fix: course permissions

SELab-2 · Mar 9, 2024 · af385e6 · af385e6
1 parent 4082b4a
commit af385e6
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/backend/api/permissions/course_permissions.py b/backend/api/permissions/course_permissions.py
@@ -58,7 +58,7 @@ def has_object_permission(self, request: Request, view: ViewSet, course: Course)
             return user.is_authenticated
 
         # Only students can add or remove themselves from a course.
-        if is_student(user) and request.data.get("id") == user.id:
+        if is_student(user) and request.data.get("student_id") == user.id:
             return True
 
         # Teachers and assistants can add and remove any student.

diff --git a/backend/api/views/course_view.py b/backend/api/views/course_view.py
@@ -1,7 +1,7 @@
 from django.utils.translation import gettext
 from rest_framework import viewsets
 from rest_framework.permissions import IsAdminUser
-from rest_framework.decorators import action
+from rest_framework.decorators import action, permission_classes
 from rest_framework.response import Response
 from rest_framework.request import Request
 from api.models.course import Course
@@ -164,6 +164,7 @@ def clone(self, request: Request, **__):
         try:
             # We should return the already cloned course, if present
             course = course.child_course
+
         except Course.DoesNotExist:
             # Else, we clone the course
             course = course.clone(