Browse Source

Classes: Allow teacher to view user, class list BT#15466

Julio 5 years ago
parent
commit
ad85105634
3 changed files with 74 additions and 30 deletions
  1. 24 9
      main/admin/usergroup_users.php
  2. 16 8
      main/inc/ajax/model.ajax.php
  3. 34 13
      main/inc/lib/usergroup.lib.php

+ 24 - 9
main/admin/usergroup_users.php

@@ -4,7 +4,7 @@
 /**
  *  @package chamilo.admin
  */
-$cidReset = true;
+
 require_once __DIR__.'/../inc/global.inc.php';
 
 $this_section = SECTION_PLATFORM_ADMIN;
@@ -17,10 +17,11 @@ if (empty($userGroupInfo)) {
     api_not_allowed(true);
 }
 
-$usergroup->protectScript($userGroupInfo);
+$usergroup->protectScript($userGroupInfo, true, true);
+$allowEdit = api_is_platform_admin() || isset($userGroupInfo['author_id']) && $userGroupInfo['author_id'] == api_get_user_id();
 
 $calendarPlugin = null;
-if (api_get_plugin_setting('learning_calendar', 'enabled') === 'true') {
+if ($allowEdit && api_get_plugin_setting('learning_calendar', 'enabled') === 'true') {
     $calendarPlugin = LearningCalendarPlugin::create();
 }
 
@@ -30,10 +31,19 @@ $action = isset($_GET['action']) ? Security::remove_XSS($_GET['action']) : null;
 $userId = isset($_GET['user_id']) ? (int) $_GET['user_id'] : 0;
 $calendarId = isset($_REQUEST['calendar_id']) ? (int) $_REQUEST['calendar_id'] : 0;
 
-// setting breadcrumbs
-$interbreadcrumb[] = ['url' => 'usergroups.php', 'name' => get_lang('Classes')];
+$courseInfo = api_get_course_info();
+if (empty($courseInfo)) {
+    $interbreadcrumb[] = ['url' => 'usergroups.php', 'name' => get_lang('Classes')];
+} else {
+    $interbreadcrumb[] = ['url' => api_get_path(WEB_CODE_PATH).'user/class.php?'.api_get_cidreq(), 'name' => get_lang('Classes')];
+
+}
 $interbreadcrumb[] = ['url' => '#', 'name' => $userGroupInfo['name']];
 
+if (!empty($action)) {
+    $usergroup->protectScript($userGroupInfo);
+}
+
 switch ($action) {
     case 'add_calendar':
         $form = new FormValidator(
@@ -194,7 +204,7 @@ $extraParams['autowidth'] = 'true';
 $extraParams['height'] = 'auto';
 $extraParams['sortname'] = 'name';
 $extraParams['sortorder'] = 'desc';
-$extraParams['multiselect'] = true;
+$extraParams['multiselect'] = $allowEdit;
 
 $deleteIcon = Display::return_icon('delete.png', get_lang('Delete'), null, ICON_SIZE_SMALL);
 $urlStats = api_get_path(WEB_CODE_PATH);
@@ -207,6 +217,11 @@ $link = '';
 if ($calendarPlugin) {
     $link = '<a href="'.$urlStats.'admin/usergroup_users.php?action=create_control_point&value=\'+value+\'&id='.$id.'&user_id=\'+options.rowId+\'">'.$controlPoint.'</a>';
 }
+
+$deleteButton = '';
+if ($allowEdit) {
+    $deleteButton = '<a onclick="javascript:if(!confirm('."\'".addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES))."\'".')) return false;" href="?id='.$id.'&action=delete&user_id=\'+options.rowId+\'">'.$deleteIcon.'</a>';
+}
 //return \'<a href="session_edit.php?page=resume_session.php&id=\'+options.rowId+\'">'.Display::return_icon('edit.png', get_lang('Edit'), '', ICON_SIZE_SMALL).'</a>'.
 // With this function we can add actions to the jgrid
 $action_links = '
@@ -215,7 +230,7 @@ function action_formatter(cellvalue, options, rowObject) {
     return \''.
     '&nbsp;'.$link.
     '&nbsp;<a href="'.$urlStats.'mySpace/myStudents.php?student=\'+options.rowId+\'">'.$reportingIcon.'</a>'.
-    ' <a onclick="javascript:if(!confirm('."\'".addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES))."\'".')) return false;" href="?id='.$id.'&action=delete&user_id=\'+options.rowId+\'">'.$deleteIcon.'</a>\';
+    ' '.$deleteButton.' \';
 }
 
 function extra_formatter(cellvalue, options, rowObject) {
@@ -269,7 +284,7 @@ $(function() {
     $("#usergroups").jqGrid(
         "navGrid",
         "#usergroups_pager",
-        { edit: false, add: false, del: true, search: false},
+        { edit: false, add: false, del: <?php echo $allowEdit ? 'true' : 'false'; ?>, search: false},
         { height:280, reloadAfterSubmit:false }, // edit options
         { height:280, reloadAfterSubmit:false }, // add options
         { reloadAfterSubmit:false, url: "<?php echo $deleteUrl; ?>" }, // del options
@@ -316,7 +331,7 @@ $(function() {
 
 $usergroup->showGroupTypeSetting = true;
 // Action handling: Adding a note
-if ($action === 'delete' && is_numeric($_GET['id'])) {
+if ($allowEdit && $action === 'delete' && is_numeric($_GET['id'])) {
     $res = $usergroup->delete_user_rel_group($_GET['user_id'], $_GET['id']);
     Display::addFlash(Display::return_message(get_lang('Deleted'), 'confirmation'));
     header('Location: '.api_get_self().'?id='.$id);

+ 16 - 8
main/inc/ajax/model.ajax.php

@@ -275,7 +275,7 @@ switch ($action) {
         break;
     case 'get_usergroups_users':
         $usergroup = new UserGroup();
-        $usergroup->protectScript();
+        $usergroup->protectScript(null, true, true);
         $id = isset($_REQUEST['id']) ? $_REQUEST['id'] : 0;
         $count = $usergroup->getUserGroupUsers($id, true);
         break;
@@ -802,7 +802,7 @@ switch ($action) {
         break;
     case 'get_usergroups_teacher':
         $obj = new UserGroup();
-        $obj->protectScript();
+        $obj->protectScript(null, false, true);
         $type = isset($_REQUEST['type']) ? $_REQUEST['type'] : 'registered';
         $groupFilter = isset($_REQUEST['group_filter']) ? (int) $_REQUEST['group_filter'] : 0;
         $keyword = isset($_REQUEST['keyword']) ? $_REQUEST['keyword'] : '';
@@ -2233,12 +2233,20 @@ switch ($action) {
             foreach ($result as $group) {
                 $countUsers = count($obj->get_users_by_usergroup($group['id']));
                 $group['users'] = $countUsers;
-
-                if ($obj->allowTeachers() && $group['author_id'] == $currentUserId) {
-                    $group['users'] = Display::url(
-                        $countUsers,
-                        $urlUserGroup.'&id='.$group['id']
-                    );
+                if (!empty($countUsers)) {
+                    if ($obj->allowTeachers()) {
+                        if (isset($group['author_id']) && $group['author_id'] == $currentUserId) {
+                            $group['users'] = Display::url(
+                                $countUsers,
+                                $urlUserGroup.'&id='.$group['id']
+                            );
+                        }
+                    } else {
+                        $group['users'] = Display::url(
+                            $countUsers,
+                            $urlUserGroup.'&id='.$group['id']
+                        );
+                    }
                 }
 
                 if ($obj->usergroup_was_added_in_course($group['id'], $course_id)) {

+ 34 - 13
main/inc/lib/usergroup.lib.php

@@ -293,9 +293,18 @@ class UserGroup extends Model
     {
         // action links
         echo '<div class="actions">';
-        echo '<a href="../admin/usergroups.php">'.
-            Display::return_icon('back.png', get_lang('BackTo').' '.get_lang('PlatformAdmin'), '', '32').
-            '</a>';
+        $courseInfo = api_get_course_info();
+        if (empty($courseInfo)) {
+            echo '<a href="../admin/usergroups.php">'.
+                Display::return_icon('back.png', get_lang('BackTo').' '.get_lang('PlatformAdmin'), '', '32').
+                '</a>';
+        } else {
+            echo Display::url(
+                Display::return_icon('back.png', get_lang('BackTo').' '.get_lang('PlatformAdmin'), '', '32'),
+                api_get_path(WEB_CODE_PATH).'user/class.php?'.api_get_cidreq()
+            );
+        }
+
         echo '</div>';
         echo Display::grid_html('usergroups');
     }
@@ -2868,22 +2877,34 @@ class UserGroup extends Model
      * Check permissions and blocks the page.
      *
      * @param array $userGroupInfo
+     * @param bool  $checkAuthor
+     * @param bool  $checkCourseIsAllow
      */
-    public function protectScript($userGroupInfo = [])
+    public function protectScript($userGroupInfo = [], $checkAuthor = true, $checkCourseIsAllow = false)
     {
         api_block_anonymous_users();
 
-        if (!api_is_platform_admin()) {
-            if (api_is_teacher()) {
-                if (!empty($userGroupInfo)) {
-                    if ($userGroupInfo['author_id'] != api_get_user_id()) {
-                        api_not_allowed(true);
-                    }
+        if (api_is_platform_admin()) {
+            return true;
+        }
+
+        if ($checkCourseIsAllow) {
+            if (api_is_allowed_to_edit()) {
+                return true;
+            }
+        }
+
+        if ($this->allowTeachers() && api_is_teacher()) {
+            if ($checkAuthor && !empty($userGroupInfo)) {
+                if (isset($userGroupInfo['author_id']) && $userGroupInfo['author_id'] != api_get_user_id()) {
+                    api_not_allowed(true);
                 }
-            } else {
-                api_protect_admin_script(true);
-                api_protect_limit_for_session_admin();
             }
+
+            return true;
+        } else {
+            api_protect_admin_script(true);
+            api_protect_limit_for_session_admin();
         }
     }
 }