Use as course-field: Access to files is forbidden

[bytesparrow]

Hi,
thank you for the plugin. But there is a problem regarding the context:
If you add a coursefield of type "File", any file uploaded will give a "404".

How I tested:

• download Moodle 4.0.4
• extract this module to moodle-root/customfield/field/file
• install moodle
• on /course/customfield.php add a field "testfile"
• create a new course "testcourse"
• upload a file "myfile.jpg" in field "testfile"
• goto /?redirect=0
• see the course "testcourse" with the field "testfile" and the entry "myfile.jpg"
• click on "myfile.jpg"
• you are on the url /pluginfile.php/1/customfield_file/value/1/myfile.jpg and see "404"

This is because in function customfield_file_pluginfile / line 56 a send_file_not_found(); is returned

And this is because the contexts don't match - if you add
die("Context: ".$data->get_context()->id . " VS " .$context->id);
before
send_file_not_found(); in customfield_file_pluginfile/56
it will output
Context: 14 VS 1
on a new installation.

You can see in the database that they really don't match:

SELECT contextid, component, filename FROM files WHERE id = 33;
contextid | component | filename |  
1 | customfield_file | myfile.jpg

VS

SELECT fieldid, instanceid, timemodified,contextid FROM customfield_data;
fieldid | instanceid | timemodified | contextid |  
1 | 2 | 1666780996 | 14

Or did I do something wrong?
I'm on Ubuntu 22.04.1 LTS / PHP 7.4.32

Thanks for your efforts!

[andrewhancox]

You’re correct, there’s a bug here… The plugin is fetching the context to store the files by going to: $context = $this->get_field()->get_handler()->get_configuration_context(); Where it should be using the get_instance_context function. I’m not using this plugin to attach fields to courses so haven’t spotted this issue. If you can submit (or fund…) a fix I can get it integrated.

…

On 26 Oct 2022, at 12:09, null ***@***.***> wrote: Hi, thank you for the plugin. But there is a problem regarding the context: If you add a coursefield of type "File", any file uploaded will give a "404". How I tested: download Moodle 4.0.4 add moodle-customfield_file to moodle/customfield/field/ install moodle on /course/customfield.php add a field "testfile" create a new course "testcourse" upload a file "myfile.jpg" in field "testfile" goto /?redirect=0 see the course "testcourse" with the field "testfile" and the entry "myfile.jpg" click on "myfile.jpg" you are on the url /pluginfile.php/1/customfield_file/value/1/myfile.jpg and see "404" This is because in function customfield_file_pluginfile / line 56 a send_file_not_found(); is returned And this is because the contexts don't match - if you add die("Context: ".$data->get_context()->id . " VS " .$context->id); before send_file_not_found(); in customfield_file_pluginfile/56 it will output Context: 14 VS 1 on a new installation. You can see in the database that they really don't match: SELECT contextid, component, filename FROM files WHERE id = 33; contextid | component | filename | 1 | customfield_file | myfile.jpg VS SELECT fieldid, instanceid, timemodified,contextid FROM customfield_data; fieldid | instanceid | timemodified | contextid | 1 | 2 | 1666780996 | 14 Or did I do something wrong? I'm on Ubuntu 22.04.1 LTS / PHP 7.4.32 — Reply to this email directly, view it on GitHub <#4>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJEYMWO7JPGC4XKCPXSFM3WFEGO5ANCNFSM6AAAAAARO4CBC4>. You are receiving this because you are subscribed to this thread.

[bytesparrow]

Thanks a lot for your input.
I'll have a try.. May I ask, for which kind of objects do you use this plugin?

[andrewhancox]

I have several custom plugins that use custom fields at the system level, they handle certification tracks, enrolments for external users, e-commerce and a super flexible tool called ‘entities’ to gather data for various purposes (authoring content, recording CPD etc.)

…

On 2 Nov 2022, at 10:12, null ***@***.***> wrote: Thanks a lot for your input. I'll have a try.. May I ask, for which kind of objects you use this plugin? — Reply to this email directly, view it on GitHub <#4 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJEYMQRGE7KHIRR5K5QH5DWGI5B5ANCNFSM6AAAAAARO4CBC4>. You are receiving this because you commented.

[bytesparrow]

I understand. I'll get the fix done (and maybe some other features if you agree) and commit the changes

[andrewhancox]

That’s great, it would be good if you could knock up unit tests for any new functionality.

…

On 4 Nov 2022, at 10:28, null ***@***.***> wrote: I understand. I'll get the fix done (and maybe some other features if you agree) and commit the changes — Reply to this email directly, view it on GitHub <#4 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJEYMTOPHS643JYYBIHECLWGTQLPANCNFSM6AAAAAARO4CBC4>. You are receiving this because you commented.

[bytesparrow]

Hi,
I apologize for the delay, as the project was unexpectedly postponed. Now we're on track again.

As frumbert found out too, this is the solution to the 403-problem:

Are you ok with this solution?

[dmitriim]

Looks like #10 is a duplicate of this one.

[TomoTsuyuki]

Hi @andrewhancox / @bytesparrow

I made PR #11 using the code from @bytesparrow above.
I added an upgrade script to update existing records in the PR.

Can you review and merge the PR if it's ok?

Thanks