diff --git a/plugins/cue_points/quiz/errors/KalturaQuizErrors.php b/plugins/cue_points/quiz/errors/KalturaQuizErrors.php index 300128a59dd..6fd6361aff9 100644 --- a/plugins/cue_points/quiz/errors/KalturaQuizErrors.php +++ b/plugins/cue_points/quiz/errors/KalturaQuizErrors.php @@ -16,6 +16,4 @@ class KalturaQuizErrors extends KalturaErrors const NO_SUCH_FILE_TYPE = 'NO_SUCH_FILE_TYPE;;Document cannot be provided. No such file type'; const QUIZ_CANNOT_BE_DOWNLOAD = 'QUIZ_CANNOT_BE_DOWNLOAD;;Quiz cannot be download'; const QUIZ_USER_ENTRY_ALREADY_EXISTS = 'QUIZ_USER_ENTRY_ALREADY_EXISTS;ENTRY_ID;A quiz user-entry for the given user-id and entry-id [@ENTRY_ID@] already exists, cannot create duplicate'; - const NOT_ENTITLED_TO_INSERT_UPDATE = "NOT_ENTITLED_TO_INSERT_UPDATE;;Current User is not entitled to insert or update the quiz"; - } diff --git a/plugins/cue_points/quiz/lib/api/KalturaQuizUserEntry.php b/plugins/cue_points/quiz/lib/api/KalturaQuizUserEntry.php index 82ea33c4ae0..6df77a06504 100644 --- a/plugins/cue_points/quiz/lib/api/KalturaQuizUserEntry.php +++ b/plugins/cue_points/quiz/lib/api/KalturaQuizUserEntry.php @@ -81,25 +81,26 @@ public function validateForInsert($propertiesToSkip = array()) if(!QuizPlugin::isQuiz($this->entryId)) throw new KalturaAPIException(KalturaQuizErrors::PROVIDED_ENTRY_IS_NOT_A_QUIZ, $this->entryId); parent::validateForInsert($propertiesToSkip); - if (!$this->validateEntitledKuser()) - throw new KalturaAPIException(KalturaQuizErrors::NOT_ENTITLED_TO_INSERT_UPDATE); + $dbEntry = entryPeer::retrieveByPK($this->entryId); + if ($this->feedback != null && !kEntitlementUtils::isEntitledForEditEntry($dbEntry) ) + { + KalturaLog::debug('Insert feedback on quiz is allowed only with admin KS or entry owner or co-editor'); + throw new KalturaAPIException(KalturaErrors::INVALID_USER_ID); + } } public function validateForUpdate($sourceObject, $propertiesToSkip = array()) { - if (!$this->validateEntitledKuser()) - throw new KalturaAPIException(KalturaQuizErrors::NOT_ENTITLED_TO_INSERT_UPDATE); + $dbEntry = entryPeer::retrieveByPK($this->entryId); + if ( !kEntitlementUtils::isEntitledForEditEntry($dbEntry) ) + { + KalturaLog::debug('Update quiz allowed only with admin KS or entry owner or co-editor'); + throw new KalturaAPIException(KalturaErrors::INVALID_USER_ID); + } return parent::validateForUpdate($sourceObject, $propertiesToSkip); } - public function validateEntitledKuser() - { - $entry = entryPeer::retrieveByPK($this->entryId); - $kuserId = kCurrentContext::getCurrentKsKuserId(); - return $entry->isEntitledKuserEdit($kuserId); - } - protected function validateEntryId() { //do nothing - already validating in QuizPlugin::isQuiz