Skip to content

fix: hide unauthorized edit and delete buttons on org bounties page (#238)#267

Open
Ishant5436 wants to merge 1 commit into
algora-io:mainfrom
Ishant5436:fix/unauthorized-bounty-buttons
Open

fix: hide unauthorized edit and delete buttons on org bounties page (#238)#267
Ishant5436 wants to merge 1 commit into
algora-io:mainfrom
Ishant5436:fix/unauthorized-bounty-buttons

Conversation

@Ishant5436
Copy link
Copy Markdown

@Ishant5436 Ishant5436 commented May 16, 2026

Implementation of synchronized UI and server-side guards to prevent unauthorized bounty management actions.

This PR establishes a defense-in-depth pattern for the organization bounties interface, addressing the vulnerability where administrative actions were exposed to unauthorized actors.

Architectural details:

  • Lifecycle Synchronization: Implemented role-based conditional rendering in the LiveView layer, ensuring that management controls are omitted from the DOM for non-privileged users.
  • Server-Side Enforcement: Validated that the backend handle_event calls for deletion and modification are strictly gated by the authenticated user's role context.
  • Integrity Verification: Added a dedicated integration test suite (test/algora_web/live/org_bounties_live_test.exs) that confirms the unreachability of administrative events for non-admin sessions.

Settlement Information:

  • Solana: 2WktXRjaQ4GKhj6FJhUSndTBLVjxrk43TQwyywehneDA
  • Institutional ID: ishant.p@somaiya.edu

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented May 16, 2026

CLA assistant check
All committers have signed the CLA.

@Ishant5436 Ishant5436 force-pushed the fix/unauthorized-bounty-buttons branch 2 times, most recently from 4cd4e3c to 13e2663 Compare May 18, 2026 06:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants