openedx / openedx/openedx-platform
Studio: New organization enforcement is UI-only in course creation
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.2k
- Forks
- 4.4k
- Avg merge
- 6d 18h
- Merged PRs (30d)
- 42
Description
A course creator whose Studio Home reports allow_to_create_new_org: false is shown, in the authoring MFE, an organization dropdown restricted to their allowed orgs, so the UI prevents creating a course under a brand-new organization. The server does not enforce the same rule: a direct POST /course/ from that session with an organization short name that does not exist yet is accepted (HTTP 200) and both the organization and the course are created. The flag gates the UI only.
Where: POST /course/, cms/djangoapps/contentstore/views/course.py, create_new_course
Fix: enforce allow_to_create_new_org server-side in create_new_course (reject an unknown organization with 403 when the creator may not create organizations), matching what the MFE already does.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in cms/djangoapps/contentstore/views/course.py at the POST /course/ entry point and create_new_course, then reproduce the direct request with allow_to_create_new_org: false and an unknown organization short name. Done means that request returns 403 and does not create either the organization or the course, while permitted organization creation remains unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authorization, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100