gistfile1.rb

  def show
    @assignment = @context.assignments.active.find(params[:assignment_id])
    if @context_enrollment && @context_enrollment.is_a?(ObserverEnrollment) && @context_enrollment.associated_user_id
      id = @context_enrollment.associated_user_id
    else
      id = @current_user.try(:id)
    end
    @user = @context.all_students.find(params[:id]) rescue nil
    if !@user
      flash[:error] = t('errors.student_not_enrolled', "The specified user is not a student in this course")
      respond_to do |format|
        format.html { redirect_to named_context_url(@context, :context_assignment_url, @assignment.id) }
        format.json { render :json => {:errors => t('errors.student_not_enrolled_id', "The specified user (%{id}) is not a student in this course", :id => params[:id])}}
      end
      return
    end

    hash = {:CONTEXT_ACTION_SOURCE => :submissions}
    append_sis_data(hash)
    js_env(hash)

    @submission = @assignment.submissions.where(user_id: @user).first
    @submission ||= @assignment.submissions.build(:user => @user)
    @submission.grants_rights?(@current_user, session)
    @rubric_association = @assignment.rubric_association
    @rubric_association.assessing_user_id = @submission.user_id if @rubric_association
    # can't just check the permission, because peer reviewiers can never read the grade
    if @assignment.muted? && !@submission.grants_right?(@current_user, :read_grade)
      @visible_rubric_assessments = []
    else
      @visible_rubric_assessments = @submission.rubric_assessments.select{|a| a.grants_rights?(@current_user, session, :read)[:read]}.sort_by{|a| [a.assessment_type == 'grading' ? SortFirst : SortLast, Canvas::ICU.collation_key(a.assessor_name)] }
    end

    @assessment_request = @submission.assessment_requests.find_by_assessor_id(@current_user.id) rescue nil
    if authorized_action(@submission, @current_user, :read)
      respond_to do |format|
        json_handled = false
        if params[:preview]
          if params[:version] && !@assignment.quiz
            @submission = @submission.submission_history[params[:version].to_i]
          end

          @headers = false
          if @assignment.quiz && @context.is_a?(Course) && @context.user_is_student?(@current_user) && !@context.user_is_instructor?(@current_user)
            format.html { redirect_to(named_context_url(@context, :context_quiz_url, @assignment.quiz.id, :headless => 1)) }
          elsif @submission.submission_type == "online_quiz" && @submission.quiz_submission_version
            format.html {
              quiz_params = {
                headless: 1,
                user_id: @submission.user_id,
                version: params[:version] || @submission.quiz_submission_version
              }
              redirect_to named_context_url(@context,
                                            :context_quiz_history_url,
                                            @assignment.quiz.id, quiz_params)
            }
          else
            format.html { render :action => "show_preview" }
          end
        elsif params[:download]
          if params[:comment_id]
            @attachment = @submission.submission_comments.find(params[:comment_id]).attachments.find{|a| a.id == params[:download].to_i }
          else
            @attachment = @submission.attachment if @submission.attachment_id == params[:download].to_i
            prior_attachment_id = @submission.submission_history.map(&:attachment_id).find{|a| a == params[:download].to_i }
            @attachment ||= Attachment.find_by_id(prior_attachment_id) if prior_attachment_id
            @attachment ||= @submission.attachments.find_by_id(params[:download]) if params[:download].present?
            @attachment ||= @submission.submission_history.map(&:versioned_attachments).flatten.find{|a| a.id == params[:download].to_i }
          end
          raise ActiveRecord::RecordNotFound unless @attachment
          format.html {
            if @attachment.context == @submission || @attachment.context == @assignment
              redirect_to(file_download_url(@attachment, :verifier => @attachment.uuid, :inline => params[:inline]))
            else
              redirect_to(named_context_url(@attachment.context, :context_file_download_url, @attachment, :verifier => @attachment.uuid, :inline => params[:inline]))
            end
          }
          json_handled = true
          format.json { render :json => @attachment.as_json(:permissions => {:user => @current_user}) }
        else
          @submission.limit_comments(@current_user, session)
          format.html
        end
        if !json_handled
          format.json { 
            @submission.limit_comments(@current_user, session)
            excludes = @assignment.grants_right?(@current_user, session, :grade) ? [:grade, :score] : []
            render :json => @submission.as_json(
              Submission.json_serialization_full_parameters(
                :exclude => excludes,
                :except  => %w(quiz_submission submission_history)
              ).merge(:permissions => {:user => @current_user, :session => session, :include_permissions => false})
            )
          }
        end
      end
    end
  end