Problem/Motivation
We recently launched an LMS site, and select users on certain courses are receiving an "access denied" message when attempting to revisit a course. The problem seems to originate when the lms_course_status table has a NULL current_lesson_status value. We migrated course statuses using a custom migration, which may have resulted bad data integrity.
Steps to reproduce
Create a course lesson status with a NULL current_lesson_status value.
Attempt to revisit the course.
You will be kicked out with a vague "Access denied" message."
Proposed resolution
The "Access Denied" message is actually a default error message generated by the odd execution path resulting from the empty current_lesson_status. Instead of correcting the message, the code should be made more robust to handle the NULL value by creating a new lesson status instead.
LMS admins may also choose to work around the issue by resetting the course status for the affected users and courses.
Remaining tasks
Create patch.
User interface changes
None.
API changes
None.
Data model changes
None.
Issue fork lms-3573261
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 3573261-fix
changes, plain diff MR !184
- 3573261-access-denied-when
changes, plain diff MR !146
Comments
Comment #4
graber commentedComment #8
graber commentedComment #10
catchBelated review - this looks good to me, was concerned it would end up having to be overly defensive but I think it's OK.