Changeset 3820 for WAeUP_SRP/trunk/skins/waeup_student

Timestamp:

16 Dec 2008, 07:43:06 (16 years ago)

Author:

Henrik Bettermann

Message:

improve security setting for lecturer course editing

File:

• WAeUP_SRP/trunk/skins/waeup_student/lecturer_course_edit.py (modified) (1 diff)

WAeUP_SRP/trunk/skins/waeup_student/lecturer_course_edit.py

@@ -50 +50 @@
 lecturer_id = getattr(course,'lecturer',None)
 #set_trace()
-if str(lecturer_id) != member_id:
+if str(lecturer_id) != member_id and not context.isSectionOfficer():
     logger.info('%s tried to access course result %s of %s but is not a lecturer of this course' % (member_id,course_id,requested_id))
     return REQUEST.RESPONSE.redirect("%s/srp_anonymous_view" % context.portal_url())