Fix XBlock studio handler silently dropping Course Editor writes

Open
  • Is something wrong?
#598 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
66/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
authorization, backend-api-design

Research direction

Start in views/component.py at component_handler around line 567 and trace how it checks course edit permission and calls update_item. Read the existing handler tests and add coverage for Course Editor writes and callers whose changed fields must receive 403. Done means permitted edits persist and unauthorized changed requests no longer return success.

Written by the indexing model from the issue text.

Description

willow
Description

When an XBlock studio handler (e.g. Drag and Drop, Survey) is called by a Course Editor, the changes are not persisted, yet the handler returns 200 and the UI reports success. This is silent data loss.

Current Behavior

component_handler (views/component.py:567) decides whether to persist using the legacy has_course_author_access. Editors have no legacy role (LEGACY_COURSE_ROLE_EQUIVALENCES does not include them), so update_item is skipped and only a warning is logged. The response is still 200.

Expected Behavior

Editors' changes are persisted. Callers without permission get an explicit 403 instead of a fake success.

Steps to reproduce
  1. Log in as a Course Editor.
  2. Edit a Drag and Drop (or Survey) component and save.
  3. Observe the success message, then reload and see the change was not saved.
Acceptance Criteria
  • component_handler persists with update_item when user_has_course_permission(request.user, COURSES_EDIT_COURSE_CONTENT.identifier, usage_key.course_key, LegacyAuthoringPermission.WRITE) is true.
  • When the user lacks permission and the handler changed fields, the response is 403 rather than a silent 200.
  • Editor edits to these XBlocks persist.
  • Tests are added or updated.
Proposed Solution
if user_has_course_permission(
    request.user, COURSES_EDIT_COURSE_CONTENT.identifier,
    usage_key.course_key, LegacyAuthoringPermission.WRITE,
):
    modulestore().update_item(block, request.user.id, asides=asides)

The else branch should return 403, at least when the handler actually changed fields.

Dominant language
Python
Stars
0
Forks
10
Avg merge
3d 23h
Merged PRs (30d)
21

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openedx/openedx-authz

All issues in openedx/openedx-authz

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.