openedx / openedx/openedx-authz

Wrap Proctored Exams Settings links with `courses.manage_pages_and_resources` permission

Open
#442 0 comments 0 reactions 1 assignee View on GitHub

@dcoa is already working on this.

Since Sep 15, 2026.

willow
Dominant language
Python
Stars
0
Forks
9
Avg merge
13d 9h
Merged PRs (30d)
9

Description

Description

Currently, the UI links leading to the Proctored Exams Settings lack the proper permission wrapping. To ensure security and correct access control, all links, buttons, or entry points navigating to the Proctored Exams Settings must be conditionally rendered. They should only be visible and accessible to users who hold the courses.manage_pages_and_resources permission.

Expected Behavior

Any link directing a user to the Proctored Exams Settings is completely hidden from the UI if the active user does not have the courses.manage_pages_and_resources permission. Users who do have this permission should see and interact with the links normally.

Current Behavior

Links to the Proctored Exams Settings are being rendered in the UI without validating if the user holds the courses.manage_pages_and_resources permission, potentially exposing the settings entry point to unauthorized users.

Steps to reproduce
  1. Log in to the system using a user that does not have the courses.manage_pages_and_resources permission. For example, a Course Auditor.
  2. Navigate to the section or page where the link to the Proctored Exams Settings is typically located.
  3. Observe that the link or button is currently visible on the interface despite the lack of permissions.
  4. Log out and log back in with an account that does have the courses.manage_pages_and_resources permission to verify that the link functions correctly for authorized users.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.