Remove user field from survey submission read serializer #3529
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The surveys are supposedly anonymous, they are not when the user field is sent with the submission
eikhr
added
testing-needed
ABA-273 Anonymize survey submissions
We claim that survey submissions are anonymous. They are not. We save the user corresponding to each submission, and even send the user and responses together in the "surveys/id/submissions" API-route. |
|
Turns out this breaks the survey submission page. It uses the user-field to find your own submission |
How about leaving it as null unless it's your submission, doing the finding in the backend instead? |
|
I agree with @jonasdeluna It would be nice to separate this so that we can finally make /surveys a non-admin page. This has been requested by many people |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The surveys are supposedly anonymous, they are not when the user field is sent with the submission
TODO:
[ ] Test that nothing breaks in lego-webapp
Resolves ABA-273