Index: lams_learning/src/java/org/lamsfoundation/lams/learning/export/web/action/MainExportServlet.java =================================================================== diff -u -r6f11dd80335ff2b8a2d06d21f1a49b307ed233c1 -r42d714810532ea8752ea62583ba513a1e1aeef0c --- lams_learning/src/java/org/lamsfoundation/lams/learning/export/web/action/MainExportServlet.java (.../MainExportServlet.java) (revision 6f11dd80335ff2b8a2d06d21f1a49b307ed233c1) +++ lams_learning/src/java/org/lamsfoundation/lams/learning/export/web/action/MainExportServlet.java (.../MainExportServlet.java) (revision 42d714810532ea8752ea62583ba513a1e1aeef0c) @@ -75,7 +75,23 @@ throws ServletException, IOException { doGet(request, response); } - + + /** If it is running from the learner interface then can use the userID from the user object + * If running from the monitoring interface, the learner's userID is supplied by the request parameters. + * + * @return userID + */ + protected Integer getLearnerUserID(HttpServletRequest request) { + Integer userId = WebUtil.readIntParam(request, AttributeNames.PARAM_USER_ID, true); + if ( userId == null ) { + HttpSession session = SessionManager.getSession(); + UserDTO userDto = (UserDTO)session.getAttribute(AttributeNames.USER); + userId = userDto.getUserID(); + } + return userId; + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException, ExportPortfolioException{ @@ -92,9 +108,8 @@ if (mode.equals(ToolAccessMode.LEARNER.toString())) { - HttpSession session = SessionManager.getSession(); - UserDTO userDto = (UserDTO)session.getAttribute(AttributeNames.USER); - Integer userId = userDto.getUserID(); + // TODO check if the user id is coming from the request then the current user should have monitoring privilege + Integer userId = getLearnerUserID(request); lessonID = new Long(WebUtil.readLongParam(request, AttributeNames.PARAM_LESSON_ID)); portfolios = exportService.exportPortfolioForStudent(userId, lessonID, true, cookies); }