Merge branch 'chamilo:master' into fix/document-upload-cid-injection

Author: addow

.github/workflows/behat.yml

@@ -14,7 +14,7 @@ jobs:
                 php-versions: [ '8.2', '8.3' ]
         steps:
             -   name: Checkout
-                uses: actions/checkout@v6
+                uses: actions/checkout@v7
 
             -   name: Setup apache
                 run: |

.github/workflows/format_code.yml

@@ -17,7 +17,7 @@ jobs:
                 php-versions: ['8.2']
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
 
             - name: Setup PHP, with composer and extensions
               uses: shivammathur/setup-php@v2

.github/workflows/php_analysis.yml

@@ -14,7 +14,7 @@ jobs:
                 php-versions: ['8.2']
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
 
             - name: Setup PHP, with composer and extensions
               uses: shivammathur/setup-php@v2

.github/workflows/phpunit.yml

@@ -17,7 +17,7 @@ jobs:
                 php-versions: ['8.2']
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
 
             - name: Setup node
               run: |

README.md

@@ -113,14 +113,14 @@ sudo apt install -y apache2 libapache2-mod-php mariadb-client mariadb-server php
 sudo mysql -e "CREATE USER chamilo2@localhost IDENTIFIED BY 'chamilo2';"
 sudo mysql -e "GRANT ALL PRIVILEGES ON chamilo2.* TO chamilo2@localhost;"
 cd /var/www
-sudo wget https://github.com/chamilo/chamilo-lms/releases/download/v2.0.0-RC.2/chamilo-2.0.0-RC.2.tar.gz
-sudo tar zxf chamilo-2.0.0-RC.2.tar.gz
-sudo mv chamilo-2.0.0-RC.2 chamilo
+sudo wget https://github.com/chamilo/chamilo-lms/releases/download/v2.0.3/chamilo-2.0.3.tar.gz
+sudo tar zxf chamilo-2.0.3.tar.gz
 cd chamilo
 sudo cp public/main/install/apache.dist.conf /etc/apache2/sites-available/my.chamilo.net.conf
-# Edit /etc/apache2/sites-available/my.chamilo.net.conf to match your domain
+# Edit /etc/apache2/sites-available/my.chamilo.net.conf to match your domain name
 sudo a2ensite my.chamilo.net
 sudo a2enmod rewrite ssl headers expires
+sudo touch .env
 sudo chown -R www-data: .env config/ var/
 sudo systemctl restart apache2
 # Open http://my.chamilo.net in your browser to go through the installation wizard

assets/vue/router/coursemaintenance.js

@@ -1,3 +1,42 @@
+import { useCidReqStore } from "../store/cidReq"
+import { checkIsAllowedToEdit } from "../composables/userPermissions"
+
+/**
+ * Course Maintenance is a teacher-only course tool (admin category): students
+ * and teachers of other courses must not reach any of its pages.
+ *
+ * Runs as beforeEnter (before beforeResolve), so the course context is loaded
+ * here first, then edit permission is resolved for the current cid/sid. Mirrors
+ * the backend gate (ROLE_CURRENT_COURSE_TEACHER / platform admin), so course
+ * teachers and admins pass while everyone else is redirected away.
+ *
+ * @param {import('vue-router').RouteLocationNormalized} to
+ * @returns {Promise<boolean|import('vue-router').RouteLocationRaw>}
+ */
+async function courseMaintenanceBeforeEnter(to) {
+  const courseId = parseInt(to.query?.cid ?? 0)
+  const sessionId = parseInt(to.query?.sid ?? 0)
+
+  if (!courseId) {
+    return { name: "Home", replace: true }
+  }
+
+  const cidReqStore = useCidReqStore()
+  await cidReqStore.setCourseAndSessionById(courseId, sessionId)
+
+  if (!cidReqStore.course) {
+    return { name: "Home", replace: true }
+  }
+
+  const isAllowedToEdit = await checkIsAllowedToEdit()
+
+  if (!isAllowedToEdit) {
+    return { name: "CourseHome", params: { id: courseId }, query: sessionId ? { sid: sessionId } : {} }
+  }
+
+  return true
+}
+
 export default {
   path: "/resources/course_maintenance/:node(\\d+)",
   meta: { requiresAuth: true, showBreadcrumb: true, breadcrumb: "Course maintenance" },
@@ -8,36 +47,42 @@ export default {
     {
       name: "CMImportBackup",
       path: "import",
+      beforeEnter: courseMaintenanceBeforeEnter,
       component: () => import("../views/coursemaintenance/ImportBackup.vue"),
       meta: { breadcrumb: "Import backup" },
     },
     {
       name: "CMCreateBackup",
       path: "create",
+      beforeEnter: courseMaintenanceBeforeEnter,
       component: () => import("../views/coursemaintenance/CreateBackup.vue"),
       meta: { breadcrumb: "Create backup" },
     },
     {
       name: "CMCopyCourse",
       path: "copy",
+      beforeEnter: courseMaintenanceBeforeEnter,
       component: () => import("../views/coursemaintenance/CopyCourse.vue"),
       meta: { breadcrumb: "Copy course" },
     },
     {
       name: "CMCc13",
       path: "cc13",
+      beforeEnter: courseMaintenanceBeforeEnter,
       component: () => import("../views/coursemaintenance/Cc13.vue"),
       meta: { breadcrumb: "IMS CC 1.3" },
     },
     {
       name: "CMRecycle",
       path: "recycle",
+      beforeEnter: courseMaintenanceBeforeEnter,
       component: () => import("../views/coursemaintenance/RecycleCourse.vue"),
       meta: { breadcrumb: "Recycle course" },
     },
     {
       name: "CMDelete",
       path: "delete",
+      beforeEnter: courseMaintenanceBeforeEnter,
       component: () => import("../views/coursemaintenance/DeleteCourse.vue"),
       meta: { breadcrumb: "Delete course" },
     },

assets/vue/services/courseService.js

@@ -22,16 +22,6 @@ export default {
     return await baseService.get("/plugin/CourseLegal/check.php", { cid, sid, gid: 0 })
   },
 
-  /**
-   * Fetches the CourseHomeNotify plugin notification for a course.
-   * @param {number} cid
-   * @param {number} sid
-   * @returns {Promise<Object>}
-   */
-  getCourseHomeNotification: async (cid, sid = 0) => {
-    return await baseService.get("/plugin/CourseHomeNotify/ajax.php", { cid, sid, gid: 0 })
-  },
-
   /**
    * Lists the current user's courses (paginated). Returns the raw response body
    * so the caller can normalize it; accepts extra axios options (e.g. a signal).

assets/vue/services/forumService.js

@@ -17,7 +17,7 @@ function buildForumFormData(payload = {}) {
   const attachments = Array.isArray(payload.attachments) ? payload.attachments : []
 
   for (const [key, value] of Object.entries(payload)) {
-    if (key === "attachments") {
+    if (["attachments", "image"].includes(key)) {
       continue
     }
 
@@ -30,15 +30,27 @@ function buildForumFormData(payload = {}) {
     formData.append("attachments[]", file)
   })
 
+  if (hasForumImage(payload)) {
+    formData.append("image", payload.image)
+  }
+
   return formData
 }
 
 function hasAttachments(payload = {}) {
   return Array.isArray(payload.attachments) && payload.attachments.length > 0
 }
 
-export default {
+function hasForumImage(payload = {}) {
+  const image = payload.image
 
+  return (
+    (typeof File !== "undefined" && image instanceof File) ||
+    (typeof Blob !== "undefined" && image instanceof Blob)
+  )
+}
+
+export default {
   async searchForums(params = {}) {
     return await baseService.get("/api/forum/search", cleanParams(params))
   },
@@ -82,7 +94,6 @@ export default {
     return await baseService.get(`/api/forums/${forumId}`, cleanParams(params))
   },
 
-
   async createForum(params, payload) {
     return await baseService.post("/api/forums/create", payload, {}, { params: cleanParams(params) })
   },
@@ -111,6 +122,12 @@ export default {
     return await baseService.put(`/api/forums/${forumId}/toggle-subscription`, payload, { params: cleanParams(params) })
   },
 
+  async uploadForumImage(forumId, params, payload) {
+    const body = hasForumImage(payload) ? buildForumFormData(payload) : payload
+
+    return await baseService.post(`/api/forums/${forumId}/image`, body, {}, { params: cleanParams(params) })
+  },
+
   async getThreads(forumId, params) {
     const { items } = await baseService.getCollection(
       "/api/forum_threads",
@@ -190,7 +207,6 @@ export default {
     return await baseService.put(`/api/forum_posts/${postId}/toggle-visibility`, payload, { params: cleanParams(params) })
   },
 
-
   async approvePost(postId, params, payload) {
     return await baseService.put(`/api/forum_posts/${postId}/approve`, payload, { params: cleanParams(params) })
   },