85 complete item 1b of security improvement #121

Ye-Tien · 2023-10-01T06:01:00Z

Describe your changes

 Update role checked endpoints which have access to the resource and be annotated with @is_user_or_has_role or @has_role

Issue ticket number and link

Role checked endpoints audited to determine who should have access to the resource, GET: required, DELETE: required (admin), POST: required (admin)

register POST: not required login POST: not required send_code POST: not required verify_code POST: not required reset_password POST: required

POST: required (admin)

GET: required (admin) PATCH: required (admin) DELETE: required (admin)

POST: required (admin) DELETE: required (admin)

editProfile POST: required getProfile POST: required

GET: required (admin)

class RoleRequest(Resource): GET: required (admin) POST: required (admin) PATCH: required (admin) DELETE: required (admin) class QualificationsRequest(Resource): GET: required (admin) POST: required (admin) PATCH: required (admin) DELETE: required (admin) class AssetTypeRequest(Resource): GET: required (admin) POST: required (admin) PATCH: required (admin) DELETE: required (admin)

GET: required (admin) DELETE: required (admin) PATCH: required (admin)

class TenancyConfig(Resource): GET: not required POST: required (admin) PATCH: required (admin) DELETE: required imageRequest GET: not required

GetQuestionRequest GET: required GetRandomQuestionRequest GET: required DeleteQuestion GET: required (admin) CreateQuestion GET: required (admin) UpdateQuestion GET: required (admin) CheckAnswer GET: required CheckSingleAnswer GET: required CheckMulitpleAns GET: required

GetUserInfoRequest GET: required GetAvailabilitiesRequest GET: required GetAllVolunteer GET: required (admin)

GET: required (admin) POST: required (admin) PATCH: required (admin)

GET: required PATCH: required (admin)

VehicleRequest GET: required (admin) POST: required (admin) DELETE: required (admin) GetInputA GET: required (admin) GetInputR GET: required (admin) GetInputP GET: required (admin) GetInputV GET: required (admin) GetInputQ GET: required (admin) GetVehicleRequest Currently used by developers

GET: required (admin)

GET: required PATCH: required

GET: required

GET: required PATCH: required

GET: required POST: required GET: required

editProfile POST: required getProfile POST: required

dietary_option GET: need to confirm if this API is being used before the user is registered POST: required dietary_requirement GET: required

GET: required DELETE: required (admin) POST: required (admin)

register POST: not required login POST: not required send_code POST: not required verify_code POST: not required reset_password POST: required

class TenancyConfig(Resource): GET: not required POST: required (admin) PATCH: required (admin) DELETE: required (admin) imageRequest GET: not required

controllers/authentication.py

reset_password POST: not required

emilymclean · 2023-10-10T00:54:29Z

controllers/diet_requirement.py

@@ -84,6 +85,7 @@ def post(self):
    This is a class to retrieve the dietary requirement data from the database
    """
    @requires_auth
+    @is_user_or_has_role('id', UserType.VOLUNTEER, UserType.ROOT_ADMIN)


Is this correct? The ID parameter should be the user ID. It looks like all these are just the ID of the thing

Have you tested this with a volunteer user?

emilymclean

I think all of the usages of is_user_or_has_role that have 'id' as the userId parameter are incorrect. Please audit and verify/test with a volunteer account.

emilymclean · 2023-10-10T00:54:39Z

controllers/diet_requirement.py

@@ -84,6 +85,7 @@ def post(self):
    This is a class to retrieve the dietary requirement data from the database
    """
    @requires_auth
+    @is_user_or_has_role('id', UserType.VOLUNTEER, UserType.ROOT_ADMIN)


Have you tested this with a volunteer user?

emilymclean · 2023-10-10T00:55:16Z

controllers/authentication.py

@@ -79,6 +78,8 @@ def post(self):


 class reset_password(Resource):
+
+    @is_user_or_has_role('id', UserType.VOLUNTEER, UserType.ROOT_ADMIN)


This shouldn't be guarded

emilymclean · 2023-10-10T00:56:02Z

controllers/asset_type_role.py

@@ -29,14 +29,16 @@

 class AssetTypeRole(Resource):
    @requires_auth
+    @is_user_or_has_role('id', UserType.VOLUNTEER, UserType.ROOT_ADMIN)


This data isn't scoped to the user, and I don't see why we should even care about role for this GET?

emilymclean · 2023-10-10T00:56:43Z

controllers/profile.py

@@ -36,6 +36,7 @@

 class EditProfile(Resource):
    @requires_auth
+    @is_user_or_has_role('id', UserType.VOLUNTEER, UserType.ROOT_ADMIN)


Again, is this the right parameter?

emilymclean · 2023-10-10T00:57:40Z

controllers/tutorial_quiz.py

@@ -30,6 +30,7 @@

 class GetQuestionRequest(Resource):
    @requires_auth
+    @is_user_or_has_role('id', UserType.VOLUNTEER, UserType.ROOT_ADMIN)


Is this data scoped to the user, and is this the right parameter?

emilymclean · 2023-10-10T00:58:02Z

controllers/user.py

@@ -18,6 +18,7 @@

 class GetUserInfoRequest(Resource):
    @requires_auth
+    @is_user_or_has_role('id', UserType.VOLUNTEER, UserType.ROOT_ADMIN)


Same with these, right parameter?

emilymclean · 2023-10-10T00:59:02Z

controllers/user_role.py

@@ -26,12 +26,14 @@

 class UserRole(Resource):
    @requires_auth
+    @has_role(UserType.ROOT_ADMIN)


Is a volunteer supposed to be able to get/write to these parameters? If not, this is fine

emilymclean · 2024-03-03T11:43:02Z

This obviously wasn't tested even once because you would have realised the role check decorator doesn't work like that

Ye-Tien added 27 commits September 30, 2023 17:08

Update asset_type_role.py for role checked endpoints

af34c3a

Role checked endpoints audited to determine who should have access to the resource, GET: required, DELETE: required (admin), POST: required (admin)

Update authentication.py for role checked endpoints

6b43c99

register POST: not required login POST: not required send_code POST: not required verify_code POST: not required reset_password POST: required

Update email.py for role checked endpoint

3ee3c3f

POST: required (admin)

Update existing_requests.py for role checked endpoints

c10a97e

GET: required (admin) PATCH: required (admin) DELETE: required (admin)

Update new_request.py for role checked points

d03b277

POST: required (admin) DELETE: required (admin)

Update profile.py for role checked endpoints

f9ab257

editProfile POST: required getProfile POST: required

Update recommendation.py for role checked endpoints

c115ec0

GET: required (admin)

Update shift_request.py for role checked points

acea65e

GET: required (admin) DELETE: required (admin) PATCH: required (admin)

Update tenancy_config.py for role checked endpoints

9fe09d1

class TenancyConfig(Resource): GET: not required POST: required (admin) PATCH: required (admin) DELETE: required imageRequest GET: not required

Update user.py for role checked endpoints

22c22be

GetUserInfoRequest GET: required GetAvailabilitiesRequest GET: required GetAllVolunteer GET: required (admin)

Update user_role.py for role checked endpoints

304d3c1

GET: required (admin) POST: required (admin) PATCH: required (admin)

Update user_type.py for role checked endpoints

ed22cd6

GET: required PATCH: required (admin)

Update volunteer.py for role checked endpoints

4a62613

GET: required (admin)

Update volunteer_all.py for role checked endpoints

269e92a

GET: required (admin)

Update volunteer_availability.py for role checked endpoints

d34a808

GET: required PATCH: required

Update volunteer_preferred_hours.py for role checked endpoints

9833279

GET: required PATCH: required

Update volunteer_shifts.py for role checked endpoints

c151dbf

GET: required

Update volunteer_status.py for role checked endpoints

71b98fb

GET: required PATCH: required

Update volunteer_unavailability.py for role checked endpoints

8357b8d

GET: required POST: required GET: required

Update profile.py for role checked endpoints

2c0c40b

editProfile POST: required getProfile POST: required

Update diet_requirement.py for role checked endpoints

b7c6e76

dietary_option GET: need to confirm if this API is being used before the user is registered POST: required dietary_requirement GET: required

Update asset_type_role.py for role checked endpoints

9b1c437

GET: required DELETE: required (admin) POST: required (admin)

Update authentication.py for role checked endpoints

e2d8778

register POST: not required login POST: not required send_code POST: not required verify_code POST: not required reset_password POST: required

Update tenancy_config.py for role checked endpoints

3251ad1

class TenancyConfig(Resource): GET: not required POST: required (admin) PATCH: required (admin) DELETE: required (admin) imageRequest GET: not required

Ye-Tien linked an issue Oct 1, 2023 that may be closed by this pull request

Complete Item 1B of security improvement #85

Open

1 task

emilymclean reviewed Oct 8, 2023

View reviewed changes

controllers/authentication.py Outdated Show resolved Hide resolved

Update authentication.py

3f75ea1

reset_password POST: not required

Ye-Tien requested review from Xinyun-Zhou and 090997 October 9, 2023 08:13

Xinyun-Zhou requested a review from emilymclean October 9, 2023 12:39

emilymclean reviewed Oct 10, 2023

View reviewed changes

emilymclean closed this Mar 3, 2024

fishchimp deleted the 85-complete-item-1b-of-security-improvement branch April 28, 2024 06:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

85 complete item 1b of security improvement #121

85 complete item 1b of security improvement #121

Ye-Tien commented Oct 1, 2023

emilymclean Oct 10, 2023

emilymclean Oct 10, 2023

emilymclean left a comment

emilymclean Oct 10, 2023

emilymclean Oct 10, 2023

emilymclean Oct 10, 2023

emilymclean Oct 10, 2023

emilymclean Oct 10, 2023

emilymclean Oct 10, 2023

emilymclean Oct 10, 2023

emilymclean commented Mar 3, 2024

		@@ -79,6 +78,8 @@ def post(self):


		class reset_password(Resource):

		@is_user_or_has_role('id', UserType.VOLUNTEER, UserType.ROOT_ADMIN)

85 complete item 1b of security improvement #121

85 complete item 1b of security improvement #121

Conversation

Ye-Tien commented Oct 1, 2023

Describe your changes

Issue ticket number and link

Choose a reason for hiding this comment

Choose a reason for hiding this comment

emilymclean left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

emilymclean commented Mar 3, 2024