Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Investigate and Block Zoom Links from VRMS API #1659

Open
4 tasks
JackHaeg opened this issue Jun 4, 2024 · 7 comments · May be fixed by #1731
Open
4 tasks

Investigate and Block Zoom Links from VRMS API #1659

JackHaeg opened this issue Jun 4, 2024 · 7 comments · May be fixed by #1731
Assignees
Labels
Milestone

Comments

@JackHaeg
Copy link
Member

JackHaeg commented Jun 4, 2024

Overview

Per stakeholder (Bonnie) - the VRMS API that is used by the HfLA website appears to be publishing Zoom links for each event stored on VRMS. For security reasons, it is recommended that these Zoom links are either blocked from being published or hidden from the public API.

Action Items

  • Review the VRMS data that the HfLA website is pulling from: vrms_data.json and check for Zoom links (look for videoConferenceLink)
  • Based on findings, investigate how to block Zoom links from being published on the VRMS API. Zoom links should still remain viewable within the VRMS app.
  • Block Zoom links from being published on VRMS API.
  • Submit PR.

Resources/Instructions

@JackHaeg JackHaeg added this to the 02 Security milestone Jun 4, 2024
@JackHaeg JackHaeg changed the title Investigate and Remove Zoom Links from VRMS API Investigate and Block Zoom Links from VRMS API Jun 4, 2024
@bkmorgan3
Copy link
Member

@JackHaeg @spiteless

I could either setup permissions on the DB, or make another route for either us or them and on the route i can leave off the zoom links with a .select("-meetinglink").

Not sure how far-future-facing we should go on this

@JackHaeg
Copy link
Member Author

As discussed during Monday's all team meeting, decision = make a new route.

@JackHaeg
Copy link
Member Author

@bkmorgan3 Please provide update:

  1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
  2. Blockers: "Difficulties or errors encountered."
  3. Availability: "How much time will you have this week to work on this issue?"
  4. ETA: "When do you expect this issue to be completed?"
  5. Pictures or links* (if necessary): "Add any pictures or links that will help illustrate what you are working on."

@bkmorgan3
Copy link
Member

@JackHaeg
I have most of the work done, I took out the meeting links from the current events call and created a new route. I just have to assign the new route to what we are using.
I'll try to get a PR in today

@JackHaeg
Copy link
Member Author

@bkmorgan3 That's great news! Thanks a ton for the update, Brad 👍

@JackHaeg
Copy link
Member Author

JackHaeg commented Oct 1, 2024

@bkmorgan3 When you have a moment, can you please provide an update:

  1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
  2. Blockers: "Difficulties or errors encountered."
  3. Availability: "How much time will you have this week to work on this issue?"
  4. ETA: "When do you expect this issue to be completed?"
  5. Pictures or links* (if necessary): "Add any pictures or links that will help illustrate what you are working on."

@bkmorgan3 bkmorgan3 linked a pull request Oct 1, 2024 that will close this issue
@bkmorgan3
Copy link
Member

@JackHaeg
Sorry, didn't link the issue in the PR. This is done and approved but not merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Status: In progress
Development

Successfully merging a pull request may close this issue.

2 participants