openedx / openedx/openedx-authz

Add authz validation for `courses.manage_pages_and_resources` to `ProctoredExamSettingsView`

Open
#443 0 comments 0 reactions 1 assignee View on GitHub

@efortish is already working on this.

Since Sep 15, 2026.

willow
Dominant language
Python
Stars
0
Forks
9
Avg merge
13d 9h
Merged PRs (30d)
9

Description

Description

On the backend side, the ProctoredExamSettingsView (handling both GET and POST requests) currently lacks authorization validation. It needs to be updated to enforce the courses.manage_pages_and_resources permission. This will secure the endpoint and bring it in line with its sibling view, ProctoringErrorsView (used for the advanced settings page), which already implements the correct authorization checks.

Expected Behavior

When a user makes a GET or POST request to the ProctoredExamSettingsView endpoint, the backend should verify if the user has the courses.manage_pages_and_resources permission. If they do, the request should proceed normally. If they do not, the backend must block the request and return an HTTP 403 Forbidden error.

Current Behavior

ProctoredExamSettingsView is missing the authz validation check. Because of this, a user who does not have the courses.manage_pages_and_resources permission could potentially access or modify the proctored exam settings by bypassing the UI and making direct API calls (GET or POST) to this endpoint.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.