Uploaded image for project: 'Sakai'
  1. Sakai
  2. SAK-43726

Tests & Quizzes: Silent failure for instructor/TA uploading attachments in Samigo when they lack content.hidden permission

    XMLWordPrintable

    Details

    • Test Plan:
      Hide
      1. Log in as instructor and create a course site with Tests & Quizzes, Resources, at least one teaching assistant, and at least one student.
      2. Go to Resources > Permissions and uncheck the Read hidden resources box under the Teaching Assistant role.
      3. Copy the site ID of the site (the string that appears in the URL after the word "site") to your computer clipboard.
      4. Log in as admin and go to Administration Workspace > Realms.
      5. Search for the site's realms using the site ID.
      6. Select the link to the realm that does not include the word "group" in it.
      7. Select the Teaching Assistant role.
      8. Enable all permissions that allow for creating, editing, publishing, and deleting assessments:
        • assessment.createAssessment
        • assessment.deleteAssessment.any
        • assessment.deleteAssessment.own
        • assessment.editAssessment.any
        • assessment.editAssessment.own
        • assessment.publishAssessment.any
        • assessment.publishAssessment.own
      9. Scroll to the bottom of the page and click Save.
      10. Log in as teaching assistant.
      11. Go to Tests & Quizzes and create a new quiz.
      12. Add a question (any type) to the quiz and on the question creation screen, use the Add Attachments button to attach a file. Then Save the question.
      13. Note that the "attachment" displays on the Questions editing screen once the question is saved. At this point, if you check the system logs, you should see an error regarding a permissions failure.
      14. Select Preview and on the preview, Begin Assessment.
      15. Issue: The attachment is not available.
      16. Publish the assessment.
      17. Log in as student and take the assessment. Issue: The attachment is not available.
      Show
      Log in as instructor and create a course site with Tests & Quizzes , Resources , at least one teaching assistant, and at least one student. Go to Resources > Permissions and uncheck the Read hidden resources box under the Teaching Assistant role. Copy the site ID of the site (the string that appears in the URL after the word "site") to your computer clipboard. Log in as admin and go to Administration Workspace > Realms . Search for the site's realms using the site ID. Select the link to the realm that does not include the word "group" in it. Select the Teaching Assistant role. Enable all permissions that allow for creating, editing, publishing, and deleting assessments: assessment.createAssessment assessment.deleteAssessment.any assessment.deleteAssessment.own assessment.editAssessment.any assessment.editAssessment.own assessment.publishAssessment.any assessment.publishAssessment.own Scroll to the bottom of the page and click Save . Log in as teaching assistant. Go to Tests & Quizzes and create a new quiz. Add a question (any type) to the quiz and on the question creation screen, use the Add Attachments button to attach a file. Then Save the question. Note that the "attachment" displays on the Questions editing screen once the question is saved. At this point, if you check the system logs, you should see an error regarding a permissions failure. Select Preview and on the preview, Begin Assessment . Issue: The attachment is not available. Publish the assessment. Log in as student and take the assessment. Issue: The attachment is not available.

      Description

      If a user has permission to create assessments in Tests & Quizzes, but lacks permission to read hidden resources in Resources, and they attempt to upload an attachment in question text or settings, the upload will silently fail. The file will appear to be attached successfully on the Questions editing screen, but it will have a permissions lock on it that will make it impossible for the assessment creator to access it when previewing the test or for students to access it while taking the test.

      Restoring content.hidden permission to the affected role will not fix existing assessments with this issue - someone has to edit the affected assessment, delete the offending attachment, and replace it with a working one.

      Rather than uploading a broken attachment, a meaningful error message should be displayed to the user, e.g.:

      Attachment upload failed. You do not have permission to read hidden resources in this site. For you to upload attachments in Tests & Quizzes, this permission will need to be granted in Resources.

        Gliffy Diagrams

          Zeplin

            Attachments

              Activity

                People

                Assignee:
                maintenanceteam Core Team
                Reporter:
                rainribbon Tiffany Stull
                Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                  Dates

                  Created:
                  Updated:

                    Git Integration