diff options
| author | maheshgudi | 2016-08-29 13:53:41 +0530 |
|---|---|---|
| committer | maheshgudi | 2016-08-29 14:07:07 +0530 |
| commit | 5d49a64d11d6a6868c74bf9a22bb7cc0fa7b8c6b (patch) | |
| tree | 8e87569b4719d928cf711b1ff11a6cd6573a4fbd /yaksh/views.py | |
| parent | 80e3a68ddfcc15fc88442d7af53d804653c4d2a4 (diff) | |
| download | online_test-5d49a64d11d6a6868c74bf9a22bb7cc0fa7b8c6b.tar.gz online_test-5d49a64d11d6a6868c74bf9a22bb7cc0fa7b8c6b.tar.bz2 online_test-5d49a64d11d6a6868c74bf9a22bb7cc0fa7b8c6b.zip | |
changed template; modified search_teacher, add_teacher and remove_teachers view functions
Diffstat (limited to 'yaksh/views.py')
| -rw-r--r-- | yaksh/views.py | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/yaksh/views.py b/yaksh/views.py index 4944691..16454b2 100644 --- a/yaksh/views.py +++ b/yaksh/views.py @@ -1166,9 +1166,12 @@ def search_teacher(request, course_id): raise Http404('You are not allowed to view this page!') context = {} - course = get_object_or_404(Course, Q(creator=user)|Q(teachers=user), pk=course_id) + course = get_object_or_404(Course, pk=course_id) context['course'] = course + if user != course.creator and user not in course.teachers.all(): + raise Http404('You are not allowed to view this page!') + if request.method == 'POST': u_name = request.POST.get('uname') if not len(u_name) == 0: @@ -1197,6 +1200,8 @@ def add_teacher(request, course_id): course = get_object_or_404(Course, pk=course_id) if user == course.creator or user in course.teachers.all(): context['course'] = course + else: + raise Http404('You are not allowed to view this page!') if request.method == 'POST': teacher_ids = request.POST.getlist('check') @@ -1217,7 +1222,7 @@ def remove_teachers(request, course_id): user = request.user course = get_object_or_404(Course, pk=course_id) - if not is_moderator(user) and (user == course.creator or user in course.teachers.all()): + if not is_moderator(user) and (user != course.creator and user not in course.teachers.all()): raise Http404('You are not allowed to view this page!') if request.method == "POST": |