Security: Broken Permission Logic, Missing Authentication, Zero RBAC, Student Record IDOR #24

Security Report

I identified several security vulnerabilities in StudX during a code review.

1. Broken Permission Logic — AND Gate Instead of OR Gate (CRITICAL)

File: user/views.py:48

if not request.user.has_perm('user.add_user') and request.user.has_perm('user.edit_user'):
    return HttpResponseForbidden()

Evaluates as (NOT add) AND edit. For a user with neither permission: True AND False = False — bypassed. Also HttpResponseForbidden is not imported. Same bug in schedule/views.py:68.

2. Configuration Views Missing Authentication (CRITICAL)

File: configuration/views.py:27,51,63 — No @login_required on any of the 3 views.

3. Memo Create/Edit Missing Authentication (CRITICAL)

File: communication/views.py:48 — No @login_required, while list and delete have it.

4. Zero Role-Based Access Control (HIGH)

Roles defined (Admin/Supervisor/Secretary/Teacher/Student) but never checked in any view.

5. Student Details IDOR (HIGH)

view_student, discipline_details, in_out_details — detail views skip class ownership checks that list views enforce.

Recommended Fixes

Fix boolean logic, add missing imports, add @login_required, implement role-based decorators, add ownership checks to detail views.

Found during automated security research.