diff --git a/lib/classes/JsonApi/Routes/Courseware/Authority.php b/lib/classes/JsonApi/Routes/Courseware/Authority.php index 5e30a415ceb04939d704ca6bf578d4fbe4f33310..e293c84aeeb49071917f5dec5783a0e8c2646020 100644 --- a/lib/classes/JsonApi/Routes/Courseware/Authority.php +++ b/lib/classes/JsonApi/Routes/Courseware/Authority.php @@ -59,7 +59,23 @@ class Authority public static function canUpdateBlock(User $user, Block $resource) { if ($resource->isBlocked()) { - return $resource->getBlockerUserId() == $user->id; + $structural_element = $resource->container->structural_element; + + if ($structural_element->range_type === 'user') { + if ($structural_element->range_id === $user->id) { + return true; + } + + return $structural_element->canEdit($user); + } + + $perm = $GLOBALS['perm']->have_studip_perm( + $structural_element->course->config->COURSEWARE_EDITING_PERMISSION, + $structural_element->course->id, + $user->id + ); + + return $resource->getBlockerUserId() === $user->id || $perm; } return self::canUpdateContainer($user, $resource->container); @@ -72,7 +88,36 @@ class Authority public static function canUpdateEditBlocker(User $user, $resource) { - return $resource->edit_blocker_id == '' || $resource->edit_blocker_id === $user->id; + $structural_element = null; + if ($resource instanceof Block) { + $structural_element = $resource->container->structural_element; + } + if ($resource instanceof Container) { + $structural_element = $resource->structural_element; + } + if ($resource instanceof StructuralElement) { + $structural_element = $resource; + } + + if ($structural_element === null) { + return false; + } + + if ($structural_element->range_type === 'user') { + if ($structural_element->range_id === $user->id) { + return true; + } + + return $structural_element->canEdit($user); + } + + $perm = $GLOBALS['perm']->have_studip_perm( + $structural_element->course->config->COURSEWARE_EDITING_PERMISSION, + $structural_element->course->id, + $user->id + ); + + return $resource->edit_blocker_id == '' || $resource->edit_blocker_id === $user->id || $perm; } public static function canShowContainer(User $user, Container $resource)