Issue 5069 fix #329
Issue 5069 fix #329
Conversation
|
@rootelement Can you check if we able to filter without auth? Thanks. |
|
@luizrrodrigues we are able to filter without auth. |
I mean filter by groups without auth. |
| @@ -306,10 +306,6 @@ async function searchChallenges (currentUser, criteria) { | |||
|
|
|||
| // Filter all groups from the criteria to make sure the user can access those | |||
| if (!_.isUndefined(criteria.group) || !_.isUndefined(criteria.groups)) { | |||
| // check group access | |||
| if (_.isUndefined(currentUser)) { | |||
| throw new errors.BadRequestError('Authentication is required to filter challenges based on groups') | |||
There was a problem hiding this comment.
The fix is clearly wrong.
Currently, if the currentUser is not set, we're throwing an error.
By removing that code, you are making the rest of the code prone to cannot get property "<prop>" of undefined errors.
Also, there's currently no check on whether a group is public or not which means, even if you bypass the above errors, you will still get wrong results back as the accessibleGroups, which is used to determine if the user has access to the requested groups, will be empty (since the user is not authenticated).
There was a problem hiding this comment.
Thanks @ThomasKranitsas , I'll remove this from Bug Bash.
topcoder-platform/community-app#5069