Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Admin panel and account routes have no authentication at all

Aperta
  • Qualcosa non va?
#366 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

@DarioDeSilva ci sta già lavorando.

Dal 7/10/2026.

  • #378 di @DarioDeSilva — aperta

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Ferma
Stack tecnologico
python
Ambito
authentication, backend, security

Direzione di ricerca

Start with the listed handlers in backend/routes/user.py, then inspect the existing authentication and role-check helpers to understand how system-level admin access is represented. The issue also points to fetch calls in pages/admin/* and pages/editAccount/index.js; review those after the backend checks. Done means the listed routes reject unauthenticated or non-admin access and the frontend sends credentials; linked PR #378 is already open.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

The admin panel (pages/admin/*) and the account-edit page (pages/editAccount/index.js) call several backend routes that have no authentication check at all — not require_authenticated(), not any role check. Confirmed by reading each route directly:

  • get_all_courses, get_all_instructors, get_all_students (backend/routes/user.py) — return every course/instructor/student in the system to anyone who calls them, logged in or not.
  • create_user, delete_user, admin_update_account (backend/routes/user.py) — let anyone create, delete, or edit any user account, no auth required.
  • get_user_by_id, update_account (backend/routes/user.py) — let anyone read or modify any user's account details given their ID.
  • get_instructor_by_eid, get_courses_by_instructor — similar unauthenticated lookups.

On the frontend, none of the corresponding fetch() calls in pages/admin/* or pages/editAccount/index.js send credentials: "include" either, but that's secondary — even with credentials, these routes don't check who (if anyone) is calling them, let alone whether they're an admin.

This is a real security gap: right now, anyone who knows (or guesses) a user ID can read or edit any account, and the entire admin panel's data is publicly readable with no login. Fixing it means adding an admin-role auth check (presumably a new check, since require_course_role is course-scoped and this is account/system-level) to each of these routes, then fixing the frontend fetches to send credentials once there's an auth check for them to matter against.

Found during a deep-dive audit of frontend/src fetch calls after Cecilia's review of PR #355, while checking for other instances of the missing-credentials pattern she found. Not currently causing a user-visible bug (no auth check to fail against yet), but a real, separate finding worth its own tracking given the security implications, especially before this platform goes live.

Lingua principale
Python
Stelle
13
Fork
0
Merge medio
2h 4m
PR unite (30g)
1

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di kiat/codeAssist

Tutte le issue di kiat/codeAssist

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.