ranjanistic / schemester Goto Github PK

Client data not being sanitized at certain points before being used for database operations.

Expected behavior
Assigned class of the removed incharge should become incharge less.

While adding schedule of a teacher, if clash at some period is found, it is reported. But the loaders in page do not reset to action buttons.

To Reproduce
Steps to reproduce the behavior:

1. Add schedule of a teacher
2. Fill a period which will clash with someone else.
3. See error

Expected behavior
Loaders should hide and buttons should resurface after any endpoint post request response is received.

Join request email is being sent to the teacher after admin adds their schedule, who is already a part of the institute.

To Reproduce
Steps to reproduce the behavior:

1. Login as admin
2. Navigate to schedule profile of a teacher who is a member of institution, but without schedule.
3. Click 'Add schedule'
4. After adding, join request email is sent.

Expected behavior
Join request email should not be sent if teacher is already an accepted member of institution and schedule is added later.

End user needs help at various points of usage
As the session is not created over http, the end user might get confused over this. And similarly many confusions can arise in user's mind.

A help guide
A documentation of features, a FAQ section and a help guide to common problems, served at a different url path.

Documentation for features
Some features might not get the eye of end user, and here a documentation could help them.

'Help' button at snackbar should take the end user to the associated solution in the guide, depending upon where the end-user got the problem.

• 'Free' is being shown as a classroom in choose class navigation dialog for teacher classroom fragment.
• 'Invite students' action when no students are present, doesn't work.

To Reproduce
Steps to reproduce the behavior:

1. Login as teacher in a institution with working schedule, and no students in assigned classroom.
2. Navigation to classroom section via bottom navigation.
3. Invite button doesn't work
4. Open menu and click 'choose class'
5. See error

Rate limiting not enabled
Rate limiting for post requests not set, vulnerable to brute force attacks.

When a new teacher's schedule is added in an existing functioning institution, and if it contains a new classroom, it doesn't get created in institution, and only remains in that teacher's schedule.

To Reproduce
Steps to reproduce the behavior:

1. Go to teachers view in a working institution.
2. Click on 'add teacher'
3. Add a new classroom at some period of the new teacher.
4. After completion, navigate to classrooms view.
5. The new classroom doesn't appear.

Expected behavior
At last step of previous section, the new class should appear, i.e., when new teacher's schedule is fully submitted, any new class names should be searched for, and must get created automatically (if other classes exist in the institute, indicating that scheduling is active).