MA-184 Prevent student access to unreleased data through mobile API

https://openedx.atlassian.net/browse/MA-184

@gwprice @aleffert Please review.
Which method in users/views.py needs this check, you think?

On Mon, Dec 15, 2014 at 3:28 PM, Akiva Leffert <notifications@github.com>
wrote:
>
> In lms/djangoapps/mobile_api/course_info/views.py
> <https://github.com/edx/edx-platform/pull/6222#discussion-diff-21853985>:
>
> > @@ -40,7 +40,7 @@ class CourseUpdatesList(generics.ListAPIView):
> >
> >      def list(self, request, *args, **kwargs):
> >          course_id = CourseKey.from_string(kwargs['course_id'])
> > -        course = modulestore().get_course(course_id)
> > +        course = get_course_with_access(request.user, 'load', course_id)
>
> This needs to happen over in users/views.py too. It seems like an easy to
> make mistake. I wonder if there's a good way for us to move some code
> around a bit so that people won't try it. Like have a verify course
> argument decorator or something?
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/edx/edx-platform/pull/6222/files#r21853985>.
>


-- 

*Mobile, Technical Lead*

edX <http://www.edx.org> | nimisha@edx.org <andya@edx.org>
[image:
http://www.e-learn.nl/media/blogs/e-learn/edX_Logo_Col_RGB_FINAL.jpg?mtime=1336074566]