From eb2e9ac679b84670e9884d8f610fc41f4ec16dfc Mon Sep 17 00:00:00 2001 From: Dillon Dumesnil Date: Fri, 23 Apr 2021 10:31:08 -0400 Subject: [PATCH] fix: AA-646: Fix is_staff_user check to check for course staff It was checking for global staff, but really only needed to check for course staff. This corrects the check --- common/lib/xmodule/xmodule/modulestore/search.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/common/lib/xmodule/xmodule/modulestore/search.py b/common/lib/xmodule/xmodule/modulestore/search.py index ee662ff9892b..51fcd687a370 100644 --- a/common/lib/xmodule/xmodule/modulestore/search.py +++ b/common/lib/xmodule/xmodule/modulestore/search.py @@ -3,7 +3,7 @@ from logging import getLogger - +from lms.djangoapps.courseware.access import has_access from lms.djangoapps.courseware.masquerade import MASQUERADE_SETTINGS_KEY from common.djangoapps.student.roles import GlobalStaff from .exceptions import ItemNotFoundError, NoPathToItem @@ -130,7 +130,7 @@ def get_child_locations(section_desc, request, course_id): Returns all child locations for a section. If user is learner or masquerading as learner, staff only blocks are excluded. """ - is_staff_user = GlobalStaff().has_user(request.user) if request else False + is_staff_user = has_access(request.user, 'staff', course_id).has_access if request else False def is_masquerading_as_student(): """