Skip to content

SAK-50562 Section Info Students can skip date-based access restrictions with URLs #14260

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
st-manu wants to merge 3 commits into
base: master
Choose a base branch
from
+45 −22
Open

SAK-50562 Section Info Students can skip date-based access restrictions with URLs #14260

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b5984db
SAK-50562 Students can skip date-based access restrictions with URLs
st-manu Nov 20, 2025
f8e632f
coderabbitai
st-manu Nov 20, 2025
d0402ef
debug
st-manu Nov 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 20 additions & 7 deletions sections/sections-app/src/java/org/sakaiproject/tool/section/filter/RoleFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
package org.sakaiproject.tool.section.filter;

import java.io.IOException;
import java.util.Calendar;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
Expand All @@ -31,14 +32,14 @@
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import lombok.extern.slf4j.Slf4j;
import org.springframework.context.ApplicationContext;
import org.springframework.web.context.WebApplicationContext;

import org.sakaiproject.component.cover.ServerConfigurationService;
import org.sakaiproject.section.api.SectionManager;
import org.sakaiproject.section.api.facade.manager.Authn;
import org.sakaiproject.section.api.facade.manager.Authz;
import org.sakaiproject.section.api.facade.manager.Context;
import org.springframework.context.ApplicationContext;
import org.springframework.web.context.WebApplicationContext;

import lombok.extern.slf4j.Slf4j;

/**
* An authorization filter to keep users out of pages they are not authorized
Expand Down Expand Up @@ -77,7 +78,7 @@ public void doFilter(ServletRequest servletRequest, ServletResponse response, Fi
String servletPath = request.getServletPath();
if (log.isDebugEnabled()) log.debug("Filtering request for servletPath=" + servletPath);
servletPath = servletPath.replaceFirst("^/", "");
if (servletPath.indexOf("/") >= 0) {
if (servletPath.contains("/")) {
// Only protect the top-level folder, to allow for login through
// a subdirectory, shared resource files, and so on.
chain.doFilter(request, response);
Expand Down Expand Up @@ -117,7 +118,19 @@ public void doFilter(ServletRequest servletRequest, ServletResponse response, Fi
isAuthorized = true;
} else if (authz.isViewOwnSectionsAllowed(userUid, siteContext)
&& authzFilterConfigBean.getViewOwnSections().contains(pageName)) {
isAuthorized = true;
// Check if sections are closed for students accessing studentView
if (pageName.equals("studentView")) {
SectionManager sm = (SectionManager)ac.getBean("org.sakaiproject.section.api.SectionManager");
Calendar open = sm.getOpenDate(siteContext);
Calendar now = Calendar.getInstance();
if (now.before(open)) {
isAuthorized = false;
} else {
isAuthorized = true;
}
} else {
isAuthorized = true;
}
} else if (pageName.contains("closed")) {
isAuthorized = true;
}
Expand Down
Loading