Blocking access if user is not subscribed see BT#6615

main/work/download.php

@@ -12,6 +12,8 @@
 
 session_cache_limiter('public');
 require_once '../inc/global.inc.php';
+require_once 'work.lib.php';
+
 $current_course_tool  = TOOL_STUDENTPUBLICATION;
 
 $this_section = SECTION_COURSES;
@@ -42,6 +44,9 @@ if (!empty($course_info['real_id'])) {
         $full_file_name = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/'.$row['url'];
 
         $item_info = api_get_item_property_info(api_get_course_int_id(), 'work', $row['id']);
+
+        allowOnlySubscribedUser(api_get_user_id(), $row['parent_id'], $course_info['real_id']);
+
         if (empty($item_info)) {
             exit;
         }

main/work/downloadfolder.inc.php

@@ -71,6 +71,9 @@ if (api_is_allowed_to_edit()) {
 
 } else {
     $courseInfo = api_get_course_info();
+
+    allowOnlySubscribedUser(api_get_user_id(), $work_id, $courseInfo['real_id']);
+
     $userCondition = null;
 
     // All users

main/work/edit.php

@@ -178,8 +178,9 @@ if ($form->validate()) {
             if ($is_author) {
                 $work_data = get_work_data_by_id($item_to_edit_id);
 
-                if (!empty($_POST['title']))
+                if (!empty($_POST['title'])) {
                     $title 		 = isset($_POST['title']) ? $_POST['title'] : $work_data['title'];
+                }
                 $description = isset($_POST['description']) ? $_POST['description'] : $work_data['description'];
 
                 if ($is_allowed_to_edit && ($_POST['qualification'] !='' )) {

main/work/upload.php

@@ -35,6 +35,8 @@ if (empty($work_id)) {
     api_not_allowed(true);
 }
 
+allowOnlySubscribedUser($user_id, $work_id, $course_id);
+
 $parent_data = $my_folder_data = get_work_data_by_id($work_id);
 
 if (empty($parent_data)) {

main/work/view.php

@@ -20,6 +20,8 @@ $interbreadcrumb[] = array ('url' => 'work.php', 'name' => get_lang('StudentPubl
 $my_folder_data = get_work_data_by_id($work['parent_id']);
 $course_info = api_get_course_info();
 
+allowOnlySubscribedUser(api_get_user_id(), $work['parent_id'], $course_info['real_id']);
+
 if (user_is_author($id) || $course_info['show_score'] == 0 && $work['active'] == 1 && $work['accepted'] == 1) {
     $url_dir = 'work.php?&id=' . $my_folder_data['id'];
     $interbreadcrumb[] = array ('url' => $url_dir,'name' =>  $my_folder_data['title']);

main/work/work.lib.php

@@ -808,46 +808,14 @@ function display_student_publications_list($id, $my_folder_data, $work_parents,
 
 			if (api_is_allowed_to_edit()) {
                 $cant_files = get_count_work($work_data['id']);
-
-                /*$sql_document = "SELECT count(*)
-                                 FROM $work_table w INNER JOIN $user_table u ON w.user_id = u.user_id
-                                 WHERE w.c_id = $course_id AND w.parent_id = ".$work_data['id']." AND w.active IN (0, 1)";*/
 			} else {
-
-                if (ADD_DOCUMENT_TO_WORK) {
-                    $subscribedUsers = getAllUserToWork($work_data['id'], $course_id);
-                    if (!empty($subscribedUsers)) {
-                        if (!in_array(api_get_user_id(), $subscribedUsers)) {
+                $isSubscribed = userIsSubscribedToWork(api_get_user_id(), $work_data['id'], $course_id);
+                if ($isSubscribed == false) {
                     continue;
                 }
-                    }
-                }
-
                 $cant_files = get_count_work($work_data['id'], api_get_user_id());
-                /*
-                $user_filter = "user_id = ".api_get_user_id()." AND ";
-                if ($course_info['show_score'] == 0) {
-                    $user_filter  = null;
 			}
 
-                $sql_document = "SELECT count(*) FROM $work_table s, $iprop_table p
-                                  WHERE s.c_id = $course_id  AND
-                                        p.c_id = $course_id AND
-                                        s.id = p.ref AND
-                                        p.tool='work' AND
-                                        s.accepted='1' AND
-                                        $user_filter
-                                        parent_id = ".$work_data['id']." AND
-                                        active = 1 AND
-                                        parent_id = ".$work_parent->id."";*/
-			}
-
-
-			//count documents
-			/*$res_document   = Database::query($sql_document);
-			$count_document = Database::fetch_row($res_document);
-			$cant_files     = $count_document[0];*/
-
 			$text_file = get_lang('FilesUpload');
 
 			if ($cant_files == 1) {
@@ -2246,5 +2214,33 @@ function deleteUserToWork($userId, $workId, $courseId)
     Database::delete($table, $params);
 }
 
+function userIsSubscribedToWork($userId, $workId, $courseId)
+{
+    if (ADD_DOCUMENT_TO_WORK == false) {
+        return true;
+    }
+    $subscribedUsers = getAllUserToWork($workId, $courseId);
+    if (empty($subscribedUsers)) {
+        return true;
+    } else {
+        if (in_array($userId, $subscribedUsers)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+function allowOnlySubscribedUser($userId, $workId, $courseId)
+{
+    if (ADD_DOCUMENT_TO_WORK == false) {
+        return true;
+    }
+    if (api_is_platform_admin() || api_is_allowed_to_edit()) {
+        return true;
+    }
+    if (userIsSubscribedToWork($userId, $workId, $courseId) == false) {
+        api_not_allowed(true);
+    }
 
+}
 

main/work/work_list.php

@@ -35,6 +35,8 @@ $courseInfo = api_get_course_info();
 $htmlHeadXtra[] = api_get_jqgrid_js();
 $url_dir = api_get_path(WEB_CODE_PATH).'work/work.php?'.api_get_cidreq();
 
+allowOnlySubscribedUser(api_get_user_id(), $workId, $courseInfo['real_id']);
+
 
 if (!empty($group_id)) {
     $group_properties  = GroupManager :: get_group_properties($group_id);

main/work/work_list_others.php

@@ -38,8 +38,9 @@ if ($courseInfo['show_score'] == 1) {
     api_not_allowed(true);
 }
 
-$htmlHeadXtra[] = api_get_jqgrid_js();
+allowOnlySubscribedUser(api_get_user_id(), $workId, $courseInfo['real_id']);
 
+$htmlHeadXtra[] = api_get_jqgrid_js();
 
 if (!empty($group_id)) {
     $group_properties  = GroupManager :: get_group_properties($group_id);