MDL-59922 calendar: allow editing of activity events

calendar/classes/local/api.php

@@ -231,15 +231,47 @@ public static function update_event_start_day(
     ) {
         $mapper = container::get_event_mapper();
         $legacyevent = $mapper->from_event_to_legacy_event($event);
+        $hascoursemodule = !empty($event->get_course_module());
         $starttime = $event->get_times()->get_start_time()->setDate(
             $startdate->format('Y'),
             $startdate->format('n'),
             $startdate->format('j')
         );
 
+        if ($hascoursemodule) {
+            $legacyevent->timestart = $starttime->getTimestamp();
+            // If this event is from an activity then we need to call
+            // the activity callback to let it validate that the changes
+            // to the event are correct.
+            component_callback(
+                'mod_' . $event->get_course_module()->get('modname'),
+                'core_calendar_validate_event_timestart',
+                [$legacyevent]
+            );
+        }
+
         // This function does our capability checks.
         $legacyevent->update((object) ['timestart' => $starttime->getTimestamp()]);
 
+        // Check that the user is allowed to manually edit calendar events before
+        // calling the event updated callback. The manual flag causes the code to
+        // check the user has the capabilities to modify the modules.
+        //
+        // We don't want to call the event update callback if the user isn't allowed
+        // to modify course modules because depending on the callback it can make
+        // some changes that would be considered security issues, such as updating the
+        // due date for and assignment.
+        if ($hascoursemodule && calendar_edit_event_allowed($legacyevent, true)) {
+            // If this event is from an activity then we need to call
+            // the activity callback to let it know that the event it
+            // created has been modified so it needs to update accordingly.
+            component_callback(
+                'mod_' . $event->get_course_module()->get('modname'),
+                'core_calendar_event_timestart_updated',
+                [$legacyevent]
+            );
+        }
+
         return $mapper->from_legacy_event_to_event($legacyevent);
     }
 }

calendar/lib.php

@@ -1999,9 +1999,35 @@ function calendar_edit_event_allowed($event, $manualedit = false) {
     }
 
     if ($manualedit && !empty($event->modulename)) {
-        // A user isn't allowed to directly edit an event generated
-        // by a module.
-        return false;
+        $hascallback = component_callback_exists(
+            'mod_' . $event->modulename,
+            'core_calendar_event_timestart_updated'
+        );
+
+        if (!$hascallback) {
+            // If the activity hasn't implemented the correct callback
+            // to handle changes to it's events then don't allow any
+            // manual changes to them.
+            return false;
+        }
+
+        $coursemodules = get_fast_modinfo($event->courseid)->instances;
+        $hasmodule = isset($coursemodules[$event->modulename]);
+        $hasinstance = isset($coursemodules[$event->modulename][$event->instance]);
+
+        // If modinfo doesn't know about the module, return false to be safe.
+        if (!$hasmodule || !$hasinstance) {
+            return false;
+        }
+
+        $coursemodule = $coursemodules[$event->modulename][$event->instance];
+        $context = context_module::instance($coursemodule->id);
+        // This is the capability that allows a user to modify the activity
+        // settings. Since the activity generated this event we need to check
+        // that the current user has the same capability before allowing them
+        // to update the event because the changes to the event will be
+        // reflected within the activity.
+        return has_capability('moodle/course:manageactivities', $context);
     }
 
     // You cannot edit URL based calendar subscription events presently.

calendar/templates/event_summary_modal.mustache

@@ -25,15 +25,17 @@
     }
 }}
 {{< core/modal }}
-{{$footer}}
-{{#canedit}}
-    {{#candelete}}
-        <button type="button" class="btn btn-secondary" data-action="delete">{{#str}} delete {{/str}}</button>
-    {{/candelete}}
-    <button type="button" class="btn btn-primary" data-action="edit">{{#str}} edit {{/str}}</button>
-{{/canedit}}
-{{#isactionevent}}
-    <a href="{{url}}">{{#str}} gotoactivity, core_calendar {{/str}}</a>
-{{/isactionevent}}
-{{/footer}}
+    {{$footer}}
+        {{#candelete}}
+            <button type="button" class="btn btn-secondary" data-action="delete">{{#str}} delete {{/str}}</button>
+        {{/candelete}}
+        {{#isactionevent}}
+            <a href="{{url}}">{{#str}} gotoactivity, core_calendar {{/str}}</a>
+        {{/isactionevent}}
+        {{^isactionevent}}
+            {{#canedit}}
+                <button type="button" class="btn btn-primary" data-action="edit">{{#str}} edit {{/str}}</button>
+            {{/canedit}}
+        {{/isactionevent}}
+    {{/footer}}
 {{/ core/modal }}

calendar/upgrade.txt

@@ -4,6 +4,8 @@ information provided here is intended especially for developers.
 === 3.4 ===
 * calendar_get_mini has been deprecated. Please update to use the new
   exporters and renderers.
+* added core_calendar_validate_event_timestart and core_calendar_event_timestart_updated callbacks for module events
+  when the update_event_start_day function is used in the local api.
 
 === 3.3 ===
 * calendar_event_hook() has been removed. Developers should be using the Moodle events system to achieve this behaviour,