Skip to content

Wrap Proctored Exams Settings links with courses.manage_pages_and_resources permission #442

Description

@BryanttV

Description

Currently, the UI links leading to the Proctored Exams Settings lack the proper permission wrapping. To ensure security and correct access control, all links, buttons, or entry points navigating to the Proctored Exams Settings must be conditionally rendered. They should only be visible and accessible to users who hold the courses.manage_pages_and_resources permission.

Expected Behavior

Any link directing a user to the Proctored Exams Settings is completely hidden from the UI if the active user does not have the courses.manage_pages_and_resources permission. Users who do have this permission should see and interact with the links normally.

Current Behavior

Links to the Proctored Exams Settings are being rendered in the UI without validating if the user holds the courses.manage_pages_and_resources permission, potentially exposing the settings entry point to unauthorized users.

Steps to reproduce

  1. Log in to the system using a user that does not have the courses.manage_pages_and_resources permission. For example, a Course Auditor.
  2. Navigate to the section or page where the link to the Proctored Exams Settings is typically located.
  3. Observe that the link or button is currently visible on the interface despite the lack of permissions.
  4. Log out and log back in with an account that does have the courses.manage_pages_and_resources permission to verify that the link functions correctly for authorized users.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

willowReleased in Willow

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions