Index: /WAeUP_SRP/trunk/skins/waeup_ois/getLecturerCourseResults.py
===================================================================
--- /WAeUP_SRP/trunk/skins/waeup_ois/getLecturerCourseResults.py	(revision 3818)
+++ /WAeUP_SRP/trunk/skins/waeup_ois/getLecturerCourseResults.py	(revision 3818)
@@ -0,0 +1,59 @@
+## Script (Python) "getLecturerCourseResultsInfo"
+##bind container=container
+##bind context=context
+##bind namespace=
+##bind script=script
+##bind subpath=traverse_subpath
+##parameters=course_id
+##title=
+##
+# $Id: getCoursesInfo.py 3482 2008-05-01 05:54:53Z henrik $
+"""
+return Info about the Courses
+"""
+
+mtool = context.portal_membership
+member = mtool.getAuthenticatedMember()
+lec_id = member_id = str(member)
+if mtool.isAnonymousUser():
+    return None
+
+
+request = context.REQUEST
+
+path_info = request.get('PATH_INFO').split('/')
+
+info = {}
+info['lec_id'] = lec_id
+info['course_id'] = course_id
+
+res = context.course_results(code=course_id)
+items = [ brain for brain in res]
+rows = []
+for r in items:
+    row = {}
+    if r['carry_over']:
+        row['carry_over'] =  'CO'
+    else:
+        row['carry_over'] =  ''
+    row['credits'] =  r['credits']
+    row['session_id'] =  r['session_id']
+    row['level_id'] =  level_id = r['level_id']
+    #row['score'] =  r['score']
+    row['student_id'] = student_id = r['student_id']
+    
+    student_record = context.students_catalog.getRecordByKey(student_id)
+    row['student_record'] = context.getFormattedStudentEntry(student_record)
+    row['url'] = "%s/campus/students/%s/study_course/%s" % (context.portal_url(),student_id,level_id)
+    
+    row['editable'] = not (r['ca1'] and r['ca2'] and r['atl'] and r['exam']) and row['student_record']['review_state'] == 'courses_validated'
+    row['sort_dummy'] = row['student_record']['review_state']
+    rows.append(row)
+    
+rows.sort(cmp=lambda x,y: cmp("%(session_id)s%(sort_dummy)s" % x,
+                              "%(session_id)s%(sort_dummy)s" % y))    
+info['students'] = rows
+
+return context.lecturer_students_list(info = info,)
+
+#return info
Index: /WAeUP_SRP/trunk/skins/waeup_ois/lecturer_students_list.pt
===================================================================
--- /WAeUP_SRP/trunk/skins/waeup_ois/lecturer_students_list.pt	(revision 3818)
+++ /WAeUP_SRP/trunk/skins/waeup_ois/lecturer_students_list.pt	(revision 3818)
@@ -0,0 +1,40 @@
+<metal:body use-macro="here/main_template/macros/master">
+  <metal:main fill-slot="main"
+              tal:define="info options/info;
+                          students info/students;">
+      <h3>Registered Students of Course <span tal:replace="info/course_id"/></h3><br />
+      <span tal:condition="students">
+        <span tal:define="items students">
+          <table class="contentListing" width="100%">
+
+             <span tal:repeat="student students">
+                <tr tal:condition="student" 
+                    tal:attributes="class python:test(repeat['student'].even(), 'even ajaxtd', 'odd ajaxtd')">
+                  <td><a href="id" tal:attributes="href string:${context/portal_url}/campus/students/${student/student_id}"
+                         tal:content="student/student_id"></a></td>    
+                  <td>
+                    <span tal:replace="student/student_record/name" />
+                  </td>                            
+                  <td><span tal:replace="student/student_record/matric_no" /></td>   
+                  <td><span tal:replace="student/student_record/session" /></td>
+                  <td><span tal:replace="student/student_record/level" /></td>
+                  <td><span tal:replace="student/student_record/review_state" /></td>
+                  <td><span tal:replace="student/session_id" /></td>
+                  <td><span tal:replace="student/level_id" /></td>
+                  
+                  <td tal:condition="student/editable">
+                    <a href="edit" tal:attributes="href string:${student/url}/lecturer_course_edit/${info/course_id}"
+                    target="edit_course_result"
+                    onclick="javascript:window.open('','edit_course_result','width=600, height=350, directories=no, toolbar=no, location=no, menubar=no, scrollbars=yes, status=no, resizable=no, dependent=no')">
+                    [edit]
+                    </a> 
+                  </td>                   
+                  
+                  
+                </tr>
+            </span>
+          </table>
+        </span>
+      </span>
+  </metal:main>
+</metal:body>
Index: /WAeUP_SRP/trunk/skins/waeup_student/lecturer_course_edit.py
===================================================================
--- /WAeUP_SRP/trunk/skins/waeup_student/lecturer_course_edit.py	(revision 3817)
+++ /WAeUP_SRP/trunk/skins/waeup_student/lecturer_course_edit.py	(revision 3818)
@@ -9,6 +9,4 @@
 # $Id: course_edit.py 1071 2006-12-16 15:53:13Z joachim $
 """
-This method is for demonstration purposes only.
-There is noi security to deter lecturers from editing courses they are not allowed to edit.
 """
 try:
@@ -34,5 +32,5 @@
 requested_id = context.getStudentId()
 if not 'Lecturers' in groups and not context.isSectionOfficer():
-    logger.info('%s tried to access course result of %s' % (member_id,requested_id))
+    logger.info('%s tried to access course result of %s but is not a lecturer' % (member_id,requested_id))
     return REQUEST.RESPONSE.redirect("%s/srp_anonymous_view" % context.portal_url())
 
@@ -48,10 +46,17 @@
 mode = 'edit'
 object = {}
-course = course_results[0]
+course_result = course_results[0]
+course = context.courses_catalog(code=course_id)[0]
+lecturer_id = getattr(course,'lecturer',None)
+#set_trace()
+if str(lecturer_id) != member_id:
+    logger.info('%s tried to access course result %s of %s but is not a lecturer of this course' % (member_id,course_id,requested_id))
+    return REQUEST.RESPONSE.redirect("%s/srp_anonymous_view" % context.portal_url())
+
 for field in context.course_results.schema():
-    object[field] = getattr(course,field,None)
+    object[field] = getattr(course_result,field,None)
     if repr(object[field]) == 'Missing.Value':
         object[field] = None
-#set_trace()     
+     
 lt = context.portal_layouts
 res,psm, ds = lt.renderLayout(schema_id = 'student_course_result',
