🐛 BUG: Severe CourseController information leak 🔥

[torss]

Unauthorized information for all courses is transmitted to any logged in user.
For example, anyone can easily read every course access key using only the built-in browser dev tools.
This is a severe issue and should be fixed ASAP.

Tested access key vulnerability on the staging system using Chrome 65 and confirmed the leak on the live system.

[torss]

Note that there is a related TODO in CourseController.ts

TODO: Do not send lectures when student has no access

but no mention of the "accessKey" property in the "Success-Response" documentation, so I assume this leak issue is unknown.

There is also another TODO in the same file for the "PostCourseWhitelist" API:

TODO: Needs more security

This probably should get its own GitHub issue.

[d89]

You would need to present how you fixed it and how it was possible beforehand to sneak the key. I'd say it looks good for now 👍