Block page for unauthorized users.

main/admin/user_import.php

@@ -387,7 +387,7 @@ function parse_xml_data($file)
 }
 
 $this_section = SECTION_PLATFORM_ADMIN;
-api_protect_admin_script(true, null, 'login');
+api_protect_admin_script(true, null);
 api_protect_limit_for_session_admin();
 
 $defined_auth_sources[] = PLATFORM_AUTH_SOURCE;

main/admin/user_update_import.php

@@ -337,7 +337,7 @@ function parse_xml_data($file)
 }
 
 $this_section = SECTION_PLATFORM_ADMIN;
-api_protect_admin_script(true, null, 'login');
+api_protect_admin_script(true, null);
 
 $defined_auth_sources[] = PLATFORM_AUTH_SOURCE;
 

main/course_info/maintenance.php

@@ -13,7 +13,12 @@ $nameTools = get_lang('Maintenance');
 api_protect_course_script(true);
 api_block_anonymous_users();
 
-Display :: display_header($nameTools);
+// Check access rights (only teachers are allowed here)
+if (!api_is_allowed_to_edit()) {
+    api_not_allowed(true);
+}
+
+Display::display_header($nameTools);
 echo Display::page_header($nameTools);
 
 ?>
@@ -46,5 +51,5 @@ echo Display::page_header($nameTools);
 <div class="sectioncomment"><?php echo get_lang('DescriptionDeleteCourse'); ?></div>
 
 <?php
-// Footer
+
 Display::display_footer();

main/exercise/exercise_report.php

@@ -60,8 +60,14 @@ if (empty($exercise_id)) {
     api_not_allowed(true);
 }
 
-if (!$is_allowedToEdit && !$allowCoachFeedbackExercises) {
-    api_not_allowed(true);
+if ($is_tutor) {
+    if (!$allowCoachFeedbackExercises) {
+        api_not_allowed(true);
+    }
+} else {
+    if (!$is_allowedToEdit) {
+        api_not_allowed(true);
+    }
 }
 
 if (!empty($exercise_id)) {

main/exercise/question_create.php

@@ -14,6 +14,12 @@ $this_section = SECTION_COURSES;
 // notice for unauthorized people.
 api_protect_course_script(true);
 
+$allow = api_is_allowed_to_edit();
+
+if (!$allow) {
+    api_not_allowed(true);
+}
+
 // breadcrumbs
 $interbreadcrumb[] = ["url" => "exercise.php", "name" => get_lang('Exercises')];
 

main/work/work.php

@@ -157,6 +157,11 @@ switch ($action) {
             header('Location: '.$currentUrl);
             exit;
         }
+
+        if (!$is_allowed_to_edit) {
+            api_not_allowed(true);
+        }
+
         $studentDeleteOwnPublication = api_get_course_setting('student_delete_own_publication') == 1 ? 1 : 0;
         /*	Display of tool options */
         $content = settingsForm(