Permalink
Browse files

Fix work access for teachers and students

  • Loading branch information...
jmontoyaa committed Apr 9, 2018
1 parent 0356a28 commit 00f3e4a6506035674a58ccdf4ebe098bd6f607e3
Showing with 2 additions and 2 deletions.
  1. +2 −2 main/work/work.lib.php
@@ -5197,10 +5197,10 @@ function getFileContents($id, $course_info, $sessionId = 0, $correction = false)
*/
$work_is_visible = $item_info['visibility'] == 1 && $row['accepted'] == 1;
$doc_visible_for_all = $course_info['show_score'] == 1;
$doc_visible_for_all = (int) $course_info['show_score'] === 0;
$is_editor = api_is_allowed_to_edit(true, true, true);
$student_is_owner_of_work = user_is_author($row['id'], $row['user_id']);
$student_is_owner_of_work = user_is_author($row['id'], api_get_user_id());

This comment has been minimized.

@ywarnier

ywarnier Apr 9, 2018

Member

Here you are just forcing the user_id to be the one of the current user, but make sure that is not breaking it for the teacher/coach now (they also need access to the file).

This comment has been minimized.

@jmontoyaa

jmontoyaa Apr 10, 2018

Member

The teacher/session coach will have access because of $is_editor = api_is_allowed_to_edit(true, true, true)

This comment has been minimized.

@AngelFQC

AngelFQC Apr 10, 2018

Member

$student_is_owner_of_work should be $currentUserIsOwnerOfWork

This comment has been minimized.

@jmontoyaa

jmontoyaa Apr 10, 2018

Member

This was a bug fix, not a format code commit.

if ($is_editor ||
$student_is_owner_of_work ||

0 comments on commit 00f3e4a

Please sign in to comment.