get_string('reset') . "</a>";
                     $creator = $token->firstname . " " . $token->lastname;
                 } else {
-                    //retrive administrator name
+                    //retrieve administrator name
                     require_once($CFG->dirroot . '/user/lib.php');
                     $creators = user_get_users_by_id(array($token->creatorid));
                     $admincreator = $creators[$token->creatorid];
@@ -318,7 +322,16 @@ public function user_webservice_tokens_box($tokens, $userid) {
                     $validuntil = date("F j, Y"); //TODO: language support (look for moodle function)
                 }
 
-                $table->data[] = array($token->token, $token->name, $validuntil, $creatoratag, $reset);
+                $row = array($token->token, $token->name, $validuntil, $creatoratag, $reset);
+
+                if ($documentation) {
+                    $doclink = new moodle_url('/webservice/wsdoc.php', 
+                            array('id' => $token->id, 'sesskey' => sesskey()));
+                    $row[] = html_writer::tag('a', get_string('doc', 'webservice'),
+                            array('href' => $doclink));
+                }
+
+                $table->data[] = $row;           
             }
             $return .= html_writer::table($table);
         } else {
@@ -521,7 +534,7 @@ public function xmlrpc_param_description_html($paramdescription, $indentation =
      */
     public function colored_box_with_pre_tag($title, $content, $rgb = 'FEEBE5') {
         //TODO: this tag removes xhtml strict error but cause warning
-        $coloredbox = html_writer::start_tag('ins', array()); 
+        $coloredbox = html_writer::start_tag('ins', array());
         $coloredbox .= html_writer::start_tag('div',
                         array('style' => "border:solid 1px #DEDEDE;background:#" . $rgb
                             . ";color:#222222;padding:4px;"));
@@ -584,24 +597,26 @@ public function rest_param_description_html($paramdescription, $paramstring) {
     /**
      * This display all the documentation
      * @param array $functions contains all decription objects
-     * @param array $authparam keys are either 'username'/'password' or 'token'
+     * @param array $authparam keys contains 'tokenid'
      * @param boolean $printableformat true if we want to display the documentation in a printable format
      * @param array $activatedprotocol
      * @return string the html to diplay
      */
     public function documentation_html($functions, $printableformat, $activatedprotocol, $authparams) {
+
+        $documentationhtml = $this->output->heading(get_string('documentation', 'webservice'));
+
         $br = html_writer::empty_tag('br', array());
         $brakeline = <<<EOF
 
 
 EOF;
         /// Some general information
         $docinfo = new stdClass();
-        $docinfo->username = $authparams['wsusername'];
         $docurl = new moodle_url('http://docs.moodle.org/en/Development:Creating_a_web_service_client');
         $docinfo->doclink = html_writer::tag('a',
                         get_string('wsclientdoc', 'webservice'), array('href' => $docurl));
-        $documentationhtml = html_writer::start_tag('table',
+        $documentationhtml .= html_writer::start_tag('table',
                         array('style' => "margin-left:auto; margin-right:auto;"));
         $documentationhtml .= html_writer::start_tag('tr', array());
         $documentationhtml .= html_writer::start_tag('td', array());
@@ -778,50 +793,4 @@ public function documentation_html($functions, $printableformat, $activatedproto
         return $documentationhtml;
     }
 
-    /**
-     * Return the login page html
-     * @param string $errormessage - the error message to display
-     * @return string the html to diplay
-     */
-    public function login_page_html($errormessage) {
-        $br = html_writer::empty_tag('br', array());
-
-        $htmlloginpage = html_writer::start_tag('table',
-                        array('style' => "margin-left:auto; margin-right:auto;"));
-        $htmlloginpage .= html_writer::start_tag('tr', array());
-        $htmlloginpage .= html_writer::start_tag('td', array());
-
-        //login form - we cannot use moodle form as we don't have sessionkey
-        $target = new moodle_url('/webservice/wsdoc.php', array()); // Required
-
-        $contents = get_string('entertoken', 'webservice');
-        $contents .= $br . $br;
-        $contents .= html_writer::empty_tag('input',
-                        array('type' => 'text', 'name' => 'token', 'style' => 'width: 30em;'));
-
-        $contents .= $br . $br;
-        $contents .= get_string('wsdocumentationlogin', 'webservice');
-        $contents .= $br . $br;
-        $contents .= html_writer::empty_tag('input',
-                        array('type' => 'text', 'name' => 'wsusername', 'style' => 'width: 30em;',
-                            'value' => get_string('wsusername', 'webservice')));
-        $contents .= $br . $br;
-        $contents .= html_writer::empty_tag('input',
-                        array('type' => 'text', 'name' => 'wspassword', 'style' => 'width: 30em;',
-                            'value' => get_string('wspassword', 'webservice')));
-        $contents .= $br . $br;
-        $contents .= html_writer::empty_tag('input',
-                        array('type' => 'submit', 'name' => 'submit',
-                            'value' => get_string('wsdocumentation', 'webservice')));
-
-        $htmlloginpage .= html_writer::tag('form', "<div>$contents</div>",
-                        array('method' => 'post', 'target' => $target));
-
-        $htmlloginpage .= html_writer::end_tag('td');
-        $htmlloginpage .= html_writer::end_tag('tr');
-        $htmlloginpage .= html_writer::end_tag('table');
-
-        return $htmlloginpage;
-    }
-
 }