Issues

Select view

  • Select search mode

 
2 of 2

Lock down results interfaces for users who don't have scorm.view.results permission

Fixed

Description

The results viewing pages are not locked down via the 'scorm.view.results' permission, only the links to these interfaces are.

If a student is able to obtain the URL of one of these links, they can view results/etc.

The attached patch simply checks the permission state before rendering the page, and if the user does not have the permission, they see a message indicating this instead of seeing the results.

Attachments

1
  • 23 Apr 2013, 01:04 PM

Details

Assignee

Reporter

Affects versions

Priority

Created April 23, 2013 at 1:03 PM
Updated June 11, 2013 at 8:55 AM
Resolved June 8, 2013 at 6:33 PM

Activity

Brian J.June 11, 2013 at 8:55 AM

Looks good, thanks Roland.

Roland GroenJune 11, 2013 at 8:35 AM

If you take a look at the Subversion tab of this issue you can see the changes that are committed, if you feel that matches the patch they are ;-).

Brian J.June 11, 2013 at 7:59 AM

Did you apply the .patch and test?

Roland GroenJune 8, 2013 at 6:33 PM

This one is done, right?

Brian J.April 24, 2013 at 9:06 AM

Glad to help out!