Skip to content

[Bugfix:Forum] Fix limited grader access checks#12715

Closed
Khine12 wants to merge 4 commits into
Submitty:mainfrom
Khine12:fix-grader-access-full-grading
Closed

[Bugfix:Forum] Fix limited grader access checks#12715
Khine12 wants to merge 4 commits into
Submitty:mainfrom
Khine12:fix-grader-access-full-grading

Conversation

@Khine12

@Khine12 Khine12 commented Apr 1, 2026

Copy link
Copy Markdown
Contributor

Why is this Change Important & Necessary?

Partially addresses #11366
Several forum features incorrectly use accessFullGrading() instead of accessGrading(), excluding limited access graders from functionality they should have as staff members. This follows the same pattern fixed in PR #11358 and PR #11356.

What is the New Behavior?

Limited access graders can now:

Have their forum posts correctly marked as staff posts
View the real names behind anonymous posts
Post in locked threads
Access the forum statistics page

What steps should a reviewer take to reproduce or test the bug or new feature?

Log in as a limited access grader (e.g. ta3)
Create a post and verify it shows staff post styling
View an anonymous post and verify the real author name is visible
Visit a locked thread and verify the grader can reply
Navigate to the forum statistics page and verify access is not blocked

Automated Testing & Documentation

Cypress tests will be added in a follow-up PR as noted in #11358.

Other information

Not a breaking change. No migrations or sysadmin actions required. No security concerns.

Files changed:

ForumController.php — Fixed is_staff_post checks and modifyAnonymous() to use accessGrading()
ForumThreadView.php — Fixed anonymous name visibility, locked thread posting, and stats page access to use accessGrading()

Note:

A full audit identified additional accessFullGrading usages in ElectronicGraderController.php, SubmissionController.php, OfficeHoursQueueModel.php, and Gradeable.php that may also need changing. Maintainer guidance on which of those should use accessGrading() would be appreciated and addressed in a follow-up PR.

@codecov

codecov Bot commented Apr 1, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 21.64%. Comparing base (f532a4f) to head (a7f8651).
⚠️ Report is 10 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff            @@
##               main   #12715   +/-   ##
=========================================
  Coverage     21.64%   21.64%           
  Complexity     9654     9654           
=========================================
  Files           268      268           
  Lines         36244    36244           
  Branches        487      487           
=========================================
  Hits           7845     7845           
  Misses        27916    27916           
  Partials        483      483           
Flag Coverage Δ
autograder 21.32% <ø> (ø)
js 2.04% <ø> (ø)
migrator 100.00% <ø> (ø)
php 20.66% <0.00%> (ø)
python_submitty_utils 80.08% <ø> (ø)
submitty_daemon_jobs 91.13% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Khine12

Khine12 commented Apr 2, 2026

Copy link
Copy Markdown
Contributor Author

The 4 failures in late_submission_warning_messages.spec.js are pre-existing on main (filed as issue #12732) and unrelated to this PR's forum changes. The test appears to be flaky and date-sensitive.

@Christian2147 Christian2147 self-assigned this Apr 3, 2026

@Christian2147 Christian2147 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested this and noticed some of the features you mentioned did not work.

Posting and liking posts worked like it was supposed to for limited access graders. Merging threads also worked properly. However, it seems that most of this stuff worked before too.

However, limited access graders were not able to view anonymous names.

I am also going to add someone else on here to see if we even need all of these features and what limited access graders should be able to do.

@github-project-automation github-project-automation Bot moved this from Seeking Reviewer to Work in Progress in Submitty Development Apr 8, 2026
@automateprojectmangement automateprojectmangement Bot moved this from Work in Progress to In Review in Submitty Development Apr 8, 2026
@Khine12

Khine12 commented Apr 8, 2026

Copy link
Copy Markdown
Contributor Author

I tested this and noticed some of the features you mentioned did not work.

Posting and liking posts worked like it was supposed to for limited access graders. Merging threads also worked properly. However, it seems that most of this stuff worked before too.

However, limited access graders were not able to view anonymous names.

I am also going to add someone else on here to see if we even need all of these features and what limited access graders should be able to do.

I tested this and noticed some of the features you mentioned did not work.

Posting and liking posts worked like it was supposed to for limited access graders. Merging threads also worked properly. However, it seems that most of this stuff worked before too.

However, limited access graders were not able to view anonymous names.

I am also going to add someone else on here to see if we even need all of these features and what limited access graders should be able to do.

Thanks for testing this, Christian! Good to know posting, liking, and merging threads are working correctly.

Regarding anonymous name visibility — I'll investigate and push a fix tonight. I'll also take another look at the PR description and trim any features that were already working before my changes.

Appreciate the detailed feedback!

@Khine12

Khine12 commented Apr 9, 2026

Copy link
Copy Markdown
Contributor Author

I tested this and noticed some of the features you mentioned did not work.

Posting and liking posts worked like it was supposed to for limited access graders. Merging threads also worked properly. However, it seems that most of this stuff worked before too.

However, limited access graders were not able to view anonymous names.

I am also going to add someone else on here to see if we even need all of these features and what limited access graders should be able to do.

Update: I've investigated and pushed the anonymous name visibility fix (commit 328d458). The issue was in ForumThreadView.php — two places where $post->isAnonymous() was setting the display name to "Anonymous" without checking if the viewing user has grading access. Limited access graders should be able to see real names behind anonymous posts, so I added a !$this->core->getUser()->accessGrading() check in both spots.

I've also updated the PR description to remove features that were already working before my changes.

@John-Roy123 John-Roy123 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested viewing forum stats, anonymous messages, and messaging in locked channels and those features seem to work as intended.

@Christian2147

Copy link
Copy Markdown
Contributor

These are not changes that we need/want. The access differences between full access graders and limited access graders are intentional, therefore I am closing this PR.

@github-project-automation github-project-automation Bot moved this from In Review to Done in Submitty Development Apr 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

3 participants