Add a course permission check to ContainerChildrenView

未关闭 适合新手
  • 哪里不对？
#604 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
76/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
python
领域
authorization, backend-api-design, testing

调研方向

从 rest_api/v1/views/course_index.py 中的 ContainerChildrenView.get() 开始，并将其访问检查与 ContainerHandlerView 的访问检查进行比较。为无法访问课程的用户添加或更新测试，并确认请求会在 get_xblock 创建课程信息块之前返回 403。验证已授权用户仍然可以加载单元页面。

由索引模型根据 Issue 内容生成。

描述

willow
Description

ContainerChildrenView does not check course access, so any authenticated user can request a container's children. It is backend only and needs a direct API call.

Current Behavior

rest_api/v1/views/course_index.py:125 only applies view_auth_classes(is_authenticated=True). Unlike its sibling ContainerHandlerView, it never calls _get_item_in_course, so no course access check runs. This also happens with the legacy access checks, and was already the case upstream.

Expected Behavior

Only users with view access to the course can list a container's children.

Steps to reproduce

Setup

  • A course with at least one unit (vertical).
  • A user with no access to that course: authenticated, not course staff, and with no AuthZ role on it.

Steps

  1. In Studio, open any unit of the course as a user with access and copy its usage key from the URL, for example block-v1:Org+Course+Run+type@vertical+block@abc123.

  2. Log in to Studio as the user with no access to the course.

  3. Call the endpoint with that usage key (URL-encoded):

    GET /api/contentstore/v1/container/{usage_key_string}/children

  4. Observe the response.

Result

  • Actual: 200, with the container's children in the body.
  • Expected: 403.

For comparison, GET /api/contentstore/v1/container_handler/{usage_key_string} as the same user returns 403, because it goes through _get_item_in_course.

Acceptance Criteria
  • get() returns 403 for users without COURSES_VIEW_COURSE on the container's course.
  • The check runs before anything else in get().
  • The unit page keeps working, since container_handler already requires the same permission.
  • Tests are added or updated.
Proposed Solution

At the top of get():

if not user_has_course_permission(
    request.user, COURSES_VIEW_COURSE.identifier,
    usage_key.course_key, LegacyAuthoringPermission.READ,
):
    self.permission_denied(request)
Technical Notes

get_xblock creates course_info blocks on a GET when they do not exist (view_handlers.py:1140), so the permission check has to come before that.

主要语言
Python
星标
0
派生
10
平均合并
5 天 9 小时
30 天内合并 PR
24

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

openedx/openedx-authz 的其他 Issue

查看 openedx/openedx-authz 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。