[Building Sakai] Permission to see official photos in Roster2

[Daniel Merino]

Hi everybody.

As it seems that Roster tool does not support official photos from 
Profile2 API and is not in its agenda neither, we have tested Roster 2 
tool to use official photos as it was implemented in RTSR-46 (1). 
Finally we use the URL approach and storing URLs in 
PROFILE_IMAGES_OFFICIAL_T works fine.

However, we have discovered that Roster2 does not support old 
roster.viewofficialphotos permission, so it is not possible AFAIK to 
allow seeing official photos only to Teacher role. As as consequence, 
any user could add other users to their site and could see their 
official photos. We think that this is a big privacy issue.

I have documented this in RSTR-58 (2) but we are in a hurry because we 
are going to 2.9 next week and I wonder if somebody has done this 
anywhere and could share their work with us.

Also, if somebody is using Roster tool with official photos loaded from 
URL and there is a patch somewhere, using Roster could be also a valid 
option for us.

I would be really grateful if somebody could help me with this.

Thanks in advance.
Best regards.

(1) https://jira.sakaiproject.org/browse/RSTR-46
(2) https://jira.sakaiproject.org/browse/RSTR-58
-- 
Daniel Merino Echeverría
daniel.merino at unavarra.es
Gestor de teleformación - Centro Superior de Innovación Educativa.
Tfno: 948-168489 - Universidad Pública de Navarra.