Require publish permission when a save request publishes content

Aperta
  • Qualcosa non va?
#600 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
1-2 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python
Ambito
authorization, backend-api-design

Direzione di ricerca

Read _get_xblock_authz_permission and _check_xblock_permission in view_handlers.py, then trace _save_xblock and the existing tests for xblock save permissions. Add or update tests for content edits, make_public, and republish on eligible blocks, including requests that need both permissions. Done means the tests confirm publishing requires publish permission while correctly privileged pure edits and publishes still work; the visibility decision in the issue remains unresolved.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

willow
Description

A Course Editor can publish content without having publish_course_content by adding content fields to a request that also sets publish. The permission is chosen from the shape of the request body instead of from what the request does. This is backend only and needs a direct API call.

Current Behavior

_get_xblock_authz_permission (view_handlers.py:216-229) asks for publish_course_content only on a "pure" publish. If the body contains any content field (_CONTENT_FIELDS, :109), it asks for edit_course_content instead. _save_xblock then publishes anyway (:696-702).

Expected Behavior

Any request that will publish requires publish permission, in addition to edit permission when it carries content.

Steps to reproduce
  1. Log in as a Course Editor (has edit but not publish permission).
  2. Send an xblock save request to the xblock handler with publish: "make_public" plus a content field such as metadata.
  3. Observe that the block is published.
Acceptance Criteria
  • A request that publishes (make_public, or republish on a non-direct-only block with a published version) requires PUBLISH_COURSE_CONTENT.
  • A request with content fields requires EDIT_COURSE_CONTENT; a request with both requires both.
  • An Editor sending content plus make_public no longer publishes.
  • Pure edits and pure publishes by correctly-privileged users keep working.
  • Tests are added or updated.
Proposed Solution
needs_publish = publish == "make_public" or (
    publish == "republish"
    and block_type not in DIRECT_ONLY_CATEGORIES
    and modulestore().has_published_version(xblock)
)

Have _get_xblock_authz_permission return a list and _check_xblock_permission require all of them.

Notes or Additional Context

Product decision needed: an editor changing visibility on a published unit. Either deny it (403), or save the change as a draft and downgrade republish to no publish. Second opinion requested on the API-level security validation.

Lingua principale
Python
Stelle
0
Fork
10
Merge medio
5g 9h
PR unite (30g)
24

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di openedx/openedx-authz

Tutte le issue di openedx/openedx-authz

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.