Index: lams_central/src/java/org/lamsfoundation/lams/authoring/web/AuthoringAction.java =================================================================== diff -u -rff01a6c237cefc4a5186889bf46041152cfc37ae -r7bba5023611f36fc23efef242a11bb7fa87e9112 --- lams_central/src/java/org/lamsfoundation/lams/authoring/web/AuthoringAction.java (.../AuthoringAction.java) (revision ff01a6c237cefc4a5186889bf46041152cfc37ae) +++ lams_central/src/java/org/lamsfoundation/lams/authoring/web/AuthoringAction.java (.../AuthoringAction.java) (revision 7bba5023611f36fc23efef242a11bb7fa87e9112) @@ -60,6 +60,9 @@ import org.lamsfoundation.lams.learningdesign.service.ILearningDesignService; import org.lamsfoundation.lams.lesson.Lesson; import org.lamsfoundation.lams.monitoring.service.IMonitoringService; +import org.lamsfoundation.lams.monitoring.web.MonitoringAction; +import org.lamsfoundation.lams.security.ISecurityService; +import org.lamsfoundation.lams.security.SecurityException; import org.lamsfoundation.lams.tool.IToolVO; import org.lamsfoundation.lams.tool.ToolContentManager; import org.lamsfoundation.lams.tool.ToolOutputDefinition; @@ -104,6 +107,7 @@ private static ILamsToolService toolService; private static IAuthoringService authoringService; private static ILearningDesignService learningDesignService; + private static ISecurityService securityService; private static int LEARNING_DESIGN_ACCESS_ENTRIES_LIMIT = 7; @@ -460,6 +464,15 @@ Long toolContentID = WebUtil.readLongParam(request, AttributeNames.PARAM_TOOL_CONTENT_ID); String contentFolderID = request.getParameter(AttributeNames.PARAM_CONTENT_FOLDER_ID); Integer organisationID = WebUtil.readIntParam(request, AttributeNames.PARAM_ORGANISATION_ID); + Integer userID = getUserId(); + + try { + getSecurityService().hasOrgRole(organisationID, userID, Role.MONITOR); + } catch (SecurityException e) { + log.error("Cannot add a lesson", e); + response.sendError(HttpServletResponse.SC_FORBIDDEN, "User is not a monitor in the given lesson"); + return null; + } // get title from tool content IToolVO tool = getToolService().getToolByID(toolID); @@ -471,7 +484,6 @@ Long learningDesignID = authoringService.insertSingleActivityLearningDesign(title, toolID, toolContentID, contentFolderID, organisationID); if (learningDesignID != null) { - Integer userID = getUserId(); User user = (User) getUserManagementService().findById(User.class, userID); Lesson lesson = getMonitoringService().initializeLessonWithoutLDcopy(title, "", learningDesignID, user, null, false, false, true, false, false, true, true, false, null, null); @@ -696,4 +708,13 @@ } return AuthoringAction.learningDesignService; } + + private ISecurityService getSecurityService() { + if (securityService == null) { + WebApplicationContext ctx = WebApplicationContextUtils.getRequiredWebApplicationContext(getServlet() + .getServletContext()); + securityService = (ISecurityService) ctx.getBean("securityService"); + } + return securityService; + } } \ No newline at end of file Index: lams_central/src/java/org/lamsfoundation/lams/web/DisplayGroupAction.java =================================================================== diff -u -r9fb16007bc803d29180994effaed30ebb0a2e561 -r7bba5023611f36fc23efef242a11bb7fa87e9112 --- lams_central/src/java/org/lamsfoundation/lams/web/DisplayGroupAction.java (.../DisplayGroupAction.java) (revision 9fb16007bc803d29180994effaed30ebb0a2e561) +++ lams_central/src/java/org/lamsfoundation/lams/web/DisplayGroupAction.java (.../DisplayGroupAction.java) (revision 7bba5023611f36fc23efef242a11bb7fa87e9112) @@ -23,11 +23,9 @@ /* $Id$ */ package org.lamsfoundation.lams.web; -import java.io.IOException; import java.sql.SQLException; import java.util.ArrayList; import java.util.Collections; -import java.util.Comparator; import java.util.Iterator; import java.util.LinkedList; import java.util.List; @@ -47,11 +45,11 @@ import org.lamsfoundation.lams.index.IndexLessonBean; import org.lamsfoundation.lams.index.IndexLinkBean; import org.lamsfoundation.lams.index.IndexOrgBean; -import org.lamsfoundation.lams.learningdesign.dto.LearningLibraryDTO; -import org.lamsfoundation.lams.learningdesign.dto.LibraryActivityDTO; import org.lamsfoundation.lams.learningdesign.service.ILearningDesignService; import org.lamsfoundation.lams.lesson.Lesson; import org.lamsfoundation.lams.lesson.service.LessonService; +import org.lamsfoundation.lams.security.ISecurityService; +import org.lamsfoundation.lams.security.SecurityException; import org.lamsfoundation.lams.usermanagement.Organisation; import org.lamsfoundation.lams.usermanagement.OrganisationState; import org.lamsfoundation.lams.usermanagement.OrganisationType; @@ -75,6 +73,8 @@ private static IUserManagementService service; private static LessonService lessonService; private static ILearningDesignService learningDesignService; + private static ISecurityService securityService; + private Integer stateId = OrganisationState.ACTIVE; @Override @@ -91,6 +91,16 @@ } if (org != null) { + User user = getUser(request.getRemoteUser()); + try { + getSecurityService().hasOrgRole(orgId, user.getUserId(), Role.LEARNER, Role.MONITOR, Role.AUTHOR, + Role.GROUP_MANAGER); + } catch (SecurityException e) { + log.error("Cannot display group", e); + response.sendError(HttpServletResponse.SC_FORBIDDEN, "The user is not a part of the organisation"); + return null; + } + boolean allowSorting = false; List roles = new ArrayList(); List userOrganisationRoles = getService().getUserOrganisationRoles(orgId, @@ -211,10 +221,9 @@ @SuppressWarnings("unchecked") private IndexOrgBean populateContentsOrgBean(IndexOrgBean orgBean, Organisation org, List roles, String username, boolean isSysAdmin) throws SQLException, NamingException { - User user = (User) getService().findByProperty(User.class, "login", username).get(0); - // set lesson beans - Map map = populateLessonBeans(user.getUserId(), org.getOrganisationId(), roles); + Map map = populateLessonBeans(getUser(username).getUserId(), org.getOrganisationId(), + roles); List lessonBeans = IndexUtils.sortLessonBeans(org.getOrderedLessonIds(), map); orgBean.setLessons(lessonBeans); @@ -364,6 +373,10 @@ return map; } + private User getUser(String login) { + return (User) getService().findByProperty(User.class, "login", login).get(0); + } + private IUserManagementService getService() { if (DisplayGroupAction.service == null) { WebApplicationContext ctx = WebApplicationContextUtils.getRequiredWebApplicationContext(getServlet() @@ -390,4 +403,13 @@ } return DisplayGroupAction.learningDesignService; } + + private ISecurityService getSecurityService() { + if (securityService == null) { + WebApplicationContext ctx = WebApplicationContextUtils.getRequiredWebApplicationContext(getServlet() + .getServletContext()); + securityService = (ISecurityService) ctx.getBean("securityService"); + } + return securityService; + } } \ No newline at end of file Index: lams_central/src/java/org/lamsfoundation/lams/web/HomeAction.java =================================================================== diff -u -r3d15dc37d0cc6e60d522cc9e5671bbbe8d017596 -r7bba5023611f36fc23efef242a11bb7fa87e9112 --- lams_central/src/java/org/lamsfoundation/lams/web/HomeAction.java (.../HomeAction.java) (revision 3d15dc37d0cc6e60d522cc9e5671bbbe8d017596) +++ lams_central/src/java/org/lamsfoundation/lams/web/HomeAction.java (.../HomeAction.java) (revision 7bba5023611f36fc23efef242a11bb7fa87e9112) @@ -34,7 +34,6 @@ import java.util.TreeSet; import java.util.Vector; -import javax.servlet.RequestDispatcher; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -58,6 +57,8 @@ import org.lamsfoundation.lams.lesson.dto.LessonDTO; import org.lamsfoundation.lams.lesson.service.ILessonService; import org.lamsfoundation.lams.lesson.util.LessonDTOComparator; +import org.lamsfoundation.lams.security.ISecurityService; +import org.lamsfoundation.lams.security.SecurityException; import org.lamsfoundation.lams.usermanagement.Organisation; import org.lamsfoundation.lams.usermanagement.Role; import org.lamsfoundation.lams.usermanagement.User; @@ -101,6 +102,7 @@ private static ILearningDesignService learningDesignService; private static IGroupUserDAO groupUserDAO; private static IWorkspaceManagementService workspaceManagementService; + private static ISecurityService securityService; /** * request for sysadmin environment @@ -178,7 +180,7 @@ if (!lesson.isLessonAccessibleForLearner()) { return displayMessage(mapping, req, "error.lesson.not.accessible.for.learners"); } - + // show lesson intro page if required and it's not been shown already boolean isLessonIntroWatched = WebUtil.readBooleanParam(req, "isLessonIntroWatched", false); if (lesson.isEnableLessonIntro() && !isLessonIntroWatched) { @@ -202,12 +204,12 @@ } return mapping.findForward("lessonIntro"); } - + if (lesson.getLearnerRestart()) { // start the lesson from the beginning each time getLessonService().removeLearnerProgress(lessonId, user.getUserID()); } - + if (mode != null) { req.setAttribute(AttributeNames.PARAM_MODE, mode); } @@ -224,10 +226,11 @@ /* Date Format for Chat room append */ DateFormat sfm = new SimpleDateFormat("yyyyMMdd_HHmmss"); req.setAttribute(AttributeNames.PARAM_CREATE_DATE_TIME, sfm.format(lesson.getCreateDateTime())); - - //forward to /lams/learning/main.jsp + + // forward to /lams/learning/main.jsp String serverURLContextPath = Configuration.get(ConfigurationKeys.SERVER_URL_CONTEXT_PATH); - serverURLContextPath = serverURLContextPath.startsWith("/") ? serverURLContextPath : "/" + serverURLContextPath; + serverURLContextPath = serverURLContextPath.startsWith("/") ? serverURLContextPath : "/" + + serverURLContextPath; serverURLContextPath += serverURLContextPath.endsWith("/") ? "" : "/"; getServlet().getServletContext().getContext(serverURLContextPath + "learning") .getRequestDispatcher("/main.jsp").forward(req, res); @@ -307,6 +310,7 @@ if (HomeAction.log.isDebugEnabled()) { HomeAction.log.debug("Requested Lesson Monitor"); } + Long lessonId = WebUtil.readLongParam(req, AttributeNames.PARAM_LESSON_ID); UserDTO user = getUser(); if (user == null) { @@ -331,13 +335,20 @@ HttpServletResponse res) throws IOException, UserAccessDeniedException, JSONException, RepositoryCheckedException { UserDTO userDTO = getUser(); + Integer organisationID = new Integer(WebUtil.readIntParam(req, "organisationID")); + try { + getSecurityService().hasOrgRole(organisationID, userDTO.getUserID(), Role.MONITOR, Role.GROUP_MANAGER); + } catch (SecurityException e) { + HomeAction.log.error("Cannot add lesson", e); + res.sendError(HttpServletResponse.SC_FORBIDDEN, "User is not a monitor in the given lesson"); + return null; + } + // get all user accessible folders and LD descriptions as JSON String folderContentsJSON = getWorkspaceManagementService().getFolderContentsJSON(null, userDTO.getUserID(), false); req.setAttribute("folderContents", folderContentsJSON); - - Integer organisationID = new Integer(WebUtil.readIntParam(req, "organisationID")); JSONObject users = new JSONObject(); // get learners available for newly created lesson @@ -395,8 +406,8 @@ RepositoryCheckedException { Integer folderID = WebUtil.readIntParam(req, "folderID", true); boolean allowInvalidDesigns = WebUtil.readBooleanParam(req, "allowInvalidDesigns", false); - String folderContentsJSON = getWorkspaceManagementService().getFolderContentsJSON(folderID, getUser().getUserID(), - allowInvalidDesigns); + String folderContentsJSON = getWorkspaceManagementService().getFolderContentsJSON(folderID, + getUser().getUserID(), allowInvalidDesigns); res.setContentType("application/json;charset=UTF-8"); res.getWriter().print(folderContentsJSON); @@ -516,6 +527,16 @@ return HomeAction.workspaceManagementService; } + private ISecurityService getSecurityService() { + if (HomeAction.securityService == null) { + WebApplicationContext webContext = WebApplicationContextUtils.getRequiredWebApplicationContext(getServlet() + .getServletContext()); + HomeAction.securityService = (ISecurityService) webContext.getBean("securityService"); + } + + return HomeAction.securityService; + } + private UserDTO getUser() { HttpSession ss = SessionManager.getSession(); return (UserDTO) ss.getAttribute(AttributeNames.USER); Index: lams_common/src/java/org/lamsfoundation/lams/commonContext.xml =================================================================== diff -u -rf3fbbb8ec1732de7e5ce51567287b42b55ab33e1 -r7bba5023611f36fc23efef242a11bb7fa87e9112 --- lams_common/src/java/org/lamsfoundation/lams/commonContext.xml (.../commonContext.xml) (revision f3fbbb8ec1732de7e5ce51567287b42b55ab33e1) +++ lams_common/src/java/org/lamsfoundation/lams/commonContext.xml (.../commonContext.xml) (revision 7bba5023611f36fc23efef242a11bb7fa87e9112) @@ -298,6 +298,22 @@ + + + + + + + + + true + + + PROPAGATION_REQUIRED,readOnly + + + + @@ -411,6 +427,11 @@ + + + + + gradebookUserDTOs = new ArrayList(); - - //if leesonID is specified show results based on lesson + + // if leesonID is specified show results based on lesson if (lessonID != null) { - - Lesson lesson = lessonService.getLesson(lessonID); + Lesson lesson = getLessonService().getLesson(lessonID); if (lesson == null) { logger.error("No lesson could be found for: " + lessonID); return null; } + try { + getSecurityService().checkIsLessonMonitor(lessonID, user.getUserID()); + } catch (SecurityException e) { + log.error("Cannot get gradebook", e); + response.sendError(HttpServletResponse.SC_FORBIDDEN, "User is not a monitor in the given lesson"); + return null; + } + if (view == GBGridView.MON_USER || view == GBGridView.MON_COURSE) { - gradebookUserDTOs = gradebookService.getGBUserRowsForLesson(lesson); + gradebookUserDTOs = getGradebookService().getGBUserRowsForLesson(lesson); } else if (view == GBGridView.MON_ACTIVITY) { String rowID = WebUtil.readStrParam(request, AttributeNames.PARAM_ACTIVITY_ID); @@ -237,9 +245,9 @@ // Getting the group id if it is there Long groupId = WebUtil.readLongParam(request, GradebookConstants.PARAM_GROUP_ID, true); - Activity activity = gradebookService.getActivityById(activityID); + Activity activity = getGradebookService().getActivityById(activityID); if (activity != null && activity instanceof ToolActivity) { - gradebookUserDTOs = gradebookService.getGBUserRowsForActivity(lesson, (ToolActivity)activity, groupId); + gradebookUserDTOs = getGradebookService().getGBUserRowsForActivity(lesson, (ToolActivity)activity, groupId); } else { // return null and the grid will report an error logger.error("No activity found for: " + activityID); @@ -250,13 +258,21 @@ //if organisationID is specified (but not lessonID) then show results for organisation } else if (organisationID != null) { - Organisation org = (Organisation) userService.findById(Organisation.class, organisationID); + Organisation org = (Organisation) getUserService().findById(Organisation.class, organisationID); if (org == null) { logger.error("No organisation could be found for: " + organisationID); return null; } - gradebookUserDTOs = gradebookService.getGBUserRowsForOrganisation(org); + try { + getSecurityService().hasOrgRole(organisationID, user.getUserID(), Role.MONITOR); + } catch (SecurityException e) { + log.error(e); + response.sendError(HttpServletResponse.SC_FORBIDDEN, "User is not a monitor in the given organisation"); + return null; + } + + gradebookUserDTOs = getGradebookService().getGBUserRowsForOrganisation(org); } else { logger.error("Missing parameters: either lessonID or organisationID should be specified."); @@ -289,8 +305,6 @@ @SuppressWarnings("unchecked") public ActionForward getCourseGridData(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception { - initServices(); - // Getting the params passed in from the jqGrid int page = WebUtil.readIntParam(request, GradebookConstants.PARAM_PAGE); int rowLimit = WebUtil.readIntParam(request, GradebookConstants.PARAM_ROWS); @@ -302,7 +316,7 @@ String searchString = WebUtil.readStrParam(request, GradebookConstants.PARAM_SEARCH_STRING, true); GBGridView view = GradebookUtil.readGBGridViewParam(request, GradebookConstants.PARAM_VIEW, false); Integer courseID = WebUtil.readIntParam(request, AttributeNames.PARAM_ORGANISATION_ID); - Organisation organisation = (Organisation) userService.findById(Organisation.class, courseID); + Organisation organisation = (Organisation) getUserService().findById(Organisation.class, courseID); // in case of toolbar searching (which uses different parameters than a single field searching) get those parameters if (isSearch && (searchField == null)) { @@ -319,7 +333,7 @@ User user; if (view == GBGridView.MON_USER) { Integer userID = WebUtil.readIntParam(request, GradebookConstants.PARAM_USERID); - user = (User) userService.findById(User.class, userID); + user = (User) getUserService().findById(User.class, userID); } else { user = getRealUser(); } @@ -330,7 +344,7 @@ logger.error("Error: request for course gradebook data with null course or user. CourseID: " + courseID); return null; } - List gradebookLessonDTOs = gradebookService.getGBLessonRows(organisation, user, viewer, view); + List gradebookLessonDTOs = getGradebookService().getGBLessonRows(organisation, user, viewer, view); if (sortBy == null) { sortBy = GradebookConstants.PARAM_ID; @@ -358,17 +372,15 @@ @SuppressWarnings("unchecked") public ActionForward getLessonMarkAggregate(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception { - initServices(); - Long lessonID = WebUtil.readLongParam(request, AttributeNames.PARAM_LESSON_ID); Integer userID = WebUtil.readIntParam(request, GradebookConstants.PARAM_USERID); - Lesson lesson = lessonService.getLesson(lessonID); - User learner = (User) userService.findById(User.class, userID); + Lesson lesson = getLessonService().getLesson(lessonID); + User learner = (User) getUserService().findById(User.class, userID); if (lesson != null && learner != null) { - GradebookUserLesson lessonMark = gradebookService.getGradebookUserLesson(lessonID, userID); + GradebookUserLesson lessonMark = getGradebookService().getGradebookUserLesson(lessonID, userID); writeResponse(response, CONTENT_TYPE_TEXT_PLAIN, ENCODING_UTF8, GradebookUtil.niceFormatting(lessonMark.getMark())); } else { // Grid will handle error, just log and return null @@ -391,8 +403,6 @@ @SuppressWarnings("unchecked") public ActionForward getActivityMarkAverage(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception { - initServices(); - String rowID = WebUtil.readStrParam(request, AttributeNames.PARAM_ACTIVITY_ID); Long activityID = null; @@ -407,10 +417,10 @@ activityID = Long.parseLong(rowID); } - Activity activity = gradebookService.getActivityById(activityID); + Activity activity = getGradebookService().getActivityById(activityID); if (activity != null) { - Double averageMark = gradebookService.getAverageMarkForActivity(activityID, groupID); + Double averageMark = getGradebookService().getAverageMarkForActivity(activityID, groupID); if (averageMark != null) { writeResponse(response, CONTENT_TYPE_TEXT_PLAIN, ENCODING_UTF8, GradebookUtil.niceFormatting(averageMark)); @@ -437,13 +447,11 @@ @SuppressWarnings("unchecked") public ActionForward getLessonMarkAverage(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception { - initServices(); - Long lessonID = WebUtil.readLongParam(request, AttributeNames.PARAM_LESSON_ID); - Lesson lesson = lessonService.getLesson(lessonID); + Lesson lesson = getLessonService().getLesson(lessonID); if (lesson != null) { - Double averageMark = gradebookService.getAverageMarkForLesson(lessonID); + Double averageMark = getGradebookService().getAverageMarkForLesson(lessonID); if (averageMark != null) { writeResponse(response, CONTENT_TYPE_TEXT_PLAIN, ENCODING_UTF8, GradebookUtil.niceFormatting(averageMark)); @@ -473,12 +481,6 @@ } } - private void initServices() { - getUserService(); - getLessonService(); - getGradebookService(); - } - private IUserManagementService getUserService() { if (userService == null) { WebApplicationContext ctx = WebApplicationContextUtils.getRequiredWebApplicationContext(getServlet() @@ -506,4 +508,13 @@ return gradebookService; } + private ISecurityService getSecurityService() { + if (GradebookAction.securityService == null) { + WebApplicationContext webContext = WebApplicationContextUtils.getRequiredWebApplicationContext(getServlet() + .getServletContext()); + GradebookAction.securityService = (ISecurityService) webContext.getBean("securityService"); + } + + return GradebookAction.securityService; + } } Index: lams_learning/src/java/org/lamsfoundation/lams/learning/export/service/ExportPortfolioServiceProxy.java =================================================================== diff -u -rf1584f80ad72ef3c942e13b1ed715fcb2b7c5e92 -r7bba5023611f36fc23efef242a11bb7fa87e9112 --- lams_learning/src/java/org/lamsfoundation/lams/learning/export/service/ExportPortfolioServiceProxy.java (.../ExportPortfolioServiceProxy.java) (revision f1584f80ad72ef3c942e13b1ed715fcb2b7c5e92) +++ lams_learning/src/java/org/lamsfoundation/lams/learning/export/service/ExportPortfolioServiceProxy.java (.../ExportPortfolioServiceProxy.java) (revision 7bba5023611f36fc23efef242a11bb7fa87e9112) @@ -27,6 +27,7 @@ import javax.servlet.ServletContext; import org.lamsfoundation.lams.lesson.service.ILessonService; +import org.lamsfoundation.lams.security.ISecurityService; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.support.WebApplicationContextUtils; @@ -50,4 +51,9 @@ public static final ILessonService getLessonService(ServletContext servletContext) { return (ILessonService) ExportPortfolioServiceProxy.getDomainService(servletContext, "lessonService"); } + + + public static final ISecurityService getSecurityService(ServletContext servletContext) { + return (ISecurityService) ExportPortfolioServiceProxy.getDomainService(servletContext, "securityService"); + } } \ No newline at end of file Index: lams_learning/src/java/org/lamsfoundation/lams/learning/export/web/action/MainExportServlet.java =================================================================== diff -u -rf1584f80ad72ef3c942e13b1ed715fcb2b7c5e92 -r7bba5023611f36fc23efef242a11bb7fa87e9112 --- lams_learning/src/java/org/lamsfoundation/lams/learning/export/web/action/MainExportServlet.java (.../MainExportServlet.java) (revision f1584f80ad72ef3c942e13b1ed715fcb2b7c5e92) +++ lams_learning/src/java/org/lamsfoundation/lams/learning/export/web/action/MainExportServlet.java (.../MainExportServlet.java) (revision 7bba5023611f36fc23efef242a11bb7fa87e9112) @@ -54,8 +54,10 @@ import org.lamsfoundation.lams.learning.export.Portfolio; import org.lamsfoundation.lams.learning.export.service.ExportPortfolioServiceProxy; import org.lamsfoundation.lams.learning.export.service.IExportPortfolioService; +import org.lamsfoundation.lams.lesson.LearnerProgress; import org.lamsfoundation.lams.lesson.Lesson; import org.lamsfoundation.lams.lesson.service.ILessonService; +import org.lamsfoundation.lams.security.ISecurityService; import org.lamsfoundation.lams.tool.ToolAccessMode; import org.lamsfoundation.lams.usermanagement.User; import org.lamsfoundation.lams.usermanagement.dto.UserDTO; @@ -111,17 +113,33 @@ IExportPortfolioService exportService = ExportPortfolioServiceProxy.getExportPortfolioService(this .getServletContext()); ILessonService lessonService = ExportPortfolioServiceProxy.getLessonService(this.getServletContext()); + ISecurityService securityService = ExportPortfolioServiceProxy.getSecurityService(this + .getServletContext()); Lesson lesson = lessonService.getLesson(lessonID); if (mode.equals(ToolAccessMode.LEARNER.toString())) { if (!lesson.getLearnerExportAvailable()) { - throw new ExportPortfolioException("This lesson does not allow export portfolio for learners"); + throw new ExportPortfolioException("Lesson with ID: " + lesson.getLessonId() + + " does not allow export portfolio for learners"); } ToolAccessMode accessMode = ToolAccessMode.TEACHER.toString().equals(role) ? ToolAccessMode.TEACHER : null; - boolean canExport = isPartOfClass(lesson, currentUserId, accessMode != null); - if (!canExport) { - throw new ExportPortfolioException("User " + currentUserId + " is not a participant in lesson " - + lessonID + " and may not export portfolio"); + + try { + if (accessMode == null) { + securityService.checkIsLessonLearner(lesson.getLessonId(), currentUserId); + LearnerProgress learnerProgress = lessonService.getUserProgressForLesson(currentUserId, + lesson.getLessonId()); + if (learnerProgress == null || !learnerProgress.isComplete()) { + throw new ExportPortfolioException("Learner with ID: " + currentUserId + + " has not finished lesson with ID: " + lesson.getLessonId()); + } + } else { + securityService.checkIsLessonMonitor(lesson.getLessonId(), currentUserId); + } + } catch (SecurityException e) { + log.error("Cannot export portfolion", e); + response.sendError(HttpServletResponse.SC_FORBIDDEN, "The user is not a monitor in the lesson"); + return; } portfolios = exportService.exportPortfolioForStudent(userIdParam == null ? currentUserId : userIdParam, @@ -131,10 +149,12 @@ exportFilename = ExportPortfolioConstants.EXPORT_LEARNER_PREFIX + " " + portfolios.getLessonName() + " " + learnerLogin + ".zip"; } else if (mode.equals(ToolAccessMode.TEACHER.toString())) { - boolean canExport = isPartOfClass(lesson, currentUserId, true); - if (!canExport) { - throw new ExportPortfolioException("User " + currentUserId + " is not a participant in lesson " - + lessonID + " and may not export portfolio"); + try { + securityService.checkIsLessonMonitor(lesson.getLessonId(), currentUserId); + } catch (SecurityException e) { + log.error("Cannot export portfolion", e); + response.sendError(HttpServletResponse.SC_FORBIDDEN, "The user is not a monitor in the lesson"); + return; } // done in the monitoring environment @@ -301,23 +321,4 @@ MainExportServlet.log.error("Unable to correct imagefolder links in file " + filename, e); } } - - private boolean isPartOfClass(Lesson lesson, Integer userId, boolean isTeacher) { - Set users = null; - if (isTeacher) { - users = lesson.getLessonClass().getStaffGroup().getUsers(); - } else { - users = lesson.getLessonClass().getLearnersGroup().getUsers(); - } - - // slightly easier than getting user from some other service and using collection methods, like contains() - boolean result = false; - for (User user : users) { - if (user.getUserId().equals(userId)) { - result = true; - break; - } - } - return result; - } } \ No newline at end of file Index: lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/monitoringApplicationContext.xml =================================================================== diff -u -rf3fbbb8ec1732de7e5ce51567287b42b55ab33e1 -r7bba5023611f36fc23efef242a11bb7fa87e9112 --- lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/monitoringApplicationContext.xml (.../monitoringApplicationContext.xml) (revision f3fbbb8ec1732de7e5ce51567287b42b55ab33e1) +++ lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/monitoringApplicationContext.xml (.../monitoringApplicationContext.xml) (revision 7bba5023611f36fc23efef242a11bb7fa87e9112) @@ -46,6 +46,7 @@ + Index: lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/service/MonitoringService.java =================================================================== diff -u -r3638ab2de0f89c52b5d5af5bbfe49f115bf8020e -r7bba5023611f36fc23efef242a11bb7fa87e9112 --- lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/service/MonitoringService.java (.../MonitoringService.java) (revision 3638ab2de0f89c52b5d5af5bbfe49f115bf8020e) +++ lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/service/MonitoringService.java (.../MonitoringService.java) (revision 7bba5023611f36fc23efef242a11bb7fa87e9112) @@ -88,6 +88,7 @@ import org.lamsfoundation.lams.logevent.service.ILogEventService; import org.lamsfoundation.lams.monitoring.MonitoringConstants; import org.lamsfoundation.lams.monitoring.dto.ContributeActivityDTO; +import org.lamsfoundation.lams.security.ISecurityService; import org.lamsfoundation.lams.tool.ToolSession; import org.lamsfoundation.lams.tool.exception.LamsToolServiceException; import org.lamsfoundation.lams.tool.exception.ToolException; @@ -180,6 +181,8 @@ private ILamsCoreToolService lamsCoreToolService; private IUserManagementService userManagementService; + + private ISecurityService securityService; private Scheduler scheduler; @@ -228,6 +231,10 @@ public void setUserManagementService(IUserManagementService userManagementService) { this.userManagementService = userManagementService; } + + public void setSecurityService(ISecurityService securityService) { + this.securityService = securityService; + } /** * @param learningDesignDAO @@ -388,6 +395,8 @@ Boolean learnerImAvailable, Boolean liveEditEnabled, Boolean enableLessonNotifications, Boolean learnerRestart, Integer scheduledNumberDaysToLessonFinish, Long precedingLessonId) { + securityService.hasOrgRole(organisationId, userID, Role.MONITOR); + LearningDesign originalLearningDesign = authoringService.getLearningDesign(new Long(learningDesignId)); if (originalLearningDesign == null) { throw new MonitoringServiceException("Learning design for id=" + learningDesignId @@ -441,7 +450,7 @@ + " is missing. Unable to initialize lesson."); } User user = userID != null ? (User) baseDAO.find(User.class, userID) : null; - + return initializeLesson(lessonName, lessonDescription, originalLearningDesign, user, null, LearningDesign.COPY_TYPE_PREVIEW, customCSV, false, false, false, learnerPresenceAvailable, learnerImAvailable, liveEditEnabled, true, false, null, null); @@ -472,7 +481,6 @@ Boolean displayDesignImage, Boolean learnerExportAvailable, Boolean learnerPresenceAvailable, Boolean learnerImAvailable, Boolean liveEditEnabled, Boolean enableLessonNotifications, Boolean learnerRestart, Integer scheduledNumberDaysToLessonFinish, Lesson precedingLesson) { - // copy the current learning design LearningDesign copiedLearningDesign = authoringService.copyLearningDesign(originalLearningDesign, new Integer( copyType), user, workspaceFolder, true, null, customCSV); @@ -554,7 +562,6 @@ } @Override - @SuppressWarnings("unchecked") public Lesson createLessonClassForLesson(long lessonId, Organisation organisation, String learnerGroupName, List organizationUsers, String staffGroupName, List staffs, Integer userId) { Lesson newLesson = lessonDAO.getLesson(new Long(lessonId)); Index: lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/MonitoringAction.java =================================================================== diff -u -r1d2ff22c947ab0d5646bb02b8189ca668020bdbc -r7bba5023611f36fc23efef242a11bb7fa87e9112 --- lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/MonitoringAction.java (.../MonitoringAction.java) (revision 1d2ff22c947ab0d5646bb02b8189ca668020bdbc) +++ lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/MonitoringAction.java (.../MonitoringAction.java) (revision 7bba5023611f36fc23efef242a11bb7fa87e9112) @@ -74,6 +74,8 @@ import org.lamsfoundation.lams.monitoring.dto.ContributeActivityDTO; import org.lamsfoundation.lams.monitoring.service.IMonitoringService; import org.lamsfoundation.lams.monitoring.service.MonitoringServiceProxy; +import org.lamsfoundation.lams.security.ISecurityService; +import org.lamsfoundation.lams.security.SecurityException; import org.lamsfoundation.lams.timezone.service.ITimezoneService; import org.lamsfoundation.lams.tool.exception.LamsToolServiceException; import org.lamsfoundation.lams.usermanagement.Organisation; @@ -141,7 +143,10 @@ private static ITimezoneService timezoneService; private static ILessonService lessonService; + + private static ISecurityService securityService; + private Integer getUserId() { HttpSession ss = SessionManager.getSession(); UserDTO user = (UserDTO) ss.getAttribute(AttributeNames.USER); @@ -365,10 +370,18 @@ + (splitNumberLessons == null ? "" : "(" + lessonIndex + "/" + splitNumberLessons + ") ") + "\"" + lessonInstanceName + "\""); } - Lesson lesson = monitoringService.initializeLesson(lessonInstanceName, introDescription, ldId, - organisationId, userId, null, introEnable, introImage, portfolioEnable, presenceEnable, imEnable, - enableLiveEdit, notificationsEnable, learnerRestart, timeLimitIndividual, precedingLessonId); + Lesson lesson = null; + try { + lesson = monitoringService.initializeLesson(lessonInstanceName, introDescription, ldId, organisationId, + userId, null, introEnable, introImage, portfolioEnable, presenceEnable, imEnable, + enableLiveEdit, notificationsEnable, learnerRestart, timeLimitIndividual, precedingLessonId); + } catch (SecurityException e) { + log.error("Cannot add a lesson for LD: " + ldId, e); + response.sendError(HttpServletResponse.SC_FORBIDDEN, "User is not a monitor in the given lesson"); + return null; + } + monitoringService.createLessonClassForLesson(lesson.getLessonId(), organisation, learnerGroupInstanceName, lessonInstanceLearners, staffGroupInstanceName, staff, userId); @@ -842,11 +855,15 @@ DateFormat sfm = new SimpleDateFormat("yyyyMMdd_HHmmss"); lessonDTO.setCreateDateTimeStr(sfm.format(lessonDTO.getCreateDateTime())); } + + try { + getSecurityService().checkIsLessonMonitor(lessonId, user.getUserID()); + } catch (SecurityException e) { + log.error("Cannot monitor lesson", e); + response.sendError(HttpServletResponse.SC_FORBIDDEN, "User is not a monitor in the given lesson"); + return null; + } - IMonitoringService monitoringService = MonitoringServiceProxy.getMonitoringService(getServlet() - .getServletContext()); - monitoringService.checkOwnerOrStaffMember(user.getUserID(), lessonId, "monitor lesson"); - // should info box on Sequence tab be displayed? Short sequenceTabInfoShowCount = (Short) ss.getAttribute("sequenceTabInfoShowCount"); if (sequenceTabInfoShowCount == null) { @@ -1203,6 +1220,15 @@ } return MonitoringAction.lessonService; } + + private ISecurityService getSecurityService() { + if (MonitoringAction.securityService == null) { + WebApplicationContext ctx = WebApplicationContextUtils.getRequiredWebApplicationContext(getServlet() + .getServletContext()); + MonitoringAction.securityService = (ISecurityService) ctx.getBean("securityService"); + } + return MonitoringAction.securityService; + } /** * Set whether or not the export portfolio button is available in learner. Expects parameters lessonID and