Description
On the backend side, the ProctoredExamSettingsView (handling both GET and POST requests) currently lacks authorization validation. It needs to be updated to enforce the courses.manage_pages_and_resources permission. This will secure the endpoint and bring it in line with its sibling view, ProctoringErrorsView (used for the advanced settings page), which already implements the correct authorization checks.
Expected Behavior
When a user makes a GET or POST request to the ProctoredExamSettingsView endpoint, the backend should verify if the user has the courses.manage_pages_and_resources permission. If they do, the request should proceed normally. If they do not, the backend must block the request and return an HTTP 403 Forbidden error.
Current Behavior
ProctoredExamSettingsView is missing the authz validation check. Because of this, a user who does not have the courses.manage_pages_and_resources permission could potentially access or modify the proctored exam settings by bypassing the UI and making direct API calls (GET or POST) to this endpoint.
Description
On the backend side, the
ProctoredExamSettingsView(handling both GET and POST requests) currently lacks authorization validation. It needs to be updated to enforce thecourses.manage_pages_and_resourcespermission. This will secure the endpoint and bring it in line with its sibling view,ProctoringErrorsView(used for the advanced settings page), which already implements the correct authorization checks.Expected Behavior
When a user makes a GET or POST request to the
ProctoredExamSettingsViewendpoint, the backend should verify if the user has thecourses.manage_pages_and_resourcespermission. If they do, the request should proceed normally. If they do not, the backend must block the request and return an HTTP 403 Forbidden error.Current Behavior
ProctoredExamSettingsViewis missing the authz validation check. Because of this, a user who does not have thecourses.manage_pages_and_resourcespermission could potentially access or modify the proctored exam settings by bypassing the UI and making direct API calls (GET or POST) to this endpoint.