Skip to content

Admin panel is unintuitive and lacks user-friendly management + security risks #13

Closed

Description

@Oreo80

Problem:
The current Admin area is using basic scaffolding that is not only unintuitive but also poses security risks and is
functionally incomplete. It is currently "unusable" for a real-world moderator.

Key Issues identified:

  1. Security Risk (XSS): The Description field accepts raw HTML input. This is a major security vulnerability
    (Cross-Site Scripting) and provides a terrible editing experience.
  2. Broken UX (JSON Templates): CodeTemplatesJson requires the admin to manually type valid JSON into a textarea. This
    is highly error-prone and practically impossible to manage without mistakes.
  3. Logic Flaw (Ordering): The OrderIndex (problem number) is manually entered by the user. This should be handled by
    the backend (auto-increment or logic-based) to ensure consistency.
  4. Incomplete Lifecycle (Test Cases): The Test Case management is "write-only". Currently, an admin cannot view,
    modify, or delete existing tests once they are added. They can only upload new ones blindly.

Suggested Fixes:

  • Sanitization: Replace raw HTML description with a Markdown editor or at least add server-side HTML sanitization.
  • Template UI: Create dedicated tabs/text areas for each language (Python, Java, C++) in the Admin UI and have the
    backend bundle them into JSON automatically.
  • Backend Ordering: Implement logic to automatically assign the next available OrderIndex.
  • Full CRUD for Tests: Implement a proper interface to list, edit, and remove ProblemTests associated with a problem
    (ideally as a nested list inside the "Edit Problem" page).

Activity

  1. linked a pull request that will close this issueFix/admin area overhaul #19on May 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions