Skip to content

fix: user with role topcoder user shouldn't be allowed to create/modify challenges #637

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 16 commits into from
May 18, 2023
Merged

fix: user with role topcoder user shouldn't be allowed to create/modify challenges #637

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
bf5849a
Security fix for root file system access
Gunasekar-K May 4, 2023
e6f897f
Merge pull request #630 from topcoder-platform/root-file-system-acces…
Gunasekar-K May 4, 2023
5dfc970
Yarn cache issue due to root file system security
Gunasekar-K May 4, 2023
9d76183
Merge pull request #631 from topcoder-platform/root-file-system-acces…
Gunasekar-K May 4, 2023
80879fe
Revert "Yarn cache issue due to root file system security"
eisbilir May 4, 2023
9960278
Revert "Security fix for root file system access"
eisbilir May 4, 2023
23ab113
root file fix
Gunasekar-K May 4, 2023
838f096
Update config.yml
Gunasekar-K May 4, 2023
da7ff2b
Merge pull request #632 from topcoder-platform/root-file-system-acces…
Gunasekar-K May 4, 2023
2bd5842
Revert "Update config.yml"
eisbilir May 4, 2023
b852c5b
Revert "root file fix"
eisbilir May 4, 2023
8e5895c
Merge pull request #633 from topcoder-platform/root-file-system-acces…
Gunasekar-K May 4, 2023
18cd0b8
fix: Enable ecs-containers-readonly-access and update Docker CMD
rakibansary May 5, 2023
143a789
Merge pull request #634 from topcoder-platform/enable-ecs-containers-…
rakibansary May 5, 2023
c5084dd
fix: user with topcoder user role should not be allowed to create cha…
rakibansary May 18, 2023
33b8aa7
Merge pull request #636 from topcoder-platform/fix/modification-checks
rakibansary May 18, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ install_dependency: &install_dependency
install_deploysuite: &install_deploysuite
name: Installation of install_deploysuite.
command: |
git clone --branch v1.4.14 https://github.com/topcoder-platform/tc-deploy-scripts ../buildscript
git clone --branch v1.4.15 https://github.com/topcoder-platform/tc-deploy-scripts ../buildscript
cp ./../buildscript/master_deploy.sh .
cp ./../buildscript/buildenv.sh .
cp ./../buildscript/awsconfiguration.sh .
Expand Down
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,3 +63,4 @@ typings/
.next
ecr-login.sh
.npmrc
test.js
2 changes: 1 addition & 1 deletion docker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,4 +10,4 @@ WORKDIR /challenge-api
# Install the dependencies from package.json
RUN yarn install

CMD yarn start
CMD node /challenge-api/app.js
5 changes: 1 addition & 4 deletions src/routes.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ module.exports = {
constants.UserRoles.SelfServiceCustomer,
constants.UserRoles.Copilot,
constants.UserRoles.Manager,
constants.UserRoles.User,
],
scopes: [CREATE, ALL],
},
Expand All @@ -53,6 +52,7 @@ module.exports = {
method: "getChallenge",
scopes: [READ, ALL],
},
// @deprecated
put: {
controller: "ChallengeController",
method: "updateChallenge",
Expand All @@ -62,7 +62,6 @@ module.exports = {
constants.UserRoles.SelfServiceCustomer,
constants.UserRoles.Copilot,
constants.UserRoles.Manager,
constants.UserRoles.User,
],
scopes: [UPDATE, ALL],
},
Expand All @@ -75,7 +74,6 @@ module.exports = {
constants.UserRoles.SelfServiceCustomer,
constants.UserRoles.Copilot,
constants.UserRoles.Manager,
constants.UserRoles.User,
],
scopes: [UPDATE, ALL],
},
Expand All @@ -88,7 +86,6 @@ module.exports = {
constants.UserRoles.Copilot,
constants.UserRoles.SelfServiceCustomer,
constants.UserRoles.Manager,
constants.UserRoles.User,
],
scopes: [DELETE, ALL],
},
Expand Down
20 changes: 16 additions & 4 deletions src/services/ChallengeService.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1182,7 +1182,12 @@ createChallenge.schema = {
projectId: Joi.number().integer().positive(),
legacyId: Joi.number().integer().positive(),
startDate: Joi.date().iso(),
status: Joi.string().valid([constants.challengeStatuses.Active, constants.challengeStatuses.New, constants.challengeStatuses.Draft, constants.challengeStatuses.Approved]),
status: Joi.string().valid([
constants.challengeStatuses.Active,
constants.challengeStatuses.New,
constants.challengeStatuses.Draft,
constants.challengeStatuses.Approved,
]),
groups: Joi.array().items(Joi.optionalId()).unique(),
// gitRepoURLs: Joi.array().items(Joi.string().uri()),
terms: Joi.array().items(
Expand Down Expand Up @@ -1428,7 +1433,7 @@ async function updateChallenge(currentUser, challengeId, data) {
data = sanitizeData(sanitizeChallenge(data), challenge);
console.debug("Sanitized Data:", data);

validateChallengeUpdateRequest(currentUser, challenge, data);
await validateChallengeUpdateRequest(currentUser, challenge, data);

let sendActivationEmail = false;
let sendSubmittedEmail = false;
Expand Down Expand Up @@ -1615,7 +1620,12 @@ async function updateChallenge(currentUser, challengeId, data) {
const finalStatus = data.status || challenge.status;
const finalTimelineTemplateId = data.timelineTemplateId || challenge.timelineTemplateId;
let timelineTemplateChanged = false;
if (!currentUser.isMachine && !hasAdminRole(currentUser) && !_.get(data, "legacy.pureV5") && !_.get(challenge, "legacy.pureV5")) {
if (
!currentUser.isMachine &&
!hasAdminRole(currentUser) &&
!_.get(data, "legacy.pureV5") &&
!_.get(challenge, "legacy.pureV5")
) {
if (
finalStatus !== constants.challengeStatuses.New &&
finalTimelineTemplateId !== challenge.timelineTemplateId
Expand Down Expand Up @@ -1748,7 +1758,9 @@ async function updateChallenge(currentUser, challengeId, data) {
const { track, type } = await challengeHelper.validateAndGetChallengeTypeAndTrack({
typeId: challenge.typeId,
trackId: challenge.trackId,
timelineTemplateId: timelineTemplateChanged ? finalTimelineTemplateId : challenge.timelineTemplateId,
timelineTemplateId: timelineTemplateChanged
? finalTimelineTemplateId
: challenge.timelineTemplateId,
});

if (_.get(type, "isTask")) {
Expand Down