Timetable
block_timetable
A block that shows the current user's calendar events for today, this week or the upcoming days, in a course or on the dashboard. Users can switch views, days and pages through an AJAX fragment, and open the core calendar's event summary from the block.
No security, code-quality or compliance defects were found after reading every PHP, JavaScript and Mustache file and checking each relied-upon core API against the Moodle source.
- Access control on the AJAX fragment is complete. Core's
get_fragmentcallsvalidate_context(), which runsrequire_login()for the block's context. The plugin then checks that the context is a block context belonging to a Timetable block, requiresmoodle/block:view, and checks the user-suppliedcourseidwithcan_access_course(..., true), which follows the same rules asrequire_login(). - Data scope is safe. Events always come from
calendar_information::create()plus core's own filters for the current user, so a tampered request can only ever return the caller's own events. - Output is safe. The values the templates print unescaped (
name,source,formattedtime) are formatted by core's calendar exporters (PARAM_TEXTproperties go throughformat_string), and core's calendar templates print them the same way. - Coding conventions are followed. The Privacy API is implemented, the strings are in language files, and the
MOODLE_INTERNALguards appear only where needed. The plugin also ships PHPUnit and Behat tests that cover the access-control paths.
block_timetable is a small block plugin (about 650 lines of PHP, one AMD module and four Mustache templates) that shows the current user's calendar events for today, this week or the upcoming days. It builds on core calendar APIs: calendar_information, core_calendar\local\api::get_events() and calendar_upcoming_exporter. It uses a core/fragment callback to switch views and pages without reloading the page.
The security posture is strong. The fragment callback goes beyond the context check core already does: it confirms the block context belongs to a Timetable block, requires moodle/block:view, and checks the user-supplied course id with can_access_course() limited to active enrolments. All other parameters go through clean_param() and are then checked against allow-lists or clamped. Events are always the caller's own, filtered the same way core's calendar view filters them, so changing request parameters exposes nothing new. The unescaped template variables hold values that core's exporters have already passed through format_string.
No findings are reported. The plugin uses no direct SQL, file access, outbound HTTP or shell calls, and it ships no third-party libraries. It includes PHPUnit and Behat coverage of its access-control rules.
Findings
Optional tool_timetable integration. If the separate tool_timetable admin tool is installed, block_timetable::get_content() and the edit form hand over rendering and extra form fields to \tool_timetable\blocktimetable. That tool is not in this repository or in core, so the content it produces was not reviewed. The block passes it only the block configuration, page context, instance id, course id and its own main renderable. No security check is delegated to it.
Unescaped template variables are intentional and safe. templates/event.mustache prints {{{name}}}, {{{source}}} and {{{formattedtime}}} unescaped. Each value comes from core's calendar exporters (PARAM_TEXT properties formatted via \core_external\util::format_string, groupname via format_string, and formattedtime rendered by the calendar renderer), and core's own upcoming_mini.mustache prints them the same way.