search

LectCap / web_folder

1 stars 0 forks source link

Edit slides - No protection against malicious users #21

Open stmi11 opened 8 years ago

stmi11 commented 8 years ago

There is currently no control over who is capable of editing slides on the editslide.php page. Any user can enter a valid URL (e.g. http://localhost:8080/editslide.php?edit_slide=Edit+slides&user=%274%27&lecture_id=%274%27) and be allowed to enter new slides, despite not being a member of the course, let alone being a teacher.

I leave this task at the moment to Anif and Hani since I assume you are busy anyway with the edit features.

stmi11 commented 8 years ago

This is a work in progress but it is at least right now not possible to delete slides through /editSlide.php. This functionality has instead moved to the header in /lecture.php. The end goal is to move the ability to upload slides to /editSlide.php as well.

Leaving this open until everything is fixed.