Security testing in all views

[asdoc]

• Check if all get or post parameters belong to the user and user has permission for viewing/adding/editing data for the corresponding parameters

[akshaykolte]

Keep updating this file as issues are found or resolved

• Student Views: View attendance : Subject arguments(True/False)[empty table shown for not assigned subject]
• Parent Views: View attendance : Subject arguments(True/False)[empty table shown for not assigned subject]
• Teacher Views: 1.Check url arguments for add attendance 2.Teacher can view attendance of students not assigned to him and also of lectures not assigned to him by changing url parameters 3.Teacher can edit attendance of students not assigned to him and also of lectures not assigned to him by changing url parameters(high priority) 4.Can view other teacher notices by changing url but cannot change the notice as uploader id != teacher id 5.Also check add_lectures and add_test_marks in teacher views for flaws in url parameters.
• Accountant Views: 1.Make transaction function: Transaction can be made for studentbatch of different branch than that of accountant by changing url parameters.