diff --git a/web/app/controllers/api_teachers_controller.rb b/web/app/controllers/api_teachers_controller.rb index 90cae056f..4348ab5e7 100644 --- a/web/app/controllers/api_teachers_controller.rb +++ b/web/app/controllers/api_teachers_controller.rb @@ -42,13 +42,9 @@ class ApiTeachersController < ApiController private def auth_teacher - if current_user.admin - @teacher = Teacher.find(params[:id]) - else - @teacher = Teacher.where("user_id=? AND id=?", current_user.id, params[:id]).first - end - - unless @teacher + @teacher = Teacher.find(params[:id]) + + if !current_user.admin && !@teacher.user == current_user Rails.logger.info("Could not find teacher #{params[:id]} for #{current_user}") raise JamPermissionError, ValidationMessages::PERMISSION_VALIDATION_ERROR end