Upgrade 1-11.38

main/gradebook/gradebook_add_result.php

@@ -9,6 +9,17 @@ api_protect_course_script(true);
 api_block_anonymous_users();
 GradebookUtils::block_students();
 
+if (isset($_GET['import'])) {
+    $queryString = $_SERVER['QUERY_STRING'];
+    $webPath = api_get_path(WEB_CODE_PATH);
+    $newUrl = $webPath.'gradebook/gradebook_view_result.php';
+    if (!empty($queryString)) {
+        $newUrl .= '?'.$queryString;
+    }
+    header("Location: $newUrl");
+    exit;
+}
+
 $selectEval = isset($_GET['selecteval']) ? (int) $_GET['selecteval'] : 0;
 
 $resultadd = new Result();

main/gradebook/gradebook_edit_eval.php

@@ -10,8 +10,19 @@ api_block_anonymous_users();
 GradebookUtils::block_students();
 
 $evaledit = Evaluation::load($_GET['editeval']);
-if ($evaledit[0]->is_locked() && !api_is_platform_admin()) {
-    api_not_allowed();
+if (empty($evaledit[0])) {
+    api_not_allowed(true);
+}
+if (!api_is_platform_admin()) {
+    $currentCourseCode = api_get_course_id();
+
+    if ($evaledit[0]->get_course_code() && $evaledit[0]->get_course_code() != $currentCourseCode) {
+        api_not_allowed(true);
+    }
+
+    if ($evaledit[0]->is_locked()) {
+        api_not_allowed(true);
+    }
 }
 $form = new EvalForm(
     EvalForm::TYPE_EDIT,
@@ -23,6 +34,12 @@ $form = new EvalForm(
 );
 if ($form->validate()) {
     $values = $form->exportValues();
+
+    $evaluationId = (int) $values['hid_id'];
+    if ($evaluationId !== (int) $evaledit[0]->get_id()) {
+        api_not_allowed(true);
+    }
+
     $eval = new Evaluation();
     $eval->set_id($values['hid_id']);
     $eval->set_name($values['name']);

main/gradebook/gradebook_flatview.php

@@ -10,12 +10,18 @@ $current_course_tool = TOOL_GRADEBOOK;
 api_protect_course_script(true);
 
 api_block_anonymous_users();
+
+$currentUserId = api_get_user_id();
+$sessionId = api_get_session_id();
+
 $isDrhOfCourse = CourseManager::isUserSubscribedInCourseAsDrh(
-    api_get_user_id(),
+    $currentUserId,
     api_get_course_info()
 );
 
-if (!$isDrhOfCourse) {
+$isDrhOfSession = $sessionId && !empty(SessionManager::getSessionFollowedByDrh($currentUserId, $sessionId));
+
+if (!$isDrhOfCourse && !$isDrhOfSession) {
     GradebookUtils::block_students();
 }
 
@@ -75,7 +81,7 @@ $simple_search_form = new UserForm(
 $values = $simple_search_form->exportValues();
 
 $keyword = '';
-if (isset($_GET['search']) && !empty($_GET['search'])) {
+if (!empty($_GET['search'])) {
     $keyword = Security::remove_XSS($_GET['search']);
 }
 if ($simple_search_form->validate() && empty($keyword)) {
@@ -90,7 +96,7 @@ if (!empty($keyword)) {
         $users = GradebookUtils::get_all_users($alleval, $alllinks);
     }
 }
-$offset = isset($_GET['offset']) ? $_GET['offset'] : '0';
+$offset = $_GET['offset'] ?? '0';
 
 $addparams = ['selectcat' => $cat[0]->get_id()];
 if (isset($_GET['search'])) {
@@ -128,7 +134,7 @@ if (isset($_GET['export_pdf']) && 'category' === $_GET['export_pdf']) {
     $params['join_firstname_lastname'] = true;
     $params['show_official_code'] = true;
     $params['export_pdf'] = true;
-    if ($cat[0]->is_locked() == true || api_is_platform_admin()) {
+    if ($cat[0]->is_locked() || api_is_platform_admin()) {
         Display::set_header(null, false, false);
         GradebookUtils::export_pdf_flatview(
             $flatViewTable,

main/gradebook/gradebook_view_result.php

@@ -40,7 +40,7 @@ if ($eval[0]->get_category_id() < 0) {
 //load the result with the evaluation id
 if (isset($_GET['delete_mark'])) {
     $result = Result::load($_GET['delete_mark']);
-    if (!empty($result[0])) {
+    if (!empty($result[0]) && $result[0]->get_evaluation_id() == $select_eval) {
         $result[0]->delete();
     }
 }
@@ -56,7 +56,9 @@ if (isset($_GET['action'])) {
     switch ($_GET['action']) {
         case 'delete_attempt':
             $result = Result::load($_GET['editres']);
-            if ($allowMultipleAttempts && !empty($result) && isset($result[0]) && api_is_allowed_to_edit()) {
+            if ($allowMultipleAttempts && !empty($result) && isset($result[0]) && api_is_allowed_to_edit()
+                && $result[0]->get_evaluation_id() == $select_eval
+            ) {
                 /** @var Result $result */
                 $result = $result[0];
                 $url = api_get_self().'?selecteval='.$select_eval.'&'.api_get_cidreq().'&editres='.$result->get_id();
@@ -74,7 +76,9 @@ if (isset($_GET['action'])) {
             break;
         case 'add_attempt':
             $result = Result::load($_GET['editres']);
-            if ($allowMultipleAttempts && !empty($result) && isset($result[0]) && api_is_allowed_to_edit()) {
+            if ($allowMultipleAttempts && !empty($result) && isset($result[0]) && api_is_allowed_to_edit()
+                && $result[0]->get_evaluation_id() == $select_eval
+            ) {
                 /** @var Result $result */
                 $result = $result[0];
                 $backUrl = api_get_self().'?selecteval='.$select_eval.'&'.api_get_cidreq();
@@ -512,8 +516,10 @@ if (isset($_GET['export'])) {
 
 if (isset($_GET['resultdelete'])) {
     $result = Result::load($_GET['resultdelete']);
-    $result[0]->delete();
-    Display::addFlash(Display::return_message(get_lang('ResultDeleted')));
+    if (!empty($result[0]) && $result[0]->get_evaluation_id() == $select_eval) {
+        $result[0]->delete();
+        Display::addFlash(Display::return_message(get_lang('ResultDeleted')));
+    }
     header('Location: gradebook_view_result.php?selecteval='.$select_eval.'&'.api_get_cidreq());
     exit;
 }
@@ -534,8 +540,10 @@ if (isset($_POST['action'])) {
                 $number_of_deleted_results = 0;
                 foreach ($_POST['id'] as $indexstr) {
                     $result = Result::load($indexstr);
-                    $result[0]->delete();
-                    $number_of_deleted_results++;
+                    if (!empty($result[0]) && $result[0]->get_evaluation_id() == $select_eval) {
+                        $result[0]->delete();
+                        $number_of_deleted_results++;
+                    }
                 }
                 Display::addFlash(Display::return_message(get_lang('ResultsDeleted'), 'confirmation', false));
                 header('Location: gradebook_view_result.php?massdelete=&selecteval='.$select_eval.'&'.api_get_cidreq());

main/gradebook/lib/GradebookUtils.php

@@ -973,8 +973,8 @@ class GradebookUtils
     }
 
     /**
-     * @param FlatViewTable $flatviewtable
-     * @param Category      $cat
+     * @param FlatViewTable        $flatviewtable
+     * @param array<int, Category> $cat
      * @param $users
      * @param $alleval
      * @param $alllinks

main/gradebook/lib/be/abstractlink.class.php

@@ -633,18 +633,23 @@ abstract class AbstractLink implements GradebookItem
      */
     public static function getCurrentUserRanking($userId, $studentList)
     {
+        $previousScore = null;
         $ranking = null;
+        $position = null;
         $currentUserId = $userId;
         if (!empty($studentList) && !empty($currentUserId)) {
             $studentList = array_map('floatval', $studentList);
-            asort($studentList);
-            $ranking = $count = count($studentList);
-
-            foreach ($studentList as $userId => $position) {
+            arsort($studentList);
+            $count = count($studentList);
+            foreach ($studentList as $userId => $score) {
+                $position++;
+                if ($previousScore === null || $score < $previousScore) {
+                    $ranking = $position;
+                }
+                $previousScore = $score;
                 if ($currentUserId == $userId) {
                     break;
                 }
-                $ranking--;
             }
 
             // If no ranking was detected.

main/gradebook/lib/be/category.class.php

@@ -128,12 +128,9 @@ class Category implements GradebookItem
         return $this->weight;
     }
 
-    /**
-     * @return bool
-     */
-    public function is_locked()
+    public function is_locked(): bool
     {
-        return isset($this->locked) && $this->locked == 1 ? true : false;
+        return isset($this->locked) && $this->locked == 1;
     }
 
     /**
@@ -429,7 +426,7 @@ class Category implements GradebookItem
      * @param bool   $order_by    Whether to show all "session"
      *                            categories (true) or hide them (false) in case there is no session id
      *
-     * @return array
+     * @return array<int, Category>
      */
     public static function load(
         $id = null,
@@ -439,7 +436,7 @@ class Category implements GradebookItem
         $visible = null,
         $session_id = null,
         $order_by = null
-    ) {
+    ): array {
         //if the category given is explicitly 0 (not null), then create
         // a root category object (in memory)
         if (isset($id) && (int) $id === 0) {
@@ -2681,10 +2678,7 @@ class Category implements GradebookItem
         return $this->weight - $subWeight;
     }
 
-    /**
-     * @return Category
-     */
-    private static function create_root_category()
+    private static function create_root_category(): Category
     {
         $cat = new Category();
         $cat->set_id(0);
@@ -2704,9 +2698,9 @@ class Category implements GradebookItem
     /**
      * @param Doctrine\DBAL\Driver\Statement|null $result
      *
-     * @return array
+     * @return array<int, Category>
      */
-    private static function create_category_objects_from_sql_result($result)
+    private static function create_category_objects_from_sql_result($result): array
     {
         $categories = [];
         $allow = api_get_configuration_value('allow_gradebook_stats');

main/gradebook/lib/be/evaluation.class.php

@@ -221,7 +221,7 @@ class Evaluation implements GradebookItem
      * @param int    $category_id parent category
      * @param int    $visible     visible
      *
-     * @return array
+     * @return array<int, Evaluation>
      */
     public static function load(
         $id = null,
@@ -230,7 +230,7 @@ class Evaluation implements GradebookItem
         $category_id = null,
         $visible = null,
         $locked = null
-    ) {
+    ): array {
         $table = Database::get_main_table(TABLE_MAIN_GRADEBOOK_EVALUATION);
         $sql = 'SELECT * FROM '.$table;
         $paramcount = 0;
@@ -935,9 +935,9 @@ class Evaluation implements GradebookItem
     /**
      * @param array $result
      *
-     * @return array
+     * @return array<int, Evaluation>
      */
-    private static function create_evaluation_objects_from_sql_result($result)
+    private static function create_evaluation_objects_from_sql_result($result): array
     {
         $alleval = [];
         $allow = api_get_configuration_value('allow_gradebook_stats');

main/gradebook/lib/be/forumthreadlink.class.php

@@ -93,7 +93,7 @@ class ForumThreadLink extends AbstractLink
         $sql = "SELECT count(*) AS number FROM $table
                 WHERE
                     c_id = ".$this->course_id." AND
-                    thread_id = '".$this->get_ref_id()."'                    
+                    thread_id = '".$this->get_ref_id()."'
                 ";
         $result = Database::query($sql);
         $number = Database::fetch_row($result);
@@ -122,8 +122,8 @@ class ForumThreadLink extends AbstractLink
 
         $sql = 'SELECT thread_qualify_max
                 FROM '.Database::get_course_table(TABLE_FORUM_THREAD)."
-                WHERE 
-                    c_id = ".$this->course_id." AND 
+                WHERE
+                    c_id = ".$this->course_id." AND
                     thread_id = '".$this->get_ref_id()."'
                     $sessionCondition
                 ";
@@ -131,8 +131,8 @@ class ForumThreadLink extends AbstractLink
         $assignment = Database::fetch_array($query);
 
         $sql = "SELECT * FROM $thread_qualify
-                WHERE 
-                    c_id = ".$this->course_id." AND 
+                WHERE
+                    c_id = ".$this->course_id." AND
                     thread_id = ".$this->get_ref_id()."
                     $sessionCondition
                 ";
@@ -265,9 +265,9 @@ class ForumThreadLink extends AbstractLink
     {
         $sessionId = $this->get_session_id();
         $sql = 'SELECT count(id) from '.$this->get_forum_thread_table().'
-                WHERE 
-                    c_id = '.$this->course_id.' AND 
-                    thread_id = '.$this->get_ref_id().' AND 
+                WHERE
+                    c_id = '.$this->course_id.' AND
+                    thread_id = '.$this->get_ref_id().' AND
                     session_id='.$sessionId;
         $result = Database::query($sql);
         $number = Database::fetch_row($result);
@@ -281,8 +281,8 @@ class ForumThreadLink extends AbstractLink
         //it was extracts the forum id
         $sql = 'SELECT * FROM '.$this->get_forum_thread_table()."
                 WHERE
-                    c_id = '.$this->course_id.' AND 
-                    thread_id = '".$this->get_ref_id()."' AND 
+                    c_id = ".$this->course_id." AND
+                    thread_id = ".$this->get_ref_id()." AND
                     session_id = $sessionId ";
         $result = Database::query($sql);
         $row = Database::fetch_array($result, 'ASSOC');
@@ -304,7 +304,7 @@ class ForumThreadLink extends AbstractLink
         $ref_id = $this->get_ref_id();
 
         if (!empty($ref_id)) {
-            $sql = 'UPDATE '.$this->get_forum_thread_table().' SET 
+            $sql = 'UPDATE '.$this->get_forum_thread_table().' SET
                     thread_weight='.api_float_val($weight).'
                     WHERE c_id = '.$this->course_id.' AND thread_id= '.$ref_id;
             Database::query($sql);
@@ -344,9 +344,9 @@ class ForumThreadLink extends AbstractLink
 
         if (!isset($this->exercise_data)) {
             $sql = 'SELECT * FROM '.$this->get_forum_thread_table().'
-                    WHERE 
-                        c_id = '.$this->course_id.' AND  
-                        thread_id = '.$this->get_ref_id().' AND 
+                    WHERE
+                        c_id = '.$this->course_id.' AND
+                        thread_id = '.$this->get_ref_id().' AND
                         '.$session_condition;
             $query = Database::query($sql);
             $this->exercise_data = Database::fetch_array($query);

main/gradebook/lib/be/result.class.php

@@ -85,9 +85,9 @@ class Result
      * @param $user_id user id (student)
      * @param $evaluation_id evaluation where this is a result for
      *
-     * @return array
+     * @return array<int, Result>
      */
-    public static function load($id = null, $user_id = null, $evaluation_id = null)
+    public static function load($id = null, $user_id = null, $evaluation_id = null): array
     {
         $tbl_user = Database::get_main_table(TABLE_MAIN_USER);
         $tbl_grade_results = Database::get_main_table(TABLE_MAIN_GRADEBOOK_RESULT);

main/gradebook/lib/fe/displaygradebook.php

@@ -429,6 +429,7 @@ class DisplayGradebook
         }
 
         // for course admin & platform admin add item buttons are added to the header
+        $toolbarActions = [];
         $actionsLeft = '';
         $actionsRight = '';
         $my_api_cidreq = api_get_cidreq();
@@ -562,11 +563,13 @@ class DisplayGradebook
         }
 
         $isDrhOfCourse = CourseManager::isUserSubscribedInCourseAsDrh(
-            api_get_user_id(),
+            $userId,
             api_get_course_info()
         );
 
-        if ($isDrhOfCourse) {
+        $isDrhOfSession = $sessionId && !empty(SessionManager::getSessionFollowedByDrh($userId, $sessionId));
+
+        if ($isDrhOfCourse || $isDrhOfSession) {
             $actionsLeft .= '<a href="gradebook_flatview.php?'.$my_api_cidreq.'&selectcat='.$catobj->get_id().'">'
                 .Display::return_icon(
                     'statistics.png',
@@ -578,9 +581,17 @@ class DisplayGradebook
         }
 
         if ($isCoach || api_is_allowed_to_edit(null, true)) {
-            echo $toolbar = Display::toolbarAction(
+            $toolbarActions = [$actionsLeft, $actionsRight];
+        }
+
+        if (empty($toolbarActions) && ($isDrhOfCourse || $isDrhOfSession)) {
+            $toolbarActions = [$actionsLeft];
+        }
+
+        if ($toolbarActions) {
+            echo Display::toolbarAction(
                 'gradebook-actions',
-                [$actionsLeft, $actionsRight]
+                $toolbarActions
             );
         }
 

main/gradebook/lib/gradebook_result.class.php

@@ -21,11 +21,11 @@ class GradeBookResult
     /**
      * Exports the complete report as a CSV file.
      *
-     * @param string $dato Document path inside the document tool
+     * @param array $dato Document path inside the document tool
      *
      * @return bool False on error
      */
-    public function exportCompleteReportCSV($dato)
+    public function exportCompleteReportCSV(array $dato)
     {
         $filename = 'gradebook_results_'.gmdate('YmdGis').'.csv';
         $data = '';
@@ -80,19 +80,16 @@ class GradeBookResult
      * Exports the complete report as an XLS file.
      *
      * @param array $data
-     *
-     * @throws PHPExcel_Exception
-     * @throws PHPExcel_Writer_Exception
      */
     public function exportCompleteReportXLS($data)
     {
         $filename = 'gradebook-results-'.api_get_local_time().'.xlsx';
 
-        $spreadsheet = new PHPExcel();
+        $spreadsheet = new \PhpOffice\PhpSpreadsheet\Spreadsheet();
         $spreadsheet->setActiveSheetIndex(0);
         $worksheet = $spreadsheet->getActiveSheet();
         $line = 1;
-        $column = 0;
+        $column = 1;
         // headers.
         foreach ($data[0] as $headerData) {
             $title = $headerData;
@@ -100,7 +97,7 @@ class GradeBookResult
                 $title = $headerData['header'];
             }
             $title = html_entity_decode(strip_tags($title));
-            $worksheet->SetCellValueByColumnAndRow(
+            $worksheet->setCellValueByColumnAndRow(
                 $column,
                 $line,
                 $title
@@ -110,9 +107,9 @@ class GradeBookResult
         $line++;
         $cant_students = count($data[1]);
         for ($i = 0; $i < $cant_students; $i++) {
-            $column = 0;
+            $column = 1;
             foreach ($data[1][$i] as $col_name) {
-                $worksheet->SetCellValueByColumnAndRow(
+                $worksheet->setCellValueByColumnAndRow(
                     $column,
                     $line,
                     html_entity_decode(strip_tags($col_name))
@@ -123,7 +120,7 @@ class GradeBookResult
         }
 
         $file = api_get_path(SYS_ARCHIVE_PATH).api_replace_dangerous_char($filename);
-        $writer = new PHPExcel_Writer_Excel2007($spreadsheet);
+        $writer = new \PhpOffice\PhpSpreadsheet\Writer\Xlsx($spreadsheet);
         $writer->save($file);
         DocumentManager::file_send_for_download($file, true, $filename);
         exit;