Skip to main content

verify_slide_and_task_belong

headless_lms_server::controllers::exercise_services::client

Function verify_slide_and_task_belong 

Source 
fn verify_slide_and_task_belong(
    exercise_id: Uuid,
    slide_id: Uuid,
    slide_exercise_id: Uuid,
    task_id: Uuid,
    task_slide_id: Uuid,
) -> Result<(), ControllerError>
Expand description

The URL path authorizes exercise_id; the slide/task ids come from the request body, so without this check a caller could submit into an unrelated exercise’s slide/task.