Browse Source

Fix #1588 - refs BT#12085

Angel Fernando Quiroz Campos 8 years ago
parent
commit
194ac5bdd5
1 changed files with 19 additions and 9 deletions
  1. 19 9
      main/mySpace/myStudents.php

+ 19 - 9
main/mySpace/myStudents.php

@@ -16,29 +16,39 @@ $course_code = isset($_GET['course']) ? Security :: remove_XSS($_GET['course'])
 $courseInfo = api_get_course_info($course_code);
 $student_id = intval($_GET['student']);
 
-if (!api_is_allowed_to_create_course() &&
+$allowedToTrackUser = true;
+
+if (
     !api_is_session_admin() &&
     !api_is_drh() &&
     !api_is_student_boss() &&
     !api_is_platform_admin()
 ) {
     if (empty($sessionId)) {
-        // Check if the user is tutor of the course
-        $userCourseStatus = CourseManager::get_tutor_in_course_status(
-            api_get_user_id(),
-            api_get_course_int_id()
-        );
-        if ($userCourseStatus != 1) {
-            api_not_allowed(true);
+        if (!$is_courseAdmin) {
+            // Check if the user is tutor of the course
+            $userCourseStatus = CourseManager::get_tutor_in_course_status(
+                api_get_user_id(),
+                api_get_course_int_id()
+            );
+
+            if ($userCourseStatus != 1) {
+                $allowedToTrackUser = false;
+            }
         }
     } else {
         $coach = api_is_coach($sessionId, $courseInfo['real_id']);
+
         if (!$coach) {
-            api_not_allowed(true);
+            $allowedToTrackUser = false;
         }
     }
 }
 
+if (!$allowedToTrackUser) {
+    api_not_allowed(true);
+}
+
 $htmlHeadXtra[] = '<script>
 function show_image(image,width,height) {
 	width = parseInt(width) + 20;