diff --git a/lib/WeBWorK3/Hooks.pm b/lib/WeBWorK3/Hooks.pm index 9752a8b8..89ada1dc 100644 --- a/lib/WeBWorK3/Hooks.pm +++ b/lib/WeBWorK3/Hooks.pm @@ -63,9 +63,12 @@ our $check_permission = sub ($next, $c, $action, $) { $user = { %$user, $course_user->get_inflated_columns }; } + # most routes use user_id as a parameter, but one uses 'user' instead. + my $user_id = $c->stash('user_id') // $c->stash('user'); + if ($c->req->url->to_string =~ /\/api/x) { # don't consult the permission table if a user is requesting their own information - my $userRequestingOwnInfo = ($c->stash('user_id') && $user->{user_id} == $c->stash('user_id')) ? 1 : 0; + my $userRequestingOwnInfo = ($user_id && $user->{user_id} == $user_id) ? 1 : 0; if ($userRequestingOwnInfo || has_permission($user, $c->perm_table->{ $c->{stash}{controller} }{ $c->{stash}{action} })) diff --git a/src/common/views.ts b/src/common/views.ts index 8eb59648..7ff09f1a 100644 --- a/src/common/views.ts +++ b/src/common/views.ts @@ -49,6 +49,13 @@ export const student_views: Array = [ ]; export const instructor_views: Array = [ + { + name: 'Dashboard', + component_name: 'Dashboard', + icon: 'speed', + route: 'dashboard', + sidebars: [] + }, { name: 'Calendar', component_name: 'Calendar', diff --git a/src/components/common/UserCourses.vue b/src/components/common/UserCourses.vue index e3990417..041e495c 100644 --- a/src/components/common/UserCourses.vue +++ b/src/components/common/UserCourses.vue @@ -41,7 +41,7 @@