AuthorizeStudent.php replacement / prevent bookmarking

CCALI / CALI-Author-Viewer-5

This is the repo for CALI Author's jQuery based lesson viewer

1 stars 1 forks source link

AuthorizeStudent.php replacement / prevent bookmarking #131

Closed sgoshorn closed 4 years ago

sgoshorn commented 4 years ago

The Viewer relied on AuthorizeStudent.php to ensure everything was in place before running a lesson (student information, lesson score run id, etc.). A student starting from a bookmark instead of the proper method would have just been redirected to the lesson's description page. Now that AuthorizeStudent.php has been disabled to solve a lessonlink issue, the Viewer itself needs to determine if it's starting correctly.

A proper start should define a runid in the Viewer landing page. When the Viewer starts up, check if runid > 0. If not, redirect to a page about how to run lessons rather than the lesson description page because it's possible for a student to bookmark a lesson link lesson and if they start that, their run would not be attached to their course. We force them to refind the lesson either with resuming a lesson, finding the lesson again or visiting their lesson link course.

emasters commented 4 years ago

A copy of authorizestudent.php is at https://github.com/CCALI/CALI-Author-Viewer-5/blob/master/lessons/web/authorizestudent.php. It's focus was on blocking links where the referrer was not www.cali.org so that would capture browser bookmark links along with run links (of which LessonLink is one type) we want to allow. It doesn't set any variables that are passed on to the viewer. Everything runs just fine without this file.

The viewer needs to detect deep links directly, something of the form https://d7.calidev.org/lessons/web/cpy01/jq.php?own#About%20this%20lesson for example, and not allow those.

emasters commented 4 years ago

Currently working on a revamped version of authroizestudent.php but still hung the bookmark part. Big issue is with the persistence of $_SESSION which carries over can cause havoc when multiple runs are open in different browser tabs.

I've opened #139 to deal with the $_SESSION issue.

emasters commented 4 years ago

Updated authorizestudent.php and dealt with $_SESSION issue in #139. Here's a checklist for testing:

[x] Clicking start button - works as expected.
[x] Following LessonLink on Course page - works as expected.
[x] Following LessonLink from off website - works as expected. Will ask to login if necessary.
[x] From browser bookmark, not logged in - routes to error page.
[x] From browser bookmark, logged in, no previous Lessons run - routes to error page.
[x] From browser bookmark, logged in, previous Lesson run - route to error page
[x] View in Lesson link for faculty use - works as expected.

@sgoshorn please runs these tests and check off if it works.

sgoshorn commented 4 years ago

Those tests pass.