Skip to content
Permalink
Browse files
Fix work access for teachers and students
  • Loading branch information
jmontoyaa committed Apr 9, 2018
1 parent 0356a28 commit 00f3e4a6506035674a58ccdf4ebe098bd6f607e3
Showing with 2 additions and 2 deletions.
  1. +2 −2 main/work/work.lib.php
@@ -5197,10 +5197,10 @@ function getFileContents($id, $course_info, $sessionId = 0, $correction = false)
*/

$work_is_visible = $item_info['visibility'] == 1 && $row['accepted'] == 1;
$doc_visible_for_all = $course_info['show_score'] == 1;
$doc_visible_for_all = (int) $course_info['show_score'] === 0;

$is_editor = api_is_allowed_to_edit(true, true, true);
$student_is_owner_of_work = user_is_author($row['id'], $row['user_id']);
$student_is_owner_of_work = user_is_author($row['id'], api_get_user_id());

This comment has been minimized.

Copy link
@ywarnier

ywarnier Apr 9, 2018

Member

Here you are just forcing the user_id to be the one of the current user, but make sure that is not breaking it for the teacher/coach now (they also need access to the file).

This comment has been minimized.

Copy link
@jmontoyaa

jmontoyaa Apr 10, 2018

Author Member

The teacher/session coach will have access because of $is_editor = api_is_allowed_to_edit(true, true, true)

This comment has been minimized.

Copy link
@AngelFQC

AngelFQC Apr 10, 2018

Member

$student_is_owner_of_work should be $currentUserIsOwnerOfWork

This comment has been minimized.

Copy link
@jmontoyaa

jmontoyaa Apr 10, 2018

Author Member

This was a bug fix, not a format code commit.


if ($is_editor ||
$student_is_owner_of_work ||

0 comments on commit 00f3e4a

Please sign in to comment.