fraport/fradrive
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Re-tighten permissions on CNotesR

Browse Source
This commit is contained in:
Gregor Kleen 2019-05-10 21:49:52 +02:00
parent 51a6cce2c2
commit 4270e0a347
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
routes
View File

@ -88,7 +88,7 @@
/users/#CryptoUUIDUser CUserR GET POST !lecturerANDparticipant
/correctors CHiWisR GET
/communication CCommR GET POST
/notes CNotesR GET POST !corrector !tutor -- THIS route is used to check for overall course corrector access!
/notes CNotesR GET POST !corrector -- THIS route is used to check for overall course corrector access!
/subs CCorrectionsR GET POST
/ex SheetListR GET !course-registered !materials !corrector
/ex/new SheetNewR GET POST
@ -124,7 +124,7 @@
/load/*FilePath MFileR GET !timeANDcourse-registered !timeANDmaterials !corrector !tutor
/download MArchiveR GET !timeANDcourse-registered !timeANDmaterials !corrector !tutor
/zip MZipR GET !timeANDcourse-registered !timeANDmaterials !corrector !tutor
/tuts CTutorialListR GET !tutor
/tuts CTutorialListR GET !tutor -- THIS route is used to check for overall course tutor access!
/tuts/new CTutorialNewR GET POST
/tuts/#TutorialName TutorialR:
/edit TEditR GET POST

7
src/Handler/Tutorial.hs
View File

@ -201,10 +201,13 @@ postTCommR tid ssh csh tutn = do
E.where_ $ tutorialUser E.^. TutorialParticipantUser E.==. E.val uid
E.&&. tutorialUser E.^. TutorialParticipantTutorial E.==. E.val tutid
isAssociated <- evalAccessForDB (Just uid) (CourseR tid ssh csh CNotesR) False
isAssociatedCorrector <- evalAccessForDB (Just uid) (CourseR tid ssh csh CNotesR) False
isAssociatedTutor <- evalAccessForDB (Just uid) (CourseR tid ssh csh CTutorialListR) False
mr <- getMsgRenderer
return $ if
| isTutorialUser -> Authorized
| otherwise -> isAssociated
| otherwise -> orAR mr isAssociatedCorrector isAssociatedTutor
}