From b5e73d2d62129d1620674db0e0d3e8c2a1121321 Mon Sep 17 00:00:00 2001 From: Ewout Verlinde Date: Fri, 24 May 2024 15:21:56 +0200 Subject: [PATCH] chore: i forgor :skull: --- backend/api/permissions/submission_permissions.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/backend/api/permissions/submission_permissions.py b/backend/api/permissions/submission_permissions.py index 8533c97f..ee85970b 100644 --- a/backend/api/permissions/submission_permissions.py +++ b/backend/api/permissions/submission_permissions.py @@ -41,8 +41,14 @@ class SubmissionFeedbackPermission(SubmissionPermission): def has_permission(self, request: Request, view: APIView) -> bool: return True - def has_object_permission(self, request: Request, view: APIView, obj: Submission) -> bool: - return True + def has_object_permission(self, request: Request, view: APIView, submission: Submission) -> bool: + if is_student(request.user) and submission.group.students.contains(request.user): + return True + + if is_teacher(request.user) or is_assistant(request.user): + return True + + return False class StructureCheckResultPermission(SubmissionPermission):