mahara-contributors team mailing list archive

[Robert Lyon <robertl@xxxxxxxxxxxxxxx>]

Ok, I think I have worked out what is going on.

When peer assessment / sign-off was designed we had (as per the manual)

"If the peer assessment block is used in conjunction with the sign-off
block, the portfolio author must sign off the page before anybody other
than themselves and the peer assessor can see published peer
assessments."

And the code handled that accordingly.

But then came Bug 1835321 -
https://bugs.launchpad.net/mahara/+bug/1835321 - which was based on a
request from WR 315075

So now peer assessments, once published, are visible before a page is
signed off

This has now created this bug report where a user can delete a fellow
peer's assessment

So is the note in the manual the correct way it should work for core versions of Mahara, and the change for WR 315075 just be a customisation for that client?
- therefore we need to revert the fix (bug 1835321) in core and make a custom fix for the client for bug 1859355?

Or is the manual wrong?
- therefore we need to fix up bug 1859355 in core and update the manual

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1859355

Title:
  Peer assessor can delete another peers assessment

Status in Mahara:
  Confirmed
Status in Mahara 19.10 series:
  Confirmed
Status in Mahara 20.04 series:
  Confirmed

Bug description:
  When we have the following setup:

  1) User A creates Page One and adds
  - a peer assessment block
  - a sign-off block

  2) User A shares Page One to
  - User B as 'peer'
  - User C as 'peer'
  - User D as 'no special role'

  3) Login as User B and add an assessment to Page One

  4) Login as User D and view Page One
  *** problem ***
   - you shouldn't be able to see peer assessment until page is signed off

  5) Login as User C and view Page One
  *** problem ***
   - you shouldn't be able to see peer assessment until page is signed off
  *** problem ***
   - you shouldn't be able to delete the peer assessment of User B

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1859355/+subscriptions