Tutors able to create page when Group's "End date" is set to the past

Bug #1758769 reported by Steven
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Mahara
Fix Released
Medium
Cecilia Vela Gurovic

Bug Description

Environment tested: Master
Browser tested: Chrome

===================
Manual Test Script
===================

Preconditions:
1) Group exists

Test Steps:
1) Group admin sets "End date" to yesterday's date
2) Group member visits group and tries to add a new page under Pages and collections

Actual result:

1) User click add page:
------------------------
user is redirected to the newly created page with an error message "Access denied You do not have access to view this page." ✔ (expected)
The page has been created and can be seen from Pages and collections page. ✘

2) User click Copy:
--------------------
User gets "Access denied You do not have access to view this page." page error and No new copy is created ✔ (expected)

3) User clicks Add collection:
-------------------------------
User is allowed to create a new collection as normal ✘

Expected result:
user should not see the add or copy button when the Group's "End date" is set to the past

Catalyst QA

Changed in mahara:
status: New → Confirmed
importance: Undecided → Medium
milestone: none → 18.10.0
Changed in mahara:
assignee: nobody → Cecilia Vela Gurovic (ceciliavg)
status: Confirmed → In Progress
Revision history for this message
Cecilia Vela Gurovic (ceciliavg) wrote :

I can't replicate: I followed the steps and after setting the end date for a group, any normal member will not see the Add or Copy buttons in Pages and Collections tab for the group. See image attached
Am I missing any step?

Changed in mahara:
status: In Progress → Incomplete
Revision history for this message
Kristina Hoeppner (kris-hoeppner) wrote :

No matter the end date, the copy button should always be visible as it doesn't affect the creation of pages because the copy will be made in the user's personal portfolio space.

Can't replicate it either on master. I'll check with Steven.

Changed in mahara:
status: Incomplete → In Progress
Revision history for this message
Cecilia Vela Gurovic (ceciliavg) wrote :

Following step of the test should say the member needs to be a tutor
2) Group member visits group and tries to add a new page under Pages and collections

Revision history for this message
Mahara Bot (dev-mahara) wrote : A patch has been submitted for review

Patch for "master" branch: https://reviews.mahara.org/8748

Revision history for this message
Kristina Hoeppner (kris-hoeppner) wrote :

Tutors and admins should be able to edit pages outside of the editability window. Only regular members can't.

The "Copy" button that was mentioned earlier is the one next to the "Add" button, not the copy button I meant being able to copy a page in your own portfolio.

summary: - Users able to create page when Group's "End date" is set to the past
+ Tutors able to create page when Group's "End date" is set to the past
Revision history for this message
Mahara Bot (dev-mahara) wrote : A change has been merged

Reviewed: https://reviews.mahara.org/8748
Committed: https://git.mahara.org/mahara/mahara/commit/a6a9a12d82321346d84724ebb26b0d53ea381173
Submitter: Robert Lyon (<email address hidden>)
Branch: master

commit a6a9a12d82321346d84724ebb26b0d53ea381173
Author: Cecilia Vela Gurovic <email address hidden>
Date: Wed Mar 28 13:51:42 2018 +1300

Bug 1758769: Tutor role creates group views outside group edit window

outside the group edit window, a tutor can:
- edit the blocks of group views
- edit access and secret urls
- create new group views
- delete a group view
- submit personal views to the group
- add new/edit topics in forum
- edit posts in forum
- create forlders and add files to a group

behatnotneeded

Change-Id: I9d554e2e0069794cad297f9ef2da8c78b2e9b200

Robert Lyon (robertl-9)
Changed in mahara:
status: In Progress → Fix Committed
Changed in mahara:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.