fix(security): verify a student belongs to the run before changing their password

src/main/java/org/wise/portal/presentation/web/controllers/teacher/management/ChangeStudentPasswordController.java

@@ -39,7 +39,7 @@ ResponseEntity<Map<String, Object>> changeStudentPassword(Authentication auth,
       @RequestParam String newStudentPassword)
       throws ObjectNotFoundException, IncorrectPasswordException {
     Run run = runService.retrieveById(runId);
-    if (runService.hasWritePermission(auth, run)) {
+    if (isAllowed(auth, run, studentId)) {
       User teacherUser = userService.retrieveUserByUsername(auth.getName());
       boolean isTeacherGoogleUser = teacherUser.getUserDetails().isGoogleUser();
       if (isTeacherPasswordCorrect(isTeacherGoogleUser, teacherUser, teacherPassword)) {
@@ -58,6 +58,12 @@ ResponseEntity<Map<String, Object>> changeStudentPassword(Authentication auth,
     }
   }
 
+  private boolean isAllowed(Authentication auth, Run run, Long studentId)
+      throws ObjectNotFoundException {
+    return runService.hasWritePermission(auth, run)
+        && run.isStudentAssociatedToThisRun(userService.retrieveById(studentId));
+  }
+
   private boolean isTeacherPasswordCorrect(boolean isGoogleUser, User teacherUser,
       String password) {
     return isGoogleUser || userService.isPasswordCorrect(teacherUser, password);

src/test/java/org/wise/portal/presentation/web/controllers/teacher/management/ChangeStudentPasswordControllerTest.java

@@ -75,6 +75,7 @@ public void changeStudentPassword_NoWritePermission_ThrowAccessDenied() throws E
   private void setupChangeStudentPasswordExpect() throws Exception {
     expect(runService.retrieveById(runId1)).andReturn(run1);
     expect(runService.hasWritePermission(teacherAuth, run1)).andReturn(true);
+    expect(userService.retrieveById(student1Id)).andReturn(student1);
     expect(userService.retrieveUserByUsername(TEACHER_USERNAME)).andReturn(teacher1);
   }
 
@@ -115,6 +116,36 @@ public void changeStudentPassword_InvalidPassword_ReturnError() throws Exception
     verifyServices();
   }
 
+  @Test
+  public void changeStudentPassword_StudentNotInRun_ThrowAccessDenied() throws Exception {
+    expect(runService.retrieveById(runId1)).andReturn(run1);
+    expect(runService.hasWritePermission(teacherAuth, run1)).andReturn(true);
+    expect(userService.retrieveById(student2Id)).andReturn(student2);
+    replayServices();
+    try {
+      controller.changeStudentPassword(teacherAuth, runId1, student2Id, TEACHER_PASSWORD_CORRECT,
+          STUDENT_PASSWORD_VALID);
+      fail("Expected AccessDeniedException to be thrown");
+    } catch (AccessDeniedException e) {
+    }
+    verifyServices();
+  }
+
+  @Test
+  public void changeStudentPassword_TargetUserIsTeacher_ThrowAccessDenied() throws Exception {
+    expect(runService.retrieveById(runId1)).andReturn(run1);
+    expect(runService.hasWritePermission(teacherAuth, run1)).andReturn(true);
+    expect(userService.retrieveById(teacher2Id)).andReturn(teacher2);
+    replayServices();
+    try {
+      controller.changeStudentPassword(teacherAuth, runId1, teacher2Id, TEACHER_PASSWORD_CORRECT,
+          STUDENT_PASSWORD_VALID);
+      fail("Expected AccessDeniedException to be thrown");
+    } catch (AccessDeniedException e) {
+    }
+    verifyServices();
+  }
+
   @Test
   public void changeStudentPassword_validTeacherPassword_ChangeStudentPassword() throws Exception {
     setupChangeStudentPasswordExpect();