Project: moodle
Issue MDL-52229: Handle hidden templates/frameworks when linking competencies
When a user is building a framework they can set their framework as hidden, in which case it will not show up in the different areas where a framework can be picked to then select some of its competencies. The same applies to templates, when the template is hidden it can not be selected to create a plan from that template. There is no security risks attached to this issue, which means that the functions listing the frameworks and templates use an optional argument to filter out the invisible template/frameworks. Everyone can list hidden frameworks/templates but the UI will only display the relevant ones (visible). Crafting a request will report the hidden frameworks/templates, and that's fine. However, the methods that are linking competencies to a framework/template should first check that the competency is not part of a hidden framework, in which case it cannot be linked. The method creating a plan from a template will perform the same check to ensure that the template is visible. Note that if a framework/template is hidden after the competency/plan was created nothing happens. The hidden option is just there to act as a draft/archived flag to only display the relevant options in the UI. If the competency/plan was already created then it remains visible regardless of the status of its origin. At a later stage we may decide to rename _visible_ to something more relevant. Or to have a _status_ on the framework/template (draft, active, archived). In that case a framework/template would have to be made "Active" to be visible in the relevant UI, and it could not be sent back as draft when used. Later maybe.
Story points: 3