Prevent contest attendants from editing contests, problems, etc.

AI-comp / wpcs

2 stars 2 forks source link

Prevent contest attendants from editing contests, problems, etc. #71

Closed ss0201 closed 11 years ago

ss0201 commented 11 years ago

Currently everyone can edit every critical element. Only admins should be able to do that.

exKAZUu commented 11 years ago

So we need an admin page for changing user roles.

ss0201 commented 11 years ago

Administrator, Contest Organizer (or Judge), Contest Attendant are considerable roles, which are also included in other programming contest systems such as DOMjudge or PC^2.

murooka commented 11 years ago

I think Contest Organizer is not necessary because Admin and Contest Organizer is now almost same in WPCS. How about separating "/admin" namespace to make admin page?

exKAZUu commented 11 years ago

I agree with murooka. We should develop the smallest program satisfying requirements.

ss0201 commented 11 years ago

All right, let's do so.

ss0201 commented 11 years ago

Well, splitting pages doesn't really prevent this issue... Non-admin users still can edit problems by accessing admin pages, because there's no authentication.

ss0201 commented 11 years ago

It might be a hard work to fix this issue in a proper way, so I don't ask you to do it right now. But let me keep this issue opened.

ss0201 commented 11 years ago

Now some elements are hidden in the admin page. There are some other cases which should be avoided:

A normal user editing another user's profile, by accessing /users/:id/edit.
A normal user editing groups, by accessing pages under /groups.
A normal user editing images, by accessing pages under /images.

Maybe we should also move these to the admin area.