diff --git a/certificates/index.php b/certificates/index.php
index 5619454eb6..d33b879a46 100755
--- a/certificates/index.php
+++ b/certificates/index.php
@@ -20,6 +20,13 @@ $certificate = new Certificate($_GET['id']);
switch ($action) {
case 'export':
+ if (
+ api_is_student() &&
+ api_get_configuration_value('hide_certificate_export_link_students')
+ ) {
+ api_not_allowed(true);
+ }
+
$certificate->generate(array('hide_print_button' => true));
if ($certificate->html_file_is_generated()) {
diff --git a/main/announcements/announcements.inc.php b/main/announcements/announcements.inc.php
index d20f58851e..bdd0ab91f8 100755
--- a/main/announcements/announcements.inc.php
+++ b/main/announcements/announcements.inc.php
@@ -152,7 +152,7 @@ class AnnouncementManager
* Displays one specific announcement
* @param int $announcement_id, the id of the announcement you want to display
*/
- public static function display_announcement($announcement_id)
+ public static function display_announcement($announcement_id, $allowToEdit)
{
if ($announcement_id != strval(intval($announcement_id))) {
return false;
@@ -164,7 +164,7 @@ class AnnouncementManager
$course_id = api_get_course_int_id();
- if (api_is_allowed_to_edit(false, true) || (api_get_course_setting('allow_user_edit_announcement') && !api_is_anonymous())) {
+ if ($allowToEdit) {
$sql_query = " SELECT announcement.*, toolitemproperties.*
FROM $tbl_announcement announcement, $tbl_item_property toolitemproperties
WHERE announcement.id = toolitemproperties.ref
@@ -174,7 +174,6 @@ class AnnouncementManager
toolitemproperties.c_id = $course_id
ORDER BY display_order DESC";
} else {
-
$group_list = GroupManager::get_group_ids($course_id, api_get_user_id());
if (empty($group_list)) {
$group_list[] = 0;
@@ -212,7 +211,7 @@ class AnnouncementManager
echo "
";
echo "" . $title . " |
";
- if (api_is_allowed_to_edit(false, true) || (api_get_course_setting('allow_user_edit_announcement') && !api_is_anonymous())) {
+ if ($allowToEdit) {
$modify_icons = "" . Display::return_icon('edit.png', get_lang('Edit'), '', ICON_SIZE_SMALL) . "";
if ($result['visibility'] == 1) {
$image_visibility = "visible";
diff --git a/main/announcements/announcements.php b/main/announcements/announcements.php
index 883e5cdf98..b1ef9fefa3 100755
--- a/main/announcements/announcements.php
+++ b/main/announcements/announcements.php
@@ -29,10 +29,26 @@ $this_section=SECTION_COURSES;
$nameTools = get_lang('ToolAnnouncement');
//session
-if(isset($_GET['id_session'])) {
+if (isset($_GET['id_session'])) {
$_SESSION['id_session'] = intval($_GET['id_session']);
}
+$allowToEdit = (
+ api_is_allowed_to_edit(false, true) ||
+ (api_get_course_setting('allow_user_edit_announcement') && !api_is_anonymous())
+);
+
+$sessionId = api_get_session_id();
+$drhHasAccessToSessionContent = api_get_configuration_value('drh_can_access_all_session_content');
+
+if (!empty($sessionId)) {
+ $allowToEdit = $allowToEdit && api_is_allowed_to_session_edit(false, true);
+}
+
+if (!empty($sessionId) && $drhHasAccessToSessionContent) {
+ $allowToEdit = $allowToEdit || api_is_drh();
+}
+
/* ACCESS RIGHTS */
api_protect_course_script(true);
@@ -48,10 +64,10 @@ $maximum = '12';
$length = '36';
// Database Table Definitions
-$tbl_courses = Database::get_main_table(TABLE_MAIN_COURSE);
-$tbl_sessions = Database::get_main_table(TABLE_MAIN_SESSION);
-$tbl_announcement = Database::get_course_table(TABLE_ANNOUNCEMENT);
-$tbl_item_property = Database::get_course_table(TABLE_ITEM_PROPERTY);
+$tbl_courses = Database::get_main_table(TABLE_MAIN_COURSE);
+$tbl_sessions = Database::get_main_table(TABLE_MAIN_SESSION);
+$tbl_announcement = Database::get_course_table(TABLE_ANNOUNCEMENT);
+$tbl_item_property = Database::get_course_table(TABLE_ITEM_PROPERTY);
/* Libraries */
@@ -76,9 +92,7 @@ $safe_newContent = isset($_POST['newContent']) ? $_POST['newContent'] : null;
$content_to_modify = $title_to_modify = '';
if (!empty($_POST['To'])) {
- if (api_get_session_id()!=0 &&
- api_is_allowed_to_session_edit(false, true) == false
- ) {
+ if (!$allowToEdit) {
api_not_allowed(true);
}
$display_form = true;
@@ -121,7 +135,7 @@ $origin = isset($_GET['origin']) ? Security::remove_XSS($_GET['origin']) : null;
if (((!empty($_GET['action']) && $_GET['action'] == 'add') && $_GET['origin'] == "") ||
(!empty($_GET['action']) && $_GET['action'] == 'edit') || !empty($_POST['To'])
) {
- if (api_get_session_id()!=0 && api_is_allowed_to_session_edit(false,true) == false) {
+ if (api_get_session_id() != 0 && !$allowToEdit) {
api_not_allowed(true);
}
$display_form = true;
@@ -181,14 +195,12 @@ if (!empty($group_id)) {
$announcement_id = isset($_GET['id']) ? intval($_GET['id']) : null;
$message = null;
-if (empty($_GET['origin']) or $_GET['origin'] !== 'learnpath') {
+if (empty($_GET['origin']) || $_GET['origin'] !== 'learnpath') {
//we are not in the learning path
- Display::display_header($nameTools,get_lang('Announcements'));
+ Display::display_header($nameTools, get_lang('Announcements'));
}
-if (api_is_allowed_to_edit(false,true) OR
- (api_get_course_setting('allow_user_edit_announcement') && !api_is_anonymous())
-) {
+if ($allowToEdit) {
/*
Change visibility of announcement
*/
@@ -197,9 +209,6 @@ if (api_is_allowed_to_edit(false,true) OR
// change visibility -> studentview -> course manager view
if (!isset($_GET['isStudentView']) || $_GET['isStudentView']!='false') {
if (isset($_GET['id']) AND $_GET['id'] AND isset($_GET['action']) AND $_GET['action']=="showhide") {
- if (api_get_session_id()!=0 && api_is_allowed_to_session_edit(false,true)==false) {
- api_not_allowed();
- }
if (!api_is_course_coach() || api_is_element_in_the_session(TOOL_ANNOUNCEMENT, $_GET['id'])) {
if ($ctok == $_GET['sec_token']) {
AnnouncementManager::change_visibility_announcement($_course, $_GET['id']);
@@ -212,9 +221,6 @@ if (api_is_allowed_to_edit(false,true) OR
/* Delete announcement */
if (!empty($_GET['action']) && $_GET['action']=='delete' && isset($_GET['id'])) {
$id = intval($_GET['id']);
- if (api_get_session_id()!=0 && api_is_allowed_to_session_edit(false, true) == false) {
- api_not_allowed();
- }
if (!api_is_course_coach() || api_is_element_in_the_session(TOOL_ANNOUNCEMENT, $id)) {
// tooledit : visibility = 2 : only visible for platform administrator
@@ -230,7 +236,7 @@ if (api_is_allowed_to_edit(false,true) OR
}
}
- //delete attachment file
+ // Delete attachment file
if (isset($_GET['action']) && $_GET['action'] == 'delete_attachment') {
$id = $_GET['id_attach'];
if ($ctok == $_GET['sec_token']) {
@@ -253,10 +259,6 @@ if (api_is_allowed_to_edit(false,true) OR
/* Modify announcement */
if (!empty($_GET['action']) and $_GET['action']=='modify' AND isset($_GET['id'])) {
- if (api_get_session_id()!=0 && api_is_allowed_to_session_edit(false,true)==false) {
- api_not_allowed();
- }
-
$display_form = true;
// RETRIEVE THE CONTENT OF THE ANNOUNCEMENT TO MODIFY
@@ -415,7 +417,6 @@ if (api_is_allowed_to_edit(false,true) OR
if ($_POST['email_ann'] && empty($_POST['onlyThoseMails'])) {
AnnouncementManager::send_email($insert_id, $sendToUsersInSession);
}
-
} // end condition token
} // isset
@@ -446,10 +447,9 @@ if (empty($_GET['origin']) || $_GET['origin'] !== 'learnpath') {
$session_id = api_get_session_id();
$condition_session = api_get_session_condition($session_id, true, true);
-if (api_is_allowed_to_edit(false,true)) {
+if ($allowToEdit) {
// check teacher status
if (empty($_GET['origin']) or $_GET['origin'] !== 'learnpath') {
-
if (api_get_group_id() == 0) {
$group_condition = "";
} else {
@@ -471,7 +471,7 @@ if (api_is_allowed_to_edit(false,true)) {
} else {
// students only get to see the visible announcements
if (empty($_GET['origin']) or $_GET['origin'] !== 'learnpath') {
- $group_memberships=GroupManager::get_group_ids($_course['real_id'], $_user['user_id']);
+ $group_memberships = GroupManager::get_group_ids($_course['real_id'], $_user['user_id']);
if ((api_get_course_setting('allow_user_edit_announcement') && !api_is_anonymous())) {
@@ -565,7 +565,7 @@ $announcement_number = Database::num_rows($result);
*/
$show_actions = false;
-if ((api_is_allowed_to_edit(false,true) OR (api_get_course_setting('allow_user_edit_announcement') && !api_is_anonymous())) and (empty($_GET['origin']) or $_GET['origin'] !== 'learnpath')) {
+if ($allowToEdit && (empty($_GET['origin']) or $_GET['origin'] !== 'learnpath')) {
echo '';
if (isset($_GET['action']) && in_array($_GET['action'], array('add', 'modify','view'))) {
echo "
".Display::return_icon('back.png',get_lang('Back'),'',ICON_SIZE_MEDIUM)."";
@@ -576,7 +576,8 @@ if ((api_is_allowed_to_edit(false,true) OR (api_get_course_setting('allow_user_e
} else {
if (in_array($_GET['action'], array('view'))) {
echo '
';
}
}
@@ -595,18 +596,18 @@ if (api_is_allowed_to_edit() && $announcement_number > 1) {
if ($show_actions)
echo '
';
-
// ANNOUNCEMENTS LIST
if ($message) {
Display::display_confirmation_message($message);
$display_announcement_list = true;
- $display_form = false;
+ $display_form = false;
}
+
if (!empty($error_message)) {
Display::display_error_message($error_message);
$display_announcement_list = false;
- $display_form = true;
+ $display_form = true;
}
/*
@@ -614,12 +615,10 @@ if (!empty($error_message)) {
*/
if ($display_form) {
-
$content_to_modify = stripslashes($content_to_modify);
$title_to_modify = stripslashes($title_to_modify);
// DISPLAY ADD ANNOUNCEMENT COMMAND
- //echo '