openwebwork/webwork2 — pull request #442 by pstaabp (2014-07-04 17:03:52+00:00)
Title: More security measures for the ww3 course manager.

Continued work on the security of the course manager. In short, we want to make sure that only those with proper permission can log into the course manager. Things to test. Start with deleting all webwork and dancer cookies.

1. Login to ww2 as normal. Use the WW3 link to go to WW3. No login should be required.
2. Logout and then logon to ww3 by directly going to http://host/webwork3/coursename/manager. You should get a login window. Try logging in.
3. Login to ww2. Delete the cookie and try to go to ww3. This doesn't require a relogin. Is this because a cookie is re-established? Is this a problem?
4. login to ww3. Delete the session key in coursename_key table of the database. Reload the page and you should be queried to relogin.
5. login to ww3. Delete the cookie and get the key from the database. go directly to http://host/webwork3/coursename/manager?user=name&key=THEKEY You should be able go in without relogin.
6. Try refreshing the page with http://host/webwork3/coursename/manager?user=name&key=THEKEY with differences between the name on the URL and the logged name as well as THEKEY and the key in the url. In each case, you should have to relogin.
7. try logging in to http://host/webwork3/coursename/manager as a student. You should be redirected to the ww2 side, but logged in.