def student_photo(request, emplid):
    # confirm user's photo agreement
    user = get_object_or_404(Person, userid=request.user.username)
    can_access = False

    if Role.objects_fresh.filter(person=user, role__in=['ADVS', 'ADVM']):
        can_access = True
    else:
        if not has_photo_agreement(user):
            url = reverse('config:photo_agreement') + '?return=' + urllib.parse.quote(request.path)
            return ForbiddenResponse(request, mark_safe('You must <a href="%s">confirm the photo usage agreement</a> before seeing student photos.' % (url)))

        # confirm user is an instructor of this student (within the last two years)
        # TODO: cache past_semester to save the query?
        past_semester = Semester.get_semester(datetime.date.today() - datetime.timedelta(days=730))
        student_members = Member.objects.filter(offering__semester__name__gte=past_semester.name,
                person__emplid=emplid, role='STUD').select_related('offering')
        student_offerings = [m.offering for m in student_members]
        instructor_of = Member.objects.filter(person=user, role='INST', offering__in=student_offerings)
        can_access = (instructor_of.count() > 0)

    if not can_access:
        return ForbiddenResponse(request, 'You must be an instructor of this student.')

    # get the photo
    data, status = photo_for_view(emplid)

    # return the photo
    response = HttpResponse(data, content_type='image/jpeg')
    response.status_code = status
    response['Content-Disposition'] = 'inline; filename="%s.jpg"' % (emplid)
    response['Cache-Control'] = 'private, max-age=300'
    response.slow_okay = True
    return response