Skip to content

Possible authorization logic bug in assignments#show #29

@s-edwards

Description

@s-edwards

The assignments#show action requires the current user to have edit access to all offerings of the currrent assignment, or a CanCan exception will be thrown. But what if an instructor for this term's offering of course X is not an instructor for other (older) offerings of course X, and so does not have edit access to assignment offerings under those prior course offerings? This appears to make assignments created by earlier instructors unusable/uneditable by a new instructor?

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions