<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Alfredo,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
There is a discrepancy between the frontend and the API way to determine which site the user have, which site to give the new candidate and if a user is allowed to create a candidate at a given site. Looking at the frontend code, I can't see any validation
on the site other than the content of the html dropdown.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The API checks if the user has the given site. </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Here is the API <a href="https://github.com/aces/Loris/blob/23.0-release/modules/api/php/endpoints/candidates.class.inc#L185" title="https://github.com/aces/Loris/blob/23.0-release/modules/api/php/endpoints/candidates.class.inc#L185" style="margin:0px;background-color:rgb(255, 255, 255)" id="LPlnk555894">
code</a>:<br>
<blockquote itemscope="" itemtype="https://schemas.microsoft.com/QuotedText" style="border-left: 3px solid rgb(200, 200, 200); border-top-color: rgb(200, 200, 200); border-right-color: rgb(200, 200, 200); border-bottom-color: rgb(200, 200, 200); padding-left: 1ex; margin-left: 0.8ex; color: rgb(102, 102, 102);">
<div>$usersites = $user->getSiteNames();
<div>if (!in_array($data['Candidate']['Site'], $usersites)) {</div>
<div> return new \LORIS\Http\Response\JSON\Forbidden(</div>
<div> 'You are not affiliated with the candidate`s site'</div>
<div> );</div>
</div>
<div>}<br>
</div>
</blockquote>
<div>So, for debugging, can you add the following lines at <a href="https://github.com/aces/Loris/blob/23.0-release/modules/api/php/endpoints/candidates.class.inc#L184" id="LPlnk928209">https://github.com/aces/Loris/blob/23.0-release/modules/api/php/endpoints/candidates.class.inc#L184</a> ,
then tell me what it the response to your POST request ?</div>
<div><br>
</div>
<blockquote itemscope="" itemtype="https://schemas.microsoft.com/QuotedText" style="border-left: 3px solid rgb(200, 200, 200); border-top-color: rgb(200, 200, 200); border-right-color: rgb(200, 200, 200); border-bottom-color: rgb(200, 200, 200); padding-left: 1ex; margin-left: 0.8ex; color: rgb(102, 102, 102);">
<div>var_dump(<span style="color:rgb(102, 102, 102);background-color:rgb(255, 255, 255);display:inline !important">$user->getSiteNames(), <span style="background-color:rgb(255, 255, 255);display:inline !important">$data['Candidate']['Site']</span></span>);</div>
<div>exit;</div>
</blockquote>
<div>Thank you</div>
<div>Xavier</div>
<div><br>
</div>
<div><br>
</div>
<div><a href="https://github.com/aces/Loris/blob/23.0-release/modules/api/php/endpoints/candidates.class.inc#L185" title="https://github.com/aces/Loris/blob/23.0-release/modules/api/php/endpoints/candidates.class.inc#L185"></a><br>
</div>
<div><br>
</div>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> loris-dev-bounces@bic.mni.mcgill.ca <loris-dev-bounces@bic.mni.mcgill.ca> on behalf of Morales Pinzon, Alfredo <AMORALESPINZON@BWH.HARVARD.EDU><br>
<b>Sent:</b> June 10, 2021 6:43 PM<br>
<b>To:</b> loris-dev@bic.mni.mcgill.ca <loris-dev@bic.mni.mcgill.ca><br>
<b>Cc:</b> Rozie Arnaoutelis, Ms. <rozie.arnaoutelis@mcgill.ca>; Sridar Narayanan, Dr. <sridar.narayanan@mcgill.ca>; Douglas Arnold, Dr. <douglas.arnold@mcgill.ca>; Guttmann, Charles, M.D. <guttmann@bwh.harvard.edu><br>
<b>Subject:</b> [Loris-dev] Error insert candidates api/v0.0.3/candidates</font>
<div> </div>
</div>
<div class="" style="word-wrap:break-word; line-break:after-white-space">Dear LorisDev team,
<div class=""><br class="">
</div>
<div class="" style="orphans:2; widows:2">I can create Candidates using the web interface using an admin account that is linked to all the project and all the sites in the system. However when I try to create a Candidate using the api <span class="" style="color:rgb(19,19,19); font-family:Inter,OpenSans,Helvetica,Arial,sans-serif; orphans:2; white-space:pre-wrap; widows:2; background-color:rgb(255,255,255)">api/v0.0.3/candidates
</span><span class="" style="orphans:2; widows:2; background-color:rgb(255,255,255)"><font color="#000000" class=""><font face="Inter, OpenSans, Helvetica, Arial, sans-serif" class=""><span class="" style="white-space:pre-wrap">I am getting the following error:</span></font></font></span></div>
<div class="" style="orphans:2; widows:2"><span class="" style="orphans:2; widows:2; background-color:rgb(255,255,255)"><font color="#000000" class=""><font face="Inter, OpenSans, Helvetica, Arial, sans-serif" class=""><span class="" style="white-space:pre-wrap"><br class="">
</span></font></font></span></div>
<div class="" style="orphans:2; widows:2"><span class="" style="orphans:2; widows:2; background-color:rgb(255,255,255)"><font color="#000000" class=""><font face="Inter, OpenSans, Helvetica, Arial, sans-serif" class=""><span class="" style="white-space:pre-wrap">===</span></font></font></span></div>
<div class="" style="orphans:2; widows:2">
<div class="" style="color:rgb(54,54,54); background-color:rgb(255,255,255); font-family:Menlo,Monaco,"Courier New",monospace; line-height:18px; white-space:pre">
<div class=""><span class="" style="color:rgb(44,44,44)">{</span></div>
<div class=""><span class="" style="color:rgb(9,89,132)">"error"</span><span class="" style="color:rgb(44,44,44)">:</span>
<span class="" style="color:rgb(162,86,55)">"You are not affiliated with the candidate`s site"</span></div>
<div class=""><span class="" style="color:rgb(44,44,44)">}</span></div>
</div>
</div>
<div class="" style="orphans:2; widows:2"><span class="" style="orphans:2; widows:2; background-color:rgb(255,255,255)"><font color="#000000" class=""><font face="Inter, OpenSans, Helvetica, Arial, sans-serif" class=""><span class="" style="white-space:pre-wrap">===</span></font></font></span></div>
<div class="" style="orphans:2; widows:2"><span class="" style="orphans:2; widows:2; background-color:rgb(255,255,255)"><font color="#000000" class=""><font face="Inter, OpenSans, Helvetica, Arial, sans-serif" class=""><span class="" style="white-space:pre-wrap"><br class="">
</span></font></font></span></div>
<div class="" style="orphans:2; widows:2"><font color="#000000" face="Inter, OpenSans, Helvetica, Arial, sans-serif" class=""><span class="" style="background-color:rgb(255,255,255)"><span class="" style="white-space:pre-wrap">I’m happy to run some queries
in the database to figure out what’s happening. Any ideas?</span></span></font></div>
<div class="" style="orphans:2; widows:2"><font color="#000000" face="Inter, OpenSans, Helvetica, Arial, sans-serif" class=""><span class="" style="background-color:rgb(255,255,255)"><span class="" style="white-space:pre-wrap"><br class="">
</span></span></font></div>
<div class="" style="orphans:2; widows:2"><font color="#000000" face="Inter, OpenSans, Helvetica, Arial, sans-serif" class=""><span class="" style="background-color:rgb(255,255,255)"><span class="" style="white-space:pre-wrap">Best,</span></span></font></div>
<div class="" style="orphans:2; widows:2"><font color="#000000" face="Inter, OpenSans, Helvetica, Arial, sans-serif" class=""><span class="" style="background-color:rgb(255,255,255)"><span class="" style="white-space:pre-wrap">Alfredo.</span></span></font></div>
<div>The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Mass General Brigham Compliance HelpLine at http://www.massgeneralbrigham.org/complianceline
. If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.</div>
<br>
<p class="x_MsoNormal">Please note that this e-mail is not secure (encrypted). If you do not wish to continue communication over unencrypted e-mail, please notify the sender of this message immediately. Continuing to send or respond to e-mail after receiving
this message means you understand and accept this risk and wish to continue to communicate over unencrypted e-mail.
</p>
</div>
</div>
</body>
</html>