mirror of
https://github.com/barkeser2002/offline-db.git
synced 2026-09-25 00:59:54 +03:00
Barış Keserandgoogle-labs-jules[bot]
c04eb0d9c1
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
6 lines
783 B
Markdown
6 lines
783 B
Markdown
1. **Identify Vulnerability**: In `apps/watchparty/views.py`, the `RoomViewSet` inherits from `viewsets.ModelViewSet` which allows any authenticated user to update or delete any room because there is no authorization check. This is an IDOR vulnerability.
|
|
2. **Implement Fix**: Create a custom permission class `IsHostOrReadOnly` (or similar logic directly in the view) to enforce that only the `host` of a room can modify or delete it. Alternatively, override `perform_update` and `perform_destroy` to raise `PermissionDenied` if `request.user != instance.host`.
|
|
3. **Write/Run Tests**: Run the existing test suite (using `USE_SQLITE=True pytest`). Add a small test if necessary.
|
|
4. **Pre-commit**: Complete the required pre-commit checks.
|
|
5. **Submit**: Create the PR for Sentinel.
|