jbclements / admiral-edu-server Goto Github PK

In reviewing existing submissions, &next; appears in the header. bad.

Here's the URL:

https://www.captain-teach.org/calpoly-cpe123/su/[email protected]/next/a1-ct/

.. only the problem is in the iframe

also it has a &step in the header.

A github repo would probably be ideal... automating it could be nasty, though.

sigh... codemirror is totally messed up here. could it be the new version (hope hope)?

state somewhere what the legal URL patterns are, and check them up front rather than allowing 'last' to fail somewhere deep within a sub-function.

It would be nice, and seems like not too much of a security risk, to allow the head instructor
to take a look at the current log.

When browsing a file, it appears that only half of the given box is used by the codemirror editor.

This problem is somewhat visible on any page load because the left-hand gutter (IIUC) is only
half present. Load a file with many lines to see the problem more clearly. I'm nearly certain
this is a regression.

... and wind up as 500s instead, viz. /foo

logs should go somewhere visible outside the container

Use the scraped html from the regression tests to actually compare old and new.

The access log should not be mushed in with the error log, I think. The code for this is mostly already in place using loggers, I just need to not dump all of the loggers' output into stdout.

paths could be protected using TR

The "is there already a database" check uses a hard-coded "captain_teach" name, meaning that if your database is named something else, CT will blow it away on startup. Bad.

It appears that the "close form" button next to an annotation line does nothing when reviewing
a text.

This is probably a regression.

the 404 error has a URL without a trailing slash which won't be properly redirected by the outer apache server.

currently, if captain teach is started and there's already an existing database, but the name of the head instructor in the database is different from the one specified in the config file, I believe the config file is ignored. In fact, it might be even more broken than that.

The easy fix would be to check for this, and refuse to start up.

More generally, there should be a way to completely re-initialize the database. Since port 8080 is the only way in, though, this would have to be an externally-visible endpoint, which seems like a really bad idea. Alternatively, you could just create a shell script that does this...

These are probably all linked to scripting vulnerabilities....

chance for free test coverage bump here...

to repeat: student submits text file then tries to view it.

https://www.captain-teach.org/calpoly-cpe123/su/[email protected]/next/a1-ct/

It's absurd that captain teach runs as root inside of the docker container.

students could submit archive files containing illegal names, most alarmingly ".." and ".".

where's the logging in the new version? did I accidentally disable it, or is it just off for testing?

These are obvious places for XSS attacks, and are completely unnecessary.

Related to #13 : paths must be url-encoded, because the receiving end is going to perform decoding.

doesn't have a nice sound to it, does it?

I can see how this arose as a refactoring bug. Yikes.

occurrences of < in output are probably evidence of xexpr-mangling, and should probably be considered bugs in regression-testing and zap-script-testing

to repeat: upload a file containing a few users.

test case coverage is awful. we need some regression tests, at least. I'm terrified that I'm breaking things.

In the 'author' page creating a new assignment, I created a new one with the following description

name: Flags
id: flags
description: Supplemental homework 1.
steps:
  - id: final-submission
    instructions: Submit your final code here.

After clicking "Validate and Submit", I was given an alert box indicating there was an error. However, when clicking the button again, I was given a different alert box saying the assignment already exists.

After navigating to the main page, the assignment did indeed exist and was correct.