feat: enhance exam answer submission security and add tests for user authentication

2026-07-05 21:59:02 +01:00
parent bb6b4c625c
commit 2744758aa8
4 changed files with 212 additions and 35 deletions
@@ -3294,8 +3294,21 @@ class ExamViews(View, LoginRequiredMixin):
    @method_decorator(csrf_exempt)
    def post_exam_answers(self, request):
        if request.method == "POST":
-            n = 0
+            root_cid = request.POST.get("cid")
+            if not root_cid:
+                return JsonResponse({"success": False, "error": "cid not defined"})

+            if request.user.is_authenticated:
+                expected_cid = f"u-{request.user.id}"
+                if root_cid != expected_cid:
+                    return JsonResponse({"success": False, "error": "user / cid mismatch"})
+            else:
+                if root_cid.startswith("u-"):
+                    return JsonResponse(
+                        {"success": False, "error": "authentication required for user submissions"}
+                    )
+
+            n = 0
            for answer in json.loads(request.POST.get("answers")):
                logger.debug("Processing answer: {}", answer)

@@ -3303,25 +3316,28 @@ class ExamViews(View, LoginRequiredMixin):
                uid = False
                passcode = None

-                try:
-                    cid = int(answer["cid"])
-                    passcode = answer["passcode"]
-                except ValueError:
-                    if answer["cid"].startswith("u-"):
-                        cid = False
-                        uid = int(answer["cid"][2:])
+                ans_cid = answer.get("cid")
+                if not ans_cid:
+                    return JsonResponse({"success": False, "error": "answer cid not defined"})

-                        if not uid == request.user.id:
-                            return JsonResponse(
-                                {"success": False, "error": "user / uid mismatch"}
-                            )
-
-                    else:
+                if request.user.is_authenticated:
+                    if ans_cid != f"u-{request.user.id}":
+                        return JsonResponse({"success": False, "error": "user / uid mismatch"})
+                    uid = request.user.id
+                    cid = False
+                    passcode = None
+                else:
+                    if str(ans_cid).startswith("u-"):
                        return JsonResponse(
-                            {
-                                "success": False,
-                                "error": "cid or eid or answers not defined",
-                            }
+                            {"success": False, "error": "authentication required"}
+                        )
+                    try:
+                        cid = int(ans_cid)
+                        passcode = answer["passcode"]
+                        uid = False
+                    except (ValueError, KeyError):
+                        return JsonResponse(
+                            {"success": False, "error": "invalid cid or passcode"}
                        )

                if not uid: