Open acelaya opened 3 months ago
In https://github.com/hypothesis/lms/pull/6540#issuecomment-2285750118 I identified an easy way to end up with "invalid" IDs in the query string just by clicking around our existing interface.
In the "All courses view":
Following the change in https://github.com/hypothesis/lms/pull/6540, the two assignments remain in the selection, but only one of them exists in the new view.
Up until now we have not validated the selected courses, assignments and students that are represented in the URL query.
This means we will be showing "4 students" if the
student_id
query param appears 4 times, but if those are invalid values, the listbox might show a different amount of selected items.This is even trickier to achieve with pagination in mind, as it is possible there are valid IDs in the query which are not part of the already loaded pages.