PHP allow_assign函数代码示例

 /**
  * Test get_enrolled_users
  */
 public function test_enrol_users()
 {
     global $DB;
     $this->resetAfterTest(true);
     $user = self::getDataGenerator()->create_user();
     $this->setUser($user);
     $course1 = self::getDataGenerator()->create_course();
     $course2 = self::getDataGenerator()->create_course();
     $user1 = self::getDataGenerator()->create_user();
     $user2 = self::getDataGenerator()->create_user();
     $context1 = context_course::instance($course1->id);
     $context2 = context_course::instance($course2->id);
     $instance1 = $DB->get_record('enrol', array('courseid' => $course1->id, 'enrol' => 'manual'), '*', MUST_EXIST);
     $instance2 = $DB->get_record('enrol', array('courseid' => $course2->id, 'enrol' => 'manual'), '*', MUST_EXIST);
     // Set the required capabilities by the external function.
     $roleid = $this->assignUserCapability('enrol/manual:enrol', $context1->id);
     $this->assignUserCapability('moodle/course:view', $context1->id, $roleid);
     $this->assignUserCapability('moodle/role:assign', $context1->id, $roleid);
     $this->assignUserCapability('enrol/manual:enrol', $context2->id, $roleid);
     $this->assignUserCapability('moodle/course:view', $context2->id, $roleid);
     $this->assignUserCapability('moodle/role:assign', $context2->id, $roleid);
     allow_assign($roleid, 3);
     // Call the external function.
     enrol_manual_external::enrol_users(array(array('roleid' => 3, 'userid' => $user1->id, 'courseid' => $course1->id), array('roleid' => 3, 'userid' => $user2->id, 'courseid' => $course1->id)));
     $this->assertEquals(2, $DB->count_records('user_enrolments', array('enrolid' => $instance1->id)));
     $this->assertEquals(0, $DB->count_records('user_enrolments', array('enrolid' => $instance2->id)));
     $this->assertTrue(is_enrolled($context1, $user1));
     $this->assertTrue(is_enrolled($context1, $user2));
     // Call without required capability.
     $DB->delete_records('user_enrolments');
     $this->unassignUserCapability('enrol/manual:enrol', $context1->id, $roleid);
     try {
         enrol_manual_external::enrol_users(array(array('roleid' => 3, 'userid' => $user1->id, 'courseid' => $course1->id)));
         $this->fail('Exception expected if not having capability to enrol');
     } catch (moodle_exception $e) {
         $this->assertInstanceOf('required_capability_exception', $e);
         $this->assertSame('nopermissions', $e->errorcode);
     }
     $this->assignUserCapability('enrol/manual:enrol', $context1->id, $roleid);
     $this->assertEquals(0, $DB->count_records('user_enrolments'));
     // Call with forbidden role.
     try {
         enrol_manual_external::enrol_users(array(array('roleid' => 1, 'userid' => $user1->id, 'courseid' => $course1->id)));
         $this->fail('Exception expected if not allowed to assign role.');
     } catch (moodle_exception $e) {
         $this->assertSame('wsusercannotassign', $e->errorcode);
     }
     $this->assertEquals(0, $DB->count_records('user_enrolments'));
     // Call for course without manual instance.
     $DB->delete_records('user_enrolments');
     $DB->delete_records('enrol', array('courseid' => $course2->id));
     try {
         enrol_manual_external::enrol_users(array(array('roleid' => 3, 'userid' => $user1->id, 'courseid' => $course1->id), array('roleid' => 3, 'userid' => $user1->id, 'courseid' => $course2->id)));
         $this->fail('Exception expected if course does not have manual instance');
     } catch (moodle_exception $e) {
         $this->assertSame('wsnoinstance', $e->errorcode);
     }
 }

 /**
  * Test allowing of role assignments.
  */
 public function test_allow_assign()
 {
     global $DB, $CFG;
     $this->resetAfterTest();
     $otherid = create_role('Other role', 'other', 'Some other role', '');
     $student = $DB->get_record('role', array('shortname' => 'student'), '*', MUST_EXIST);
     $this->assertFalse($DB->record_exists('role_allow_assign', array('roleid' => $otherid, 'allowassign' => $student->id)));
     allow_assign($otherid, $student->id);
     $this->assertTrue($DB->record_exists('role_allow_assign', array('roleid' => $otherid, 'allowassign' => $student->id)));
     // Test event trigger.
     $allowroleassignevent = \core\event\role_allow_assign_updated::create(array('context' => context_system::instance()));
     $sink = $this->redirectEvents();
     $allowroleassignevent->trigger();
     $events = $sink->get_events();
     $sink->close();
     $event = array_pop($events);
     $this->assertInstanceOf('\\core\\event\\role_allow_assign_updated', $event);
     $mode = 'assign';
     $baseurl = new moodle_url('/admin/roles/allow.php', array('mode' => $mode));
     $expectedlegacylog = array(SITEID, 'role', 'edit allow ' . $mode, str_replace($CFG->wwwroot . '/', '', $baseurl));
     $this->assertEventLegacyLogData($expectedlegacylog, $event);
 }

 /**
  * Test allowing of role assignments.
  * @return void
  */
 public function test_allow_assign()
 {
     global $DB;
     $this->resetAfterTest();
     $otherid = create_role('Other role', 'other', 'Some other role', '');
     $student = $DB->get_record('role', array('shortname' => 'student'), '*', MUST_EXIST);
     $this->assertFalse($DB->record_exists('role_allow_assign', array('roleid' => $otherid, 'allowassign' => $student->id)));
     allow_assign($otherid, $student->id);
     $this->assertTrue($DB->record_exists('role_allow_assign', array('roleid' => $otherid, 'allowassign' => $student->id)));
 }

/**
 * function that creates a role
 * @param name - role name
 * @param shortname - role short name
 * @param description - role description
 * @param legacy - optional legacy capability
 * @return id or false
 */
function create_role($name, $shortname, $description, $legacy = '')
{
    // check for duplicate role name
    if ($role = get_record('role', 'name', $name)) {
        error('there is already a role with this name!');
    }
    if ($role = get_record('role', 'shortname', $shortname)) {
        error('there is already a role with this shortname!');
    }
    $role = new object();
    $role->name = $name;
    $role->shortname = $shortname;
    $role->description = $description;
    //find free sortorder number
    $role->sortorder = count_records('role');
    while (get_record('role', 'sortorder', $role->sortorder)) {
        $role->sortorder += 1;
    }
    if (!($context = get_context_instance(CONTEXT_SYSTEM))) {
        return false;
    }
    if ($id = insert_record('role', $role)) {
        if ($legacy) {
            assign_capability($legacy, CAP_ALLOW, $id, $context->id);
        }
        /// By default, users with role:manage at site level
        /// should be able to assign users to this new role, and override this new role's capabilities
        // find all admin roles
        if ($adminroles = get_roles_with_capability('moodle/role:manage', CAP_ALLOW, $context)) {
            // foreach admin role
            foreach ($adminroles as $arole) {
                // write allow_assign and allow_overrid
                allow_assign($arole->id, $id);
                allow_override($arole->id, $id);
            }
        }
        return $id;
    } else {
        return false;
    }
}

/**
 * @package mod
 * @subpackage adobeconnect
 * @author Akinsaya Delamarre (adelamarre@remote-learner.net)
 * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */
function xmldb_adobeconnect_install()
{
    global $DB;
    // The commented out code is waiting for a fix for MDL-25709
    $result = true;
    $timenow = time();
    $sysctx = get_context_instance(CONTEXT_SYSTEM);
    $mrole = new stdClass();
    $levels = array(CONTEXT_COURSECAT, CONTEXT_COURSE, CONTEXT_MODULE);
    $param = array('shortname' => 'coursecreator');
    $coursecreatorrid = $DB->get_record('role', $param);
    $param = array('shortname' => 'editingteacher');
    $editingteacherrid = $DB->get_record('role', $param);
    $param = array('shortname' => 'teacher');
    $teacherrid = $DB->get_record('role', $param);
    /// Fully setup the Adobe Connect Presenter role.
    $param = array('shortname' => 'adobeconnectpresenter');
    if (!($mrole = $DB->get_record('role', $param))) {
        if ($rid = create_role(get_string('adobeconnectpresenter', 'adobeconnect'), 'adobeconnectpresenter', get_string('adobeconnectpresenterdescription', 'adobeconnect'), 'adobeconnectpresenter')) {
            $mrole->id = $rid;
            $result = assign_capability('mod/adobeconnect:meetingpresenter', CAP_ALLOW, $mrole->id, $sysctx->id);
            set_role_contextlevels($mrole->id, $levels);
        } else {
            $result = false;
        }
    }
    $param = array('allowassign' => $mrole->id, 'roleid' => $coursecreatorrid->id);
    if (!$DB->get_record('role_allow_assign', $param)) {
        $result = allow_assign($coursecreatorrid->id, $mrole->id);
    }
    $param = array('allowassign' => $mrole->id, 'roleid' => $editingteacherrid->id);
    if (!$DB->get_record('role_allow_assign', $param)) {
        $result = allow_assign($editingteacherrid->id, $mrole->id);
    }
    $param = array('allowassign' => $mrole->id, 'roleid' => $teacherrid->id);
    if (!$DB->get_record('role_allow_assign', $param)) {
        $result = allow_assign($teacherrid->id, $mrole->id);
    }
    /// Fully setup the Adobe Connect Participant role.
    $param = array('shortname' => 'adobeconnectparticipant');
    if (!($mrole = $DB->get_record('role', $param))) {
        if ($rid = create_role(get_string('adobeconnectparticipant', 'adobeconnect'), 'adobeconnectparticipant', get_string('adobeconnectparticipantdescription', 'adobeconnect'), 'adobeconnectparticipant')) {
            $mrole->id = $rid;
            $result = assign_capability('mod/adobeconnect:meetingparticipant', CAP_ALLOW, $mrole->id, $sysctx->id);
            set_role_contextlevels($mrole->id, $levels);
        } else {
            $result = false;
        }
    }
    $param = array('allowassign' => $mrole->id, 'roleid' => $coursecreatorrid->id);
    if (!$DB->get_record('role_allow_assign', $param)) {
        $result = allow_assign($coursecreatorrid->id, $mrole->id);
    }
    $param = array('allowassign' => $mrole->id, 'roleid' => $editingteacherrid->id);
    if (!$DB->get_record('role_allow_assign', $param)) {
        $result = allow_assign($editingteacherrid->id, $mrole->id);
    }
    $param = array('allowassign' => $mrole->id, 'roleid' => $teacherrid->id);
    if (!$DB->get_record('role_allow_assign', $param)) {
        $result = allow_assign($teacherrid->id, $mrole->id);
    }
    /// Fully setup the Adobe Connect Host role.
    $param = array('shortname' => 'adobeconnecthost');
    if (!($mrole = $DB->get_record('role', $param))) {
        if ($rid = create_role(get_string('adobeconnecthost', 'adobeconnect'), 'adobeconnecthost', get_string('adobeconnecthostdescription', 'adobeconnect'), 'adobeconnecthost')) {
            $mrole->id = $rid;
            $result = assign_capability('mod/adobeconnect:meetinghost', CAP_ALLOW, $mrole->id, $sysctx->id);
            set_role_contextlevels($mrole->id, $levels);
        } else {
            $result = false;
        }
    }
    $param = array('allowassign' => $mrole->id, 'roleid' => $coursecreatorrid->id);
    if (!$DB->get_record('role_allow_assign', $param)) {
        $result = allow_assign($coursecreatorrid->id, $mrole->id);
    }
    $param = array('allowassign' => $mrole->id, 'roleid' => $editingteacherrid->id);
    if (!$DB->get_record('role_allow_assign', $param)) {
        $result = allow_assign($editingteacherrid->id, $mrole->id);
    }
    $param = array('allowassign' => $mrole->id, 'roleid' => $teacherrid->id);
    if (!$DB->get_record('role_allow_assign', $param)) {
        $result = allow_assign($teacherrid->id, $mrole->id);
    }
    return $result;
}

if ($grant = data_submitted()) {
    foreach ($grant as $grole => $val) {
        if ($grole == 'dummy') {
            continue;
        }
        $string = explode('_', $grole);
        $temp[$string[1]][$string[2]] = 1;
        // if set, means can access
    }
    // if current assignment is in data_submitted, ignore, else, write deny into db
    foreach ($roles as $srole) {
        foreach ($roles as $trole) {
            if (isset($temp[$srole->id][$trole->id])) {
                // if set, need to write to db
                if (!($record = get_record('role_allow_assign', 'roleid', $srole->id, 'allowassign', $trole->id))) {
                    allow_assign($srole->id, $trole->id);
                }
            } else {
                //if set, means can access, attempt to remove it from db
                delete_records('role_allow_assign', 'roleid', $srole->id, 'allowassign', $trole->id);
            }
        }
    }
    // updated allowassigns sitewide...
    mark_context_dirty($sitecontext->path);
}
/// displaying form here
admin_externalpage_print_header();
$currenttab = 'allowassign';
require_once 'managetabs.php';
$table->tablealign = 'center';

//.........这里部分代码省略.........
function tao_reset_custom_roles($path = 'local')
{
    global $CFG;
    if (!get_site()) {
        // not finished installing, skip
        return true;
    }
    // get latest role definition from roles file
    $rolespath = $CFG->dirroot . '/' . $path . '/roles.php';
    if (!file_exists($rolespath)) {
        debugging("Local caps reassignment called with invalid path {$path}");
        return false;
    }
    require_once $rolespath;
    if (!isset($customroles)) {
        return true;
        // nothing to do.
    }
    $undeletableroles = array();
    $undeletableroles[$CFG->notloggedinroleid] = 1;
    $undeletableroles[$CFG->guestroleid] = 1;
    $undeletableroles[$CFG->defaultuserroleid] = 1;
    $undeletableroles[$CFG->defaultcourseroleid] = 1;
    // If there is only one admin role, add that to $undeletableroles too.
    $adminroles = get_admin_roles();
    if (count($adminroles) == 1) {
        $undeletableroles[reset($adminroles)->id] = 1;
    }
    // get recordset of existing custom roles
    $sql = "SELECT id, name, shortname, description, sortorder, custom\n              FROM {$CFG->prefix}role\n              WHERE custom IS NOT NULL";
    $roles = get_records_sql($sql);
    // remove custom roles that are not in the latest definition
    foreach ($roles as $role) {
        // check whether this role is in the latest definition
        if (array_key_exists($role->shortname, $customroles)) {
            continue;
        }
        // extra safety: check undeletable roles
        if (isset($undeletableroles[$role->id])) {
            continue;
        }
        delete_role($role->id);
    }
    // hack to avoid sortorder unique constraint
    execute_sql("UPDATE {$CFG->prefix}role SET sortorder = (sortorder+1000) WHERE custom IS NOT NULL");
    // set sortorder to current highest value
    $sortorder = get_field_sql("SELECT " . sql_max('sortorder') . " FROM {$CFG->prefix}role WHERE custom IS NULL");
    // now loop through the new settings
    foreach ($customroles as $shortname => $role) {
        $sortorder++;
        // get the roleid
        $roleid = get_field('role', 'id', 'shortname', $shortname);
        // if exists then make updates
        if (!empty($roleid)) {
            // only update fields that have been set
            if (isset($role['name'])) {
                set_field('role', 'name', $role['name'], 'shortname', $shortname);
            }
            if (isset($role['description'])) {
                set_field('role', 'description', $role['description'], 'shortname', $shortname);
            }
            // reset sortorder
            set_field('role', 'sortorder', $sortorder, 'shortname', $shortname);
            // else create record
        } else {
            $newrole = new stdclass();
            $newrole->name = $role['name'];
            $newrole->shortname = $shortname;
            $newrole->description = $role['description'];
            $newrole->sortorder = $sortorder;
            $newrole->custom = 1;
            $roleid = insert_record('role', $newrole);
        }
        // remove any previously set legacy roles
        $legacyroles = get_legacy_roles();
        foreach ($legacyroles as $ltype => $lcap) {
            unassign_capability($lcap, $roleid);
        }
        // reset legacy role
        if (isset($role['legacy'])) {
            $legacycap = $legacyroles[$role['legacy']];
            $context = get_context_instance(CONTEXT_SYSTEM);
            assign_capability($legacycap, CAP_ALLOW, $roleid, $context->id);
        }
        // update the context settings
        set_role_contextlevels($roleid, $role['context']);
        //  e.g. array(CONTEXT_SYSTEM, CONTEXT_COURSECAT)
        // set allow assigns
        if (is_array($role['canassign'])) {
            // delete existing
            delete_records('role_allow_assign', 'allowassign', $roleid);
            foreach ($role['canassign'] as $canassign) {
                $canassignid = get_field('role', 'id', 'shortname', $canassign);
                allow_assign($canassignid, $roleid);
            }
        }
    }
    // reset custom capabilities to keep up with changes
    return tao_reset_capabilities();
}

function elluminate_install()
{
    $result = true;
    $timenow = time();
    $sysctx = get_context_instance(CONTEXT_SYSTEM);
    $adminrid = get_field('role', 'id', 'shortname', 'admin');
    $coursecreatorrid = get_field('role', 'id', 'shortname', 'coursecreator');
    $editingteacherrid = get_field('role', 'id', 'shortname', 'editingteacher');
    $teacherrid = get_field('role', 'id', 'shortname', 'teacher');
    /// Fully setup the Elluminate Moderator role.
    if ($result && !($mrole = get_record('role', 'shortname', 'elluminatemoderator'))) {
        if ($rid = create_role(get_string('elluminatemoderator', 'elluminate'), 'elluminatemoderator', get_string('elluminatemoderatordescription', 'elluminate'))) {
            $mrole = get_record('role', 'id', $rid);
            $result = $result && assign_capability('mod/elluminate:moderatemeeting', CAP_ALLOW, $mrole->id, $sysctx->id);
        } else {
            $result = false;
        }
    }
    if (!count_records('role_allow_assign', 'allowassign', $mrole->id)) {
        $result = $result && allow_assign($adminrid, $mrole->id);
        $result = $result && allow_assign($coursecreatorrid, $mrole->id);
        $result = $result && allow_assign($editingteacherrid, $mrole->id);
        $result = $result && allow_assign($teacherrid, $mrole->id);
    }
    /// Fully setup the Elluminate Participant role.
    if ($result && !($prole = get_record('role', 'shortname', 'elluminateparticipant'))) {
        if ($rid = create_role(get_string('elluminateparticipant', 'elluminate'), 'elluminateparticipant', get_string('elluminateparticipantdescription', 'elluminate'))) {
            $prole = get_record('role', 'id', $rid);
            $result = $result && assign_capability('mod/elluminate:joinmeeting', CAP_ALLOW, $prole->id, $sysctx->id);
        } else {
            $result = false;
        }
    }
    if (!count_records('role_allow_assign', 'allowassign', $prole->id)) {
        $result = $result && allow_assign($adminrid, $prole->id);
        $result = $result && allow_assign($coursecreatorrid, $prole->id);
        $result = $result && allow_assign($editingteacherrid, $prole->id);
        $result = $result && allow_assign($teacherrid, $prole->id);
    }
    return $result;
}

/**
 * @package mod
 * @subpackage adobeconnect
 * @author Akinsaya Delamarre (adelamarre@remote-learner.net)
 * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */
function xmldb_adobeconnect_install()
{
    global $DB;
    $result = true;
    $sysctx = context_system::instance();
    $levels = array(CONTEXT_COURSECAT, CONTEXT_COURSE, CONTEXT_MODULE);
    $param = array('shortname' => 'coursecreator');
    $coursecreator = $DB->get_records('role', $param, 'id ASC', 'id', 0, 1);
    if (empty($coursecreator)) {
        $param = array('archetype' => 'coursecreator');
        $coursecreator = $DB->get_records('role', $param, 'id ASC', 'id', 0, 1);
    }
    $coursecreatorrid = array_shift($coursecreator);
    $param = array('shortname' => 'editingteacher');
    $editingteacher = $DB->get_records('role', $param, 'id ASC', 'id', 0, 1);
    if (empty($editingteacher)) {
        $param = array('archetype' => 'editingteacher');
        $editingteacher = $DB->get_records('role', $param, 'id ASC', 'id', 0, 1);
    }
    $editingteacherrid = array_shift($editingteacher);
    $param = array('shortname' => 'teacher');
    $teacher = $DB->get_records('role', $param, 'id ASC', 'id', 0, 1);
    if (empty($teacher)) {
        $param = array('archetype' => 'teacher');
        $teacher = $DB->get_records('role', $param, 'id ASC', 'id', 0, 1);
    }
    $teacherrid = array_shift($teacher);
    // Fully setup the Adobe Connect Presenter role.
    $param = array('shortname' => 'adobeconnectpresenter');
    if (!($mrole = $DB->get_record('role', $param))) {
        if ($rid = create_role(get_string('adobeconnectpresenter', 'adobeconnect'), 'adobeconnectpresenter', get_string('adobeconnectpresenterdescription', 'adobeconnect'), 'adobeconnectpresenter')) {
            $mrole = new stdClass();
            $mrole->id = $rid;
            $result = $result && assign_capability('mod/adobeconnect:meetingpresenter', CAP_ALLOW, $mrole->id, $sysctx->id);
            set_role_contextlevels($mrole->id, $levels);
        } else {
            $result = false;
        }
    }
    if (isset($coursecreatorrid->id)) {
        $param = array('allowassign' => $mrole->id, 'roleid' => $coursecreatorrid->id);
        if (!$DB->get_record('role_allow_assign', $param)) {
            allow_assign($coursecreatorrid->id, $mrole->id);
        }
    }
    if (isset($editingteacherrid->id)) {
        $param = array('allowassign' => $mrole->id, 'roleid' => $editingteacherrid->id);
        if (!$DB->get_record('role_allow_assign', $param)) {
            allow_assign($editingteacherrid->id, $mrole->id);
        }
    }
    if (isset($teacherrid->id)) {
        $param = array('allowassign' => $mrole->id, 'roleid' => $teacherrid->id);
        if (!$DB->get_record('role_allow_assign', $param)) {
            allow_assign($teacherrid->id, $mrole->id);
        }
    }
    // Fully setup the Adobe Connect Participant role.
    $param = array('shortname' => 'adobeconnectparticipant');
    if ($result && !($mrole = $DB->get_record('role', $param))) {
        if ($rid = create_role(get_string('adobeconnectparticipant', 'adobeconnect'), 'adobeconnectparticipant', get_string('adobeconnectparticipantdescription', 'adobeconnect'), 'adobeconnectparticipant')) {
            $mrole = new stdClass();
            $mrole->id = $rid;
            $result = $result && assign_capability('mod/adobeconnect:meetingparticipant', CAP_ALLOW, $mrole->id, $sysctx->id);
            set_role_contextlevels($mrole->id, $levels);
        } else {
            $result = false;
        }
    }
    if (isset($coursecreatorrid->id)) {
        $param = array('allowassign' => $mrole->id, 'roleid' => $coursecreatorrid->id);
        if (!$DB->get_record('role_allow_assign', $param)) {
            allow_assign($coursecreatorrid->id, $mrole->id);
        }
    }
    if (isset($editingteacherrid->id)) {
        $param = array('allowassign' => $mrole->id, 'roleid' => $editingteacherrid->id);
        if (!$DB->get_record('role_allow_assign', $param)) {
            allow_assign($editingteacherrid->id, $mrole->id);
        }
    }
    if (isset($teacherrid->id)) {
        $param = array('allowassign' => $mrole->id, 'roleid' => $teacherrid->id);
        if (!$DB->get_record('role_allow_assign', $param)) {
            allow_assign($teacherrid->id, $mrole->id);
        }
    }
    // Fully setup the Adobe Connect Host role.
    $param = array('shortname' => 'adobeconnecthost');
    if ($result && !($mrole = $DB->get_record('role', $param))) {
        if ($rid = create_role(get_string('adobeconnecthost', 'adobeconnect'), 'adobeconnecthost', get_string('adobeconnecthostdescription', 'adobeconnect'), 'adobeconnecthost')) {
            $mrole = new stdClass();
            $mrole->id = $rid;
            $result = $result && assign_capability('mod/adobeconnect:meetinghost', CAP_ALLOW, $mrole->id, $sysctx->id);
//.........这里部分代码省略.........

//.........这里部分代码省略.........
        $mnethost->ip_address = $_SERVER['SERVER_ADDR'];
    }
    $mnetid = $DB->insert_record('mnet_host', $mnethost);
    set_config('mnet_localhost_id', $mnetid);
    // Initial insert of mnet applications info
    $mnet_app = new object();
    $mnet_app->name = 'moodle';
    $mnet_app->display_name = 'Moodle';
    $mnet_app->xmlrpc_server_url = '/mnet/xmlrpc/server.php';
    $mnet_app->sso_land_url = '/auth/mnet/land.php';
    $mnet_app->sso_jump_url = '/auth/mnet/land.php';
    $DB->insert_record('mnet_application', $mnet_app);
    $mnet_app = new object();
    $mnet_app->name = 'mahara';
    $mnet_app->display_name = 'Mahara';
    $mnet_app->xmlrpc_server_url = '/api/xmlrpc/server.php';
    $mnet_app->sso_land_url = '/auth/xmlrpc/land.php';
    $mnet_app->sso_jump_url = '/auth/xmlrpc/jump.php';
    $DB->insert_record('mnet_application', $mnet_app);
    /// insert log entries - replaces statements section in install.xml
    update_log_display_entry('user', 'view', 'user', 'CONCAT(firstname,\' \',lastname)');
    update_log_display_entry('course', 'user report', 'user', 'CONCAT(firstname,\' \',lastname)');
    update_log_display_entry('course', 'view', 'course', 'fullname');
    update_log_display_entry('course', 'update', 'course', 'fullname');
    update_log_display_entry('course', 'enrol', 'course', 'fullname');
    update_log_display_entry('course', 'unenrol', 'course', 'fullname');
    update_log_display_entry('course', 'report log', 'course', 'fullname');
    update_log_display_entry('course', 'report live', 'course', 'fullname');
    update_log_display_entry('course', 'report outline', 'course', 'fullname');
    update_log_display_entry('course', 'report participation', 'course', 'fullname');
    update_log_display_entry('course', 'report stats', 'course', 'fullname');
    update_log_display_entry('message', 'write', 'user', 'CONCAT(firstname,\' \',lastname)');
    update_log_display_entry('message', 'read', 'user', 'CONCAT(firstname,\' \',lastname)');
    update_log_display_entry('message', 'add contact', 'user', 'CONCAT(firstname,\' \',lastname)');
    update_log_display_entry('message', 'remove contact', 'user', 'CONCAT(firstname,\' \',lastname)');
    update_log_display_entry('message', 'block contact', 'user', 'CONCAT(firstname,\' \',lastname)');
    update_log_display_entry('message', 'unblock contact', 'user', 'CONCAT(firstname,\' \',lastname)');
    update_log_display_entry('group', 'view', 'groups', 'name');
    /// Create guest record
    $guest = new object();
    $guest->auth = 'manual';
    $guest->username = 'guest';
    $guest->password = hash_internal_user_password('guest');
    $guest->firstname = get_string('guestuser');
    $guest->lastname = ' ';
    $guest->email = 'root@localhost';
    $guest->description = get_string('guestuserinfo');
    $guest->mnethostid = $CFG->mnet_localhost_id;
    $guest->confirmed = 1;
    $guest->lang = $CFG->lang;
    $guest->timemodified = time();
    $guest->id = $DB->insert_record('user', $guest);
    /// Now create admin user
    $admin = new object();
    $admin->auth = 'manual';
    $admin->firstname = get_string('admin');
    $admin->lastname = get_string('user');
    $admin->username = 'admin';
    $admin->password = 'adminsetuppending';
    $admin->email = '';
    $admin->confirmed = 1;
    $admin->mnethostid = $CFG->mnet_localhost_id;
    $admin->lang = $CFG->lang;
    $admin->maildisplay = 1;
    $admin->timemodified = time();
    $admin->lastip = CLI_SCRIPT ? '0.0.0.0' : getremoteaddr();
    // installation hijacking prevention
    $admin->id = $DB->insert_record('user', $admin);
    /// Install the roles system.
    $adminrole = create_role(get_string('administrator'), 'admin', get_string('administratordescription'), 'moodle/legacy:admin');
    $coursecreatorrole = create_role(get_string('coursecreators'), 'coursecreator', get_string('coursecreatorsdescription'), 'moodle/legacy:coursecreator');
    $editteacherrole = create_role(get_string('defaultcourseteacher'), 'editingteacher', get_string('defaultcourseteacherdescription'), 'moodle/legacy:editingteacher');
    $noneditteacherrole = create_role(get_string('noneditingteacher'), 'teacher', get_string('noneditingteacherdescription'), 'moodle/legacy:teacher');
    $studentrole = create_role(get_string('defaultcoursestudent'), 'student', get_string('defaultcoursestudentdescription'), 'moodle/legacy:student');
    $guestrole = create_role(get_string('guest'), 'guest', get_string('guestdescription'), 'moodle/legacy:guest');
    $userrole = create_role(get_string('authenticateduser'), 'user', get_string('authenticateduserdescription'), 'moodle/legacy:user');
    /// Now is the correct moment to install capabilities - after creation of legacy roles, but before assigning of roles
    assign_capability('moodle/site:doanything', CAP_ALLOW, $adminrole, $syscontext->id);
    update_capabilities('moodle');
    /// assign default roles
    role_assign($guestrole, $guest->id, 0, $syscontext->id);
    role_assign($adminrole, $admin->id, 0, $syscontext->id);
    /// Default allow assign/override/switch.
    $defaultallows = array($coursecreatorrole => $noneditteacherrole, $coursecreatorrole => $editteacherrole, $coursecreatorrole => $studentrole, $coursecreatorrole => $guestrole, $editteacherrole => $noneditteacherrole, $editteacherrole => $studentrole, $editteacherrole => $guestrole);
    foreach ($defaultallows as $fromroleid => $toroleid) {
        allow_assign($fromroleid, $toroleid);
        allow_override($fromroleid, $toroleid);
        // There is a rant about this in MDL-15841.
        allow_switch($fromroleid, $toroleid);
    }
    allow_switch($noneditteacherrole, $studentrole);
    /// Set up the context levels where you can assign each role.
    set_role_contextlevels($adminrole, get_default_contextlevels('admin'));
    set_role_contextlevels($coursecreatorrole, get_default_contextlevels('coursecreator'));
    set_role_contextlevels($editteacherrole, get_default_contextlevels('editingteacher'));
    set_role_contextlevels($noneditteacherrole, get_default_contextlevels('teacher'));
    set_role_contextlevels($studentrole, get_default_contextlevels('student'));
    set_role_contextlevels($guestrole, get_default_contextlevels('guest'));
    set_role_contextlevels($userrole, get_default_contextlevels('user'));
}

/**
 * Execute post-install custom actions for the module
 * This function was added in 1.9
 *
 * @return boolean true if success, false on error
 */
function adobeconnect_install()
{
    $result = true;
    $timenow = time();
    $sysctx = get_context_instance(CONTEXT_SYSTEM);
    //    $adminrid          = get_field('role', 'id', 'shortname', 'admin');
    $coursecreatorrid = get_field('role', 'id', 'shortname', 'coursecreator');
    $editingteacherrid = get_field('role', 'id', 'shortname', 'editingteacher');
    $teacherrid = get_field('role', 'id', 'shortname', 'teacher');
    /// Fully setup the Adobe Connect Presenter role.
    if ($result && !($mrole = get_record('role', 'shortname', 'adobeconnectpresenter'))) {
        if ($rid = create_role(get_string('adobeconnectpresenter', 'adobeconnect'), 'adobeconnectpresenter', get_string('adobeconnectpresenterdescription', 'adobeconnect'))) {
            $mrole = get_record('role', 'id', $rid);
            $result = $result && assign_capability('mod/adobeconnect:meetingpresenter', CAP_ALLOW, $mrole->id, $sysctx->id);
        } else {
            $result = false;
        }
    }
    if (!get_field('role_allow_assign', 'id', 'allowassign', $mrole->id, 'roleid', $coursecreatorrid)) {
        $result = $result && allow_assign($coursecreatorrid, $mrole->id);
    }
    if (!get_field('role_allow_assign', 'id', 'allowassign', $mrole->id, 'roleid', $editingteacherrid)) {
        $result = $result && allow_assign($editingteacherrid, $mrole->id);
    }
    if (!get_field('role_allow_assign', 'id', 'allowassign', $mrole->id, 'roleid', $teacherrid)) {
        $result = $result && allow_assign($teacherrid, $mrole->id);
    }
    /// Fully setup the Adobe Connect Participant role.
    if ($result && !($mrole = get_record('role', 'shortname', 'adobeconnectparticipant'))) {
        if ($rid = create_role(get_string('adobeconnectparticipant', 'adobeconnect'), 'adobeconnectparticipant', get_string('adobeconnectparticipantdescription', 'adobeconnect'))) {
            $mrole = get_record('role', 'id', $rid);
            $result = $result && assign_capability('mod/adobeconnect:meetingparticipant', CAP_ALLOW, $mrole->id, $sysctx->id);
        } else {
            $result = false;
        }
    }
    if (!get_field('role_allow_assign', 'id', 'allowassign', $mrole->id, 'roleid', $coursecreatorrid)) {
        $result = $result && allow_assign($coursecreatorrid, $mrole->id);
    }
    if (!get_field('role_allow_assign', 'id', 'allowassign', $mrole->id, 'roleid', $editingteacherrid)) {
        $result = $result && allow_assign($editingteacherrid, $mrole->id);
    }
    if (!get_field('role_allow_assign', 'id', 'allowassign', $mrole->id, 'roleid', $teacherrid)) {
        $result = $result && allow_assign($teacherrid, $mrole->id);
    }
    /// Fully setup the Adobe Connect Host role.
    if ($result && !($mrole = get_record('role', 'shortname', 'adobeconnecthost'))) {
        if ($rid = create_role(get_string('adobeconnecthost', 'adobeconnect'), 'adobeconnecthost', get_string('adobeconnecthostdescription', 'adobeconnect'))) {
            $mrole = get_record('role', 'id', $rid);
            $result = $result && assign_capability('mod/adobeconnect:meetinghost', CAP_ALLOW, $mrole->id, $sysctx->id);
        } else {
            $result = false;
        }
    }
    if (!get_field('role_allow_assign', 'id', 'allowassign', $mrole->id, 'roleid', $coursecreatorrid)) {
        $result = $result && allow_assign($coursecreatorrid, $mrole->id);
    }
    if (!get_field('role_allow_assign', 'id', 'allowassign', $mrole->id, 'roleid', $editingteacherrid)) {
        $result = $result && allow_assign($editingteacherrid, $mrole->id);
    }
    if (!get_field('role_allow_assign', 'id', 'allowassign', $mrole->id, 'roleid', $teacherrid)) {
        $result = $result && allow_assign($teacherrid, $mrole->id);
    }
    return $result;
}

/**
 * function that creates a role
 * @param name - role name
 * @param shortname - role short name
 * @param description - role description
 * @param legacy - optional legacy capability
 * @return id or false
 */
function create_role($name, $shortname, $description, $legacy = '')
{
    global $CFG;
    // check for duplicate role name
    if ($role = get_record('role', 'name', $name)) {
        error('there is already a role with this name!');
    }
    if ($role = get_record('role', 'shortname', $shortname)) {
        error('there is already a role with this shortname!');
    }
    // Get the system context.
    if (!($context = get_context_instance(CONTEXT_SYSTEM))) {
        return false;
    }
    // Insert the role record.
    $role = new object();
    $role->name = $name;
    $role->shortname = $shortname;
    $role->description = $description;
    //find free sortorder number
    if (!($role->sortorder = get_field_sql('SELECT MAX(sortorder) + 1 FROM ' . $CFG->prefix . 'role'))) {
        $role->sortorder = 1;
    }
    $id = insert_record('role', $role);
    if (!$id) {
        return false;
    }
    if ($legacy) {
        assign_capability($legacy, CAP_ALLOW, $id, $context->id);
    }
    // By default, users with role:manage at site level should be able to assign
    // users to this new role, and override this new role's capabilities.
    if ($adminroles = get_admin_roles()) {
        foreach ($adminroles as $arole) {
            allow_assign($arole->id, $id);
            allow_override($arole->id, $id);
        }
    }
    return $id;
}

function xmldb_core_install() {
    global $CFG, $DB, $SITE;

    // switch to new default theme 
    set_config('theme', 'standard');

    $dbman = $DB->get_manager(); // loads ddl manager and xmldb classes
    $systemcontext = context_system::instance();
    // add coursetype and icon fields to course table

    $table = new xmldb_table('course');

    $field = new xmldb_field('coursetype');
    if (!$dbman->field_exists($table, $field)) {
        $field->set_attributes(XMLDB_TYPE_INTEGER, '4', null, null, null, null, null);
        $dbman->add_field($table, $field);
    }

    $field = new xmldb_field('icon');
    if (!$dbman->field_exists($table, $field)) {
        $field->set_attributes(XMLDB_TYPE_CHAR, '255', null, null, null, null);
        $dbman->add_field($table, $field);
    }

    // rename the moodle 'manager' fullname to "Site Manager" to make it
    // distinct from the "Staff Manager"
    if ($managerroleid = $DB->get_field('role', 'id', array('shortname' => 'manager', 'name' => get_string('manager', 'role')))) {
        $todb = new stdClass();
        $todb->id = $managerroleid;
        $todb->name = get_string('sitemanager', 'local_core');
        $DB->update_record('role', $todb);
    }

    // Create roles.
    $manager             = $DB->get_record('role', array('shortname' => 'manager'));
    $managerrole         = $manager->id;
    $staffmanagerrole    = create_role('', 'staffmanager', '', 'staffmanager');
    $assessorrole        = create_role('', 'assessor', '', 'assessor');
    $regionalmanagerrole = create_role('', 'regionalmanager', '');
    $regionaltrainerrole = create_role('', 'regionaltrainer', '');

    $defaultallowassigns = array(
        array($managerrole, $staffmanagerrole),
        array($managerrole, $assessorrole),
        array($managerrole, $regionalmanagerrole),
        array($managerrole, $regionaltrainerrole)
    );
    foreach ($defaultallowassigns as $allow) {
        list($fromroleid, $toroleid) = $allow;
        allow_assign($fromroleid, $toroleid);
    }

    $defaultallowoverrides = array(
        array($managerrole, $staffmanagerrole),
        array($managerrole, $assessorrole),
        array($managerrole, $regionalmanagerrole),
        array($managerrole, $regionaltrainerrole)
    );
    foreach ($defaultallowoverrides as $allow) {
        list($fromroleid, $toroleid) = $allow;
        allow_override($fromroleid, $toroleid); // There is a rant about this in MDL-15841.
    }

    $defaultallowswitch = array(
        array($managerrole, $staffmanagerrole),
    );
    foreach ($defaultallowswitch as $allow) {
        list($fromroleid, $toroleid) = $allow;
        allow_switch($fromroleid, $toroleid);
    }

    set_role_contextlevels($staffmanagerrole,   get_default_contextlevels('staffmanager'));
    assign_capability('moodle/user:viewdetails', CAP_ALLOW, $staffmanagerrole, $systemcontext->id, true);
    assign_capability('moodle/user:viewuseractivitiesreport', CAP_ALLOW, $staffmanagerrole, $systemcontext->id, true);
    assign_capability('moodle/cohort:view', CAP_ALLOW, $staffmanagerrole, $systemcontext->id, true);
    assign_capability('moodle/comment:view', CAP_ALLOW, $staffmanagerrole, $systemcontext->id, true);
    assign_capability('moodle/comment:delete', CAP_ALLOW, $staffmanagerrole, $systemcontext->id, true);
    assign_capability('moodle/comment:post', CAP_ALLOW, $staffmanagerrole, $systemcontext->id, true);
    $systemcontext->mark_dirty();
    set_role_contextlevels($assessorrole,       get_default_contextlevels('teacher'));

    $role_to_modify = array(
        'editingteacher' => 'editingtrainer',
        'teacher' => 'trainer',
        'student' => 'learner'
    );

    $DB->update_record('role', array('id' => $assessorrole, 'archetype' => 'assessor'));
    assign_capability('moodle/user:editownprofile', CAP_ALLOW, $assessorrole, $systemcontext->id, true);
    assign_capability('moodle/user:editownprofile', CAP_ALLOW, $regionalmanagerrole, $systemcontext->id, true);
    assign_capability('moodle/user:editownprofile', CAP_ALLOW, $regionaltrainerrole, $systemcontext->id, true);

    foreach ($role_to_modify as $old => $new) {
        if ($old_role = $DB->get_record('role', array('shortname' => $old))) {
            $new_role = new stdClass();
            $new_role->id = $old_role->id;
            $new_role->name = '';
            $new_role->description = '';

            $DB->update_record('role', $new_role);
//.........这里部分代码省略.........

 protected function set_allow($fromroleid, $targetroleid)
 {
     allow_assign($fromroleid, $targetroleid);
 }

require_once '../../config.php';
require_once $CFG->libdir . '/adminlib.php';
require_login();
$systemcontext = get_context_instance(CONTEXT_SYSTEM);
require_capability('moodle/role:manage', $systemcontext);
/// Get all roles
$roles = get_all_roles();
role_fix_names($roles, $systemcontext, ROLENAME_ORIGINAL);
/// Process form submission
if (optional_param('submit', false, PARAM_BOOL) && data_submitted() && confirm_sesskey()) {
    /// Delete all records, then add back the ones that should be allowed.
    delete_records('role_allow_assign');
    foreach ($roles as $fromroleid => $notused) {
        foreach ($roles as $targetroleid => $alsonotused) {
            if (optional_param('s_' . $fromroleid . '_' . $targetroleid, false, PARAM_BOOL)) {
                allow_assign($fromroleid, $targetroleid);
            }
        }
    }
    /// Updated allowassigns sitewide, so force a premissions refresh, and redirect.
    mark_context_dirty($systemcontext->path);
    add_to_log(SITEID, 'role', 'edit allow assign', 'admin/roles/allowassign.php', '', '', $USER->id);
    redirect($CFG->wwwroot . '/' . $CFG->admin . '/roles/allowassign.php');
}
/// Load the current settings
$allowed = array();
foreach ($roles as $role) {
    // Make an array $role->id => false. This is probalby too clever for its own good.1
    $allowed[$role->id] = array_combine(array_keys($roles), array_fill(0, count($roles), false));
}
$raas = get_recordset('role_allow_assign');