[DMS-1890] Changing values of form from Console[Developer Tools] should not be allowed - Workterra Jira

Details

Type: Bug
Status: Done
Priority: Medium
Resolution: Done
Affects Version/s: None
Fix Version/s: Between Fall and Winter 2019
Labels:
None

Company:
All Clients/Multiple Clients

Description

Disallow User to manipulate data from console of form on Review and Sign page and on Admin Preview page.
Manipulated data should not be saved in Database.

CC: Rohan J Khandave,Samir,Priya Dhamande

Attachments

Activity

Ascending order - Click to sort in descending order

Hide

Permalink

Ramya Tantry (Inactive) added a comment - 19/Sep/19 05:49 AM

Areas impacted:

Admin preview -> changes done to view only and/or no rights field from developer tools -> Send
Candidate Review and Sign -> changes done to view only and/or no rights field from developer tools -> Submit/Decline
API : Custom create -> open link in browser -> changes done to view only and/or no rights field from developer tools -> Save

Implementation:

If previous JSON data is not present, form data is compared with database values. If manipulated data is found, it is replaced with database value.
If previous JSON data is present, form data is compared with previous JSON values. If manipulated data is found, it is replaced with previous JSON value.

We are reusing the functionality done for fetching history data but will need additional changes. So extending the estimates 16h to 24h

Show

Ramya Tantry (Inactive) added a comment - 19/Sep/19 05:49 AM Areas impacted: Admin preview -> changes done to view only and/or no rights field from developer tools -> Send Candidate Review and Sign -> changes done to view only and/or no rights field from developer tools -> Submit/Decline API : Custom create -> open link in browser -> changes done to view only and/or no rights field from developer tools -> Save Implementation: If previous JSON data is not present, form data is compared with database values. If manipulated data is found, it is replaced with database value. If previous JSON data is present, form data is compared with previous JSON values. If manipulated data is found, it is replaced with previous JSON value. We are reusing the functionality done for fetching history data but will need additional changes. So extending the estimates 16h to 24h

Hide

Permalink

Ramya Tantry (Inactive) added a comment - 22/Sep/19 08:56 PM

Putting on hold as I am working on ~~DMS-1913~~.

Show

Ramya Tantry (Inactive) added a comment - 22/Sep/19 08:56 PM Putting on hold as I am working on DMS-1913 .

Hide

Permalink

Ramya Tantry (Inactive) added a comment - 24/Sep/19 05:29 AM

Concern: Manipulated data of no rights and view only permissions was getting saved in JSON of the document.

Cause: The JSON data received from UI was getting saved into DB directly without it getting verified with the DB values. So in case if the data has been manipulated from DEV tools and saved, this data will be saved into DB as document JSON and the same will be fetched to candidate.This is data security breach.

Correction: While saving the JSON data, additional code changes have been done to verify -

If previous JSON data is not present, form data is compared with database values. If manipulated data is found, it is replaced with database value.
If previous JSON data is present, form data is compared with previous JSON values. If manipulated data is found, it is replaced with previous JSON value.

Files Affected:

DMS\DMS.App\src\DMS_AppLogic\BuisnessLogic\DocumentData.cs
DMS\DMS.App\src\DMS_AppLogic\BuisnessLogic\PersonData.cs
DMS\DMS.App\src\DMS_AppLogic\Common\HistoryData.cs
DMS\DMS.App\src\DMS_AppLogic\Common\IHistoryData.cs
DMS\DMS.App\src\DMS_AppLogic\Common\Routines\CommonRoutines.cs
DMS\DMS.App\src\DMS_AppLogic\Common\Routines\ICommonRoutines.cs
DMS\DMS.App\src\DMS_AppLogic\IntegrationLogic\CandidateProfile.cs
DMS\DMS.App\src\DMS_AppLogic\Repository\IDocumentRepository.cs
DMS\DMS.App\src\DMS_WebApi\Startup.cs
DMS\DMS.App\src\Entities\Document\FieldsDto.cs
DMS\DMS.Web\src\DMS_WebApp\ClientApp\src\app\candidate\document-review\document-review.component.ts

Show

Ramya Tantry (Inactive) added a comment - 24/Sep/19 05:29 AM Concern : Manipulated data of no rights and view only permissions was getting saved in JSON of the document. Cause : The JSON data received from UI was getting saved into DB directly without it getting verified with the DB values. So in case if the data has been manipulated from DEV tools and saved, this data will be saved into DB as document JSON and the same will be fetched to candidate.This is data security breach. Correction : While saving the JSON data, additional code changes have been done to verify - If previous JSON data is not present, form data is compared with database values. If manipulated data is found, it is replaced with database value. If previous JSON data is present, form data is compared with previous JSON values. If manipulated data is found, it is replaced with previous JSON value. Files Affected: DMS\DMS.App\src\DMS_AppLogic\BuisnessLogic\DocumentData.cs DMS\DMS.App\src\DMS_AppLogic\BuisnessLogic\PersonData.cs DMS\DMS.App\src\DMS_AppLogic\Common\HistoryData.cs DMS\DMS.App\src\DMS_AppLogic\Common\IHistoryData.cs DMS\DMS.App\src\DMS_AppLogic\Common\Routines\CommonRoutines.cs DMS\DMS.App\src\DMS_AppLogic\Common\Routines\ICommonRoutines.cs DMS\DMS.App\src\DMS_AppLogic\IntegrationLogic\CandidateProfile.cs DMS\DMS.App\src\DMS_AppLogic\Repository\IDocumentRepository.cs DMS\DMS.App\src\DMS_WebApi\Startup.cs DMS\DMS.App\src\Entities\Document\FieldsDto.cs DMS\DMS.Web\src\DMS_WebApp\ClientApp\src\app\candidate\document-review\document-review.component.ts

Hide

Permalink

Priya Dhamande (Inactive) added a comment - 03/Oct/19 03:11 AM

No testing input required. So, marking jira done.

Show

Priya Dhamande (Inactive) added a comment - 03/Oct/19 03:11 AM No testing input required. So, marking jira done.

People

Assignee:: Rohan J Khandave (Inactive)

Reporter:: Ramya Tantry (Inactive)

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 11/Sep/19 12:18 AM

Updated:: 10/Oct/19 09:37 PM

Resolved:: 03/Oct/19 03:11 AM

Time Tracking

Estimated:

24h

Remaining:

Logged:

26h