is_none predicate is actually is_not_none #140

New issue

Closed

opened 2021-02-26 17:03:08 +01:00 by hansegucker · 7 comments

hansegucker commented 2021-02-26 17:03:08 +01:00 (Migrated from edugit.org)

Copy link

The predicate actually checks if an object is not none, but of course it should check if an object is none. This also breaks at least one permission rule, so this is very urgent and security-related.

(No worries, I fixed it in our production environment.)

The predicate actually checks if an object is **not** none, but of course it should check if an object is none. This also breaks at least one permission rule, so this is very urgent and security-related. (No worries, I fixed it in our production environment.)

hansegucker commented 2021-02-26 17:05:22 +01:00 (Migrated from edugit.org)

Copy link

created merge request hansegucker/AlekSIS-App-Alsijil!391 to address this issue

created merge request hansegucker/AlekSIS-App-Alsijil!391 to address this issue

hansegucker commented 2021-02-26 17:08:33 +01:00 (Migrated from edugit.org)

Copy link

made the issue visible to everyone

made the issue visible to everyone

hansegucker commented 2021-02-26 17:09:02 +01:00 (Migrated from edugit.org)

Copy link

created merge request !535 to address this issue

created merge request !535 to address this issue

hansegucker commented 2021-02-26 17:09:03 +01:00 (Migrated from edugit.org)

Copy link

mentioned in merge request !535

mentioned in merge request !535

nik commented 2021-02-26 18:20:51 +01:00 (Migrated from edugit.org)

Copy link

Please always report security issues as confidential!

Please *always* report security issues as confidential!

nik (Migrated from edugit.org) closed this issue 2021-02-26 18:21:53 +01:00

nik commented 2021-02-26 18:21:57 +01:00 (Migrated from edugit.org)

Copy link

mentioned in commit 654a975888

mentioned in commit 654a9758889ed89fcdeb40bc78e966b78eb33ae6

hansegucker commented 2021-02-26 21:49:13 +01:00 (Migrated from edugit.org)

Copy link

I did so, but I wasn't able to create a related MR, so I made it visible.

I did so, but I wasn't able to create a related MR, so I made it visible.

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

master

370-nfc-based-centralized-attendance-tracking-in-open-education

weblate-frontend

weblate

377-adapt-fullscreen-statistics-for-person-page-follow-up-from-draft-port-to-vue3

376-re-add-coursebookloader-follow-up-from-draft-port-to-vue3

docs

check/update-merge-request-template

check/update-builddeps-package-json

check/update-eslint-rc-js

check/update-tox-ini

369-adapt-to-object-url-schema

363-date-range-displayed-in-coursebook-is-wrong

360-add-some-kind-of-text-to-long-term-absence-fab-in-absence-overview

adapt-to-caldav

350-make-permission-checks-for-absences-and-personal-notes-list-on-statistics-page-efficient

335-allow-access-to-other-groups-for-special-roles-like-school-management

269-include-class-register-in-calendar-dialog

330-make-days-more-distinguishable-in-coursebook

release/4.0.0.dev9

342-ordering-of-affected-lessons-in-register-absence-dialog-is-wrong

324-graphqlerror-can-t-compare-offset-naive-and-offset-aware-datetimes

340-disable-list-of-participations-button-during-documentation-save

333-kolego-absences-are-not-properly-taken-into-regard-when-creating-participation-statuses

308-follow-up-from-resolve-add-absence-overview-page

release/4.0.0.dev7

release/4.0.0.dev6

311-creating-absence-fails-absence-reasons-do-not-load

reformat

migration-to-fix-unique-constraints

295-respect-permissions-in-coursebook-frontend

280-reduce-top-app-bar-in-coursebook-make-collapsible

289-fix-coursebook-permissions-for-participation-statuses-and-personal-notes-from-student

engs-4.0

261-add-absence-management-to-course-book-student-dialog-2

279-follow-up-from-draft-resolve-migrate-to-new-data-model

256-add-simple-course-book-list

rebased2-michael-scrollt

rebased-michael-scrollt

michael-scrollt

259-add-dialog-with-each-lesson-s-students

246-roadmap-migrate-to-new-data-model

tmp/demo

stable-3.0

174-instructions-can-be-linked-to-a-document-as-remarks-by-the-group

engs-coursebook-print

249-migrations-broken-on-empty-db

251-lessons-doesn-t-get-cancelled-by-events-in-my-timetable

engs

prepare-release-3.0b0

243-personalnote-gets-deleted-without-warning-when-a-person-is-marked-as-excused-but-not-absent

244-fix-wrong-redirect-url-after-editing-seating-plan-from-class-register

239-linter

233-adjust-for-operation-with-new-spa

feature/core-3.0

feature/vuejs

211-prevent-double-counting-of-absences

replace-ugettext-with-gettext

230-attributeerror-nonetype-object-has-no-attribute-period

216-the-content-of-lessons-should-be-able-to-be-entered-by-each-teacher-involved-in-the-event

menu-register-absence-rule-error

174-instructions-can-be-linked-to-a-document-as-remarks-by-the-group-2

hhg

backup-vuejs

test/lessondoculist

test/vuejs

213-use-iconify-for-material-icons-instead-of-icon-font

i10n-ru-ua

183-allow-group-roles-to-be-specific-to-one-group-type

124-provide-relevant-personal-notes-with-selected-filter-as-dashboard-widget

tmp/aleksis-engs

212-absences-are-carried-over-to-lessons-student-is-no-member-of

release-2.0

add-docs

revert-0d064fd6

199-date-select-for-registering-absences-unusable-ticket-75918

core-284-unify-permission-names

185-show-only-personal-notes-from-current-term-2

70-add-link-in-chronos-views

152-group-hierarchies-handled-incompletely

188-add-useful-information-to-current-lesson-404

197-fix-readme

prepare-release-2.0rc7-2

prepare-release-2.0rc7

update/tox-makemessages

release/2.0

181-bulk_update-missing-1-required-positional-argument-fields-2

159-add-link-to-next-missing-lesson-documentation-for-teachers

trigger_dist_build

trigger-dist-pipeline

fix-ci-config

fix/typo

138-do-not-show-my-overview-for-teachers

136-date-overflows-box-in-print-view-when-only-a-few-lessons-are-displayed

update/poetry-2

130-group-members-are-counted-multiple-times-in-my_students

test-foo

update-lockfile

126-aleksis-admin-yarn-install-needs-a-database

gettext-lazy

update-tox2

update-tox

122-make-previous-next-lesson-buttons-independent-of-validity-range

117-create-revisions-in-django-reversion-for-all-changes-that-need-auditing

feature/use-entrypoints

fix/update-or-create

mix/perms

comb/rules-week

77-rename-core-template-references

file-refs

49-printout-lesson-periods-missing-in-week-summary

38-week-view-personal-notes-only-work-when-filtering-by-group

48-printout-pages-can-overflow

46-printout-add-one-page-per-student-in-group

2-register-absences-and-excuses-centrally

29-lesson-view-show-summary-homework-etc-of-previous-lessons

fix-buttons

5.0.2

5.0.1

5.0.0

5.0.0b0

4.0.0

4.0.0.dev9

4.0.0.dev8

4.0.0.dev7

4.0.0.dev6

4.0.0.dev5

4.0.0.dev4

4.0.0.dev3

4.0.0.dev2

4.0.0.dev1

4.0.0.dev0

3.0.1

3.0

3.0b0

2.1.1

3.0.dev0

2.1

2.0.1

2.0

2.0rc7.post0

2.0rc7

2.0rc6

2.0rc5

2.0rc4

2.0rc3

2.0rc2

2.0rc1

2.0b0

2.0a3

delete-tag

2.0a1

1.0a3

1.0a2

1.0a1

1.0a0

Labels

Clear labels   

Security

  

TeX

Needs LaTeX template

  

auto-update

  

board

done

  

board

ready

  

board

todo

  

check

delete-eslint-rc-js

  

check

update-builddeps-package-json

  

check

update-eslint-rc-js

  

check

update-gitignore

  

check

update-merge-request-template

  

check

update-prettier-ignore

  

check

update-pyproject-toml

  

check

update-renovate-json

  

check

update-tox-ini

  

part

backend

Backend (view code, models, logic, etc.)

  

part

ci

  

part

docs

Issue or addition to the documentation

  

part

frontend

Frontend (templates, etc.)

  

part

i18n

Translation or internationalisation issue

  

part

non-technical

Non-technical (policy, maintenance, etc.) issue or discussion

  

part

packaging

Issue concerning the packaging of AlekSIS and components

  

prio

1

Priority High

  

prio

2

Priority Medium

  

prio

3

Priority Low

  

release-mr-5.x

  

size

large

  

size

medium

  

size

small

  

source

customer

Requested by a customer or affiliated user

  

source

customer::fsmw

  

source

customer::fss

  

source

customer::teckids

  

source

downstream

Issue or merge request from other projects using AlekSIS or parts of it

  

type

breaking

  

type

bug

Bug

  

type

feature

New feature

  

type

refactoring

  

workflow

blocked

Issue is blocked by another issue

  

workflow

confirmed

The bug is reproducible and will be fixed

  

workflow

current-todo

  

workflow

discussing

Needs to be discussed before implementation

  

workflow

new-app

Requires new AlekSIS app, which has to be created

  

workflow

wontfix

The bug is not reproducible or the feature was decided against

No labels

Security

TeX

auto-update

board

done

board

ready

board

todo

check

delete-eslint-rc-js

check

update-builddeps-package-json

check

update-eslint-rc-js

check

update-gitignore

check

update-merge-request-template

check

update-prettier-ignore

check

update-pyproject-toml

check

update-renovate-json

check

update-tox-ini

part

backend

part

ci

part

docs

part

frontend

part

i18n

part

non-technical

part

packaging

prio

1

prio

2

prio

3

release-mr-5.x

size

large

size

medium

size

small

source

customer

source

customer::fsmw

source

customer::fss

source

customer::teckids

source

downstream

type

breaking

type

bug

type

feature

type

refactoring

workflow

blocked

workflow

confirmed

workflow

current-todo

workflow

discussing

workflow

new-app

workflow

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

aleksis/AlekSIS-App-Alsijil#140

No description provided.