MIDNIGHT/enlight-lms
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: permission checks for api

Browse Source
This commit is contained in:
Jannat Patel
2026-02-16 18:20:02 +05:30
parent eba1815390
commit 7e683f8b44
2 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
lms/lms/api.py
View File

@@ -1511,6 +1511,7 @@ def validate_meta_data_permissions(meta_type: str):
@frappe.whitelist() @frappe.whitelist()
def create_programming_exercise_submission(exercise: str, submission: str, code: str, test_cases: list): def create_programming_exercise_submission(exercise: str, submission: str, code: str, test_cases: list):
frappe.only_for(["Moderator", "Course Creator", "Batch Evaluator"])
if submission == "new": if submission == "new":
return make_new_exercise_submission(exercise, code, test_cases) return make_new_exercise_submission(exercise, code, test_cases)
else: else:
@@ -2037,7 +2038,7 @@ def get_upcoming_batches():
@frappe.whitelist() @frappe.whitelist()
def delete_programming_exercise(exercise: str): def delete_programming_exercise(exercise: str):
frappe.only_for(["Moderator", "Course Creator"]) frappe.only_for(["Moderator", "Course Creator", "Batch Evaluator"])
frappe.db.delete("LMS Programming Exercise Submission", {"exercise": exercise}) frappe.db.delete("LMS Programming Exercise Submission", {"exercise": exercise})
frappe.db.delete("LMS Programming Exercise", exercise) frappe.db.delete("LMS Programming Exercise", exercise)

14
lms/lms/utils.py
View File

@@ -1010,12 +1010,7 @@ def get_lesson(course: str, chapter: int, lesson: int) -> dict:
as_dict=1, as_dict=1,
) )
if ( if not lesson_details.include_in_preview and not membership and not can_modify_course(course):
not lesson_details.include_in_preview
and not membership
and not has_moderator_role()
and not is_instructor(course)
):
return { return {
"no_preview": 1, "no_preview": 1,
"title": lesson_details.title, "title": lesson_details.title,
@@ -2050,6 +2045,13 @@ def get_program_details(program_name: str) -> dict:
if not guest_access_allowed(): if not guest_access_allowed():
frappe.throw(_("Please login to view program details.")) frappe.throw(_("Please login to view program details."))
is_published = frappe.db.get_value("LMS Program", program_name, "published")
is_member = frappe.db.exists(
"LMS Program Member", {"parent": program_name, "member": frappe.session.user}
)
if not is_published and not is_member:
frappe.throw(_("You are not authorized to view the details of this program."))
program = frappe.db.get_value( program = frappe.db.get_value(
"LMS Program", "LMS Program",
program_name, program_name,