harvard-lil / h2o

H2O is a web app for creating and reading open educational resources, primarily in the legal field
https://opencasebook.org
GNU Affero General Public License v3.0
37 stars 30 forks source link

Permission check for enhanced media upload is inconsistent #1825

Closed lizadaly closed 1 year ago

lizadaly commented 1 year ago

Only superusers and verified professors should have the ability to upload media embeds in content, but the superuser check is not being correctly applied.

The base head of the page is intended to create two global JS variables:

window.SUP = {% if super %}true{% else %}false{% endif %};
window.VERIFIED = {% if request.user.verified_professor %}true{% else %}false{% endif %};

but in some cases like the Casebook Edit page, the super variable is either undefined or false and is getting incorrectly set to false. This means that the experience for superusers is inconsistent across pages.

Probably changing this to use request.user.is_superuser and getting rid of the custom super variable would improve consistency.