Report and Setup buttons in the Stash block are visible to student

[senaiboy]

We have a Stash block added to the main page of our courses. Currently when a student views the page, they have access to the Report and Setup buttons as well.

How do we turn this off? Within the permissions we can only set 'acquire items' and 'view stash and content'.

Edit: Seems like the same issue as reported on the moodle plugin page for stash (https://moodle.org/plugins/block_stash) by Stephan on 27th August 2021.

[FMCorz]

Hi @senaiboy,

Thank you for reporting this. Was the capability addinstance inadvertently given to the student role?

[senaiboy]

It was set to "Not Set" (by default I think).

Changing it to Prohibit did not solve the issue, those buttons are still accessible and usable by students.

[FMCorz]

Hi @senaiboy

Would you please confirm the following:

• Which version of Moodle is installed?
• Which version of Stash is installed?
• What permissions are given to a student in the block? (see A below)
• What permissions are given to a student in the course? (see B below)

A) For the permissions, would you please follow this process:

1. Turn editing on
2. In the "Cog" icon dropdown menu of the block (top right), click "Check permissions"
3. In the next page, select a student that has the issue
4. Click "Show this user's permissions"
5. Report on what the page contains.

B) Report on the course permissions:

Similar to process above

1. From the course page, follow Participants > Permissions > Check permissions
2. Select the same student as previously, and click "Show user's permissions"
3. In the filter field, enter "stash"
4. Share the content of the page with us.

--

In A and B, the page should show two things, the roles of the user, and their permissions, such as:

Roles for user Laura Jørgensen

• Student in Course: Moodle Development 7790
• Role X in Course: Moodle Development 7790
• Role Y in System
• Authenticated user in System

Permissions for user Laura Jørgensen

• block/stash:acquireitems Yes
• block/stash:view Yes
• block/stash:addinstance No

[senaiboy]

Moodle 3.11.6+ (Build: 20220329)
Stash block_stash - 1.3.3 (2019120500)

A)

Roles for user Ricky Rickster

• Authenticated user on frontpage in Front page
• Authenticated user in System

Permissions for user Ricky Rickster

• moodle/block:edit No
• moodle/block:view Yes

B)

Roles for user Ricky Rickster

• Student in Course: KS3 Baseline Assessment
• Authenticated user in System

Permissions

• block/stash:acquireitems Yes
• block/stash:view Yes
• block/stash:addinstance No