Require publish permission when a save request publishes content

Open
  • Is something wrong?
#600 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
1-2 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
python
Domain
authorization, backend-api-design

Research direction

Read _get_xblock_authz_permission and _check_xblock_permission in view_handlers.py, then trace _save_xblock and the existing tests for xblock save permissions. Add or update tests for content edits, make_public, and republish on eligible blocks, including requests that need both permissions. Done means the tests confirm publishing requires publish permission while correctly privileged pure edits and publishes still work; the visibility decision in the issue remains unresolved.

Written by the indexing model from the issue text.

Description

willow
Description

A Course Editor can publish content without having publish_course_content by adding content fields to a request that also sets publish. The permission is chosen from the shape of the request body instead of from what the request does. This is backend only and needs a direct API call.

Current Behavior

_get_xblock_authz_permission (view_handlers.py:216-229) asks for publish_course_content only on a "pure" publish. If the body contains any content field (_CONTENT_FIELDS, :109), it asks for edit_course_content instead. _save_xblock then publishes anyway (:696-702).

Expected Behavior

Any request that will publish requires publish permission, in addition to edit permission when it carries content.

Steps to reproduce
  1. Log in as a Course Editor (has edit but not publish permission).
  2. Send an xblock save request to the xblock handler with publish: "make_public" plus a content field such as metadata.
  3. Observe that the block is published.
Acceptance Criteria
  • A request that publishes (make_public, or republish on a non-direct-only block with a published version) requires PUBLISH_COURSE_CONTENT.
  • A request with content fields requires EDIT_COURSE_CONTENT; a request with both requires both.
  • An Editor sending content plus make_public no longer publishes.
  • Pure edits and pure publishes by correctly-privileged users keep working.
  • Tests are added or updated.
Proposed Solution
needs_publish = publish == "make_public" or (
    publish == "republish"
    and block_type not in DIRECT_ONLY_CATEGORIES
    and modulestore().has_published_version(xblock)
)

Have _get_xblock_authz_permission return a list and _check_xblock_permission require all of them.

Notes or Additional Context

Product decision needed: an editor changing visibility on a published unit. Either deny it (403), or save the change as a draft and downgrade republish to no publish. Second opinion requested on the API-level security validation.

Dominant language
Python
Stars
0
Forks
10
Avg merge
3d 23h
Merged PRs (30d)
21

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openedx/openedx-authz

All issues in openedx/openedx-authz

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.