From 5d49a64d11d6a6868c74bf9a22bb7cc0fa7b8c6b Mon Sep 17 00:00:00 2001
From: maheshgudi
Date: Mon, 29 Aug 2016 13:53:41 +0530
Subject: changed template; modified search_teacher, add_teacher and
 remove_teachers view functions

---
 yaksh/templates/yaksh/courses.html | 4 +++-
 yaksh/views.py                     | 9 +++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

(limited to 'yaksh')

diff --git a/yaksh/templates/yaksh/courses.html b/yaksh/templates/yaksh/courses.html
index 5e2266c..42f49d1 100644
--- a/yaksh/templates/yaksh/courses.html
+++ b/yaksh/templates/yaksh/courses.html
@@ -141,9 +141,11 @@
     </div>
     <br><br>
     {% endfor %}
+{% else %}
+    <center><h4> No new Courses allotted </h4></center>
 {% endif %}
+<button class="btn primary" type="button" onClick='location.replace("{{URL_ROOT}}/exam/manage/add_course");'>Add New Course</button>
     {% if courses or allotted_courses %}
-    <button class="btn primary" type="button" onClick='location.replace("{{URL_ROOT}}/exam/manage/add_course");'>Add New Course</button>
     <button class="btn primary" type="button" onClick='location.replace("{{URL_ROOT}}/exam/manage/addquiz");'>Add New Quiz</button>
 {% endif %}    
 {% endblock %}
diff --git a/yaksh/views.py b/yaksh/views.py
index 4944691..16454b2 100644
--- a/yaksh/views.py
+++ b/yaksh/views.py
@@ -1166,9 +1166,12 @@ def search_teacher(request, course_id):
         raise Http404('You are not allowed to view this page!')
 
     context = {}
-    course = get_object_or_404(Course, Q(creator=user)|Q(teachers=user), pk=course_id)
+    course = get_object_or_404(Course, pk=course_id)
     context['course'] = course
 
+    if user != course.creator and user not in course.teachers.all():
+       raise Http404('You are not allowed to view this page!')
+
     if request.method == 'POST':
         u_name = request.POST.get('uname')
         if not len(u_name) == 0:
@@ -1197,6 +1200,8 @@ def add_teacher(request, course_id):
     course = get_object_or_404(Course, pk=course_id)
     if user == course.creator or user in course.teachers.all():
         context['course'] = course
+    else:
+        raise Http404('You are not allowed to view this page!')
 
     if request.method == 'POST':
         teacher_ids = request.POST.getlist('check')
@@ -1217,7 +1222,7 @@ def remove_teachers(request, course_id):
  
     user = request.user
     course = get_object_or_404(Course, pk=course_id)
-    if not is_moderator(user) and (user == course.creator or user in course.teachers.all()):
+    if not is_moderator(user) and (user != course.creator and user not in course.teachers.all()):
         raise Http404('You are not allowed to view this page!')
 
     if request.method == "POST":
-- 
cgit