From 8c18242ecbadf94a0a7f03390ea42fe6ad0fa940 Mon Sep 17 00:00:00 2001 From: Dillon Dumesnil Date: Fri, 23 Apr 2021 10:24:53 -0400 Subject: [PATCH] fix: AA-646: Fix is_staff_user check to check for course staff It was checking for global staff, but really only needed to check for course staff. This corrects the check. --- common/lib/xmodule/xmodule/modulestore/search.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/common/lib/xmodule/xmodule/modulestore/search.py b/common/lib/xmodule/xmodule/modulestore/search.py index ee662ff989..d1e7762a67 100644 --- a/common/lib/xmodule/xmodule/modulestore/search.py +++ b/common/lib/xmodule/xmodule/modulestore/search.py @@ -4,6 +4,7 @@ from logging import getLogger +from lms.djangoapps.courseware.access import has_access from lms.djangoapps.courseware.masquerade import MASQUERADE_SETTINGS_KEY from common.djangoapps.student.roles import GlobalStaff from .exceptions import ItemNotFoundError, NoPathToItem @@ -130,7 +131,7 @@ def get_child_locations(section_desc, request, course_id): Returns all child locations for a section. If user is learner or masquerading as learner, staff only blocks are excluded. """ - is_staff_user = GlobalStaff().has_user(request.user) if request else False + is_staff_user = has_access(request.user, 'staff', course_id).has_access if request else False def is_masquerading_as_student(): """