TireSwingSoftware/openassign-server — Issue #86: ExamSessionManager.create() should not return rejoinders
Author: mhrivnak
Created: 2012-01-26 04:35:59+00:00
State: open
Labels: security

When calling ExamSessionManager.create() with fetch_all=True, the returned data structure includes the rejoinders. Rejoinders should not be sent to the user until after they have submitted a response.

With the current setup, if a user was watching traffic with something like FireBug, they could easily see the rejoinders before having to answer the question.