[Bugfix:Forum] Fix limited grader access checks#12715
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #12715 +/- ##
=========================================
Coverage 21.64% 21.64%
Complexity 9654 9654
=========================================
Files 268 268
Lines 36244 36244
Branches 487 487
=========================================
Hits 7845 7845
Misses 27916 27916
Partials 483 483
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
The 4 failures in late_submission_warning_messages.spec.js are pre-existing on main (filed as issue #12732) and unrelated to this PR's forum changes. The test appears to be flaky and date-sensitive. |
Christian2147
left a comment
There was a problem hiding this comment.
I tested this and noticed some of the features you mentioned did not work.
Posting and liking posts worked like it was supposed to for limited access graders. Merging threads also worked properly. However, it seems that most of this stuff worked before too.
However, limited access graders were not able to view anonymous names.
I am also going to add someone else on here to see if we even need all of these features and what limited access graders should be able to do.
Thanks for testing this, Christian! Good to know posting, liking, and merging threads are working correctly. Regarding anonymous name visibility — I'll investigate and push a fix tonight. I'll also take another look at the PR description and trim any features that were already working before my changes. Appreciate the detailed feedback! |
Update: I've investigated and pushed the anonymous name visibility fix (commit 328d458). The issue was in I've also updated the PR description to remove features that were already working before my changes. |
John-Roy123
left a comment
There was a problem hiding this comment.
I tested viewing forum stats, anonymous messages, and messaging in locked channels and those features seem to work as intended.
|
These are not changes that we need/want. The access differences between full access graders and limited access graders are intentional, therefore I am closing this PR. |
Why is this Change Important & Necessary?
Partially addresses #11366
Several forum features incorrectly use accessFullGrading() instead of accessGrading(), excluding limited access graders from functionality they should have as staff members. This follows the same pattern fixed in PR #11358 and PR #11356.
What is the New Behavior?
Limited access graders can now:
Have their forum posts correctly marked as staff posts
View the real names behind anonymous posts
Post in locked threads
Access the forum statistics page
What steps should a reviewer take to reproduce or test the bug or new feature?
Log in as a limited access grader (e.g. ta3)
Create a post and verify it shows staff post styling
View an anonymous post and verify the real author name is visible
Visit a locked thread and verify the grader can reply
Navigate to the forum statistics page and verify access is not blocked
Automated Testing & Documentation
Cypress tests will be added in a follow-up PR as noted in #11358.
Other information
Not a breaking change. No migrations or sysadmin actions required. No security concerns.
Files changed:
ForumController.php — Fixed is_staff_post checks and modifyAnonymous() to use accessGrading()
ForumThreadView.php — Fixed anonymous name visibility, locked thread posting, and stats page access to use accessGrading()
Note:
A full audit identified additional accessFullGrading usages in ElectronicGraderController.php, SubmissionController.php, OfficeHoursQueueModel.php, and Gradeable.php that may also need changing. Maintainer guidance on which of those should use accessGrading() would be appreciated and addressed in a follow-up PR.