fraport/fradrive-old
Archived
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Loosen tutorial-communication-recipient restrictions

Browse Source
This commit is contained in:
Gregor Kleen 2019-05-10 21:43:47 +02:00
parent bf287a4a99
commit 801b92bccf
3 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
routes
View File

@ -88,7 +88,7 @@
/users/#CryptoUUIDUser CUserR GET POST !lecturerANDparticipant /users/#CryptoUUIDUser CUserR GET POST !lecturerANDparticipant
/correctors CHiWisR GET /correctors CHiWisR GET
/communication CCommR GET POST /communication CCommR GET POST
/notes CNotesR GET POST !corrector -- THIS route is used to check for overall course corrector access! /notes CNotesR GET POST !corrector !tutor -- THIS route is used to check for overall course corrector access!
/subs CCorrectionsR GET POST /subs CCorrectionsR GET POST
/ex SheetListR GET !course-registered !materials !corrector /ex SheetListR GET !course-registered !materials !corrector
/ex/new SheetNewR GET POST /ex/new SheetNewR GET POST

10
src/Handler/Tutorial.hs
View File

@ -197,8 +197,14 @@ postTCommR tid ssh csh tutn = do
) )
] ]
, crRecipientAuth = Just $ \uid -> do , crRecipientAuth = Just $ \uid -> do
cID <- encrypt uid [E.Value isTutorialUser] <- E.select . return . E.exists . E.from $ \tutorialUser ->
evalAccessDB (CourseR tid ssh csh $ CUserR cID) False E.where_ $ tutorialUser E.^. TutorialParticipantUser E.==. E.val uid
E.&&. tutorialUser E.^. TutorialParticipantTutorial E.==. E.val tutid
isAssociated <- evalAccessForDB (Just uid) (CourseR tid ssh csh CNotesR) False
return $ if
| isTutorialUser -> Authorized
| otherwise -> isAssociated
} }

2
src/Handler/Utils/Communication.hs
View File

@ -75,7 +75,7 @@ instance RenderMessage UniWorX RecipientCategory where
data CommunicationRoute = CommunicationRoute data CommunicationRoute = CommunicationRoute
{ crRecipients :: Map RecipientGroup (E.SqlQuery (E.SqlExpr (Entity User))) { crRecipients :: Map RecipientGroup (E.SqlQuery (E.SqlExpr (Entity User)))
, crRecipientAuth :: Maybe (UserId -> DB AuthResult) , crRecipientAuth :: Maybe (UserId -> DB AuthResult) -- ^ Only resolve userids given as GET-Parameter if they fulfil this criterion
, crJobs :: Communication -> Source (YesodDB UniWorX) Job , crJobs :: Communication -> Source (YesodDB UniWorX) Job
, crHeading :: SomeMessage UniWorX , crHeading :: SomeMessage UniWorX
, crUltDest :: SomeRoute UniWorX , crUltDest :: SomeRoute UniWorX