diff --git a/lib/classes/JsonApi/Routes/Courseware/Authority.php b/lib/classes/JsonApi/Routes/Courseware/Authority.php index 47d44184dcb429be0c8a37a4bd09a13b7cdb7381..aa61d0ab778f8cb8d599d021b1e38c31b7070565 100755 --- a/lib/classes/JsonApi/Routes/Courseware/Authority.php +++ b/lib/classes/JsonApi/Routes/Courseware/Authority.php @@ -58,7 +58,23 @@ class Authority public static function canUpdateBlock(User $user, Block $resource) { if ($resource->isBlocked()) { - return $resource->getBlockerUserId() == $user->id; + $structural_element = $resource->container->structural_element; + + if ($structural_element->range_type === 'user') { + if ($structural_element->range_id === $user->id) { + return true; + } + + return $structural_element->canEdit($user); + } + + $perm = $GLOBALS['perm']->have_studip_perm( + $structural_element->course->config->COURSEWARE_EDITING_PERMISSION, + $structural_element->course->id, + $user->id + ); + + return $resource->getBlockerUserId() === $user->id || $perm; } return self::canUpdateContainer($user, $resource->container); @@ -71,7 +87,36 @@ class Authority public static function canUpdateEditBlocker(User $user, $resource) { - return $resource->edit_blocker_id == '' || $resource->edit_blocker_id === $user->id; + $structural_element = null; + if ($resource instanceof Block) { + $structural_element = $resource->container->structural_element; + } + if ($resource instanceof Container) { + $structural_element = $resource->structural_element; + } + if ($resource instanceof StructuralElement) { + $structural_element = $resource; + } + + if ($structural_element === null) { + return false; + } + + if ($structural_element->range_type === 'user') { + if ($structural_element->range_id === $user->id) { + return true; + } + + return $structural_element->canEdit($user); + } + + $perm = $GLOBALS['perm']->have_studip_perm( + $structural_element->course->config->COURSEWARE_EDITING_PERMISSION, + $structural_element->course->id, + $user->id + ); + + return $resource->edit_blocker_id == '' || $resource->edit_blocker_id === $user->id || $perm; } public static function canShowContainer(User $user, Container $resource)