Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

anonymous user handling #1691

Merged
merged 15 commits into from
Feb 8, 2024
Merged

anonymous user handling #1691

merged 15 commits into from
Feb 8, 2024

Conversation

HanilJain
Copy link
Contributor

fixed the issue here anonymous user was able to view private reported issue in latest activity.

https://github.com/HanilJain/BLT/blob/64310e4fe217b7de992d257c520db781e3856c77/website/views.py#L135C1-L138C98

@HanilJain HanilJain mentioned this pull request Jan 23, 2024
Open
@HanilJain HanilJain changed the title anonymous user can't view private issue #1685 anonymous user can't view private issue Jan 23, 2024
DonnieBLT
DonnieBLT reviewed Jan 23, 2024
View reviewed changes
Copy link
Collaborator

@DonnieBLT DonnieBLT left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. How about the api can you please check other places this might happen?

@HanilJain HanilJain changed the title anonymous user can't view private issue anonymous user handling Jan 26, 2024
@HanilJain
Copy link
Contributor Author

HanilJain commented Jan 26, 2024 •
edited
Loading

anonymous user handling in API added :
in the following API
/api/v1/issues/
/api/v1/userissues/
/api/v1/search

@HanilJain HanilJain requested a review from DonnieBLT January 28, 2024 09:52
@HanilJain HanilJain mentioned this pull request Jan 28, 2024
Closed
DonnieBLT
DonnieBLT requested changes Jan 29, 2024
View reviewed changes
Copy link
Collaborator

@DonnieBLT DonnieBLT left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please add an automated test to this because it's an important security feature.

@HanilJain
Copy link
Contributor Author

HanilJain commented Jan 29, 2024 •
edited
Loading

@DonnieBLT Added automated test for the API. was this a correct way ?

@HanilJain HanilJain requested a review from DonnieBLT January 29, 2024 19:33
@HanilJain HanilJain mentioned this pull request Feb 4, 2024
Closed
@HanilJain
Copy link
Contributor Author

@DonnieBLT is it ready to be merged then ?

@DonnieBLT DonnieBLT enabled auto-merge (squash) February 8, 2024 04:45
@DonnieBLT DonnieBLT merged commit e895e1e into OWASP-BLT:main Feb 8, 2024
6 checks passed
@HanilJain HanilJain deleted the issue-1685 branch February 9, 2024 06:17
@HanilJain HanilJain mentioned this pull request Feb 16, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@DonnieBLT DonnieBLT DonnieBLT approved these changes

@fredfalcon fredfalcon fredfalcon approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@HanilJain @fredfalcon @DonnieBLT