Summary

Sender confirmation link can only be opened by the sender of the message

Background

Currently, the sender confirmation link can be opened by anyone, any user and even without any login. This shouldn't be the case as the sender of the message should only be able to confirm sending the packet.

Details

Steps to solution would be:
1. Making MessageSenderConfirmationView accessible to only logged in users by adding LoginRequiredMixin as well as specifying the login_url.
2. Checking if the logged-in user is actually the sender of the packet. If not, redirecting them display that they need to login with the sender of the message.

Outcome

Sender confirmation link is only accessible to the sender of the message

Metadata Update from @jflory7:
- Issue priority set to: waiting on assignee (was: awaiting triage)
- Issue tagged with: PASSED, difficulty - medium, new change, type - backend, type - summer coding

Apr 17, 2019

jflory7 commented Apr 17, 2019

+1 for this. I noticed this for the first time today too. Since we have the authentication layer now, we can require authentication to view your sent and received messages.

saidat commented Apr 22, 2019

hello @flory, if not one is working on this issue i would like to work on it

jflory7 commented Apr 22, 2019

@saidat I suggest starting on a smaller task first before working on this issue. Ticket #72 could be done.

Metadata Update from @shraddhaag:
- Issue assigned to shraddhaag

May 22, 2019

shraddhaag commented May 22, 2019

Hi @jflory7! I've filed PR #231 to address this. I'd love to hear feedback when you find time :)

alishapapun commented May 23, 2019

This issue can be closed! Good work @shraddhaag :)

Edited May 23, 2019 by alishapapun

alishapapun commented May 23, 2019