serious authentication bug?
Closed this issue · 8 comments
My fgmartin13@gmail.com user seems to be able to view all courses in the system, even though it's only enrolled for a subset of them.
Here's that user's view of https://grader.cs.uml.edu/courses:
But, if I log in as fredm@cs.uml.edu and examine the fgmartin13 user, this is what he's enrolled in:
Whoops I realized this is a feature, not a bug... you're deliberately revealing all courses to the user.
However, there is still an issue. I had added fgmartin13@gmail.com to the new 91.204.201 course, and it didn't get added to his courses.
See instructor's view:
Also, I notice that fgmartin13@gmail.com is display as realname "Fred G Martin" in one place, and "Fred Martin" in another... can that be related?
Huh. Looks like it's possible to add duplicate users with the same email. That shouldn't happen.
Are messages ending up in your Spam box?
Nice. One user is " fgmartin13@gmail.com". Looks like I have to sanitize input better.
Looks like an email misconfiguration problem on the server. Should work now.
Or not...
Nope, just forgot to restart the server. Should work now.