Repository: fossasia/open-event-server

Issue:
Ensure permissions in the orders API comply with the handbook
**I'm submitting a ...**  (check one with "x")
- [x] bug report
- [ ] feature request
- [ ] support request => Please do not submit support requests here, instead ask your query in out Gitter channel at https://gitter.im/fossasia/open-event-orga-server

**Current behavior:**
<!-- Describe how the bug manifests. -->

**Expected behavior:**
<!-- Describe what the behavior would be without the bug. -->

**Steps to reproduce:**
<!-- If you are able to illustrate the bug or feature request with an example, please provide steps to reproduce -->

**Related code:**

```
insert any relevant code here else remove this section
```

**Other information:**
<!-- List any other information that is relevant to your issue. Stack traces, related issues, suggestions on how to fix, Stack Overflow links, forum links, etc. -->

**System information:** 

<!-- Add information about the system your facing this bug on. If you think this is irrelevant or if it's a UI bug or a feature request, please remove this section -->

```
Your operating system
```

```
output of `python --version`
```



Discussion:

Resolving patch:
diff --git a/app/api/orders.py b/app/api/orders.py
--- a/app/api/orders.py
+++ b/app/api/orders.py
@@ -125,32 +125,44 @@ def before_get_object(self, view_kwargs):
             attendee = safe_query(self, TicketHolder, 'id', view_kwargs['attendee_id'], 'attendee_id')
             view_kwargs['order_identifier'] = attendee.order.identifier
 
+        order = safe_query(self, Order, 'identifier', view_kwargs['order_identifier'], 'order_identifier')
+
+        if not has_access('is_coorganizer_or_user_itself', event_id=order.event_id, user_id=order.user_id):
+            return ForbiddenException({'source': ''}, 'Access Forbidden')
+
+
     def before_update_object(self, order, data, view_kwargs):
-        if data.get('cancel_note'):
-            del data['cancel_note']
+        if not has_access('is_admin'):
+            for element in data:
+                if element != 'status':
+                    setattr(data, element, getattr(order, element))
 
-        if data.get('status'):
-            if has_access('is_coorganizer', event_id=order.event.id):
-                pass
-            else:
-                raise ForbiddenException({'pointer': 'data/status'},
-                                         "To update status minimum Co-organizer access required")
+        if not has_access('is_coorganizer', event_id=order.event.id):
+            raise ForbiddenException({'pointer': 'data/status'},
+                                     "To update status minimum Co-organizer access required")
 
     def after_update_object(self, order, data, view_kwargs):
         if order.status == 'cancelled':
             send_order_cancel_email(order)
             send_notif_ticket_cancel(order)
 
-    decorators = (api.has_permission('is_coorganizer', fetch="event_id", fetch_as="event_id",
-                                     fetch_key_model="identifier", fetch_key_url="order_identifier", model=Order),)
+    def before_delete_object(self, order, view_kwargs):
+        if not has_access('is_coorganizer', event_id=order.event.id):
+            raise ForbiddenException({'source': ''}, 'Access Forbidden')
+
+    decorators = (jwt_required,)
 
     schema = OrderSchema
     data_layer = {'session': db.session,
                   'model': Order,
                   'url_field': 'order_identifier',
                   'id_field': 'identifier',
-                  'methods': {'before_update_object': before_update_object,
-                              'after_update_object': after_update_object}}
+                  'methods': {
+                      'before_update_object': before_update_object,
+                      'before_delete_object': before_delete_object,
+                      'before_get_object': before_get_object,
+                      'after_update_object': after_update_object
+                  }}
 
 
 class OrderRelationship(ResourceRelationship):


Test patch: