Unauthorize Copilot Can Access Challenges

[citra-rahman]

Steps to Reproduce:

• Login as JCori
• Go to Test taas Project Tab
• in Active Tab choose challenge with title logo
  (https://challenges.topcoder-dev.com/projects/16529/challenges/af04bebb-aad3-4731-9861-f9cd158447ee/edit)
• Copy link and then go to another browser with different user (I used cori_copilot)
• Paste link

Video

https://www.dropbox.com/s/ou7h2q7nw9metyi/2020-05-08-21-11-12.avi?raw=1

Actual Result:

User can access specific challenge that assign to another copilot

• challenge belongs to jcori
  

• cori_copilot can access if we paste the link
  

Expected Result:

User cannot access specific challenge that assign to another copilot

Device/OS/Browser Information:

• Device: Lenovo (laptop)
• Processor : AMD A9-9420 RADEON R5, 5 Compute Cores 2C+3G 3.00 GHz
• RAM : 8 GB
• System Type: 64 Bit OS, x64-based processor
• Pen or touch: no pen or touch
• OS: Windows 10 Home Single Language
• Browser: Google Chrome (81.0.4044.138 (Official Build) (64-bit)) and Firefox(76.0.1 (64-bit))

[acshields]

@vikasrohit - can you test this out as well? If still valid, then this will need to be addressed soon.

[ThomasKranitsas]

This seems very outdated. The security checks have been completely refactored since this issue was created. Please re-test and close this.