CQI-80: OWASP A01:2021-Broken Access Control - openimis-be-core_py BE

[sniedzielski]

TICKET: https://openimis.atlassian.net/browse/CQI-80

Solving issues with CSRF : 275f3f9, 1d907f7

Addressing Password-Related Issues: One of the issues at the service level is not related to setting the password but hardcoded encoded in base64 'stored_password'

openimis-be-core_py/core/services/userServices.py

Line 52 in ddc3191

i_user.stored_password = "locked"

. In the legacy version, setting the password for a User was optional, and this approach is retained here to maintain compatibility. For sure this part of code and mechanism can be improved, but at this stage we can mark this code as SAFE in my opinion.

Issues to fix: 2/10
False positive issues: 8/10

[sonarqubecloud]

SonarCloud Quality Gate failed.   

0 Bugs
0 Vulnerabilities
2 Security Hotspots
145 Code Smells

67.3% Coverage
1.1% Duplication

Catch issues before they fail your Quality Gate with our IDE extension SonarLint