HEEDLS-438 Fix user permissions for course admin fields pages #616
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
DigitalLearningSolutions.Data.Tests/Services/CourseServiceTests.cs
Outdated
Show resolved
Hide resolved
livzorn
force-pushed
the
HEEDLS-438-add-course-admin-fields
branch
from
b6c9e4b to
6f0e6f5
Compare
DanBloxham-sw
approved these changes
Sep 24, 2021
stellake
reviewed
Sep 24, 2021
DigitalLearningSolutions.Web/Controllers/TrackingSystem/CourseSetup/AdminFieldsController.cs
Show resolved
Hide resolved
DigitalLearningSolutions.Web/Controllers/TrackingSystem/CourseSetup/AdminFieldsController.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Web/Controllers/TrackingSystem/CourseSetup/AdminFieldsController.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Web/Controllers/TrackingSystem/CourseSetup/AdminFieldsController.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Data.Tests/Services/CourseServiceTests.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Data/DataServices/CourseDataService.cs
Outdated
Show resolved
Hide resolved
livzorn
force-pushed
the
HEEDLS-438-add-course-admin-fields
branch
from
6f0e6f5 to
9b75755
Compare
stellake
suggested changes
Sep 30, 2021
DigitalLearningSolutions.Data.Tests/DataServices/CourseDataServiceTests.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Data.Tests/Services/CourseServiceTests.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Data/DataServices/CourseDataService.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Data/DataServices/CourseDataService.cs
Outdated
Show resolved
Hide resolved
...gSolutions.Web.AutomatedUiTests/AccessibilityTests/AddCourseAdminFieldsAccessibilityTests.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Web.Tests/ServiceFilter/VerifyAdminUserCanAccessCourseTests.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Web.Tests/ServiceFilter/VerifyAdminUserCanAccessCourseTests.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Web/Controllers/TrackingSystem/CourseSetup/AdminFieldsController.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Web/Controllers/TrackingSystem/CourseSetup/AdminFieldsController.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Web/Controllers/TrackingSystem/CourseSetup/AdminFieldsController.cs
Show resolved
Hide resolved
stellake
reviewed
Oct 1, 2021
...Solutions.Web.AutomatedUiTests/AccessibilityTests/EditCourseAdminFieldsAccessibilityTests.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Web.Tests/ServiceFilter/VerifyAdminUserCanAccessCourseTests.cs
Outdated
Show resolved
Hide resolved
...alLearningSolutions.Web/Views/TrackingSystem/CourseSetup/AdminFields/RemoveAdminField.cshtml
Outdated
Show resolved
Hide resolved
added 14 commits
October 1, 2021 11:26
…ge data service method for Service Filter to return a bool
livzorn
force-pushed
the
HEEDLS-438-add-course-admin-fields
branch
from
0cd569e to
b70791e
Compare
stellake
approved these changes
Oct 1, 2021
DigitalLearningSolutions.Web.Tests/ServiceFilter/VerifyAdminUserCanAccessCourseTests.cs
Outdated
Show resolved
Hide resolved
DigitalLearningSolutions.Web/Controllers/TrackingSystem/CourseSetup/AdminFieldsController.cs
Outdated
Show resolved
Hide resolved
...alLearningSolutions.Web/Views/TrackingSystem/CourseSetup/AdminFields/RemoveAdminField.cshtml
Show resolved
Hide resolved
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
JIRA link
HEEDLS-438
Description
Added a check in AdminFieldsController that verifies the user can access the selected course on the following pages: Manage admin fields, Edit admin field, Configure answers in bulk (in edit and add journeys), Remove admin field, and Add admin field. Only AdminUsers with the correct CentreID and CategoryID should be able to access these pages. This means that they have the same CentreID as the customisation, and either have the same CategoryID as the customisation's course category OR CategoryID = 0, which means they can manage all courses. If a customisationID that the user cannot access is entered in the url they should be directed to a NotFound page.
I also fixed the capitalization of the (ViewData["Title"]) on all the course admin fields pages.
Screenshots
Developer checks
I have: