Added middleware to confirm isTeacher.

hpi-schul-cloud · Oct 5, 2023 · 352fce6 · 352fce6
1 parent e6c6434
commit 352fce6
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 3 deletions.
diff --git a/controllers/topics.js b/controllers/topics.js
@@ -46,6 +46,7 @@ const editTopicHandler = (req, res, next) => {
 		const schoolId = res.locals.currentSchool;
 		const { filesStorage } = await filesStoragesHelper
 			.filesStorageInit(schoolId, lesson._id, 'lessons', false, req);
+		const isTeacher = req.isTeacher;
 
 		if (lesson.title) lesson.title = decode(lesson.title);
 		if (lesson.contents) lesson.contents = decode(lesson.contents);
@@ -63,6 +64,7 @@ const editTopicHandler = (req, res, next) => {
 			lesson,
 			courseId: req.params.courseId,
 			topicId: req.params.topicId,
+			isTeacher,
 			schoolId,
 			teamId: req.params.teamId,
 			courseGroupId: req.query.courseGroup,

diff --git a/middleware/checkIfUserIsTeacher.js b/middleware/checkIfUserIsTeacher.js
@@ -0,0 +1,16 @@
+const express = require('express');
+
+const router = express.Router();
+
+const checkIfUserIsTeacher = (req, res, next) => {
+	if (req.user && req.user.role === 'teacher') {
+		req.isTeacher = true;
+	} else {
+		req.isTeacher = false;
+	}
+	next();
+};
+
+router.use('topic/edit-topic', checkIfUserIsTeacher);
+
+module.exports = checkIfUserIsTeacher;
diff --git a/views/topic/edit-topic.hbs b/views/topic/edit-topic.hbs
@@ -45,9 +45,18 @@
                 <div class="form-group">
                     <label>{{$t "topic._topic.label.content" }}</label>
 
-                    <!-- React Magic -->
-                    <div id="content-blocks" data-value="{{lesson.contents}}" data-parent-id="{{lesson._id}}" data-school-id="{{schoolId}}" data-parent-type="lessons" data-etherpadbaseurl="{{etherpadBaseUrl}}"
-                        data-nexboardenabled="{{#ifEnv "FEATURE_NEXBOARD_ENABLED" "true"}}{{#unless userIsTeacher}}true{{/unless}}{{/ifEnv}}"></div>
+                    {{!-- <div id="content-blocks" data-value="{{lesson.contents}}" data-parent-id="{{lesson._id}}" data-school-id="{{schoolId}}" data-parent-type="lessons" data-etherpadbaseurl="{{etherpadBaseUrl}}"
+                        data-nexboardenabled="{{#ifEnv "FEATURE_NEXBOARD_ENABLED" "true"}}{{#unless userIsTeacher}}true{{/unless}}{{/ifEnv}}"></div> --}}
+                {{#unless userIsTeacher}}
+                    <div id="content-blocks" 
+                        data-value="{{lesson.contents}}"
+                        data-parent-id="{{lesson._id}}"
+                        data-school-id="{{schoolId}}"
+                        data-parent-type="lessons"
+                        data-etherpadbaseurl="{{etherpadBaseUrl}}"
+                        data-nexboardenabled="{{#ifEnv "FEATURE_NEXBOARD_ENABLED" "true"}}true{{/ifEnv}}">
+                    </div>
+                {{/unless}}
                 </div>
                 {{#ifneq 0 (arrayLength @root.lessonFilesStorageData.files)}}
                 <label>{{$t "topic._topic.label.embeddedFiles" }}</label>