MIDNIGHT/enlight-lms
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(Batch): restrict student list in batch details API

Browse Source
This commit is contained in:
raizasafeel
2026-01-28 14:41:10 +05:30
parent b429fb2e47
commit fb0499acc4
1 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
lms/lms/utils.py
View File

@@ -1115,11 +1115,12 @@ def get_neighbour_lesson(course, chapter, lesson):
@rate_limit(limit=500, seconds=60 * 60) @rate_limit(limit=500, seconds=60 * 60)
def get_batch_details(batch): def get_batch_details(batch):
batch_students = frappe.get_all("LMS Batch Enrollment", {"batch": batch}, pluck="member") batch_students = frappe.get_all("LMS Batch Enrollment", {"batch": batch}, pluck="member")
if (
not frappe.db.get_value("LMS Batch", batch, "published") has_create_batch_role = can_create_batches()
and not can_create_batches() is_course_published = frappe.db.get_value("LMS Batch", batch, "published")
and frappe.session.user not in batch_students is_student_enrolled = frappe.session.user in batch_students
):
if not (is_course_published or has_create_batch_role or is_student_enrolled):
return return
batch_details = frappe.db.get_value( batch_details = frappe.db.get_value(
@@ -1164,7 +1165,10 @@ def get_batch_details(batch):
batch_details.courses = frappe.get_all( batch_details.courses = frappe.get_all(
"Batch Course", filters={"parent": batch}, fields=["course", "title", "evaluator"] "Batch Course", filters={"parent": batch}, fields=["course", "title", "evaluator"]
) )
batch_details.students = batch_students if can_create_batches():
batch_details.students = batch_students
else:
batch_details.students = []
if batch_details.paid_batch and batch_details.start_date >= getdate(): if batch_details.paid_batch and batch_details.start_date >= getdate():
batch_details.amount, batch_details.currency = check_multicurrency( batch_details.amount, batch_details.currency = check_multicurrency(
@@ -1173,7 +1177,7 @@ def get_batch_details(batch):
batch_details.price = fmt_money(batch_details.amount, 0, batch_details.currency) batch_details.price = fmt_money(batch_details.amount, 0, batch_details.currency)
if batch_details.seat_count: if batch_details.seat_count:
batch_details.seats_left = batch_details.seat_count - len(batch_details.students) batch_details.seats_left = batch_details.seat_count - len(batch_students)
return batch_details return batch_details