BCStudentSoftwareDevTeam / BCStudentSoftwareDevTeam/chemical-inventory
Permission for Adding Users
- Dominant language
- Python
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
**[Original report](https://bitbucket.org/laborstudents/chemical-inventory-new/issue/164) by Benjamin Quesada (Bitbucket: [benrquesada](https://bitbucket.org/benrquesada), GitHub: [benrquesada](https://github.com/benrquesada)).**
----------------------------------------
User permissions were not updated for /AddUser/ and /ViewUser/ in the website so if regular users (aka students) knew the URL they could access the web-page and make changes to the Users.
No danger as long as the students don't know the URL.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the /AddUser/ and /ViewUser/ route handlers and reading how permissions are checked for comparable pages. Verify that regular users cannot access these pages or modify users, while authorized users retain access. No specific files or tests are named in the issue, so identify the relevant checks and existing permission tests first.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authorization, backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100