Changeset 4033

Timestamp:

30 Mar 2009, 21:14:56 (16 years ago)

Author:

Henrik Bettermann

Message:

improve security level for lecturers

Location:

WAeUP_SRP/trunk/skins

Files:

• waeup_ois/getLecturerCourseResults.py (modified) (1 diff)
• waeup_ois/lecturer_students_list.pt (modified) (1 diff)
• waeup_student/getFormattedStudentEntry.py (modified) (1 diff)
• waeup_student/lecturer_course_edit.py (modified) (2 diffs)

WAeUP_SRP/trunk/skins/waeup_ois/getLecturerCourseResults.py

@@ -40 +40 @@
     row['session_id'] =  r['session_id']
     row['level_id'] =  level_id = r['level_id']
+    row['level_string'] = context.portal_vocabularies.student_levels.get(r['level_id'])
+    row['session_string'] = context.portal_vocabularies.sessions.get(r['session_id'])
     #row['score'] =  r['score']
     row['student_id'] = student_id = r['student_id']

WAeUP_SRP/trunk/skins/waeup_ois/lecturer_students_list.pt

@@ -17 +17 @@
                   </td>                            
                   <td><span tal:replace="student/student_record/matric_no" /></td>   
-                  <td><span tal:replace="student/student_record/session" /></td>
-                  <td><span tal:replace="student/student_record/level" /></td>
                   <td><span tal:replace="student/student_record/review_state" /></td>
-                  <td><span tal:replace="student/session_id" /></td>
-                  <td><span tal:replace="student/level_id" /></td>
+                  <td><span tal:replace="student/session_string" /></td>
+                  <td><span tal:replace="student/level_string" /></td>
                   
                   <td tal:condition="student/editable">
                     <a href="edit" tal:attributes="href string:${student/url}/lecturer_course_edit/${info/course_id}"
                     target="edit_course_result"
-                    onclick="javascript:window.open('','edit_course_result','width=600, height=350, directories=no, toolbar=no, location=no, menubar=no, scrollbars=yes, status=no, resizable=no, dependent=no')">
+                    onclick="javascript:window.open('','edit_course_result','width=600, height=500, directories=no, toolbar=no, location=no, menubar=no, scrollbars=yes, status=no, resizable=no, dependent=no')">
                     [edit]
                     </a> 

WAeUP_SRP/trunk/skins/waeup_student/getFormattedStudentEntry.py

@@ -30 +30 @@
     students_object = context.portal_url.getPortalObject().campus.students
     student = getattr(students_object, brain.id)
-    app_obj = student.application.getContent()
-    d['email'] = getattr(app_obj, 'app_email', '') 
-            
+    try:
+        app_obj = student.application.getContent()
+        d['email'] = getattr(app_obj, 'app_email', '')
+    except: 
+        d['email'] = 'not accessible'
 return d            

WAeUP_SRP/trunk/skins/waeup_student/lecturer_course_edit.py

@@ -32 +32 @@
 requested_id = context.getStudentId()
 if not 'Lecturers' in groups and not context.isSectionOfficer():
-    logger.info('%s tried to access course result of %s but is not a lecturer' % (member_id,requested_id))
+    logger.info('%s tried to access course result record of %s but is not a lecturer' % (member_id,requested_id))
     return REQUEST.RESPONSE.redirect("%s/srp_anonymous_view" % context.portal_url())
 
 student_id = requested_id
+student_record = context.students_catalog.getRecordByKey(student_id)
+if student_record.review_state != 'courses_validated':
+    logger.info('%s tried to access non-validated course result record of %s' % (member_id,requested_id))
+    return REQUEST.RESPONSE.redirect("%s/srp_anonymous_view" % context.portal_url())
+
 
 level_id = context.getId()
@@ -51 +56 @@
 #set_trace()
 if str(lecturer_id) != member_id and not context.isSectionOfficer():
-    logger.info('%s tried to access course result %s of %s but is not a lecturer of this course' % (member_id,course_id,requested_id))
+    logger.info('%s tried to access course result record %s of %s but is not a lecturer of this course' % (member_id,course_id,requested_id))
     return REQUEST.RESPONSE.redirect("%s/srp_anonymous_view" % context.portal_url())