Browse Source

Only teachers and group members can upload documents

Julio Montoya 13 years ago
parent
commit
803154e97d
1 changed files with 14 additions and 0 deletions
  1. 14 0
      main/inc/ajax/document.ajax.php

+ 14 - 0
main/inc/ajax/document.ajax.php

@@ -7,6 +7,20 @@ require_once '../global.inc.php';
 
 api_protect_course_script(true);
 
+//User access same as upload.php
+$is_allowed_to_edit = api_is_allowed_to_edit(null, true);
+
+// This needs cleaning!
+if (api_get_group_id()) {   
+    if ($is_allowed_to_edit || GroupManager::is_user_in_group(api_get_user_id(), api_get_group_id())) { // Only courseadmin or group members allowed        
+    } else {
+        exit;
+    }
+} elseif ($is_allowed_to_edit || is_my_shared_folder(api_get_user_id(), $_POST['curdirpath'], api_get_session_id())) {
+} else { // No course admin and no group member...
+    exit;
+}
+
 if (!empty($_FILES)) {
     require_once api_get_path(LIBRARY_PATH).'document.lib.php';
     require_once api_get_path(LIBRARY_PATH).'fileDisplay.lib.php';