webservice MDL-23438 do not create a token for a user if the service doesn't allow him

diff --git a/admin/webservice/tokens.php b/admin/webservice/tokens.php
index 76ecda2..ccd6031 100644 (file)
--- a/admin/webservice/tokens.php
+++ b/admin/webservice/tokens.php
@@ -51,6 +51,9 @@ require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM));
 
 $tokenlisturl = new moodle_url("/" . $CFG->admin . "/settings.php", array('section' => 'webservicetokens'));
 
+require_once($CFG->dirroot . "/webservice/lib.php");
+$webservicemanager = new webservice();
+
 switch ($action) {
 
     case 'create':
@@ -60,26 +63,43 @@ switch ($action) {
             redirect($tokenlisturl);
         } else if ($data and confirm_sesskey()) {
             ignore_user_abort(true);
-            //TODO improvement: either move this function from externallib.php to webservice/lib.php
-            // either move most of webservicelib.php functions into externallib.php
-            // (create externalmanager class) MDL-23523
-            external_generate_token(EXTERNAL_TOKEN_PERMANENT, $data->service,
-                    $data->user, get_context_instance(CONTEXT_SYSTEM),
-                    $data->validuntil, $data->iprestriction);
-            redirect($tokenlisturl);
+
+            //check the the user is allowed for the service
+            $selectedservice = $webservicemanager->get_external_service_by_id($data->service);
+            if ($selectedservice->restrictedusers) {
+                $restricteduser = $webservicemanager->get_ws_authorised_user($data->service, $data->user);
+                if (empty($restricteduser)) {
+                    $allowuserurl = new moodle_url('/admin/webservice/service_users.php',
+                            array('id' => $selectedservice->id));
+                    $allowuserlink = html_writer::tag('a', $selectedservice->name , array('href' => $allowuserurl));
+                    $errormsg = $OUTPUT->notification(get_string('usernotallowed', 'webservice', $allowuserlink));
+                }
+            }
+
+            //process the creation
+            if (empty($errormsg)) {
+                //TODO improvement: either move this function from externallib.php to webservice/lib.php
+                // either move most of webservicelib.php functions into externallib.php
+                // (create externalmanager class) MDL-23523
+                external_generate_token(EXTERNAL_TOKEN_PERMANENT, $data->service,
+                        $data->user, get_context_instance(CONTEXT_SYSTEM),
+                        $data->validuntil, $data->iprestriction);
+                redirect($tokenlisturl);
+            }
         }
 
         //OUTPUT: create token form
         echo $OUTPUT->header();
         echo $OUTPUT->heading(get_string('createtoken', 'webservice'));
+        if (!empty($errormsg)) {
+            echo $errormsg;
+        }
         $mform->display();
         echo $OUTPUT->footer();
         die;
         break;
 
-    case 'delete':
-        require_once($CFG->dirroot . "/webservice/lib.php");
-        $webservicemanager = new webservice();
+    case 'delete':        
         $token = $webservicemanager->get_created_by_user_ws_token($USER->id, $tokenid);
 
         //Delete the token

diff --git a/lang/en/webservice.php b/lang/en/webservice.php
index 0bc146b..3b23b37 100644 (file)
--- a/lang/en/webservice.php
+++ b/lang/en/webservice.php
@@ -174,6 +174,7 @@ $string['updateusersettings'] = 'Update';
 $string['userasclients'] = 'Users as clients with token';
 $string['userasclientsdescription'] = 'The following steps help you to set up the Moodle web service for users as clients. These steps also help to set up the recommended token (security keys) authentication method. In this use case, the user will generate his token from his <strong>Security keys</strong> profile page.';
 $string['usermissingcaps'] = 'Missing capabilities: {$a}.';
+$string['usernotallowed'] = 'The user is not allowed for this service. First you need to allow this user on the {$a}\'s allowed users administration page.';
 $string['usersettingssaved'] = 'User settings saved';
 $string['validuntil'] = 'Valid until';
 $string['validuntil_help'] = 'If set, the service will be inactivated after this date for this user.';