Index: main/waeup.kofa/trunk/CHANGES.txt
===================================================================
--- main/waeup.kofa/trunk/CHANGES.txt	(revision 12852)
+++ main/waeup.kofa/trunk/CHANGES.txt	(revision 12853)
@@ -4,4 +4,8 @@
 1.3.2.dev0 (unreleased)
 =======================
+
+* Students are only allowed to download course registration slips if they are
+  in state 'registered' and their current level corresponds with the course
+  registration level.
 
 * Add ReportsManager role.
Index: main/waeup.kofa/trunk/src/waeup/kofa/students/browser.py
===================================================================
--- main/waeup.kofa/trunk/src/waeup/kofa/students/browser.py	(revision 12852)
+++ main/waeup.kofa/trunk/src/waeup/kofa/students/browser.py	(revision 12853)
@@ -1359,4 +1359,11 @@
         'adm_code', 'sex', 'suspended_comment', 'current_level')
 
+
+    def update(self):
+        if self.context.student.state != REGISTERED \
+            or self.context.student.current_level != self.context.level:
+            self.flash(_('Forbidden'), type="warning")
+            self.redirect(self.url(self.context))
+
     @property
     def title(self):
Index: main/waeup.kofa/trunk/src/waeup/kofa/students/tests/test_browser.py
===================================================================
--- main/waeup.kofa/trunk/src/waeup/kofa/students/tests/test_browser.py	(revision 12852)
+++ main/waeup.kofa/trunk/src/waeup/kofa/students/tests/test_browser.py	(revision 12853)
@@ -2478,9 +2478,4 @@
         self.assertTrue(
             self.student['studycourse']['200']['COURSE1'].carry_over is True)
-        # Students can open the pdf course registration slip
-        self.browser.open(self.student_path + '/studycourse/200')
-        self.browser.getLink("Download course registration slip").click()
-        self.assertEqual(self.browser.headers['Status'], '200 Ok')
-        self.assertEqual(self.browser.headers['Content-Type'], 'application/pdf')
         # Students can remove course tickets
         self.browser.open(self.student_path + '/studycourse/200/edit')
@@ -2517,8 +2512,30 @@
         self.assertTrue('K1000000 - students.browser.StudyLevelEditFormPage - '
             'K1000000 - added: COURSE1|200|2004' in logcontent)
+        # Students can't open the pdf course registration slip right
+        self.assertFalse(
+            'Download course registration slip' in self.browser.contents)
+        self.browser.open(
+            self.student_path + '/studycourse/200/course_registration_slip.pdf')
+        self.assertTrue('Forbidden' in self.browser.contents)
         # Course list can be registered
+        self.browser.open(self.student_path + '/studycourse/200/edit')
         self.browser.getControl("Register course list").click()
         self.assertTrue('Course list has been registered' in self.browser.contents)
         self.assertEqual(self.student.state, 'courses registered')
+        # and students can open the pdf course registration slip right
+        self.browser.getLink("Download course registration slip").click()
+        self.assertEqual(self.browser.headers['Status'], '200 Ok')
+        self.assertEqual(self.browser.headers['Content-Type'], 'application/pdf')
+        # Students can't view the download link if current_session
+        # does not correspond with level_session.
+        self.student['studycourse'].current_level = 300
+        self.browser.open(self.student_path + '/studycourse/200/edit')
+        self.assertFalse(
+            'Download course registration slip' in self.browser.contents)
+        self.assertFalse(
+            'Download course registration slip' in self.browser.contents)
+        self.browser.open(
+            self.student_path + '/studycourse/200/course_registration_slip.pdf')
+        self.assertTrue('Forbidden' in self.browser.contents)
         # Students can view the transcript
         #self.browser.open(self.studycourse_path)
Index: main/waeup.kofa/trunk/src/waeup/kofa/students/viewlets.py
===================================================================
--- main/waeup.kofa/trunk/src/waeup/kofa/students/viewlets.py	(revision 12852)
+++ main/waeup.kofa/trunk/src/waeup/kofa/students/viewlets.py	(revision 12853)
@@ -453,4 +453,7 @@
         if not is_current:
             return ''
+        if self.context.student.state != REGISTERED \
+            or self.context.student.current_level != self.context.level:
+            return ''
         return self.view.url(self.view.context, self.target)
 
