openedx / openedx/openedx-authz
Add authz validation for `courses.manage_pages_and_resources` to `ProctoredExamSettingsView`
@efortish is already working on this.
Since Sep 15, 2026.
- Dominant language
- Python
- Stars
- 0
- Forks
- 9
- Avg merge
- 13d 9h
- Merged PRs (30d)
- 9
Description
Description
On the backend side, the ProctoredExamSettingsView (handling both GET and POST requests) currently lacks authorization validation. It needs to be updated to enforce the courses.manage_pages_and_resources permission. This will secure the endpoint and bring it in line with its sibling view, ProctoringErrorsView (used for the advanced settings page), which already implements the correct authorization checks.
Expected Behavior
When a user makes a GET or POST request to the ProctoredExamSettingsView endpoint, the backend should verify if the user has the courses.manage_pages_and_resources permission. If they do, the request should proceed normally. If they do not, the backend must block the request and return an HTTP 403 Forbidden error.
Current Behavior
ProctoredExamSettingsView is missing the authz validation check. Because of this, a user who does not have the courses.manage_pages_and_resources permission could potentially access or modify the proctored exam settings by bypassing the UI and making direct API calls (GET or POST) to this endpoint.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.