Api security - competitions and edit competition

[ihsaan-ullah]

@ mention of reviewers

@Didayolo

A brief description of the purpose of the changes contained in this PR.

The following problems are solved

1. http://localhost/api/competitions/ was exposing all competitions even not published
2. users were able to see competition info in edit screen of any competition by just adding edit to competition link e.g. adding edit to competitions/11 --> competitions/edit/11

To test

• http://localhost/api/competitions/ is not leaking any private competitions
• you can access a competition with valid secret key while loggedin and not loggedin
• you cannot enter edit screen of a competition if you are not admin/collaborator
• you can search competitions using searchbar
• you can see expected competitions in public/features/mine/participating in

Issues this PR resolves

• API competitions exposing all competitions #971
• Any user can see competition edit screen #1020

Checklist

• Code review by me
• Hand tested by me
• I'm proud of my work
• Code review by reviewer
• Hand tested by reviewer
• CircleCi tests are passing
• Ready to merge

[dtuantran]

On my local instance, I can still see private competition. When I logged in as "testcodabench" user, I can see "Iris", private competition created by "test1", even this user "testcodabench" doesn't participate in "Iris" competition.

[ihsaan-ullah]

On my local instance, I can still see private competition. When I logged in as "testcodabench" user, I can see "Iris", private competition created by "test1", even this user "testcodabench" doesn't participate in "Iris" competition.

You are right. I am checking this

Can you check the other points:

• you can access a competition with valid secret key while loggedin and not loggedin
• you cannot enter edit screen of a competition if you are not admin/collaborator
• you can search competitions using searchbar
• you can see expected competitions in public/features/mine/participating in

[ihsaan-ullah]

Also check when you are NOT logged in

[ihsaan-ullah]

@dtuantran with the latest push everything should be ok. Please don't forget to collect static

[dtuantran]

Also check when you are NOT logged in

All checks passed