I used the gradebook module for students to upload their homeworks, and view their results online.

However, after some time I got a report, that students can view other students results by guessing their user IDs, and manually modifying the grade URL by replacing the user ID from their URLs. The module does not display any links to such pages, but the issue seems important enough to warrant some fix.

After some code reading, I found out that the menu callback only checks whether the user is an student or a teacher; however, this is not enough: in case of students the owner of the node has also be checked.

I tried to create a patch for this issue, but I was only partially lucky: I managed to update the gradebook_grade_page function in gradebook.pages.inc to disable incorrect access.

The biggest issue with this but access control should be applied at the menu level, but I sadly did not understand the concrete access control parameters, and was not able to come up with a nice, Drupal-like solution.

However, hoping this would help to create the correct solution I insert my half-backed workaround for future reference.

function gradebook_grade_page($gradebook, $uid, $nid) {
  $account = user_load(array('uid' => $uid));
  if ($account !== FALSE && gradebookapi_is_student($gradebook, $account)) {
    global $user;
    if ($user->uid != $uid && !gradebookapi_is_teacher($gradebook, $user)) { 
      drupal_not_found();
      return; 
    }

Thank you for your help,
Zoltán Ujhelyi