Fix an issue with the navigation_allowed permission. - #3132
Conversation
2aa915a to
5c20ed2
Compare
64d980f to
e675cf1
Compare
|
I don't have LTI fully setup on my develop server, but I noticed the following as an instructor: In course configuration set Go to set manager, and click on the problem number for a set to get into the set details editor, from there the link to the set appears under the greyed out assignments page. Click on that to get to the link to the set (or typing in the url directly) gives a warning: Now this is not something anyone should be doing, but the error states that there could be a chance that either |
| return $c->maketext("Requested set '[_1]' is not available yet.", $setName); | ||
| } | ||
|
|
||
| if (!$self->hasPermissions($userName, 'navigation_allowed') && $c->authen->session->{set_id} ne $setName) { |
There was a problem hiding this comment.
Changing this to:
if (!$self->hasPermissions($userName, 'navigation_allowed') && ($c->authen->session->{set_id} // '') ne $setName) {
Fixes the warning I ran into.
There was a problem hiding this comment.
I made that change, but I am certain that if you start changing various permissions to nobody that really shouldn't be, and that don't make sense to be nobody, you will find lots of other more serious problems with the code not being prepared to deal with that.
Do not let a user view another set other than the one in the session if a user does not have the `navigation_allowed` permission. Generally, the only way this will happen is if the user modifies the URL in the browser to try to change to a different set. Currently that works, and it shouldn't.
e675cf1 to
1f8ad10
Compare
|
Agreed, this permission doesn't work well for anything above I was just worried their maybe other cases where |
3 participants
Do not let a user view another set other than the one in the session if a user does not have the
navigation_allowedpermission. Generally, the only way this will happen is if the user modifies the URL in the browser to try to change to a different set. Currently that works, and it shouldn't.