Skip to content

Issue 5069 fix #329

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

Issue 5069 fix #329

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
611e099
Merge pull request #1 from topcoder-platform/develop
PrakashDurlabhji Oct 15, 2020
5812e92
Update ChallengeService.js
PrakashDurlabhji Oct 15, 2020
a2e8e54
Update ChallengeService.js
PrakashDurlabhji Oct 15, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions src/services/ChallengeService.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,10 +306,6 @@ async function searchChallenges (currentUser, criteria) {

// Filter all groups from the criteria to make sure the user can access those
if (!_.isUndefined(criteria.group) || !_.isUndefined(criteria.groups)) {
// check group access
if (_.isUndefined(currentUser)) {
throw new errors.BadRequestError('Authentication is required to filter challenges based on groups')
Copy link
Contributor

@ThomasKranitsas ThomasKranitsas Oct 16, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fix is clearly wrong.

Currently, if the currentUser is not set, we're throwing an error.
By removing that code, you are making the rest of the code prone to cannot get property "<prop>" of undefined errors.

Also, there's currently no check on whether a group is public or not which means, even if you bypass the above errors, you will still get wrong results back as the accessibleGroups, which is used to determine if the user has access to the requested groups, will be empty (since the user is not authenticated).

Copy link
Collaborator

@luizrrodrigues luizrrodrigues Oct 16, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @ThomasKranitsas , I'll remove this from Bug Bash.

}
if (!currentUser.isMachine && !helper.hasAdminRole(currentUser)) {
if (accessibleGroups.includes(criteria.group)) {
groupsToFilter.push(criteria.group)
Expand Down