Index: /main/waeup.uniben/trunk/CHANGES.txt
===================================================================
--- /main/waeup.uniben/trunk/CHANGES.txt	(revision 12854)
+++ /main/waeup.uniben/trunk/CHANGES.txt	(revision 12855)
@@ -4,4 +4,8 @@
 1.2dev (unreleased)
 ===================
+
+* Students are only allowed to download course registration slips if they are
+  in state 'registered' and their current level corresponds with the course
+  registration level.
 
 * Add second New Postgraduate Programmes (#2) application type and category.
Index: /main/waeup.uniben/trunk/src/waeup/uniben/students/browser.py
===================================================================
--- /main/waeup.uniben/trunk/src/waeup/uniben/students/browser.py	(revision 12854)
+++ /main/waeup.uniben/trunk/src/waeup/uniben/students/browser.py	(revision 12855)
@@ -255,4 +255,10 @@
         'level_verdict', 'gpa')
 
+    def update(self):
+        if self.context.student.state != REGISTERED \
+            or self.context.student.current_level != self.context.level:
+            self.flash(_('Forbidden'), type="warning")
+            self.redirect(self.url(self.context))
+
     @property
     def tabletitle(self):
Index: /main/waeup.uniben/trunk/src/waeup/uniben/students/tests/test_browser.py
===================================================================
--- /main/waeup.uniben/trunk/src/waeup/uniben/students/tests/test_browser.py	(revision 12854)
+++ /main/waeup.uniben/trunk/src/waeup/uniben/students/tests/test_browser.py	(revision 12855)
@@ -366,9 +366,4 @@
         self.browser.getLink("COURSE1").click()
         self.assertFalse('Score' in self.browser.contents)
-        # Students can open the customized pdf course registration slip
-        self.browser.open(self.student_path + '/studycourse/100')
-        self.browser.getLink("Download course registration slip").click()
-        self.assertEqual(self.browser.headers['Status'], '200 Ok')
-        self.assertEqual(self.browser.headers['Content-Type'], 'application/pdf')
         # Students can open the special Uniben pdf course result slip
         self.browser.open(self.student_path + '/studycourse/100')
@@ -384,4 +379,14 @@
         self.browser.getControl("Remove selected", index=0).click()
         self.assertTrue('Successfully removed' in self.browser.contents)
+        # Students can open the customized pdf course registration slip
+        # if they have registered their course list
+        self.browser.open(
+            self.student_path + '/studycourse/100/course_registration_slip.pdf')
+        self.assertTrue('Forbidden' in self.browser.contents)
+        IWorkflowState(self.student).setState('courses registered')
+        self.browser.open(self.student_path + '/studycourse/100')
+        self.browser.getLink("Download course registration slip").click()
+        self.assertEqual(self.browser.headers['Status'], '200 Ok')
+        self.assertEqual(self.browser.headers['Content-Type'], 'application/pdf')
 
     def test_get_returning_data(self):
Index: /main/waeup.uniben/trunk/src/waeup/uniben/students/viewlets.py
===================================================================
--- /main/waeup.uniben/trunk/src/waeup/uniben/students/viewlets.py	(revision 12854)
+++ /main/waeup.uniben/trunk/src/waeup/uniben/students/viewlets.py	(revision 12855)
@@ -18,5 +18,5 @@
 
 import grok
-from waeup.kofa.interfaces import REQUESTED
+from waeup.kofa.interfaces import REQUESTED, REGISTERED
 from waeup.kofa.browser.viewlets import ManageActionButton
 from waeup.uniben.students.interfaces import (
@@ -44,4 +44,23 @@
             return self.view.url(self.view.context, self.target)
         return False
+
+class CourseRegistrationSlipActionButton(ManageActionButton):
+    grok.order(5)
+    grok.context(ICustomStudentStudyLevel)
+    grok.view(StudyLevelDisplayFormPage)
+    grok.require('waeup.viewStudent')
+    icon = 'actionicon_pdf.png'
+    text = _('Download course registration slip')
+    target = 'course_registration_slip.pdf'
+
+    @property
+    def target_url(self):
+        is_current = self.context.__parent__.is_current
+        if not is_current:
+            return ''
+        if self.context.student.state != REGISTERED \
+            or self.context.student.current_level != self.context.level:
+            return ''
+        return self.view.url(self.view.context, self.target)
 
 class CourseResultSlipActionButton(ManageActionButton):
