OO-1988 don't show course resource folders to learners

src/main/java/org/olat/course/ICourse.java

@@ -85,9 +85,10 @@ public interface ICourse extends OLATResourceable {
 	public OlatRootFolderImpl getCourseBaseContainer();
 	
 	/**
-	 * Return the container to the coursefolder of this course.
-	 * (E.g. "COURSEBASEPATH/coursefolder/"). This is for administration
-	 * use. There is no permission check.
+	 * Return the container to the coursefolder of this course. (E.g.
+	 * "COURSEBASEPATH/coursefolder/"). !! This is for administration or
+	 * internal use!! There is no permission check, make sure your controller
+	 * does check if user is allowed to see stuff, e.g. shared folder
 	 * 
 	 * @return the container to the coursefolder of this course
 	 */
@@ -95,7 +96,7 @@ public interface ICourse extends OLATResourceable {
 	
 	/**
 	 * The course folder that the user specified by its identity environment
-	 * can see and use.
+	 * can see and use. Used by WebDAV access.
 	 * 
 	 * @param identityEnv
 	 * @return The aggreagted course folder

src/main/java/org/olat/course/MergedCourseContainer.java

@@ -81,11 +81,12 @@ public class MergedCourseContainer extends MergeSource {
 	
 	protected void init(PersistingCourseImpl persistingCourse) {
 		super.init();
+		RepositoryEntry re = null;
 
 		if(identityEnv == null || identityEnv.getRoles().isOLATAdmin()) {
 			addContainersChildren(persistingCourse.getIsolatedCourseFolder(), true);
 		} else {
-			RepositoryEntry re = persistingCourse.getCourseEnvironment().getCourseGroupManager().getCourseEntry();
+			re = persistingCourse.getCourseEnvironment().getCourseGroupManager().getCourseEntry();
 			RepositoryEntrySecurity reSecurity = RepositoryManager.getInstance()
 					.isAllowed(identityEnv.getIdentity(), identityEnv.getRoles(), re);
 			if(reSecurity.isEntryAdmin()) {
@@ -93,18 +94,25 @@ public class MergedCourseContainer extends MergeSource {
 			}
 		}
 			
-		// grab any shared folder that is configured
+		// grab any shared folder that is configured, but only when in unchecked
+		// security mode (no identity environment) or when the user has course
+		// admin rights
 		OlatRootFolderImpl sharedFolder = null;
 		String sfSoftkey = persistingCourse.getCourseConfig().getSharedFolderSoftkey();
 		if (StringHelper.containsNonWhitespace(sfSoftkey) && !CourseConfig.VALUE_EMPTY_SHAREDFOLDER_SOFTKEY.equals(sfSoftkey)) {
-			OLATResource sharedResource = CoreSpringFactory.getImpl(RepositoryService.class)
-					.loadRepositoryEntryResourceBySoftKey(sfSoftkey);
-			if (sharedResource != null) {
-				sharedFolder = SharedFolderManager.getInstance().getSharedFolder(sharedResource);
-				if (sharedFolder != null) {
-					sharedFolder.setLocalSecurityCallback(new ReadOnlyCallback());
-					//add local course folder's children as read/write source and any sharedfolder as subfolder
-					addContainer(new NamedContainerImpl("_sharedfolder", sharedFolder));
+			if (re == null) {
+				// reuse if already loaded, else load
+				re = persistingCourse.getCourseEnvironment().getCourseGroupManager().getCourseEntry();				
+			}
+			if(identityEnv == null || identityEnv.getRoles().isOLATAdmin() || RepositoryManager.getInstance().isOwnerOfRepositoryEntry(identityEnv.getIdentity(), re)) {
+				OLATResource sharedResource = CoreSpringFactory.getImpl(RepositoryService.class).loadRepositoryEntryResourceBySoftKey(sfSoftkey);
+				if (sharedResource != null) {
+					sharedFolder = SharedFolderManager.getInstance().getSharedFolder(sharedResource);
+					if (sharedFolder != null) {
+						sharedFolder.setLocalSecurityCallback(new ReadOnlyCallback());
+						//add local course folder's children as read/write source and any sharedfolder as subfolder
+						addContainer(new NamedContainerImpl("_sharedfolder", sharedFolder));
+					}
 				}
 			}
 		}