MDL-62782 assign: viewgrades allows files

Grade viewer role should be able to see feedback files for an assignment submission.

diff --git a/mod/assign/feedback/editpdf/lib.php b/mod/assign/feedback/editpdf/lib.php
index 85eeba7..143acff 100644 (file)
--- a/mod/assign/feedback/editpdf/lib.php
+++ b/mod/assign/feedback/editpdf/lib.php
@@ -45,23 +45,23 @@ function assignfeedback_editpdf_pluginfile($course,
                                            array $options=array()) {
     global $USER, $DB, $CFG;
 
+    require_once($CFG->dirroot . '/mod/assign/locallib.php');
+
     if ($context->contextlevel == CONTEXT_MODULE) {
 
         require_login($course, false, $cm);
         $itemid = (int)array_shift($args);
 
-        if (!$assign = $DB->get_record('assign', array('id'=>$cm->instance))) {
-            return false;
-        }
+        $assign = new assign($context, $cm, $course);
 
-        $record = $DB->get_record('assign_grades', array('id'=>$itemid), 'userid,assignment', MUST_EXIST);
+        $record = $DB->get_record('assign_grades', array('id' => $itemid), 'userid,assignment', MUST_EXIST);
         $userid = $record->userid;
-        if ($assign->id != $record->assignment) {
+        if ($assign->get_instance()->id != $record->assignment) {
             return false;
         }
 
-        // Check is users feedback or has grading permission.
-        if ($USER->id != $userid and !has_capability('mod/assign:grade', $context)) {
+        // Rely on mod_assign checking permissions.
+        if (!$assign->can_view_submission($userid)) {
             return false;
         }
 

diff --git a/mod/assign/feedback/file/lib.php b/mod/assign/feedback/file/lib.php
index 29427c4..1a33d43 100644 (file)
--- a/mod/assign/feedback/file/lib.php
+++ b/mod/assign/feedback/file/lib.php
@@ -42,27 +42,27 @@ function assignfeedback_file_pluginfile($course,
                                         $args,
                                         $forcedownload,
                                         array $options=array()) {
-    global $USER, $DB;
+    global $USER, $DB, $CFG, $PAGE;
 
     if ($context->contextlevel != CONTEXT_MODULE) {
         return false;
     }
 
+    require_once($CFG->dirroot . '/mod/assign/locallib.php');
+
     require_login($course, false, $cm);
     $itemid = (int)array_shift($args);
-    $record = $DB->get_record('assign_grades', array('id'=>$itemid), 'userid,assignment', MUST_EXIST);
+    $record = $DB->get_record('assign_grades', array('id' => $itemid), 'userid,assignment', MUST_EXIST);
     $userid = $record->userid;
 
-    if (!$assign = $DB->get_record('assign', array('id'=>$cm->instance))) {
-        return false;
-    }
+    $assign = new assign($context, $cm, $course);
 
-    if ($assign->id != $record->assignment) {
+    if ($assign->get_instance()->id != $record->assignment) {
         return false;
     }
 
-    // Check is users feedback or has grading permission.
-    if ($USER->id != $userid and !has_capability('mod/assign:grade', $context)) {
+    // Rely on mod_assign checking permissions.
+    if (!$assign->can_view_submission($userid)) {
         return false;
     }