diff --git a/app/controllers/submission_comments_controller.rb b/app/controllers/submission_comments_controller.rb index 86959c063df..d7cb36f5aaf 100644 --- a/app/controllers/submission_comments_controller.rb +++ b/app/controllers/submission_comments_controller.rb @@ -21,8 +21,9 @@ class SubmissionCommentsController < ApplicationController def index submission = Submission.preload(assignment: :context, all_submission_comments: :author).find(params[:submission_id]) + course = submission.assignment.context return render_unauthorized_action if submission.assignment.anonymize_students? - return render_unauthorized_action unless submission.grants_all_rights?(@current_user, :read_grade, :read_comments) + return render_unauthorized_action unless course.grants_any_right?(@current_user, :manage_grades, :view_all_grades) render pdf: :index, locals: index_pdf_locals(submission) end diff --git a/spec/controllers/submission_comments_controller_spec.rb b/spec/controllers/submission_comments_controller_spec.rb index 63dcc2ea31f..37a31be3524 100644 --- a/spec/controllers/submission_comments_controller_spec.rb +++ b/spec/controllers/submission_comments_controller_spec.rb @@ -21,10 +21,10 @@ require_relative '../spec_helper' RSpec.describe SubmissionCommentsController do describe "GET 'index'" do before :once do - course = Account.default.courses.create! - @teacher = course_with_teacher(course: course, active_all: true).user - @student = course_with_student(course: course, active_all: true).user - @assignment = course.assignments.create! + @course = Account.default.courses.create! + @teacher = course_with_teacher(course: @course, active_all: true).user + @student = course_with_student(course: @course, active_all: true).user + @assignment = @course.assignments.create! @submission = @assignment.submissions.find_by!(user: @student) @submission.submission_comments.create!(author: @teacher, comment: 'a comment') end @@ -42,6 +42,20 @@ RSpec.describe SubmissionCommentsController do specify { expect(response.headers.fetch('Content-Type')).to match(/\Aapplication\/pdf/) } end + context "when course is in a concluded term" do + before :once do + @course.enrollment_term.update!(end_at: 1.day.ago) + end + + before do + get :index, params: { submission_id: @submission.id }, format: :pdf + end + + specify { expect(response).to have_http_status :ok } + specify { expect(response).to render_template(:index) } + specify { expect(response.headers.fetch('Content-Type')).to match(/\Aapplication\/pdf/) } + end + context 'given a request where no submission is present' do before do @submission.all_submission_comments.destroy_all