Changeset 4033 for WAeUP_SRP/trunk/skins/waeup_student

Timestamp:

30 Mar 2009, 21:14:56 (16 years ago)

Author:

Henrik Bettermann

Message:

improve security level for lecturers

Location:

WAeUP_SRP/trunk/skins/waeup_student

Files:

• getFormattedStudentEntry.py (modified) (1 diff)
• lecturer_course_edit.py (modified) (2 diffs)

WAeUP_SRP/trunk/skins/waeup_student/getFormattedStudentEntry.py

@@ -30 +30 @@
     students_object = context.portal_url.getPortalObject().campus.students
     student = getattr(students_object, brain.id)
-    app_obj = student.application.getContent()
-    d['email'] = getattr(app_obj, 'app_email', '') 
-            
+    try:
+        app_obj = student.application.getContent()
+        d['email'] = getattr(app_obj, 'app_email', '')
+    except: 
+        d['email'] = 'not accessible'
 return d            

WAeUP_SRP/trunk/skins/waeup_student/lecturer_course_edit.py

@@ -32 +32 @@
 requested_id = context.getStudentId()
 if not 'Lecturers' in groups and not context.isSectionOfficer():
-    logger.info('%s tried to access course result of %s but is not a lecturer' % (member_id,requested_id))
+    logger.info('%s tried to access course result record of %s but is not a lecturer' % (member_id,requested_id))
     return REQUEST.RESPONSE.redirect("%s/srp_anonymous_view" % context.portal_url())
 
 student_id = requested_id
+student_record = context.students_catalog.getRecordByKey(student_id)
+if student_record.review_state != 'courses_validated':
+    logger.info('%s tried to access non-validated course result record of %s' % (member_id,requested_id))
+    return REQUEST.RESPONSE.redirect("%s/srp_anonymous_view" % context.portal_url())
+
 
 level_id = context.getId()
@@ -51 +56 @@
 #set_trace()
 if str(lecturer_id) != member_id and not context.isSectionOfficer():
-    logger.info('%s tried to access course result %s of %s but is not a lecturer of this course' % (member_id,course_id,requested_id))
+    logger.info('%s tried to access course result record %s of %s but is not a lecturer of this course' % (member_id,course_id,requested_id))
     return REQUEST.RESPONSE.redirect("%s/srp_anonymous_view" % context.portal_url())