/**
 * Deletes one or more role assignments.   You must specify at least one parameter.
 * @param $roleid
 * @param $userid
 * @param $groupid
 * @param $contextid
 * @param $enrol unassign only if enrolment type matches, NULL means anything
 * @return boolean - success or failure
 */
function role_unassign($roleid = 0, $userid = 0, $groupid = 0, $contextid = 0, $enrol = NULL)
{
    global $USER, $CFG, $DB;
    require_once $CFG->dirroot . '/group/lib.php';
    $success = true;
    $args = array('roleid', 'userid', 'groupid', 'contextid');
    $select = array();
    $params = array();
    foreach ($args as $arg) {
        if (${$arg}) {
            $select[] = "{$arg} = ?";
            $params[] = ${$arg};
        }
    }
    if (!empty($enrol)) {
        $select[] = "enrol=?";
        $params[] = $enrol;
    }
    if ($select) {
        if ($ras = $DB->get_records_select('role_assignments', implode(' AND ', $select), $params)) {
            $mods = get_list_of_plugins('mod');
            foreach ($ras as $ra) {
                $fireevent = false;
                /// infinite loop protection when deleting recursively
                if (!($ra = $DB->get_record('role_assignments', array('id' => $ra->id)))) {
                    continue;
                }
                if ($DB->delete_records('role_assignments', array('id' => $ra->id))) {
                    $fireevent = true;
                } else {
                    $success = false;
                }
                if (!($context = get_context_instance_by_id($ra->contextid))) {
                    // strange error, not much to do
                    continue;
                }
                /* mark contexts as dirty here, because we need the refreshed
                 * caps bellow to delete group membership and user_lastaccess!
                 * and yes, this is very expensive for bulk operations :-(
                 */
                mark_context_dirty($context->path);
                /// If the user is the current user, then do full reload of capabilities too.
                if (!empty($USER->id) && $USER->id == $ra->userid) {
                    load_all_capabilities();
                }
                /// Ask all the modules if anything needs to be done for this user
                foreach ($mods as $mod) {
                    include_once $CFG->dirroot . '/mod/' . $mod . '/lib.php';
                    $functionname = $mod . '_role_unassign';
                    if (function_exists($functionname)) {
                        $functionname($ra->userid, $context);
                        // watch out, $context might be NULL if something goes wrong
                    }
                }
                /// now handle metacourse role unassigment and removing from goups if in course context
                if ($context->contextlevel == CONTEXT_COURSE) {
                    // cleanup leftover course groups/subscriptions etc when user has
                    // no capability to view course
                    // this may be slow, but this is the proper way of doing it
                    if (!has_capability('moodle/course:view', $context, $ra->userid)) {
                        // remove from groups
                        groups_delete_group_members($context->instanceid, $ra->userid);
                        // delete lastaccess records
                        $DB->delete_records('user_lastaccess', array('userid' => $ra->userid, 'courseid' => $context->instanceid));
                    }
                    //unassign roles in metacourses if needed
                    if ($parents = $DB->get_records('course_meta', array('child_course' => $context->instanceid))) {
                        foreach ($parents as $parent) {
                            sync_metacourse($parent->parent_course);
                        }
                    }
                }
                if ($fireevent) {
                    events_trigger('role_unassigned', $ra);
                }
            }
        }
    }
    return $success;
}

/**
 * Call to complete the user login process after authenticate_user_login()
 * has succeeded. It will setup the $USER variable and other required bits
 * and pieces.
 *
 * NOTE:
 * - It will NOT log anything -- up to the caller to decide what to log.
 *
 *
 *
 * @uses $CFG, $USER
 * @param string $user obj
 * @return user|flase A {@link $USER} object or false if error
 */
function complete_user_login($user)
{
    global $CFG, $USER;
    $USER = $user;
    // this is required because we need to access preferences here!
    if (!empty($CFG->regenloginsession)) {
        // please note this setting may break some auth plugins
        session_regenerate_id();
    }
    reload_user_preferences();
    update_user_login_times();
    if (empty($CFG->nolastloggedin)) {
        set_moodle_cookie($USER->username);
    } else {
        // do not store last logged in user in cookie
        // auth plugins can temporarily override this from loginpage_hook()
        // do not save $CFG->nolastloggedin in database!
        set_moodle_cookie('nobody');
    }
    set_login_session_preferences();
    // Call enrolment plugins
    check_enrolment_plugins($user);
    /// This is what lets the user do anything on the site :-)
    load_all_capabilities();
    /// Select password change url
    $userauth = get_auth_plugin($USER->auth);
    /// check whether the user should be changing password
    if (get_user_preferences('auth_forcepasswordchange', false)) {
        if ($userauth->can_change_password()) {
            if ($changeurl = $userauth->change_password_url()) {
                redirect($changeurl);
            } else {
                redirect($CFG->httpswwwroot . '/login/change_password.php');
            }
        } else {
            print_error('nopasswordchangeforced', 'auth');
        }
    }
    return $USER;
}

/**
 * Require key login. Function terminates with error if key not found or incorrect.
 * @param string $script unique script identifier
 * @param int $instance optional instance id
 */
function require_user_key_login($script, $instance = null)
{
    global $nomoodlecookie, $USER, $SESSION, $CFG;
    if (empty($nomoodlecookie)) {
        error('Incorrect use of require_key_login() - session cookies must be disabled!');
    }
    /// extra safety
    @session_write_close();
    $keyvalue = required_param('key', PARAM_ALPHANUM);
    if (!($key = get_record('user_private_key', 'script', $script, 'value', $keyvalue, 'instance', $instance))) {
        error('Incorrect key');
    }
    if (!empty($key->validuntil) and $key->validuntil < time()) {
        error('Expired key');
    }
    if ($key->iprestriction) {
        $remoteaddr = getremoteaddr();
        if ($remoteaddr == '' or !address_in_subnet($remoteaddr, $key->iprestriction)) {
            error('Client IP address mismatch');
        }
    }
    if (!($user = get_record('user', 'id', $key->userid))) {
        error('Incorrect user record');
    }
    /// emulate normal session
    $SESSION = new object();
    $USER = $user;
    /// note we are not using normal login
    if (!defined('USER_KEY_LOGIN')) {
        define('USER_KEY_LOGIN', true);
    }
    load_all_capabilities();
    /// return isntance id - it might be empty
    return $key->instance;
}

/**
 * Switches the current user to another role for the current session and only
 * in the given context.
 *
 * The caller *must* check
 * - that this op is allowed
 * - that the requested role can be switched to in this context (use get_switchable_roles)
 * - that the requested role is NOT $CFG->defaultuserroleid
 *
 * To "unswitch" pass 0 as the roleid.
 *
 * This function *will* modify $USER->access - beware
 *
 * @param integer $roleid the role to switch to.
 * @param context $context the context in which to perform the switch.
 * @return bool success or failure.
 */
function role_switch($roleid, context $context) {
    global $USER;

    //
    // Plan of action
    //
    // - Add the ghost RA to $USER->access
    //   as $USER->access['rsw'][$path] = $roleid
    //
    // - Make sure $USER->access['rdef'] has the roledefs
    //   it needs to honour the switcherole
    //
    // Roledefs will get loaded "deep" here - down to the last child
    // context. Note that
    //
    // - When visiting subcontexts, our selective accessdata loading
    //   will still work fine - though those ra/rdefs will be ignored
    //   appropriately while the switch is in place
    //
    // - If a switcherole happens at a category with tons of courses
    //   (that have many overrides for switched-to role), the session
    //   will get... quite large. Sometimes you just can't win.
    //
    // To un-switch just unset($USER->access['rsw'][$path])
    //
    // Note: it is not possible to switch to roles that do not have course:view

    if (!isset($USER->access)) {
        load_all_capabilities();
    }


    // Add the switch RA
    if ($roleid == 0) {
        unset($USER->access['rsw'][$context->path]);
        return true;
    }

    $USER->access['rsw'][$context->path] = $roleid;

    // Load roledefs
    load_role_access_by_context($roleid, $context, $USER->access);

    return true;
}

/**
 * Adds a temp role to current USER->access array.
 *
 * Useful for the "temporary guest" access we grant to logged-in users.
 * @since 2.2
 *
 * @param context_course $coursecontext
 * @param int $roleid
 * @return void
 */
function load_temp_course_role(context_course $coursecontext, $roleid)
{
    global $USER;
    //TODO: this gets removed if there are any dirty contexts, we should probably store list of these temp roles somewhere (skodak)
    if (empty($roleid)) {
        debugging('invalid role specified in load_temp_course_role()');
        return;
    }
    if (!isset($USER->access)) {
        load_all_capabilities();
    }
    $coursecontext->reload_if_dirty();
    if (isset($USER->access['ra'][$coursecontext->path][$roleid])) {
        return;
    }
    // load course stuff first
    load_course_context($USER->id, $coursecontext, $USER->access);
    $USER->access['ra'][$coursecontext->path][(int) $roleid] = (int) $roleid;
    load_role_access_by_context($roleid, $coursecontext, $USER->access);
}

//.........这里部分代码省略.........
             // see also: admin/cron.php, $this->cron(), $CFG->an_capture_day...
             case AN_ACTION_AUTH_ONLY:
                 $a = new stdClass();
                 $a->url = "{$CFG->wwwroot}/enrol/authorize/index.php?order={$order->id}";
                 $a->orderid = $order->id;
                 $a->transid = $order->transid;
                 $a->amount = "{$order->currency} {$order->amount}";
                 $a->expireon = userdate(AuthorizeNet::getsettletime($timenow + 30 * 3600 * 24));
                 $a->captureon = userdate(AuthorizeNet::getsettletime($timenow + intval($CFG->an_capture_day) * 3600 * 24));
                 $a->course = $course->fullname;
                 $a->user = fullname($USER);
                 $a->acstatus = $CFG->an_capture_day > 0 ? get_string('yes') : get_string('no');
                 $emailmessage = get_string('adminneworder', 'enrol_authorize', $a);
                 $a = new stdClass();
                 $a->course = $course->shortname;
                 $a->orderid = $order->id;
                 $emailsubject = get_string('adminnewordersubject', 'enrol_authorize', $a);
                 $context = get_context_instance(CONTEXT_COURSE, $course->id);
                 if ($paymentmanagers = get_users_by_capability($context, 'enrol/authorize:managepayments')) {
                     foreach ($paymentmanagers as $paymentmanager) {
                         $eventdata = new object();
                         $eventdata->modulename = 'moodle';
                         $eventdata->userfrom = $USER;
                         $eventdata->userto = $paymentmanager;
                         $eventdata->subject = $emailsubject;
                         $eventdata->fullmessage = $emailmessage;
                         $eventdata->fullmessageformat = FORMAT_PLAIN;
                         $eventdata->fullmessagehtml = '';
                         $eventdata->smallmessage = '';
                         events_trigger('message_send', $eventdata);
                     }
                 }
                 redirect($CFG->wwwroot, get_string("reviewnotify", "enrol_authorize"), '30');
                 break;
             case AN_ACTION_CAPTURE_ONLY:
                 // auth code received via phone and the code accepted.
             // auth code received via phone and the code accepted.
             case AN_ACTION_AUTH_CAPTURE:
                 // Credit card captured, ENROL student now...
                 if (enrol_into_course($course, $USER, 'authorize')) {
                     if (!empty($CFG->enrol_mailstudents)) {
                         send_welcome_messages($order->id);
                     }
                     if (!empty($CFG->enrol_mailteachers)) {
                         $context = get_context_instance(CONTEXT_COURSE, $course->id);
                         $paymentmanagers = get_users_by_capability($context, 'enrol/authorize:managepayments', '', '', '0', '1');
                         $paymentmanager = array_shift($paymentmanagers);
                         $a = new stdClass();
                         $a->course = "{$course->fullname}";
                         $a->user = fullname($USER);
                         $eventdata = new object();
                         $eventdata->modulename = 'moodle';
                         $eventdata->userfrom = $USER;
                         $eventdata->userto = $paymentmanager;
                         $eventdata->subject = get_string("enrolmentnew", '', format_string($course->shortname));
                         $eventdata->fullmessage = get_string('enrolmentnewuser', '', $a);
                         $eventdata->fullmessageformat = FORMAT_PLAIN;
                         $eventdata->fullmessagehtml = '';
                         $eventdata->smallmessage = '';
                         events_trigger('message_send', $eventdata);
                     }
                     if (!empty($CFG->enrol_mailadmins)) {
                         $a = new stdClass();
                         $a->course = "{$course->fullname}";
                         $a->user = fullname($USER);
                         $admins = get_admins();
                         foreach ($admins as $admin) {
                             $eventdata = new object();
                             $eventdata->modulename = 'moodle';
                             $eventdata->userfrom = $USER;
                             $eventdata->userto = $admin;
                             $eventdata->subject = get_string("enrolmentnew", '', format_string($course->shortname));
                             $eventdata->fullmessage = get_string('enrolmentnewuser', '', $a);
                             $eventdata->fullmessageformat = FORMAT_PLAIN;
                             $eventdata->fullmessagehtml = '';
                             $eventdata->smallmessage = '';
                             events_trigger('message_send', $eventdata);
                         }
                     }
                 } else {
                     message_to_admin("Error while trying to enrol " . fullname($USER) . " in '{$course->fullname}'", $order);
                 }
                 load_all_capabilities();
                 echo $OUTPUT->box_start('generalbox notice');
                 echo '<p>' . get_string('paymentthanks', 'moodle', $course->fullname) . '</p>';
                 echo $OUTPUT->container_start('buttons');
                 echo $OUTPUT->button(html_form::make_button("{$CFG->wwwroot}/enrol/authorize/index.php", array('order' => $order->id), get_string('payments')));
                 echo $OUTPUT->button(html_form::make_button("{$CFG->wwwroot}/course/view.php", array('id' => $course->id), $course->fullname));
                 echo $OUTPUT->container_end();
                 echo $OUTPUT->box_end();
                 echo $OUTPUT->footer();
                 exit;
                 // break;
         }
         return NULL;
     } else {
         message_to_admin($message, $order);
         return $message;
     }
 }

 }
 /// Let's get them all set up.
 $USER = $user;
 add_to_log(SITEID, 'user', 'login', "view.php?id={$USER->id}&course=" . SITEID, $USER->id, 0, $USER->id);
 update_user_login_times();
 if (empty($CFG->nolastloggedin)) {
     set_moodle_cookie($USER->username);
 } else {
     // do not store last logged in user in cookie
     // auth plugins can temporarily override this from loginpage_hook()
     // do not save $CFG->nolastloggedin in database!
     set_moodle_cookie('nobody');
 }
 set_login_session_preferences();
 /// This is what lets the user do anything on the site :-)
 load_all_capabilities();
 /// Select password change url
 $userauth = get_auth_plugin($USER->auth);
 if ($userauth->can_change_password()) {
     if ($userauth->change_password_url()) {
         $passwordchangeurl = $userauth->change_password_url();
     } else {
         $passwordchangeurl = $CFG->httpswwwroot . '/login/change_password.php';
     }
 } else {
     $passwordchangeurl = '';
 }
 /// check whether the user should be changing password
 if (get_user_preferences('auth_forcepasswordchange', false) || $frm->password == 'changeme') {
     if ($frm->password == 'changeme') {
         //force the change

//.........这里部分代码省略.........
     accesslib_clear_all_caches(false);
     // must be done after assign_capability()
     // Extra tests for guests and not-logged-in users because they can not be verified by cross checking
     // with get_users_by_capability() where they are ignored
     $this->assertFalse(has_capability('moodle/block:view', $frontpageblockcontext, $guestid));
     $this->assertFalse(has_capability('mod/page:view', $frontpagepagecontext, $guestid));
     $this->assertTrue(has_capability('mod/page:view', $frontpagecontext, $guestid));
     $this->assertFalse(has_capability('mod/page:view', $systemcontext, $guestid));
     $this->assertFalse(has_capability('moodle/block:view', $frontpageblockcontext, 0));
     $this->assertFalse(has_capability('mod/page:view', $frontpagepagecontext, 0));
     $this->assertTrue(has_capability('mod/page:view', $frontpagecontext, 0));
     $this->assertFalse(has_capability('mod/page:view', $systemcontext, 0));
     $this->assertFalse(has_capability('moodle/course:create', $systemcontext, $testusers[11]));
     $this->assertTrue(has_capability('moodle/course:create', context_coursecat::instance($testcategories[2]), $testusers[11]));
     $this->assertFalse(has_capability('moodle/course:create', context_course::instance($testcourses[1]), $testusers[11]));
     $this->assertTrue(has_capability('moodle/course:create', context_course::instance($testcourses[19]), $testusers[11]));
     $this->assertFalse(has_capability('moodle/course:update', context_course::instance($testcourses[1]), $testusers[9]));
     $this->assertFalse(has_capability('moodle/course:update', context_course::instance($testcourses[19]), $testusers[9]));
     $this->assertFalse(has_capability('moodle/course:update', $systemcontext, $testusers[9]));
     // Test the list of enrolled users
     $coursecontext = context_course::instance($course1->id);
     $enrolled = get_enrolled_users($coursecontext);
     $this->assertEqual(count($enrolled), 10);
     for ($i = 0; $i < 10; $i++) {
         $this->assertTrue(isset($enrolled[$testusers[$i]]));
     }
     $enrolled = get_enrolled_users($coursecontext, 'moodle/course:update');
     $this->assertEqual(count($enrolled), 1);
     $this->assertTrue(isset($enrolled[$testusers[9]]));
     unset($enrolled);
     // role switching
     $userid = $testusers[9];
     $USER = $DB->get_record('user', array('id' => $userid));
     load_all_capabilities();
     $coursecontext = context_course::instance($course1->id);
     $this->assertTrue(has_capability('moodle/course:update', $coursecontext));
     $this->assertFalse(is_role_switched($course1->id));
     role_switch($allroles['student'], $coursecontext);
     $this->assertTrue(is_role_switched($course1->id));
     $this->assertEqual($USER->access['rsw'][$coursecontext->path], $allroles['student']);
     $this->assertFalse(has_capability('moodle/course:update', $coursecontext));
     reload_all_capabilities();
     $this->assertFalse(has_capability('moodle/course:update', $coursecontext));
     role_switch(0, $coursecontext);
     $this->assertTrue(has_capability('moodle/course:update', $coursecontext));
     $userid = $adminid;
     $USER = $DB->get_record('user', array('id' => $userid));
     load_all_capabilities();
     $coursecontext = context_course::instance($course1->id);
     $blockcontext = context_block::instance($block1->id);
     $this->assertTrue(has_capability('moodle/course:update', $blockcontext));
     role_switch($allroles['student'], $coursecontext);
     $this->assertEqual($USER->access['rsw'][$coursecontext->path], $allroles['student']);
     $this->assertFalse(has_capability('moodle/course:update', $blockcontext));
     reload_all_capabilities();
     $this->assertFalse(has_capability('moodle/course:update', $blockcontext));
     load_all_capabilities();
     $this->assertTrue(has_capability('moodle/course:update', $blockcontext));
     // temp course role for enrol
     $DB->delete_records('cache_flags', array());
     // this prevents problem with dirty contexts immediately resetting the temp role - this is a known problem...
     $userid = $testusers[5];
     $roleid = $allroles['editingteacher'];
     $USER = $DB->get_record('user', array('id' => $userid));
     load_all_capabilities();
     $coursecontext = context_course::instance($course1->id);

/**
 * Deletes one or more role assignments.   You must specify at least one parameter.
 * @param $roleid
 * @param $userid
 * @param $groupid
 * @param $contextid
 * @param $enrol unassign only if enrolment type matches, NULL means anything
 * @return boolean - success or failure
 */
function role_unassign($roleid = 0, $userid = 0, $groupid = 0, $contextid = 0, $enrol = NULL)
{
    global $USER, $CFG;
    $success = true;
    $args = array('roleid', 'userid', 'groupid', 'contextid');
    $select = array();
    foreach ($args as $arg) {
        if (${$arg}) {
            $select[] = $arg . ' = ' . ${$arg};
        }
    }
    if (!empty($enrol)) {
        $select[] = "enrol='{$enrol}'";
    }
    if ($select) {
        if ($ras = get_records_select('role_assignments', implode(' AND ', $select))) {
            $mods = get_list_of_plugins('mod');
            foreach ($ras as $ra) {
                /// infinite loop protection when deleting recursively
                if (!($ra = get_record('role_assignments', 'id', $ra->id))) {
                    continue;
                }
                $success = delete_records('role_assignments', 'id', $ra->id) and $success;
                /// If the user is the current user, then reload the capabilities too.
                if (!empty($USER->id) && $USER->id == $ra->userid) {
                    load_all_capabilities();
                }
                $context = get_record('context', 'id', $ra->contextid);
                /// Ask all the modules if anything needs to be done for this user
                foreach ($mods as $mod) {
                    include_once $CFG->dirroot . '/mod/' . $mod . '/lib.php';
                    $functionname = $mod . '_role_unassign';
                    if (function_exists($functionname)) {
                        $functionname($ra->userid, $context);
                        // watch out, $context might be NULL if something goes wrong
                    }
                }
                /// now handle metacourse role unassigment and removing from goups if in course context
                if (!empty($context) and $context->contextlevel == CONTEXT_COURSE) {
                    // cleanup leftover course groups/subscriptions etc when user has
                    // no capability to view course
                    // this may be slow, but this is the proper way of doing it
                    if (!has_capability('moodle/course:view', $context, $ra->userid)) {
                        // remove from groups
                        if ($groups = groups_get_all_groups($context->instanceid)) {
                            foreach ($groups as $group) {
                                delete_records('groups_members', 'groupid', $group->id, 'userid', $ra->userid);
                            }
                        }
                        // delete lastaccess records
                        delete_records('user_lastaccess', 'userid', $ra->userid, 'courseid', $context->instanceid);
                    }
                    //unassign roles in metacourses if needed
                    if ($parents = get_records('course_meta', 'child_course', $context->instanceid)) {
                        foreach ($parents as $parent) {
                            sync_metacourse($parent->parent_course);
                        }
                    }
                }
            }
        }
    }
    return $success;
}

function teosso_authenticate_user()
{
    global $CFG, $USER, $SESSION;
    $pluginconfig = get_config('auth/teosso');
    // retrieve the login data from the HTTP Headers
    $attributes = auth_plugin_teosso::get_sso_attributes();
    // check to see if we got any authentication data
    if (empty($attributes)) {
        redirect($pluginconfig->signin_url);
    }
    // get the http headers for error reporting
    $headers = apache_request_headers();
    $attr_hdrs = array();
    foreach ($headers as $key => $value) {
        if (preg_match('/^HTTP_/', $key)) {
            $attr_hdrs[] = $key . ': ' . $value;
        }
    }
    $headers = implode(' | ', $attr_hdrs);
    // FIND THE VALIDIDTY OF THE HTTP HEADER
    $attrmap = auth_plugin_teosso::get_attributes();
    if (empty($attrmap['idnumber'])) {
        // serious misdemeanour
        print_error('missingidnumber', 'auth_teosso');
    }
    if (empty($attributes[$attrmap['idnumber']])) {
        #
        // not valid session. Ship user off to Federation Manager
        add_to_log(0, 'login', 'error', '/auth/teosso/index.php', get_string('idnumber_error', 'auth_teosso', $headers));
        redirect($pluginconfig->signin_error_url);
    } else {
        // in theory we only need acct_id at this point - we should retrieve the user record to get the username via idnumber
        if (!($user = get_record('user', 'idnumber', $attributes[$attrmap['idnumber']]))) {
            // must be a new user
            if (!empty($attributes[$attrmap['username']])) {
                $attributes['username'] = $attributes[$attrmap['username']];
            } else {
                add_to_log(0, 'login', 'error', '/auth/teosso/index.php', get_string('username_error', 'auth_teosso', $headers));
                redirect($pluginconfig->signin_error_url);
            }
        } else {
            // user must use the auth type teosso or authenticate_user_login() will fail
            if ($user->auth != 'teosso') {
                add_to_log(0, 'login', 'error', '/auth/teosso/index.php', get_string('user_auth_type_error', 'auth_teosso', $headers));
                redirect($pluginconfig->signin_error_url);
            }
            // because we want to retain acct_id as the master ID
            // we need to modify idnumber on mdl_user NOW - so it all lines up later
            if (isset($attributes[$attrmap['username']]) && $user->username != $attributes[$attrmap['username']]) {
                if (!set_field('user', 'username', $attributes[$attrmap['username']], 'id', $user->id)) {
                    print_error('usernameupdatefailed', 'auth_teosso');
                }
                $attributes['username'] = $attributes[$attrmap['username']];
            } else {
                $attributes['username'] = $user->username;
            }
        }
        // Valid session. Register or update user in Moodle, log him on, and redirect to Moodle front
        // we require the plugin to know that we are now doing a teosso login in hook puser_login
        $GLOBALS['teosso_login'] = TRUE;
        // make variables accessible to teosso->get_userinfo. Information will be requested from authenticate_user_login -> create_user_record / update_user_record
        $GLOBALS['teosso_login_attributes'] = $attributes;
        // just passes time as a password. User will never log in directly to moodle with this password anyway or so we hope?
        $USER = authenticate_user_login($attributes['username'], time());
        $USER->loggedin = true;
        $USER->site = $CFG->wwwroot;
        update_user_login_times();
        if ($pluginconfig->notshowusername) {
            // Don't show username on login page
            set_moodle_cookie('nobody');
        }
        set_login_session_preferences();
        add_to_log(SITEID, 'user', 'login', "view.php?id={$USER->id}&course=" . SITEID, $USER->id, 0, $USER->id);
        check_enrolment_plugins($USER);
        load_all_capabilities();
        // just fast copied this from some other module - might not work...
        if (isset($SESSION->wantsurl) and strpos($SESSION->wantsurl, $CFG->wwwroot) === 0) {
            $urltogo = $SESSION->wantsurl;
        } else {
            $urltogo = $CFG->wwwroot . '/';
        }
        unset($SESSION->wantsurl);
        redirect($urltogo);
    }
}

 /**
  * Enrols the current user in the specified course
  * NOTE: a side effect of this is that it logs-in the user
  * @param object $sloodle_course A {@link SloodleCourse} object setup for the necessary course. If null, then the {@link $_session} member is queried instead.
  * @param bool True if successful (or the user was already enrolled), or false otherwise
  * @access public
  */
 function enrol($sloodle_course = null)
 {
     global $USER, $CFG;
     // Attempt to log-in the user
     if (!$this->login()) {
         return false;
     }
     // Was course data provided?
     if (empty($sloodle_course)) {
         // No - attempt to get some from the Sloodle session
         if (empty($this->_session)) {
             return false;
         }
         if (empty($this->_session->course)) {
             return false;
         }
         $sloodle_course = $this->_session->course;
     }
     // NOTE: much of this stuff was lifted from the Moodle 1.8 "course/enrol.php" script
     // Fetch the Moodle course data, and a course context
     $course = $sloodle_course->get_course_object();
     if (!($context = get_context_instance(CONTEXT_COURSE, $course->id))) {
         return false;
     }
     // Ensure we have up-to-date capabilities for the current user
     load_all_capabilities();
     // Check if the user can view the course, and does not simply have guest access to it
     // (No point trying to enrol somebody if they are already enrolled!)
     if (has_capability('moodle/course:view', $context) && !has_capability('moodle/legacy:guest', $context, NULL, false)) {
         return true;
     }
     // Make sure auto-registration is enabled for this site/course, and that the controller (if applicable) is enabled
     if (!$sloodle_course->check_autoreg()) {
         return false;
     }
     // Can't enrol users on meta courses or the site course
     if ($course->metacourse || $course->id == SITEID) {
         return false;
     }
     // Is there an enrolment period in effect?
     if ($course->enrolperiod) {
         if ($roles = get_user_roles($context, $USER->id)) {
             foreach ($roles as $role) {
                 if ($role->timestart && $role->timestart >= time()) {
                     return false;
                 }
             }
         }
     }
     // Make sure the course is enrollable
     if (!$course->enrollable || $course->enrollable == 2 && $course->enrolstartdate > 0 && $course->enrolstartdate > time() || $course->enrollable == 2 && $course->enrolenddate > 0 && $course->enrolenddate <= time()) {
         return false;
     }
     // Finally, after all that, enrol the user
     if (!enrol_into_course($course, $USER, 'manual')) {
         return false;
     }
     // Everything seems fine
     // Log the auto-enrolment
     add_to_log($course->id, 'sloodle', 'update', '', 'auto-enrolment');
     return true;
 }

//.........这里部分代码省略.........
        $index->setAttributes(XMLDB_INDEX_NOTUNIQUE, array('idnumber', 'course'));
        /// Launch add index idnumber-course
        $result = $result && add_index($table, $index);
        /// Define index idnumber-courseid (not unique) to be added to grade_items
        $table = new XMLDBTable('grade_items');
        $index = new XMLDBIndex('idnumber-courseid');
        $index->setAttributes(XMLDB_INDEX_NOTUNIQUE, array('idnumber', 'courseid'));
        /// Launch add index idnumber-courseid
        $result = $result && add_index($table, $index);
        upgrade_main_savepoint($result, 2007090600);
    }
    /// Create the permanent context_temp table to be used by build_context_path()
    if ($result && $oldversion < 2007092001) {
        /// Define table context_temp to be created
        $table = new XMLDBTable('context_temp');
        /// Adding fields to table context_temp
        $table->addFieldInfo('id', XMLDB_TYPE_INTEGER, '10', XMLDB_UNSIGNED, XMLDB_NOTNULL, null, null, null, null);
        $table->addFieldInfo('path', XMLDB_TYPE_CHAR, '255', null, XMLDB_NOTNULL, null, null, null, null);
        $table->addFieldInfo('depth', XMLDB_TYPE_INTEGER, '2', XMLDB_UNSIGNED, XMLDB_NOTNULL, null, null, null, null);
        /// Adding keys to table context_temp
        $table->addKeyInfo('primary', XMLDB_KEY_PRIMARY, array('id'));
        /// Launch create table for context_temp
        $result = $result && create_table($table);
        /// make sure category depths, parents and paths are ok, categories from 1.5 may not be properly initialized (MDL-12585)
        upgrade_fix_category_depths();
        /// Recalculate depths, paths and so on
        if (!empty($CFG->rolesactive)) {
            cleanup_contexts();
            // make sure all course, category and user contexts exist - we need it for grade letter upgrade, etc.
            create_contexts(CONTEXT_COURSE, false, true);
            create_contexts(CONTEXT_USER, false, true);
            // we need all contexts path/depths filled properly
            build_context_path(true, true);
            load_all_capabilities();
        } else {
            // upgrade from 1.6 - build all contexts
            create_contexts(null, true, true);
        }
        upgrade_main_savepoint($result, 2007092001);
    }
    /**
     * Merging of grade_grades_text back into grade_grades
     */
    if ($result && $oldversion < 2007092002) {
        /// Define field feedback to be added to grade_grades
        $table = new XMLDBTable('grade_grades');
        $field = new XMLDBField('feedback');
        $field->setAttributes(XMLDB_TYPE_TEXT, 'medium', null, null, null, null, null, null, 'excluded');
        if (!field_exists($table, $field)) {
            /// Launch add field feedback
            $result = $result && add_field($table, $field);
        }
        /// Define field feedbackformat to be added to grade_grades
        $table = new XMLDBTable('grade_grades');
        $field = new XMLDBField('feedbackformat');
        $field->setAttributes(XMLDB_TYPE_INTEGER, '10', XMLDB_UNSIGNED, XMLDB_NOTNULL, null, null, null, '0', 'feedback');
        if (!field_exists($table, $field)) {
            /// Launch add field feedbackformat
            $result = $result && add_field($table, $field);
        }
        /// Define field information to be added to grade_grades
        $table = new XMLDBTable('grade_grades');
        $field = new XMLDBField('information');
        $field->setAttributes(XMLDB_TYPE_TEXT, 'medium', null, null, null, null, null, null, 'feedbackformat');
        if (!field_exists($table, $field)) {
            /// Launch add field information

/**
 * Setup $USER object - called during login, loginas, etc.
 * Preloads capabilities and checks enrolment plugins
 *
 * @param stdClass $user full user record object
 * @return void
 */
function session_set_user($user)
{
    $_SESSION['USER'] = $user;
    unset($_SESSION['USER']->description);
    // conserve memory
    if (!isset($_SESSION['USER']->access)) {
        // check enrolments and load caps only once
        enrol_check_plugins($_SESSION['USER']);
        load_all_capabilities();
    }
    sesskey();
    // init session key
}

//.........这里部分代码省略.........
        $this->assertFalse(has_capability('mod/page:view', $frontpagepagecontext, $guestid));
        $this->assertTrue(has_capability('mod/page:view', $frontpagecontext, $guestid));
        $this->assertFalse(has_capability('mod/page:view', $systemcontext, $guestid));

        $this->assertFalse(has_capability('moodle/block:view', $frontpageblockcontext, 0));
        $this->assertFalse(has_capability('mod/page:view', $frontpagepagecontext, 0));
        $this->assertTrue(has_capability('mod/page:view', $frontpagecontext, 0));
        $this->assertFalse(has_capability('mod/page:view', $systemcontext, 0));

        $this->assertFalse(has_capability('moodle/course:create', $systemcontext, $testusers[11]));
        $this->assertTrue(has_capability('moodle/course:create', context_coursecat::instance($testcategories[2]), $testusers[11]));
        $this->assertFalse(has_capability('moodle/course:create', context_course::instance($testcourses[1]), $testusers[11]));
        $this->assertTrue(has_capability('moodle/course:create', context_course::instance($testcourses[19]), $testusers[11]));

        $this->assertFalse(has_capability('moodle/course:update', context_course::instance($testcourses[1]), $testusers[9]));
        $this->assertFalse(has_capability('moodle/course:update', context_course::instance($testcourses[19]), $testusers[9]));
        $this->assertFalse(has_capability('moodle/course:update', $systemcontext, $testusers[9]));

        // Test the list of enrolled users
        $coursecontext = context_course::instance($course1->id);
        $enrolled = get_enrolled_users($coursecontext);
        $this->assertEquals(count($enrolled), 10);
        for($i=0; $i<10; $i++) {
            $this->assertTrue(isset($enrolled[$testusers[$i]]));
        }
        $enrolled = get_enrolled_users($coursecontext, 'moodle/course:update');
        $this->assertEquals(count($enrolled), 1);
        $this->assertTrue(isset($enrolled[$testusers[9]]));
        unset($enrolled);

        // role switching
        $userid = $testusers[9];
        $USER = $DB->get_record('user', array('id'=>$userid));
        load_all_capabilities();
        $coursecontext = context_course::instance($course1->id);
        $this->assertTrue(has_capability('moodle/course:update', $coursecontext));
        $this->assertFalse(is_role_switched($course1->id));
        role_switch($allroles['student'], $coursecontext);
        $this->assertTrue(is_role_switched($course1->id));
        $this->assertEquals($USER->access['rsw'][$coursecontext->path],  $allroles['student']);
        $this->assertFalse(has_capability('moodle/course:update', $coursecontext));
        reload_all_capabilities();
        $this->assertFalse(has_capability('moodle/course:update', $coursecontext));
        role_switch(0, $coursecontext);
        $this->assertTrue(has_capability('moodle/course:update', $coursecontext));
        $userid = $adminid;
        $USER = $DB->get_record('user', array('id'=>$userid));
        load_all_capabilities();
        $coursecontext = context_course::instance($course1->id);
        $blockcontext = context_block::instance($block1->id);
        $this->assertTrue(has_capability('moodle/course:update', $blockcontext));
        role_switch($allroles['student'], $coursecontext);
        $this->assertEquals($USER->access['rsw'][$coursecontext->path],  $allroles['student']);
        $this->assertFalse(has_capability('moodle/course:update', $blockcontext));
        reload_all_capabilities();
        $this->assertFalse(has_capability('moodle/course:update', $blockcontext));
        load_all_capabilities();
        $this->assertTrue(has_capability('moodle/course:update', $blockcontext));

        // temp course role for enrol
        $DB->delete_records('cache_flags', array()); // this prevents problem with dirty contexts immediately resetting the temp role - this is a known problem...
        $userid = $testusers[5];
        $roleid = $allroles['editingteacher'];
        $USER = $DB->get_record('user', array('id'=>$userid));
        load_all_capabilities();
        $coursecontext = context_course::instance($course1->id);

/**
 * Removes multiple role assignments, parameters may contain:
 *   'roleid', 'userid', 'contextid', 'component', 'enrolid'.
 *
 * @param array $params role assignment parameters
 * @param bool $subcontexts unassign in subcontexts too
 * @param bool $includmanual include manual role assignments too
 * @return void
 */
function role_unassign_all(array $params, $subcontexts = false, $includemanual = false)
{
    global $USER, $CFG, $DB;
    if (!$params) {
        throw new coding_exception('Missing parameters in role_unsassign_all() call');
    }
    $allowed = array('roleid', 'userid', 'contextid', 'component', 'itemid');
    foreach ($params as $key => $value) {
        if (!in_array($key, $allowed)) {
            throw new coding_exception('Unknown role_unsassign_all() parameter key', 'key:' . $key);
        }
    }
    if (isset($params['component']) and $params['component'] !== '' and strpos($params['component'], '_') === false) {
        throw new coding_exception('Invalid component