illinois-cs241 · ananthm0203 · Jan 25, 2024 · Feb 4, 2024 · Feb 4, 2024 · Feb 4, 2024
diff --git a/.gitignore b/.gitignore
diff --git a/requirements.txt b/requirements.txt
diff --git a/src/__pycache__/__init__.cpython-37.pyc b/src/__pycache__/__init__.cpython-37.pyc
diff --git a/src/__pycache__/auth.cpython-37.pyc b/src/__pycache__/auth.cpython-37.pyc
diff --git a/src/__pycache__/bw_api.cpython-37.pyc b/src/__pycache__/bw_api.cpython-37.pyc
diff --git a/src/__pycache__/common.cpython-37.pyc b/src/__pycache__/common.cpython-37.pyc
diff --git a/src/__pycache__/db.cpython-37.pyc b/src/__pycache__/db.cpython-37.pyc
diff --git a/src/__pycache__/ghe_api.cpython-37.pyc b/src/__pycache__/ghe_api.cpython-37.pyc
diff --git a/src/__pycache__/routes_admin.cpython-37.pyc b/src/__pycache__/routes_admin.cpython-37.pyc
diff --git a/src/__pycache__/routes_api.cpython-37.pyc b/src/__pycache__/routes_api.cpython-37.pyc
diff --git a/src/__pycache__/routes_staff.cpython-37.pyc b/src/__pycache__/routes_staff.cpython-37.pyc
diff --git a/src/__pycache__/routes_student.cpython-37.pyc b/src/__pycache__/routes_student.cpython-37.pyc
diff --git a/src/__pycache__/sched_api.cpython-37.pyc b/src/__pycache__/sched_api.cpython-37.pyc
diff --git a/src/__pycache__/template_filters.cpython-37.pyc b/src/__pycache__/template_filters.cpython-37.pyc
diff --git a/src/__pycache__/util.cpython-37.pyc b/src/__pycache__/util.cpython-37.pyc
diff --git a/src/auth.py b/src/auth.py
@@ -1,5 +1,6 @@
 from functools import wraps
 from http import HTTPStatus
+import json
 
 from flask import session, redirect, url_for, abort, request, render_template, make_response
 from src.common import verify_staff, verify_admin
@@ -81,6 +82,7 @@ def wrapper(*arg, **kwargs):
 		token = request.headers.get("Authorization", None)
 		cid = kwargs[CID_KEY]
 		course = get_course(cid)
+		print(course["token"]==token)
 		if course is None or ("token" in course and token != course["token"]):
 			return abort(HTTPStatus.FORBIDDEN)
 		return func(*arg, **kwargs)
@@ -97,8 +99,14 @@ def require_admin_status(func):
 	@wraps(func)
 	def wrapper(*args, **kwargs):
 		netid = kwargs.get(UID_KEY, None)
-		if request.json is not None:
-			netid = request.json.get(UID_KEY, netid)
+		if netid is None and request.json is not None:
+			_json = request.json
+			if isinstance(_json, str):
+				try:
+					_json = json.loads(request.json)
+				except json.JSONDecodeError:
+					return abort(HTTPStatus.BAD_REQUEST)
+			netid = _json.get(UID_KEY, netid)
 		cid = kwargs[CID_KEY]
 		if netid is None or not verify_staff(netid, cid) or not verify_admin(netid, cid):
 			return abort(HTTPStatus.FORBIDDEN)

diff --git a/src/routes_admin.py b/src/routes_admin.py
@@ -167,7 +167,8 @@ def add_assignment(netid, cid):
                 return util.error("Start must be before End.")
 
             try:
-                config = json.loads(request.form["config"])
+                if not isinstance(request.form["config"], dict):
+                    config = json.loads(request.form["config"])
                 msg = bw_api.set_assignment_config(cid, aid, config)
 
                 if msg: