devilry 6.7.0__tar.gz → 6.7.1__tar.gz

{devilry-6.7.0 → devilry-6.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: devilry
-Version: 6.7.0
+Version: 6.7.1
 Summary: A system for handling electronic deliveries. See https://github.com/devilry/devilry-django.
 Author: Tor Johansen, Bendik Opstad, Vegard Angell, Magne Westlie, Ilya Kostolomov, Christian Tryti, Rebekka Mørken, Stian Julseth, Åsmund J. Rosendahl
 Author-email: Espen Angell Kristiansen <post@appresso.no>

devilry-6.7.1/devilry/__init__.py

@@ -0,0 +1 @@
+__version__ = "6.7.1"

{devilry-6.7.0 → devilry-6.7.1}/devilry/devilry_admin/tests/dashboard/test_createsubject.py

@@ -1,36 +1,68 @@
 from django.conf import settings
+from django.core.exceptions import PermissionDenied
 from django.test import TestCase
 from cradmin_legacy import cradmin_testhelpers
 from cradmin_legacy import crinstance
 from model_bakery import baker
 
 from devilry.apps.core.models import Subject
+from devilry.devilry_account.models import PermissionGroup
 from devilry.devilry_admin.views.dashboard import createsubject
 
 
 class TestCreateView(TestCase, cradmin_testhelpers.TestCaseMixin):
     viewclass = createsubject.CreateView
 
+    def __make_superuser(self):
+        return baker.make(settings.AUTH_USER_MODEL, is_superuser=True)
+
     def test_get_render_title(self):
-        user = baker.make(settings.AUTH_USER_MODEL, is_superuser=True)
-        mockresponse = self.mock_http200_getrequest_htmls(cradmin_role=user)
+        mockresponse = self.mock_http200_getrequest_htmls(requestuser=self.__make_superuser())
         self.assertEqual("Create new course", mockresponse.selector.one("title").alltext_normalized)
 
     def test_get_render_h1(self):
-        user = baker.make(settings.AUTH_USER_MODEL, is_superuser=True)
-        mockresponse = self.mock_http200_getrequest_htmls(cradmin_role=user)
+        mockresponse = self.mock_http200_getrequest_htmls(requestuser=self.__make_superuser())
         self.assertEqual("Create new course", mockresponse.selector.one("h1").alltext_normalized)
 
     def test_get_render_formfields(self):
-        user = baker.make(settings.AUTH_USER_MODEL, is_superuser=True)
-        mockresponse = self.mock_http200_getrequest_htmls(cradmin_role=user)
+        mockresponse = self.mock_http200_getrequest_htmls(requestuser=self.__make_superuser())
         self.assertTrue(mockresponse.selector.exists("input[name=long_name]"))
         self.assertTrue(mockresponse.selector.exists("input[name=short_name]"))
 
+    def test_get_permissiondenied_if_not_superuser(self):
+        with self.assertRaises(PermissionDenied):
+            self.mock_getrequest(requestuser=baker.make(settings.AUTH_USER_MODEL))
+
+    def test_get_permissiondenied_if_subjectadmin(self):
+        requestuser = baker.make(settings.AUTH_USER_MODEL)
+        baker.make(
+            "devilry_account.PermissionGroupUser",
+            user=requestuser,
+            permissiongroup=baker.make(
+                "devilry_account.SubjectPermissionGroup",
+                permissiongroup__grouptype=PermissionGroup.GROUPTYPE_DEPARTMENTADMIN,
+                subject=baker.make("core.Subject"),
+            ).permissiongroup,
+        )
+        with self.assertRaises(PermissionDenied):
+            self.mock_getrequest(requestuser=requestuser)
+
+    def test_post_permissiondenied_if_not_superuser(self):
+        with self.assertRaises(PermissionDenied):
+            self.mock_postrequest(
+                requestuser=baker.make(settings.AUTH_USER_MODEL),
+                requestkwargs={
+                    "data": {
+                        "long_name": "Test subject",
+                        "short_name": "testsubject",
+                    }
+                },
+            )
+        self.assertEqual(Subject.objects.count(), 0)
+
     def test_post_missing_short_name(self):
-        user = baker.make(settings.AUTH_USER_MODEL, is_superuser=True)
         mockresponse = self.mock_http200_postrequest_htmls(
-            cradmin_role=user,
+            requestuser=self.__make_superuser(),
             requestkwargs={
                 "data": {
                     "long_name": "Test subject",
@@ -44,9 +76,8 @@ class TestCreateView(TestCase, cradmin_testhelpers.TestCaseMixin):
         )
 
     def test_post_missing_long_name(self):
-        user = baker.make(settings.AUTH_USER_MODEL, is_superuser=True)
         mockresponse = self.mock_http200_postrequest_htmls(
-            cradmin_role=user, requestkwargs={"data": {"long_name": "", "short_name": "testsubject"}}
+            requestuser=self.__make_superuser(), requestkwargs={"data": {"long_name": "", "short_name": "testsubject"}}
         )
         self.assertEqual(Subject.objects.count(), 0)
         self.assertEqual(
@@ -54,9 +85,8 @@ class TestCreateView(TestCase, cradmin_testhelpers.TestCaseMixin):
         )
 
     def test_post_duplicate_short_name(self):
-        user = baker.make(settings.AUTH_USER_MODEL, is_superuser=True)
         mockresponse = self.mock_http200_postrequest_htmls(
-            cradmin_role=user,
+            requestuser=self.__make_superuser(),
             requestkwargs={
                 "data": {
                     "long_name": "Test subject",
@@ -71,9 +101,9 @@ class TestCreateView(TestCase, cradmin_testhelpers.TestCaseMixin):
 
     def __valid_post_request(self, user=None):
         if not user:
-            user = baker.make(settings.AUTH_USER_MODEL, is_superuser=True)
+            user = self.__make_superuser()
         mockresponse = self.mock_http302_postrequest(
-            cradmin_role=user,
+            requestuser=user,
             requestkwargs={
                 "data": {
                     "long_name": "Test subject",

{devilry-6.7.0 → devilry-6.7.1}/devilry/devilry_admin/tests/dashboard/test_student_feedbackfeed_wizard/test_assignment_listview.py

@@ -1,5 +1,6 @@
 from django import test
 from django.conf import settings
+from django.http import Http404
 from django.template import defaultfilters
 from django.utils import timezone
 
@@ -18,11 +19,45 @@ class TestStudentAssignmentGroupListView(test.TestCase, cradmin_testhelpers.Test
     def setUp(self):
         AssignmentGroupDbCacheCustomSql().initialize()
 
+    def __make_candidate(self, group, user):
+        """
+        Make a Candidate with a RelatedStudent within the period of the given ``group``,
+        which is the only way candidates are created in production.
+        """
+        return baker.make(
+            "core.Candidate",
+            assignment_group=group,
+            relatedstudent=baker.make("core.RelatedStudent", user=user, period=group.parentnode.parentnode),
+        )
+
     def test_title(self):
         testuser = baker.make(settings.AUTH_USER_MODEL, shortname="testuser@example.com", fullname="Test User")
-        mockresponse = self.mock_http200_getrequest_htmls(viewkwargs={"user_id": testuser.id})
+        baker.make("core.RelatedStudent", user=testuser)
+        mockresponse = self.mock_http200_getrequest_htmls(
+            requestuser=baker.make(settings.AUTH_USER_MODEL, is_superuser=True), viewkwargs={"user_id": testuser.id}
+        )
         self.assertEqual(mockresponse.selector.one("title").alltext_normalized, "Assignments for testuser@example.com")
 
+    def test_404_if_requestuser_is_not_admin_for_any_period_where_user_is_student(self):
+        testuser = baker.make(settings.AUTH_USER_MODEL, shortname="testuser@example.com", fullname="Test User")
+        baker.make("core.RelatedStudent", user=testuser)
+        with self.assertRaises(Http404):
+            self.mock_getrequest(requestuser=baker.make(settings.AUTH_USER_MODEL), viewkwargs={"user_id": testuser.id})
+
+    def test_404_if_user_is_not_a_student_anywhere(self):
+        testuser = baker.make(settings.AUTH_USER_MODEL, shortname="testuser@example.com", fullname="Test User")
+        with self.assertRaises(Http404):
+            self.mock_getrequest(
+                requestuser=baker.make(settings.AUTH_USER_MODEL, is_superuser=True),
+                viewkwargs={"user_id": testuser.id},
+            )
+
+    def test_404_if_user_id_does_not_exist(self):
+        with self.assertRaises(Http404):
+            self.mock_getrequest(
+                requestuser=baker.make(settings.AUTH_USER_MODEL, is_superuser=True), viewkwargs={"user_id": 1234567}
+            )
+
     def test_user_can_only_see_assignments_where_user_is_admin_on_subject(self):
         adminuser = baker.make(settings.AUTH_USER_MODEL)
         testuser = baker.make(settings.AUTH_USER_MODEL, shortname="testuser@example.com", fullname="Test User")
@@ -47,8 +82,8 @@ class TestStudentAssignmentGroupListView(test.TestCase, cradmin_testhelpers.Test
             parentnode__long_name="Inaccessible Assignment",
             parentnode__parentnode__parentnode=testsubject2,
         )
-        baker.make("core.Candidate", assignment_group=testgroup1, relatedstudent__user=testuser)
-        baker.make("core.Candidate", assignment_group=testgroup2, relatedstudent__user=testuser)
+        self.__make_candidate(group=testgroup1, user=testuser)
+        self.__make_candidate(group=testgroup2, user=testuser)
         selector = self.mock_http200_getrequest_htmls(
             requestuser=adminuser, viewkwargs={"user_id": testuser.id}
         ).selector
@@ -79,8 +114,8 @@ class TestStudentAssignmentGroupListView(test.TestCase, cradmin_testhelpers.Test
         testgroup2 = baker.make(
             "core.AssignmentGroup", parentnode__long_name="Inaccessible Assignment", parentnode__parentnode=testperiod2
         )
-        baker.make("core.Candidate", assignment_group=testgroup1, relatedstudent__user=testuser)
-        baker.make("core.Candidate", assignment_group=testgroup2, relatedstudent__user=testuser)
+        self.__make_candidate(group=testgroup1, user=testuser)
+        self.__make_candidate(group=testgroup2, user=testuser)
         selector = self.mock_http200_getrequest_htmls(
             requestuser=adminuser, viewkwargs={"user_id": testuser.id}
         ).selector
@@ -464,8 +499,8 @@ class TestStudentAssignmentGroupListView(test.TestCase, cradmin_testhelpers.Test
                     parentnode__long_name="Accessible Assignment",
                     parentnode__parentnode__parentnode=testsubject,
                 )
-                baker.make("core.Candidate", assignment_group=testgroup, relatedstudent__user=testuser)
-        with self.assertNumQueries(8):
+                self.__make_candidate(group=testgroup, user=testuser)
+        with self.assertNumQueries(7):
             selector = self.mock_http200_getrequest_htmls(
                 requestuser=adminuser, viewkwargs={"user_id": testuser.id}
             ).selector

devilry-6.7.1/devilry/devilry_admin/tests/dashboard/test_student_feedbackfeed_wizard/test_student_listview.py

@@ -0,0 +1,196 @@
+from unittest import mock
+from django import test
+from django.conf import settings
+
+from model_bakery import baker
+from cradmin_legacy import cradmin_testhelpers
+
+from devilry.devilry_account.models import PermissionGroup
+from devilry.devilry_admin.views.dashboard.student_feedbackfeed_wizard import student_list
+
+
+class TestStudentListView(test.TestCase, cradmin_testhelpers.TestCaseMixin):
+    viewclass = student_list.UserListView
+
+    def __make_periodadmin(self, period):
+        adminuser = baker.make(settings.AUTH_USER_MODEL)
+        baker.make(
+            "devilry_account.PermissionGroupUser",
+            user=adminuser,
+            permissiongroup=baker.make(
+                "devilry_account.PeriodPermissionGroup",
+                permissiongroup__grouptype=PermissionGroup.GROUPTYPE_PERIODADMIN,
+                period=period,
+            ).permissiongroup,
+        )
+        return adminuser
+
+    def __make_subjectadmin(self, subject):
+        adminuser = baker.make(settings.AUTH_USER_MODEL)
+        baker.make(
+            "devilry_account.PermissionGroupUser",
+            user=adminuser,
+            permissiongroup=baker.make(
+                "devilry_account.SubjectPermissionGroup",
+                permissiongroup__grouptype=PermissionGroup.GROUPTYPE_SUBJECTADMIN,
+                subject=subject,
+            ).permissiongroup,
+        )
+        return adminuser
+
+    def __get_titles(self, mockresponse):
+        return [
+            element.alltext_normalized
+            for element in mockresponse.selector.list(".cradmin-legacy-listbuilder-itemvalue-titledescription-title")
+        ]
+
+    def test_title(self):
+        testperiod = baker.make("core.Period")
+        mockresponse = self.mock_http200_getrequest_htmls(requestuser=self.__make_periodadmin(period=testperiod))
+        self.assertEqual(mockresponse.selector.one("title").alltext_normalized, "Select a student")
+
+    def test_only_users_with_relatedstudent_are_listed(self):
+        testperiod = baker.make("core.Period")
+        baker.make(settings.AUTH_USER_MODEL, shortname="notstudentuser")
+        baker.make("core.RelatedStudent", period=testperiod, user__shortname="studentuser")
+        mockresponse = self.mock_http200_getrequest_htmls(requestuser=self.__make_periodadmin(period=testperiod))
+        self.assertEqual(mockresponse.selector.count(".cradmin-legacy-listbuilder-itemvalue-titledescription-title"), 1)
+        self.assertContains(mockresponse.response, "studentuser")
+        self.assertNotContains(mockresponse.response, "notstudentuser")
+
+    def test_user_without_admin_permissions_sees_no_students(self):
+        baker.make("core.RelatedStudent", user__shortname="studentuser")
+        mockresponse = self.mock_http200_getrequest_htmls(requestuser=baker.make(settings.AUTH_USER_MODEL))
+        self.assertEqual(mockresponse.selector.count(".cradmin-legacy-listbuilder-itemvalue"), 0)
+        self.assertNotContains(mockresponse.response, "studentuser")
+
+    def test_periodadmin_only_sees_students_in_period_where_user_is_admin(self):
+        testperiod1 = baker.make("core.Period")
+        testperiod2 = baker.make("core.Period")
+        baker.make("core.RelatedStudent", period=testperiod1, user__shortname="accessiblestudent")
+        baker.make("core.RelatedStudent", period=testperiod2, user__shortname="inaccessiblestudent")
+        mockresponse = self.mock_http200_getrequest_htmls(requestuser=self.__make_periodadmin(period=testperiod1))
+        self.assertEqual(mockresponse.selector.count(".cradmin-legacy-listbuilder-itemvalue"), 1)
+        self.assertContains(mockresponse.response, "accessiblestudent")
+        self.assertNotContains(mockresponse.response, "inaccessiblestudent")
+
+    def test_subjectadmin_sees_students_in_all_periods_within_subject(self):
+        testsubject1 = baker.make("core.Subject")
+        testsubject2 = baker.make("core.Subject")
+        baker.make(
+            "core.RelatedStudent",
+            period=baker.make("core.Period", parentnode=testsubject1),
+            user__shortname="accessiblestudent1",
+        )
+        baker.make(
+            "core.RelatedStudent",
+            period=baker.make("core.Period", parentnode=testsubject1),
+            user__shortname="accessiblestudent2",
+        )
+        baker.make(
+            "core.RelatedStudent",
+            period=baker.make("core.Period", parentnode=testsubject2),
+            user__shortname="inaccessiblestudent",
+        )
+        mockresponse = self.mock_http200_getrequest_htmls(requestuser=self.__make_subjectadmin(subject=testsubject1))
+        self.assertEqual(mockresponse.selector.count(".cradmin-legacy-listbuilder-itemvalue"), 2)
+        self.assertContains(mockresponse.response, "accessiblestudent1")
+        self.assertContains(mockresponse.response, "accessiblestudent2")
+        self.assertNotContains(mockresponse.response, "inaccessiblestudent")
+
+    def test_superuser_sees_students_in_all_periods(self):
+        baker.make("core.RelatedStudent", user__shortname="studenta")
+        baker.make("core.RelatedStudent", user__shortname="studentb")
+        mockresponse = self.mock_http200_getrequest_htmls(
+            requestuser=baker.make(settings.AUTH_USER_MODEL, is_superuser=True)
+        )
+        self.assertEqual(mockresponse.selector.count(".cradmin-legacy-listbuilder-itemvalue"), 2)
+
+    def test_student_in_multiple_periods_is_only_listed_once(self):
+        testsubject = baker.make("core.Subject")
+        testuser = baker.make(settings.AUTH_USER_MODEL, shortname="studentuser")
+        baker.make("core.RelatedStudent", period=baker.make("core.Period", parentnode=testsubject), user=testuser)
+        baker.make("core.RelatedStudent", period=baker.make("core.Period", parentnode=testsubject), user=testuser)
+        mockresponse = self.mock_http200_getrequest_htmls(requestuser=self.__make_subjectadmin(subject=testsubject))
+        self.assertEqual(mockresponse.selector.count(".cradmin-legacy-listbuilder-itemvalue"), 1)
+
+    def test_list_users(self):
+        testperiod = baker.make("core.Period")
+        baker.make("core.RelatedStudent", period=testperiod, user__shortname="a", user__fullname="A")
+        baker.make("core.RelatedStudent", period=testperiod, user__shortname="b", user__fullname="B")
+        baker.make("core.RelatedStudent", period=testperiod, user__shortname="c", user__fullname="C")
+        mockresponse = self.mock_http200_getrequest_htmls(requestuser=self.__make_periodadmin(period=testperiod))
+        fullname_list = self.__get_titles(mockresponse)
+        shortname_list = [
+            element.alltext_normalized
+            for element in mockresponse.selector.list(
+                ".cradmin-legacy-listbuilder-itemvalue-titledescription-description"
+            )
+        ]
+        self.assertEqual(mockresponse.selector.count(".cradmin-legacy-listbuilder-itemvalue"), 3)
+        self.assertIn("A", fullname_list)
+        self.assertIn("B", fullname_list)
+        self.assertIn("C", fullname_list)
+        self.assertIn("a", shortname_list)
+        self.assertIn("b", shortname_list)
+        self.assertIn("c", shortname_list)
+
+    def test_search_no_match(self):
+        testperiod = baker.make("core.Period")
+        baker.make("core.RelatedStudent", period=testperiod, user__shortname="a", user__fullname="A")
+        mockresponse = self.mock_http200_getrequest_htmls(
+            requestuser=self.__make_periodadmin(period=testperiod), viewkwargs={"filters_string": "search-No match"}
+        )
+        self.assertEqual(0, mockresponse.selector.count(".cradmin-legacy-listbuilder-itemvalue"))
+
+    def test_search_match_fullname(self):
+        testperiod = baker.make("core.Period")
+        baker.make("core.RelatedStudent", period=testperiod, user__shortname="shortnamea", user__fullname="FullnameA")
+        mockresponse = self.mock_http200_getrequest_htmls(
+            requestuser=self.__make_periodadmin(period=testperiod), viewkwargs={"filters_string": "search-FullnameA"}
+        )
+        self.assertEqual(1, mockresponse.selector.count(".cradmin-legacy-listbuilder-itemvalue"))
+
+    def test_search_match_shortname(self):
+        testperiod = baker.make("core.Period")
+        baker.make("core.RelatedStudent", period=testperiod, user__shortname="shortnamea", user__fullname="FullnameA")
+        mockresponse = self.mock_http200_getrequest_htmls(
+            requestuser=self.__make_periodadmin(period=testperiod), viewkwargs={"filters_string": "search-shortnamea"}
+        )
+        self.assertEqual(1, mockresponse.selector.count(".cradmin-legacy-listbuilder-itemvalue"))
+
+    def test_search_does_not_match_student_in_other_period(self):
+        testperiod = baker.make("core.Period")
+        baker.make("core.RelatedStudent", user__shortname="shortnamea", user__fullname="FullnameA")
+        mockresponse = self.mock_http200_getrequest_htmls(
+            requestuser=self.__make_periodadmin(period=testperiod), viewkwargs={"filters_string": "search-FullnameA"}
+        )
+        self.assertEqual(0, mockresponse.selector.count(".cradmin-legacy-listbuilder-itemvalue"))
+
+    def test_backlink(self):
+        testperiod = baker.make("core.Period")
+        mockresponse = self.mock_http200_getrequest_htmls(requestuser=self.__make_periodadmin(period=testperiod))
+        self.assertEqual(1, len(mockresponse.request.cradmin_instance.reverse_url.call_args_list))
+        self.assertEqual(
+            mock.call(appname="overview", args=(), kwargs={}, viewname="INDEX"),
+            mockresponse.request.cradmin_instance.reverse_url.call_args_list[0],
+        )
+
+    def test_pagination(self):
+        testperiod = baker.make("core.Period")
+        baker.make("core.RelatedStudent", period=testperiod, _quantity=50)
+        mockresponse = self.mock_http200_getrequest_htmls(requestuser=self.__make_periodadmin(period=testperiod))
+        self.assertEqual(mockresponse.selector.count(".cradmin-legacy-listbuilder-itemvalue"), 35)
+
+    def test_query_count(self):
+        testperiod = baker.make("core.Period")
+        requestuser = self.__make_periodadmin(period=testperiod)
+        baker.make("core.RelatedStudent", period=testperiod, _quantity=10)
+        with self.assertNumQueries(4):
+            self.mock_http200_getrequest_htmls(requestuser=requestuser)
+        baker.make("core.RelatedStudent", period=testperiod, _quantity=90)
+        with self.assertNumQueries(4):
+            self.mock_http200_getrequest_htmls(requestuser=requestuser)
+        baker.make("core.RelatedStudent", period=testperiod, _quantity=400)
+        with self.assertNumQueries(4):
+            self.mock_http200_getrequest_htmls(requestuser=requestuser)

{devilry-6.7.0 → devilry-6.7.1}/devilry/devilry_admin/views/dashboard/createsubject.py

@@ -1,5 +1,6 @@
 from crispy_forms import layout
 from django import forms
+from django.core.exceptions import PermissionDenied
 from django.utils.translation import gettext_lazy
 from cradmin_legacy import crapp
 from cradmin_legacy import crinstance
@@ -42,6 +43,16 @@ class CreateView(crudbase.OnlySaveButtonMixin, CreateUpdateMixin, create.CreateV
     model = Subject
     template_name = "devilry_cradmin/viewhelpers/devilry_createview_with_backlink.django.html"
 
+    def dispatch(self, request, *args, **kwargs):
+        # NOTE: ``role`` is always None in the dashboard cradmin instance (it has no
+        #       roleclass), and the instance gives access to any authenticated user.
+        #       The permission check must therefore be done on request.user. Creating
+        #       a course is a superuser operation - the same check as the one guarding
+        #       the link to this view in devilry_admin/dashboard/overview.django.html.
+        if not request.user.is_superuser:
+            raise PermissionDenied("Only superusers can create courses.")
+        return super(CreateView, self).dispatch(request, *args, **kwargs)
+
     def get_pagetitle(self):
         return gettext_lazy("Create new course")
 

{devilry-6.7.0 → devilry-6.7.1}/devilry/devilry_admin/views/dashboard/student_feedbackfeed_wizard/assignment_list.py

@@ -1,9 +1,9 @@
 # -*- coding: utf-8 -*-
 
 
-from django.contrib.auth import get_user_model
 from django.db import models
 from django.db.models.functions import Lower, Concat
+from django.shortcuts import get_object_or_404
 from django.utils.translation import gettext, gettext_lazy
 
 from cradmin_legacy.crinstance import reverse_cradmin_url
@@ -15,6 +15,9 @@ from devilry.apps.core import models as core_models
 from devilry.devilry_cradmin import devilry_listbuilder
 from devilry.devilry_cradmin import devilry_listfilter
 from devilry.devilry_admin.views.dashboard.student_feedbackfeed_wizard import filters
+from devilry.devilry_admin.views.dashboard.student_feedbackfeed_wizard.student_list import (
+    get_student_users_queryset_for_user,
+)
 from devilry.devilry_cradmin.devilry_listfilter.utils import WithResultValueRenderable
 
 
@@ -88,13 +91,18 @@ class StudentAssignmentGroupListView(listbuilderview.FilterListMixin, listbuilde
 
     def dispatch(self, request, *args, **kwargs):
         self.user_id = kwargs.get("user_id")
+
+        # Ensure the requesting user is admin for a period where the requested user is
+        # a student. Without this, the displayname of any user in the system is exposed
+        # through the page title/heading below.
+        self.student_user = get_object_or_404(get_student_users_queryset_for_user(user=request.user), id=self.user_id)
+
         self.assignment_queryset = core_models.Assignment.objects.prefetch_point_to_grade_map().all()
         return super(StudentAssignmentGroupListView, self).dispatch(request, *args, **kwargs)
 
     @property
     def user_displayname(self):
-        user = get_user_model().objects.get(id=self.user_id)
-        return user.get_short_name()
+        return self.student_user.get_short_name()
 
     def get_pagetitle(self):
         return gettext("Assignments for %(user_shortname)s") % {"user_shortname": self.user_displayname}

{devilry-6.7.0 → devilry-6.7.1}/devilry/devilry_admin/views/dashboard/student_feedbackfeed_wizard/student_list.py

@@ -9,13 +9,28 @@ from cradmin_legacy.viewhelpers import listbuilderview
 from cradmin_legacy.viewhelpers.listbuilder.lists import RowList
 from cradmin_legacy.viewhelpers.listbuilder.itemframe import DefaultSpacingItemFrame
 
-from devilry.apps.core.models import RelatedStudent
+from devilry.apps.core.models import Period, RelatedStudent
 from devilry.devilry_cradmin import devilry_listbuilder
 from devilry.devilry_cradmin.devilry_listbuilder import user
 from devilry.devilry_admin.views.dashboard.student_feedbackfeed_wizard import filters
 from devilry.devilry_cradmin.devilry_listfilter.utils import WithResultValueRenderable
 
 
+def get_student_users_queryset_for_user(user):
+    """
+    Get a queryset of the users that the given ``user`` is allowed to look up
+    in the student feedbackfeed wizard.
+
+    This is the users that are :class:`devilry.apps.core.models.RelatedStudent`
+    within a :class:`devilry.apps.core.models.Period` where the given ``user``
+    is admin - the same students they can see in the period admin student list.
+    """
+    relatedstudent_ids = RelatedStudent.objects.filter(
+        period__in=Period.objects.filter_user_is_admin(user=user)
+    ).values_list("user_id", flat=True)
+    return get_user_model().objects.filter(id__in=relatedstudent_ids)
+
+
 class UserItemFrame(devilry_listbuilder.common.GoForwardLinkItemFrame):
     valuealias = "user"
 
@@ -82,8 +97,10 @@ class UserListView(listbuilderview.FilterListMixin, listbuilderview.View):
         filterlist.append(filters.UserSearchExtension())
 
     def get_unfiltered_queryset_for_role(self, role):
-        relatedstudent_ids = RelatedStudent.objects.all().values_list("user_id", flat=True)
-        queryset = get_user_model().objects.filter(id__in=relatedstudent_ids).order_by("username")
+        # NOTE: ``role`` is always None in the dashboard cradmin instance (it has no
+        #       roleclass), and the instance gives access to any authenticated user.
+        #       The permission check must therefore be done on self.request.user.
+        queryset = get_student_users_queryset_for_user(user=self.request.user).order_by("username")
 
         # Set unfiltered count on self.
         self.num_total = queryset.count()

{devilry-6.7.0 → devilry-6.7.1}/devilry/devilry_group/tests/test_feedbackfeed/admin/test_comment_edit_history.py

@@ -57,6 +57,35 @@ class TestAdminCommentEditHistoryView(TestCase, cradmin_testhelpers.TestCaseMixi
                 cradmin_role=testgroup, requestuser=testuser, viewkwargs={"group_comment_id": 1}
             )
 
+    def test_comment_in_another_group_raises_404(self):
+        testuser = baker.make("devilry_account.User", shortname="admin", fullname="Thor")
+        testperiod = baker.make_recipe("devilry.apps.core.period_active", admins=[testuser])
+        testgroup = baker.make("core.AssignmentGroup", parentnode__parentnode=testperiod)
+        self.__make_user_admin(user=testuser, assignment=testgroup.parentnode)
+        othergroupcomment = baker.make(
+            "devilry_group.GroupComment",
+            text="Comment in a group the requestuser has nothing to do with",
+            visibility=group_models.GroupComment.VISIBILITY_VISIBLE_TO_EVERYONE,
+        )
+        with self.assertRaises(Http404):
+            self.mock_getrequest(
+                cradmin_role=testgroup, requestuser=testuser, viewkwargs={"group_comment_id": othergroupcomment.id}
+            )
+
+    def test_examiner_and_admin_visibility_comment_in_another_group_raises_404(self):
+        testuser = baker.make("devilry_account.User", shortname="admin", fullname="Thor")
+        testperiod = baker.make_recipe("devilry.apps.core.period_active", admins=[testuser])
+        testgroup = baker.make("core.AssignmentGroup", parentnode__parentnode=testperiod)
+        self.__make_user_admin(user=testuser, assignment=testgroup.parentnode)
+        othergroupcomment = baker.make(
+            "devilry_group.GroupComment",
+            visibility=group_models.GroupComment.VISIBILITY_VISIBLE_TO_EXAMINER_AND_ADMINS,
+        )
+        with self.assertRaises(Http404):
+            self.mock_getrequest(
+                cradmin_role=testgroup, requestuser=testuser, viewkwargs={"group_comment_id": othergroupcomment.id}
+            )
+
     def test_comment_no_history_no_history_items_rendered(self):
         testuser = baker.make("devilry_account.User", shortname="admin", fullname="Thor")
         testperiod = baker.make_recipe("devilry.apps.core.period_active", admins=[testuser])

{devilry-6.7.0 → devilry-6.7.1}/devilry/devilry_group/tests/test_feedbackfeed/examiner/test_comment_edit_history.py

@@ -39,6 +39,47 @@ class TestExaminerCommentEditHistoryView(TestCase, cradmin_testhelpers.TestCaseM
                 cradmin_role=testgroup, requestuser=testuser, viewkwargs={"group_comment_id": 1}
             )
 
+    def test_comment_in_another_group_raises_404(self):
+        testuser = baker.make("devilry_account.User", shortname="admin", fullname="Thor")
+        testgroup = baker.make("core.AssignmentGroup")
+        self.__make_examiner(user=testuser)
+        othergroupcomment = baker.make(
+            "devilry_group.GroupComment",
+            text="Comment in a group the requestuser has nothing to do with",
+            visibility=group_models.GroupComment.VISIBILITY_VISIBLE_TO_EVERYONE,
+        )
+        with self.assertRaises(Http404):
+            self.mock_getrequest(
+                cradmin_role=testgroup, requestuser=testuser, viewkwargs={"group_comment_id": othergroupcomment.id}
+            )
+
+    def test_examiner_and_admin_visibility_comment_in_own_group_is_rendered(self):
+        testuser = baker.make("devilry_account.User", shortname="admin", fullname="Thor")
+        testgroup = baker.make("core.AssignmentGroup")
+        baker.make("core.Examiner", assignmentgroup=testgroup, relatedexaminer__user=testuser)
+        groupcomment = baker.make(
+            "devilry_group.GroupComment",
+            feedback_set__group=testgroup,
+            visibility=group_models.GroupComment.VISIBILITY_VISIBLE_TO_EXAMINER_AND_ADMINS,
+        )
+        mockresponse = self.mock_http200_getrequest_htmls(
+            cradmin_role=testgroup, requestuser=testuser, viewkwargs={"group_comment_id": groupcomment.id}
+        )
+        self.assertTrue(mockresponse.selector.exists(".devilry-comment-history-no-items"))
+
+    def test_examiner_and_admin_visibility_comment_in_another_group_raises_404(self):
+        testuser = baker.make("devilry_account.User", shortname="admin", fullname="Thor")
+        testgroup = baker.make("core.AssignmentGroup")
+        baker.make("core.Examiner", assignmentgroup=testgroup, relatedexaminer__user=testuser)
+        othergroupcomment = baker.make(
+            "devilry_group.GroupComment",
+            visibility=group_models.GroupComment.VISIBILITY_VISIBLE_TO_EXAMINER_AND_ADMINS,
+        )
+        with self.assertRaises(Http404):
+            self.mock_getrequest(
+                cradmin_role=testgroup, requestuser=testuser, viewkwargs={"group_comment_id": othergroupcomment.id}
+            )
+
     def test_comment_no_history_no_history_items_rendered(self):
         testuser = baker.make("devilry_account.User", shortname="admin", fullname="Thor")
         testgroup = baker.make("core.AssignmentGroup")

{devilry-6.7.0 → devilry-6.7.1}/devilry/devilry_group/tests/test_feedbackfeed/student/test_comment_edit_history.py

@@ -26,7 +26,9 @@ class TestStudentCommentEditHistoryView(TestCase, cradmin_testhelpers.TestCaseMi
     def test_comment_not_visible_to_everyone_raises_404(self):
         candidate = baker.make("core.Candidate", relatedstudent=baker.make("core.RelatedStudent"))
         groupcomment = baker.make(
-            "devilry_group.GroupComment", visibility=group_models.GroupComment.VISIBILITY_VISIBLE_TO_EXAMINER_AND_ADMINS
+            "devilry_group.GroupComment",
+            feedback_set__group=candidate.assignment_group,
+            visibility=group_models.GroupComment.VISIBILITY_VISIBLE_TO_EXAMINER_AND_ADMINS,
         )
         with self.assertRaises(Http404):
             self.mock_http200_getrequest_htmls(
@@ -35,6 +37,20 @@ class TestStudentCommentEditHistoryView(TestCase, cradmin_testhelpers.TestCaseMi
                 viewkwargs={"group_comment_id": groupcomment.id},
             )
 
+    def test_comment_in_another_group_raises_404(self):
+        candidate = baker.make("core.Candidate", relatedstudent=baker.make("core.RelatedStudent"))
+        othergroupcomment = baker.make(
+            "devilry_group.GroupComment",
+            text="Comment in a group the requestuser has nothing to do with",
+            visibility=group_models.GroupComment.VISIBILITY_VISIBLE_TO_EVERYONE,
+        )
+        with self.assertRaises(Http404):
+            self.mock_getrequest(
+                cradmin_role=candidate.assignment_group,
+                requestuser=candidate.relatedstudent.user,
+                viewkwargs={"group_comment_id": othergroupcomment.id},
+            )
+
     def test_missing_comment_id_in_kwargs(self):
         candidate = baker.make("core.Candidate", relatedstudent=baker.make("core.RelatedStudent"))
         with self.assertRaises(Http404):