** Changed in: mahara/1.10
Milestone: 1.10.5 => 1.10.6
** Changed in: mahara/1.9
Milestone: 1.9.7 => 1.9.8
** Changed in: mahara/15.04
Milestone: 15.04.2 => 15.04.3
--
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask
on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1262040
Title:
Problems with group artefact permissions due to misuse of
$USER->can_view_artefact and $USER->can_edit_artefact
Status in Mahara ePortfolio:
Confirmed
Status in Mahara 1.10 series:
Confirmed
Status in Mahara 1.8 series:
Won't Fix
Status in Mahara 1.9 series:
Confirmed
Status in Mahara 15.04 series:
Confirmed
Status in Mahara 15.10 series:
In Progress
Bug description:
While discussing the export to ZIP bug ( Bug 1013022 ) I realized that
$USER->can_view_artefact() does not do what I thought it did. I
thought that it was like can_view_view(), i.e. it was an easy way to
tell whether a particular user is allowed to see the contents of a
particular artefact.
But it does not mean that, as evidenced by the fact that it's not
accessed at all on the artefact detail page, view/artefact.php.
Instead, this function refers to whether or not the user should be
able to see the artefact in their own or a group's Content area.
The reason it exists and has this name, is because of the group files
permissions system (see
http://manual.mahara.org/en/1.8/groups/inside_group.html#index-16 ).
This defines three permission levels for a file: "View" lets you see
the page in Contents and use it in Group pages, "Edit" lets you change
the file's metadata, and "Publish" lets you use the file in your own
Portfolio pages.
Anyway, I misunderstood it as doing the same thing as can_view_view(),
which checks whether a particular user can see a particular Page in
display-mode. The similar functionality for artefacts, as seen on
view/artefact.php, is to provide an artefact ID & a page ID, and to
check whether the artefact is in the page and the user can view the
page.
To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1262040/+subscriptions
_______________________________________________
Mailing list: https://launchpad.net/~mahara-contributors
Post to : mahara-contributors@lists.launchpad.net
Unsubscribe : https://launchpad.net/~mahara-contributors
More help : https://help.launchpad.net/ListHelp
