[C+ Checklist Needs Completion] [$1000] Web - Unauthorized Task Reopening by Anonymous User in Incognito Mode- Inconsistency

[kbecciv]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Action Performed:

1. Create a room in public mode
2. Assign a task to yourself
3. Mark the task to completion
4. Go to share code > copy the link
5. Open the link in incognito mode
6. Open the assign task thread
7. Click on the check button once
8. Verify you receive not authorized message
9. Click on the check button twice (very fast-two clicks) (Very Imp)
10. Verify the task was reopened
11. Verify the “reopened‘ message
12. Go to the actual test account and verify that the task was not opened. (inconsistent)
    Note-(Double click on the check button to reopen it, its tricky)

Expected Result:

Anonymous users in incognito mode should not have the ability to reopen tasks in the chat interface.

Actual Result:

Anonymous users in incognito mode able reopen tasks by double clicking on the check button with a task reopened button

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android / native
• Android / Chrome
• iOS / native
• iOS / Safari
• MacOS / Chrome / Safari
• MacOS / Desktop

Version Number: 1.3.41-2
Reproducible in staging?: y
Reproducible in production?: y
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Notes/Photos/Videos: Any additional supporting documentation

priority.mov

Expensify/Expensify Issue URL:
Issue reported by: @avi-shek-jha
Slack conversation: https://expensify.slack.com/archives/C049HHMV9SM/p1689547160425739

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~011877db7acb0d69f6
• Upwork Job ID: 1681607804571918336
• Last Price Increase: 2023-07-21
• Automatic offers:
• dukenv0307 | Contributor | 26118584
• avi-shek-jha | Reporter | 26118590

[dukenv0307]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Unauthorized Task Reopening by Anonymous User in Incognito Mode- Inconsistency

What is the root cause of that problem?

We don't check to redirect to sign in page if anonymous user does this action

App/src/components/ReportActionItem/TaskPreview.js

Line 87 in 6e5b07c

onPress={() => {

What changes do you think we should make in order to solve the problem?

We should add Session.checkIfActionIsAllowed to redirect to sign in page if anonymous user complete or re-open task

onPress={Session.checkIfActionIsAllowed(() => {
    if (isTaskCompleted) {
        Task.reopenTask(props.taskReportID, taskTitle);
    } else {
        Task.completeTask(props.taskReportID, taskTitle);
    }
})}

What alternative solutions did you explore? (Optional)

[melvin-bot]

Triggered auto assignment to @greg-schroeder (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[melvin-bot]

Bug0 Triage Checklist (Main S/O)

• This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
• This bug is not a duplicate report (check E/App issues and #expensify-bugs)
  • If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead
• This bug is reproducible using the reproduction steps in the OP. S/O
  • If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
  • If the reproduction steps aren't clear and you determine the correct steps, please update the OP.
• This issue is filled out as thoroughly and clearly as possible
  • Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.
• I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync

[Nodebrute]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Unauthorized Task Reopening by Anonymous User in Incognito Mode- Inconsistency

What is the root cause of that problem?

We are not disabling checkbox or unauthorised users

What changes do you think we should make in order to solve the problem?

We can add a check if it's a anonymous User than disable checkbox

  disabled={ReportUtils.isCanceledTaskReport(props.taskReport) || Session.isAnonymousUser()}

What alternative solutions did you explore? (Optional)

We can also disable this button for other users who don't have permissions to change tasks.
For example people other than "Task assignee, Task owner and policy admin". It will make more sense to disable this checkbox for users who are not allowed to open and reopen task within taskView.
!Task.isTaskAssigneeOrTaskOwner ---To check if current user is task assignee or task owner if not then user will not be able to access that page.
!PolicyUtils.isPolicyAdmin----To check if current user is policy admin if not then user will not be able to access that page

[greg-schroeder]

Per discussion it sounds like this needs to be Internal:

Is the bug that an anonymous user can take action on a task? If that’s true, this looks like a seperate bug we need to handle in the BE

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~011877db7acb0d69f6

[melvin-bot]

Triggered auto assignment to Contributor Plus for review of internal employee PR - @rushatgabhane (Internal)

[melvin-bot]

Triggered auto assignment to @robertjchen (Engineering), see https://stackoverflow.com/c/expensify/questions/4319 for more details.