added 1 commit <ul><li>5756ba3a - Protect subjects query by checking permissions</li></ul> [Compare with previous version](/AlekSIS/onboarding/AlekSIS-App-Cursus/-/merge_requests/82/diffs?diff_id=55498&start_sha=3a4df1ab089f6d7b288ba193c2f6a5d24b066b6c)

permcu commented

2025-02-11 18:15:03 +01:00

(Migrated from edugit.org)

Lint fails because of some incompatible module.

hansegucker commented

2025-02-11 19:35:59 +01:00

(Migrated from edugit.org)

I cite: Authenticated users should be able to fetch all subjects. So, globally check for this rule:

https://edugit.org/AlekSIS/onboarding/AlekSIS-App-Cursus/-/blob/master/aleksis/apps/cursus/rules.py?ref_type=heads#L20

I cite: Authenticated users should be able to fetch all subjects. So, globally check for this rule: https://edugit.org/AlekSIS/onboarding/AlekSIS-App-Cursus/-/blob/master/aleksis/apps/cursus/rules.py?ref_type=heads#L20

hansegucker commented

2025-02-11 19:36:36 +01:00

(Migrated from edugit.org)

@yuha Will that break any of your fancy substitution tools?

permcu commented

2025-02-12 12:11:46 +01:00

(Migrated from edugit.org)

changed this line in version 2 of the diff

changed this line in [version 2 of the diff](/AlekSIS/onboarding/AlekSIS-App-Cursus/-/merge_requests/82/diffs?diff_id=55512&start_sha=5756ba3abc1044688490700ef947d0bedc85f4d0#a81fc04014516b978c11ae4b968d93b6d93e1dec_339_338)

permcu commented

2025-02-12 12:11:47 +01:00

(Migrated from edugit.org)

added 1 commit

47bbb9ee - Enable all authenticated users to fetch all subjects

Compare with previous version

added 1 commit <ul><li>47bbb9ee - Enable all authenticated users to fetch all subjects</li></ul> [Compare with previous version](/AlekSIS/onboarding/AlekSIS-App-Cursus/-/merge_requests/82/diffs?diff_id=55512&start_sha=5756ba3abc1044688490700ef947d0bedc85f4d0)

yuha commented

2025-02-12 17:15:40 +01:00

(Migrated from edugit.org)

wait, no, in case you mean the teacher sorting functionality of SubjectField which fetches the subjects of teachers which only requires users using the substitution assistant to have sufficient permissions for accessing all relevant teachers. But since that has always been the case, nothing should break.

wait, no, in case you mean the teacher sorting functionality of `SubjectField` which fetches the subjects _of_ teachers which only requires users using the substitution assistant to have sufficient permissions for accessing all relevant teachers. But since that has always been the case, nothing should break.

hansegucker commented

2025-02-12 20:37:41 +01:00

(Migrated from edugit.org)

Introduce the following rule:

view_subject_details_predicate = view_subject_predicate & (has_global_perm("cursus.view_subject") | has_object_perm("cursus.view_subject"))
)
add_perm("cursus.view_subject_details_rule", view_subject_details_predicate)

and use it

Introduce the following rule: ``` view_subject_details_predicate = view_subject_predicate & (has_global_perm("cursus.view_subject") | has_object_perm("cursus.view_subject")) ) add_perm("cursus.view_subject_details_rule", view_subject_details_predicate) ``` and use it

hansegucker commented

2025-02-12 20:39:33 +01:00

(Migrated from edugit.org)

    if not info.context.user.has_perm("cursus.view_subject_details_rule", root):
        return []

if not info.context.user.has_perm("cursus.view_subject_details_rule", root): return []

permcu commented

2025-02-13 10:45:50 +01:00

(Migrated from edugit.org)

changed this line in version 3 of the diff

changed this line in [version 3 of the diff](/AlekSIS/onboarding/AlekSIS-App-Cursus/-/merge_requests/82/diffs?diff_id=55589&start_sha=47bbb9ee78ee37a63f8416c8b5acaaff19764227#a81fc04014516b978c11ae4b968d93b6d93e1dec_66_66)

permcu commented

2025-02-13 10:45:50 +01:00

(Migrated from edugit.org)

changed this line in version 3 of the diff

permcu commented

2025-02-13 10:45:51 +01:00

(Migrated from edugit.org)

added 1 commit

86581035 - Fix and optimize resolve_teachers-method of SubjectType

Compare with previous version

added 1 commit <ul><li>86581035 - Fix and optimize resolve_teachers-method of SubjectType</li></ul> [Compare with previous version](/AlekSIS/onboarding/AlekSIS-App-Cursus/-/merge_requests/82/diffs?diff_id=55589&start_sha=47bbb9ee78ee37a63f8416c8b5acaaff19764227)

hansegucker commented

2025-02-15 22:12:50 +01:00

(Migrated from edugit.org)

resolved all threads

hansegucker commented

2025-02-15 22:15:01 +01:00

(Migrated from edugit.org)

mentioned in commit f0cbe4e13e

mentioned in commit f0cbe4e13ef5c024f1a141064739fed835bd1ac6