Repository: fossasia/open-event-server

Issue:
Can't Submit a session via cfs
**Describe the bug**
<!-- A clear and concise description of what the bug is. -->
I cannot submit a session via cfs by a user who has **not** created the event
**To Reproduce**
Steps to reproduce the behavior:
1. Go to CFS of an event which user has not created
2. Click on the add session proposal
3. Fill the details and hit submit
4. See error

**Expected behavior**
<!-- A clear and concise description of what you expected to happen. -->
It should not be happening, the session should've been accepted

**Screenshots**
<!-- If applicable, add screenshots to help explain your problem. -->
![ezgif com-video-to-gif 3](https://user-images.githubusercontent.com/21087061/52403857-bb547180-2aed-11e9-9f7c-ba1283105730.gif)

**Desktop (please complete the following information):**
 - OS: [e.g. iOS] Ubuntu 16.04 LTS
 - Browser [e.g. chrome, safari] Chrome

**Additional context**
<!-- Add any other context about the problem here. -->
It's up for grabs but would love it if someone confirms it too


Discussion:
Your user is not verified, see the top. Open a different issue, to disable the button if the user is not verified.
@CosmicCoder96 this is happening with me even for a verified user. Also a loader comes up on the form which doesn't go away unless refreshed.
I checked a little more on this, so the error comes up on the user side, but the session gets submitted as it is visible in the admin.
![modules120190218_130601](https://user-images.githubusercontent.com/21174572/52935090-65e65300-337e-11e9-8ded-085533b47454.gif)

can you check the console to find out what the error might be?
I would like to work on this issue

On Wed, 20 Feb 2019, 18:06 Abhinav Khare <notifications@github.com wrote:

> Reopened #2142
> <https://github.com/fossasia/open-event-frontend/issues/2142>.
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub
> <https://github.com/fossasia/open-event-frontend/issues/2142#event-2151782670>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AUMZLMj3T6NOK4KD0h6qV5OG3dkRQlz0ks5vPUFXgaJpZM4am843>
> .
>

@CosmicCoder96 sure I'll take a look at the console once.
As much I remember it was having `403` error `forbidden`.
@CosmicCoder96  I confirmed the error, it's `PATCH` request error with the status code `403` for `Forbidden` request.
Admin user can submit a session though.
![screenshot from 2019-02-22 22-31-02](https://user-images.githubusercontent.com/21174572/53258061-b3055480-36f1-11e9-92cb-b3001122b752.png)

I can reproduce this bug too with a verified and non-verified user. Sessions get submitted and the admin can view and edit them, but the user is unaware of what's happening on the server.

I'm wondering if this is a front-end issue, as from the API you need at least "co-organizer" permissions to create and update a session, http://dev.eventyay.com/api/v1/#sessions-sessions-collection-post, but that's not the case here as sessions get submitted.
For info, the following seems to be the flow on submit (minus the OPTIONS calls):
POST https://eventsap.../v1/sessions - 201 CREATED
Payload:
`{"data":{"attributes":{"title":"test2","subtitle":null,"starts-at":null,"ends-at":null,"short-abstract":"abstract goes here","long-abstract":null,"language":null,"level":null,"comments":"Test comment","state":null,"slides-url":null,"video-url":null,"audio-url":null,"signup-url":null,"send-email":false,"is-mail-sent":false,"created-at":null,"deleted-at":null,"submitted-at":"Tue Mar 26 2019 18:06:34 GMT+0000","last-modified-at":null},"relationships":{"session-type":{"data":{"type":"session-type","id":"4"}},"track":{"data":{"type":"track","id":"1"}},"event":{"data":{"type":"event","id":"2"}},"creator":{"data":{"type":"user","id":"8"}}},"type":"session"}}`

GET https://eventapi.../v1/sessions - 200 OK
Returns: 
`{"data": [], "links": {"self": "/v1/speakers/7/sessions"}, "meta": {"count": 0}, "jsonapi": {"version": "1.0"}}`

PATCH https://eventapi.../v1/sessions/7 - 403 FORBIDDEN
Payload:
`{"data":{"id":"7","attributes":{"title":"test2","subtitle":null,"starts-at":null,"ends-at":null,"short-abstract":"abstract goes here","long-abstract":null,"language":null,"level":null,"comments":"Test comment","state":"pending","slides-url":null,"video-url":null,"audio-url":null,"signup-url":null,"send-email":false,"is-mail-sent":false,"created-at":"2019-03-26T18:06:33.205009+00:00","deleted-at":null,"submitted-at":"2019-03-26T18:06:34+00:00","last-modified-at":"2019-03-26T18:06:33.227941+00:00"},"relationships":{"session-type":{"data":{"type":"session-type","id":"4"}},"track":{"data":{"type":"track","id":"1"}},"speakers":{"data":[{"type":"speaker","id":"7"}]},"event":{"data":{"type":"event","id":"2"}},"creator":{"data":{"type":"user","id":"8"}}},"type":"session"}}`

A further follow up. For some reason, the session isn't being linked with any speakers on creation, which is why the api returns a 403 when it tries to update it. It does seem that no speakers are associated with the session.
@maulkin could you try querying for a session with `speakers` in the include argument?
@uds5501 :

`{"data": {"type": "session", "attributes": {"created-at": "2019-03-27T20:04:43.911646+00:00", "average-rating": null, "starts-at": null, "video-url": null, "slides-url": null, "signup-url": null, "short-abstract": "", "long-abstract": null, "is-mail-sent": false, "level": null, "comments": "", "language": null, "title": "test4", "audio-url": null, "submitted-at": "2019-03-27T20:04:45+00:00", "state": "pending", "subtitle": null, "ends-at": null, "last-modified-at": "2019-03-27T20:04:43.933524+00:00", "deleted-at": null}, "id": "10", "relationships": {"microlocation": {"links": {"self": "/v1/sessions/10/relationships/microlocation", "related": "/v1/sessions/10/microlocation"}}, "track": {"links": {"self": "/v1/sessions/10/relationships/track", "related": "/v1/sessions/10/track"}}, "feedbacks": {"links": {"self": "/v1/sessions/10/relationships/feedbacks", "related": "/v1/sessions/10/feedbacks"}}, "creator": {"links": {"self": "/v1/sessions/10/relationships/creator", "related": "/v1/sessions/10/creator"}}, "speakers": {"links": {"self": "/v1/sessions/10/relationships/speakers", "related": "/v1/sessions/10/speakers"}, "data": []}, "event": {"links": {"self": "/v1/sessions/10/relationships/event", "related": "/v1/sessions/10/event"}}, "session-type": {"links": {"self": "/v1/sessions/10/relationships/session-type", "related": "/v1/sessions/10/session-type"}}}, "links": {"self": "/v1/sessions/10"}}, "links": {"self": "/v1/sessions/10"}, "jsonapi": {"version": "1.0"}}`

Resolving patch:
diff --git a/app/api/helpers/permission_manager.py b/app/api/helpers/permission_manager.py
--- a/app/api/helpers/permission_manager.py
+++ b/app/api/helpers/permission_manager.py
@@ -158,6 +158,9 @@ def is_speaker_for_session(view, view_args, view_kwargs, *args, **kwargs):
             if speaker.user_id == user.id:
                 return view(*view_args, **view_kwargs)
 
+    if session.creator_id == user.id:
+        return view(*view_args, **view_kwargs)
+
     return ForbiddenError({'source': ''}, 'Access denied.').respond()
 
 


Test patch: