fix/IDOR vulnerability - #63

Open

atharv02-git wants to merge 8 commits into

thoth-tech:app-attack-fixesfrom

atharv02-git:fix/IDOR-Vulnerability

Commits on May 6, 2025

Imported role_helpers to implement Role Based Access Controls
atharv02-git
committed
b9de910
Reusing centralized role-checking logic by importing role_helpers module to implement RBAC on email, firstname, lastmame, username
atharv02-git
committed
56a3ecc
Add role-based checks in UnitRoleEntity to prevent students from accessing full staff details
atharv02-git
committed
a35aea1
Add my_role context to UnitRole serializer to enforce RBAC during API response serialization.
atharv02-git
committed
b0b1cef
Add user: current_user to unit serializer to enable role-based filtering in UnitEntity for RBAC enforcement.
atharv02-git
committed
358a9f1
Added role_helpers module to centralize and reuse RBAC logic across different api entities
atharv02-git
committed
c1593c2

Commits on May 8, 2025

Restoring all the changes as per 8.0.x
atharv02-git
committed
a294e9d
filtering out the staff_data object for non_staff_roles
atharv02-git
committed
df0bdca