Changeset 3820 for WAeUP_SRP/trunk/skins

Timestamp:

16 Dec 2008, 07:43:06 (16 years ago)

Author:

Henrik Bettermann

Message:

improve security setting for lecturer course editing

Location:

WAeUP_SRP/trunk/skins

Files:

• waeup_default/get_csv_names.py (modified) (1 diff)
• waeup_ois/getStudyLevelInfo.py (modified) (3 diffs)
• waeup_student/lecturer_course_edit.py (modified) (1 diff)

WAeUP_SRP/trunk/skins/waeup_default/get_csv_names.py

@@ -2 +2 @@
 # $Id$
 """
-Return the sessions as an vocabulary
-
 """
 files = context.waeup_tool.get_csv_filenames()

WAeUP_SRP/trunk/skins/waeup_ois/getStudyLevelInfo.py

@@ -98 +98 @@
 complete1 = 0
 for r in normal1:
-   if r['grade']:
+   if r['grade'] and r['atl']:
        complete1 += 1
 if len(normal1) == complete1:
@@ -108 +108 @@
 complete2 = 0
 for r in normal1:
-   if r['grade']:
+   if r['grade'] and r['atl']:
        complete2 += 1
 if len(normal2) == complete2:
@@ -118 +118 @@
 complete3 = 0
 for r in normal1:
-   if r['grade']:
+   if r['grade'] and r['atl']:
        complete3 += 1
 if len(normal3) == complete3:

WAeUP_SRP/trunk/skins/waeup_student/lecturer_course_edit.py

@@ -50 +50 @@
 lecturer_id = getattr(course,'lecturer',None)
 #set_trace()
-if str(lecturer_id) != member_id:
+if str(lecturer_id) != member_id and not context.isSectionOfficer():
     logger.info('%s tried to access course result %s of %s but is not a lecturer of this course' % (member_id,course_id,requested_id))
     return REQUEST.RESPONSE.redirect("%s/srp_anonymous_view" % context.portal_url())