More routes with no authentication check
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- docker, python
- Domain
- authentication, backend
Research direction
Start by reading #366, the listed handlers in backend/routes/course.py, user.py, assignment.py, regrade_request.py and submission.py, and the helpers in util/auth.py. Check each route's callers and what access rule fits; then add authentication tests for 401, 403 and success cases. Done means every listed route has an appropriate check and its tests pass.
Written by the indexing model from the issue text.
Description
While fixing #366 I scanned backend/routes/ for routes that never call require_authenticated, require_course_role, require_admin or one of the _verify_* helpers. These are left over. Each one needs a quick look to confirm it really has no check and to decide the right rule.
course.py
create_course: anyone can create a course and name any user as its instructor. The admin panel (pages/admin/courses/add.js) calls it.enroll_course: takesuser_idfrom the request body, so anyone with an entry code can enroll any user.leave_course: takesuser_idfrom the request body, so anyone can remove any student from any course.
user.py
get_user_by_email: returns a user's id, name, email and role to anyone. The instructor enrollment page calls it, so it probably needs a course staff rule rather than admin only.
assignment.py
get_assignment: returns full assignment details, including AI settings, to anyone with the id.get_extension,get_assignment_extensions: anyone can read extensions./courses
regrade_request.py
send_regrade_request,get_student_regrade_requests,check_regrade_request,delete_regrade_request
submission.py
test_autograder_submission: runs code in Docker, so this one matters most.
Suggested approach: same as #366. Use the helpers in util/auth.py, run auth before input checks, and add unit tests for 401, 403 and the success case.
- Dominant language
- Python
- Stars
- 13
- Forks
- 0
- Avg merge
- 2h 4m
- Merged PRs (30d)
- 1
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from kiat/codeAssist
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
kiat/codeAssist#391 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
kiat/codeAssist#364 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 63/100
kiat/codeAssist#392 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
kiat/codeAssist#390 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
kiat/codeAssist#389 ·
Similar issues
-
SSM GetParameter throttling during concurrent workflow launchesPossibly taken @alexiswl claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
-
[Bug] Dev image build fails: `npm install` in the root Dockerfile runs out of memory (exit 134)Possibly taken @andest01 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Rename FunctionalRole BOT_DEV to DEV_STAFFPossibly taken A pull request linked to this issue is open or already merged. Openenhancement good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
pesu-dev/discord_bot#97 ·
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
gradio-app/gradio#13964 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 93/100
BSData/horus-heresy-3rd-edition#3232 · 1 comment ·
Maintainers usually reply within 1 day