authors should have perms on videos as well

elan-ev · Nov 28, 2024 · c05d4d0 · c05d4d0
1 parent a897494
commit c05d4d0
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 4 deletions.
diff --git a/app/controllers/redirect.php b/app/controllers/redirect.php
@@ -185,13 +185,11 @@ private function getLtiLinkFor($lti, $endpoint)
      */
     public function preview_action($token)
     {
-        global $user, $perm;
-
         $this->set_layout(null);
 
         $video = Videos::findByToken($token);
 
-        if (!$video->getUserPerm($user->id)) {
+        if (!$video->getUserPerm()) {
             throw new \Exception('Access denied!');
         }
 

diff --git a/lib/Models/Videos.php b/lib/Models/Videos.php
@@ -547,7 +547,7 @@ private function getSeminarVisibility($cid, $playlist_id)
      *
      * @return string $perm the perm value
      */
-    public function getUserPerm($user_id = null, $course_id = null)
+    public function getUserPerm($user_id = null)
     {
         global $user, $perm;
 
@@ -572,6 +572,13 @@ public function getUserPerm($user_id = null, $course_id = null)
             }
         }
 
+        if (!$ret_perm) {
+            // check if at least read perms are present due to course participation
+            if ($this->haveCoursePerm('user')) {
+                return 'read';
+            }
+        }
+
         return $ret_perm;
     }