codejump
MediumPro challengePython

Fix Missing Access Control

PythonSecurity

The function below returns admin-only "secret" content to any authenticated user, with no role check at all.

The bug: this is the real behavior of OWASP's PyGoat (a deliberately-vulnerable Django app used for security training) — its a1_broken_access_lab3_secret view checks only request.user.is_authenticated before rendering admin-only content. The source literally contains the comment # no checking applied here. Any logged-in user, not just admins, sees the secret page.

Your task: fix solve(user, resource_owner_id) so access is only granted when:

  • the user is an admin, OR
  • the user is the resource owner (user['id'] == resource_owner_id)

Otherwise, return {'allowed': False}.

solve({'id': 'u1', 'is_admin': False}, 'u1')
# → {'allowed': True, 'user_id': 'u1'}   (own resource)

solve({'id': 'u1', 'is_admin': False}, 'u2')
# → {'allowed': False}   (regular user trying to access someone else's resource)

Sample tests

Test #1Regular user accessing someone else's resource — blocked
Input: [{"id":"u1","is_admin":false},"u2"]
Output: {"allowed":false}
Test #2Admin accessing another user's resource — allowed
Input: [{"id":"admin1","is_admin":true},"u2"]
Output: {"allowed":true,"user_id":"u2"}
Test #3Regular user accessing their own resource — allowed
Input: [{"id":"u1","is_admin":false},"u1"]
Output: {"allowed":true,"user_id":"u1"}
← All challenges