Changeset 12853

Timestamp:

13 Apr 2015, 11:25:52 (10 years ago)

Author:

Henrik Bettermann

Message:

Students are only allowed to download course registration slips if they are
in state 'registered' and their current level corresponds with the course
registration level.

Location:

main/waeup.kofa/trunk

Files:

• CHANGES.txt (modified) (1 diff)
• src/waeup/kofa/students/browser.py (modified) (1 diff)
• src/waeup/kofa/students/tests/test_browser.py (modified) (2 diffs)
• src/waeup/kofa/students/viewlets.py (modified) (1 diff)

main/waeup.kofa/trunk/CHANGES.txt

@@ -4 +4 @@
 1.3.2.dev0 (unreleased)
 =======================
+
+* Students are only allowed to download course registration slips if they are
+  in state 'registered' and their current level corresponds with the course
+  registration level.
 
 * Add ReportsManager role.

main/waeup.kofa/trunk/src/waeup/kofa/students/browser.py

@@ -1359 +1359 @@
         'adm_code', 'sex', 'suspended_comment', 'current_level')
 
+
+    def update(self):
+        if self.context.student.state != REGISTERED \
+            or self.context.student.current_level != self.context.level:
+            self.flash(_('Forbidden'), type="warning")
+            self.redirect(self.url(self.context))
+
     @property
     def title(self):

main/waeup.kofa/trunk/src/waeup/kofa/students/tests/test_browser.py

@@ -2478 +2478 @@
         self.assertTrue(
             self.student['studycourse']['200']['COURSE1'].carry_over is True)
-        # Students can open the pdf course registration slip
-        self.browser.open(self.student_path + '/studycourse/200')
-        self.browser.getLink("Download course registration slip").click()
-        self.assertEqual(self.browser.headers['Status'], '200 Ok')
-        self.assertEqual(self.browser.headers['Content-Type'], 'application/pdf')
         # Students can remove course tickets
         self.browser.open(self.student_path + '/studycourse/200/edit')
@@ -2517 +2512 @@
         self.assertTrue('K1000000 - students.browser.StudyLevelEditFormPage - '
             'K1000000 - added: COURSE1|200|2004' in logcontent)
+        # Students can't open the pdf course registration slip right
+        self.assertFalse(
+            'Download course registration slip' in self.browser.contents)
+        self.browser.open(
+            self.student_path + '/studycourse/200/course_registration_slip.pdf')
+        self.assertTrue('Forbidden' in self.browser.contents)
         # Course list can be registered
+        self.browser.open(self.student_path + '/studycourse/200/edit')
         self.browser.getControl("Register course list").click()
         self.assertTrue('Course list has been registered' in self.browser.contents)
         self.assertEqual(self.student.state, 'courses registered')
+        # and students can open the pdf course registration slip right
+        self.browser.getLink("Download course registration slip").click()
+        self.assertEqual(self.browser.headers['Status'], '200 Ok')
+        self.assertEqual(self.browser.headers['Content-Type'], 'application/pdf')
+        # Students can't view the download link if current_session
+        # does not correspond with level_session.
+        self.student['studycourse'].current_level = 300
+        self.browser.open(self.student_path + '/studycourse/200/edit')
+        self.assertFalse(
+            'Download course registration slip' in self.browser.contents)
+        self.assertFalse(
+            'Download course registration slip' in self.browser.contents)
+        self.browser.open(
+            self.student_path + '/studycourse/200/course_registration_slip.pdf')
+        self.assertTrue('Forbidden' in self.browser.contents)
         # Students can view the transcript
         #self.browser.open(self.studycourse_path)

main/waeup.kofa/trunk/src/waeup/kofa/students/viewlets.py

@@ -453 +453 @@
         if not is_current:
             return ''
+        if self.context.student.state != REGISTERED \
+            or self.context.student.current_level != self.context.level:
+            return ''
         return self.view.url(self.view.context, self.target)