From 24a511f48e233d6422355840bf00be894311ac2a Mon Sep 17 00:00:00 2001 From: Jannat Patel Date: Mon, 2 Feb 2026 14:44:13 +0530 Subject: [PATCH] fix: do nor return details of unpublished courses and batches via api --- lms/lms/utils.py | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-) diff --git a/lms/lms/utils.py b/lms/lms/utils.py index b041fcab..052efbdc 100644 --- a/lms/lms/utils.py +++ b/lms/lms/utils.py @@ -329,17 +329,6 @@ def has_course_instructor_role(member=None): ) -def can_create_batches(member=None): - if not member: - member = frappe.session.user - - if has_moderator_role(member): - return True - if has_evaluator_role(member): - return True - return False - - def has_moderator_role(member=None): return frappe.db.get_value( "Has Role", @@ -885,6 +874,10 @@ def get_course_details(course): if not guest_access_allowed(): return {} + is_course_published = frappe.db.get_value("LMS Course", course, "published") + if not is_course_published and not can_modify_course(course): + return {} + fields = get_course_fields() course_details = frappe.db.get_value( "LMS Course", @@ -1105,11 +1098,11 @@ def get_batch_details(batch): return {} batch_students = frappe.get_all("LMS Batch Enrollment", {"batch": batch}, pluck="member") - has_create_batch_role = can_create_batches() - is_course_published = frappe.db.get_value("LMS Batch", batch, "published") + is_batch_admin = can_modify_batch(batch) + is_batch_published = frappe.db.get_value("LMS Batch", batch, "published") is_student_enrolled = frappe.session.user in batch_students - if not (is_course_published or has_create_batch_role or is_student_enrolled): + if not (is_batch_published or is_batch_admin or is_student_enrolled): return batch_details = frappe.db.get_value( @@ -1154,7 +1147,7 @@ def get_batch_details(batch): batch_details.courses = frappe.get_all( "Batch Course", filters={"parent": batch}, fields=["course", "title", "evaluator"] ) - if can_create_batches(): + if can_modify_batch(batch): batch_details.students = batch_students elif is_student_enrolled: batch_details.students = [frappe.session.user]