adding ldb requirement for viewing quiz results

Change-Id: Id011290fbd5d8ad791b016450671c88c7cba30bc
Reviewed-on: https://gerrit.instructure.com/3152
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Zach Wily <zach@instructure.com>

app/controllers/quizzes_controller.rb

@@ -101,6 +101,10 @@ class QuizzesController < ApplicationController
       
       @headers = !params[:headless]
 
+      if @quiz.require_lockdown_browser? && @quiz.require_lockdown_browser_for_results? && params[:viewing]
+        return unless check_lockdown_browser(:medium, named_context_url(@context, 'context_quiz_url', @quiz.to_param, :viewing => "1"))
+      end
+
       @question_count = @quiz.question_count
       if session[:quiz_id] == @quiz.id && !request.xhr?
         session[:quiz_id] = nil
@@ -151,20 +155,8 @@ class QuizzesController < ApplicationController
   def take_quiz
     return unless authorized_action(@quiz, @current_user, :submit)
 
-    if @quiz.require_lockdown_browser? && !@quiz.grants_right?(@current_user, session, :grade)
-      plugin = Canvas::LockdownBrowser.plugin.base
-      if plugin.require_authorization_redirect?(self)
-        return redirect_to(plugin.redirect_url(self, @context, @quiz))
-      elsif !plugin.authorized?(self)
-        return redirect_to(:action => 'lockdown_browser_required')
-      elsif @query_params = plugin.popup_window(self)
-        session['lockdown_browser_popup'] = true
-        return render(:action => 'take_quiz_in_popup')
-      end
-      @headers = false
-      @show_left_side = false
-      @padless = true
-      @lockdown_browser_params = plugin.quiz_exit_params(self)
+    if @quiz.require_lockdown_browser?
+      return unless check_lockdown_browser(:highest, named_context_url(@context, 'context_quiz_take_url', @quiz.to_param))
     end
 
     can_retry = @submission && (@quiz.unlimited_attempts? || @submission.attempts_left > 0 || @quiz.grants_right?(@current_user, session, :update))
@@ -321,6 +313,10 @@ class QuizzesController < ApplicationController
           @version_number = "current" if @current_version
         end
         log_asset_access(@quiz, "quizzes", 'quizzes')
+        
+        if @quiz.require_lockdown_browser? && @quiz.require_lockdown_browser_for_results? && params[:viewing]
+          return unless check_lockdown_browser(:medium, named_context_url(@context, 'context_quiz_history_url', @quiz.to_param, :viewing => "1", :version => params[:version]))
+        end
       end
     end
   end
@@ -452,4 +448,26 @@ class QuizzesController < ApplicationController
     @quiz_name = @quiz.title
     @quiz
   end
+
+  # if this returns false, it's rendering or redirecting, so return from the
+  # action that called it
+  def check_lockdown_browser(security_level, redirect_return_url)
+    return true if @quiz.grants_right?(@current_user, session, :grade)
+    plugin = Canvas::LockdownBrowser.plugin.base
+    if plugin.require_authorization_redirect?(self)
+      redirect_to(plugin.redirect_url(self, redirect_return_url))
+      return false
+    elsif !plugin.authorized?(self)
+      redirect_to(:action => 'lockdown_browser_required', :quiz_id => @quiz.id)
+      return false
+    elsif @query_params = plugin.popup_window(self, security_level)
+      session['lockdown_browser_popup'] = true
+      render(:action => 'take_quiz_in_popup')
+      return false
+    end
+    @lockdown_browser_authorized_to_view = true
+    @headers = false
+    @show_left_side = false
+    @padless = true
+  end
 end

app/models/quiz.rb

@@ -25,7 +25,8 @@ class Quiz < ActiveRecord::Base
   attr_accessible :title, :description, :points_possible, :assignment_id, :shuffle_answers,
     :show_correct_answers, :time_limit, :allowed_attempts, :scoring_policy, :quiz_type,
     :lock_at, :unlock_at, :due_at, :access_code, :anonymous_submissions, :assignment_group_id,
-    :hide_results, :locked, :ip_filter, :require_lockdown_browser, :context
+    :hide_results, :locked, :ip_filter, :require_lockdown_browser,
+    :require_lockdown_browser_for_results, :context
 
   attr_readonly :context_id, :context_type
   

app/views/quizzes/_quiz_submission.html.erb

@@ -56,6 +56,13 @@
 <div class="quiz_duration" style="<%= hidden if @quiz.quiz_type == 'survey' %>">
   This attempt took <%= time_ago_in_words(Time.now + @submission.duration) %>.
 </div>
+<% if @quiz.require_lockdown_browser && @quiz.require_lockdown_browser_for_results && !@lockdown_browser_authorized_to_view && !can_do(@quiz, @current_user, :grade) %>
+<p>
+  <br /><br />
+  Respondus LockDown Browser is required to view your quiz results.
+  <%= link_to "Click here to view the results.", { :viewing => 1, :version => params[:version] }, :target => "_top" %>
+</p>
+<% else %>
 <% jammit_css :quizzes %>
 <% js_block do %>
 <script>
@@ -149,3 +156,4 @@ $(document).ready(function() {
 </div>
 <% end %>
 <% end %>
+<% end %>

app/views/quizzes/history.html.erb

@@ -3,7 +3,7 @@
 
 <% unless params[:headless] %>
 <% content_for :right_side do %>
-  <% if @current_version %>
+  <% if @current_version && can_do(@quiz, @current_user, :grade) %>
     <div class="rs-margin-lr rs-margin-top">
       <p>Here's the latest <%= @quiz.readable_type.downcase %> results for <%= user_name %>.  You can modify the
       points for any question and add more comments, then click "Update Scores"

app/views/quizzes/new.html.erb

@@ -169,7 +169,15 @@
                 <td colspan="2">
                   <div style="padding-left: 20px;">
                     <%= check_box :quiz, :require_lockdown_browser %>
-                    <%= label :quiz, :require_lockdown_browser, "Require the lockdown browser" %>  
+                    <%= label :quiz, :require_lockdown_browser, "Require Respondus LockDown Browser" %>
+                  </div>
+                </td>
+              </tr>
+              <tr id="lockdown_browser_suboptions" style="display: none;">
+                <td colspan="2">
+                  <div style="padding-left: 40px;">
+                    <%= check_box :quiz, :require_lockdown_browser_for_results %>
+                    <%= label :quiz, :require_lockdown_browser_for_results, "Required to view quiz results" %>
                   </div>
                 </td>
               </tr>

app/views/quizzes/show.html.erb

@@ -199,7 +199,7 @@
       <div style="text-align: center; margin-top: 20px; font-size: 1.3em;">
         <a href="<%= context_url(@context, :context_quiz_take_url, @quiz.id, :user_id => @current_user && @current_user.id) %>" target="_top">Resume <%= @quiz.readable_type %></a>
       </div>
-    <% elsif can_do(@quiz, @current_user, :submit) %>
+    <% elsif can_do(@quiz, @current_user, :submit) && !@lockdown_browser_authorized_to_view %>
       <div style="text-align: center; margin-top: 20px; font-size: 1.3em;">
         <a href="<%= context_url(@context, :context_quiz_take_url, @quiz.id, :user_id => @current_user && @current_user.id) %>" target="_top">Take the <%= @quiz.readable_type %> <%= 'Again' if @submission && !@submission.settings_only? %></a>
       </div>

app/views/quizzes/take_quiz_in_popup.html.erb

@@ -1,9 +1,11 @@
 <h1>
-  Quiz Loading
+  Loading Quiz in Respondus LockDown Browser
 </h1>
 <script type="text/javascript">
   // open the quiz in a popup window with the plugin's given query param hash
   window.open(<%= raw url_for(params.merge(@query_params).merge(:escape => false)).to_json %>);
-  // redirect this window back to the quiz show page
-  window.location = <%= raw context_url(@context, "context_quiz_url", @quiz).to_json %>;
 </script>
+
+<p>
+  <a href="#" onclick="history.go(-1); return false;">Click here</a> to return to the quiz page.
+</p>

db/migrate/20110416052050_add_quiz_require_lockdown_browser_for_results.rb

@@ -0,0 +1,9 @@
+class AddQuizRequireLockdownBrowserForResults < ActiveRecord::Migration
+  def self.up
+    add_column :quizzes, :require_lockdown_browser_for_results, :boolean
+  end
+
+  def self.down
+    remove_column :quizzes, :require_lockdown_browser_for_results
+  end
+end

public/javascripts/quizzes.js

@@ -882,6 +882,11 @@ var quiz = {};
       }
     });
   }).triggerHandler('change');
+  $("#quiz_require_lockdown_browser").change(function() {
+    $("#lockdown_browser_suboptions").showIf($(this).attr('checked'));
+    $("#quiz_require_lockdown_browser_for_results").attr('checked', true).change();
+  });
+  $("#lockdown_browser_suboptions").showIf($("#quiz_require_lockdown_browser").attr('checked'));
   $("#ip_filter").change(function() {
     $("#ip_filter_suboptions").showIf($(this).attr('checked'));
     if(!$(this).attr('checked')) {